8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2024, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe

Executes dropped EXE 1 IoCs

pid	Process
4676	Solara.exe

Loads dropped DLL 11 IoCs

pid	Process
1960	MsiExec.exe
1960	MsiExec.exe
740	MsiExec.exe
740	MsiExec.exe
740	MsiExec.exe
740	MsiExec.exe
740	MsiExec.exe
3840	MsiExec.exe
3840	MsiExec.exe
3840	MsiExec.exe
1960	MsiExec.exe

Unexpected DNS network traffic destination 27 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Blocklisted process makes network request 4 IoCs

flow	pid	Process
39	2244	msiexec.exe
42	2244	msiexec.exe
39	2244	msiexec.exe
42	2244	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
51	pastebin.com
57	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
249	api.ipify.org
252	api.ipify.org
253	api.ipify.org
257	api.ipify.org

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\convert\dmp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\readable.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\cjs\index-cjs.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\timers.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmaccess\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-root.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\pnpm	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\bin\node-gyp-bin\node-gyp	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\max-satisfying.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\passthrough.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\clean.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\graceful-fs\polyfills.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\create.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-normalize-package-bin\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\binary-extensions\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-audit.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-uninstall.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-access.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\disparity-colors\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmversion\lib\tag.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\strip-ansi\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-star.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\using-npm\scripts.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmversion\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\merkle\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\memoization.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\inventory.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\tokenize.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-collect\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\did-you-mean.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\are-we-there-yet\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\http-proxy-agent\dist\agent.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-stop.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\abort-controller\dist\abort-controller.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\fs\lib\with-owner.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tlog\verify\set.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\npx.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-install.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\string.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\has\src\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\queryable.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\SECURITY.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\http-proxy-agent\dist\agent.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-ci.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\configuring-npm\install.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\archy\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\bin\node-gyp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\debug\src\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-repo.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\defaults\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-fetch\lib\headers.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ignore-walk\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\entry-index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\lib\depth-descent.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-org.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\make-fetch-happen\lib\cache\key.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\google\protobuf\timestamp.js	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF00E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF03E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFCE.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF724.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9B6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20F9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2186.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI233D.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ea12.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB.tmp	msiexec.exe
File created	C:\Windows\Installer\e57ea16.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2949.tmp	msiexec.exe
File created	C:\Windows\Installer\e57ea12.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4904	ipconfig.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2352	Bootstrapper.exe
2352	Bootstrapper.exe
2244	msiexec.exe
2244	msiexec.exe
4676	Solara.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5056	WMIC.exe
Token: SeSecurityPrivilege	5056	WMIC.exe
Token: SeTakeOwnershipPrivilege	5056	WMIC.exe
Token: SeLoadDriverPrivilege	5056	WMIC.exe
Token: SeSystemProfilePrivilege	5056	WMIC.exe
Token: SeSystemtimePrivilege	5056	WMIC.exe
Token: SeProfSingleProcessPrivilege	5056	WMIC.exe
Token: SeIncBasePriorityPrivilege	5056	WMIC.exe
Token: SeCreatePagefilePrivilege	5056	WMIC.exe
Token: SeBackupPrivilege	5056	WMIC.exe
Token: SeRestorePrivilege	5056	WMIC.exe
Token: SeShutdownPrivilege	5056	WMIC.exe
Token: SeDebugPrivilege	5056	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5056	WMIC.exe
Token: SeRemoteShutdownPrivilege	5056	WMIC.exe
Token: SeUndockPrivilege	5056	WMIC.exe
Token: SeManageVolumePrivilege	5056	WMIC.exe
Token: 33	5056	WMIC.exe
Token: 34	5056	WMIC.exe
Token: 35	5056	WMIC.exe
Token: 36	5056	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5056	WMIC.exe
Token: SeSecurityPrivilege	5056	WMIC.exe
Token: SeTakeOwnershipPrivilege	5056	WMIC.exe
Token: SeLoadDriverPrivilege	5056	WMIC.exe
Token: SeSystemProfilePrivilege	5056	WMIC.exe
Token: SeSystemtimePrivilege	5056	WMIC.exe
Token: SeProfSingleProcessPrivilege	5056	WMIC.exe
Token: SeIncBasePriorityPrivilege	5056	WMIC.exe
Token: SeCreatePagefilePrivilege	5056	WMIC.exe
Token: SeBackupPrivilege	5056	WMIC.exe
Token: SeRestorePrivilege	5056	WMIC.exe
Token: SeShutdownPrivilege	5056	WMIC.exe
Token: SeDebugPrivilege	5056	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5056	WMIC.exe
Token: SeRemoteShutdownPrivilege	5056	WMIC.exe
Token: SeUndockPrivilege	5056	WMIC.exe
Token: SeManageVolumePrivilege	5056	WMIC.exe
Token: 33	5056	WMIC.exe
Token: 34	5056	WMIC.exe
Token: 35	5056	WMIC.exe
Token: 36	5056	WMIC.exe
Token: SeDebugPrivilege	2352	Bootstrapper.exe
Token: SeShutdownPrivilege	2216	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2216	msiexec.exe
Token: SeSecurityPrivilege	2244	msiexec.exe
Token: SeCreateTokenPrivilege	2216	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2216	msiexec.exe
Token: SeLockMemoryPrivilege	2216	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2216	msiexec.exe
Token: SeMachineAccountPrivilege	2216	msiexec.exe
Token: SeTcbPrivilege	2216	msiexec.exe
Token: SeSecurityPrivilege	2216	msiexec.exe
Token: SeTakeOwnershipPrivilege	2216	msiexec.exe
Token: SeLoadDriverPrivilege	2216	msiexec.exe
Token: SeSystemProfilePrivilege	2216	msiexec.exe
Token: SeSystemtimePrivilege	2216	msiexec.exe
Token: SeProfSingleProcessPrivilege	2216	msiexec.exe
Token: SeIncBasePriorityPrivilege	2216	msiexec.exe
Token: SeCreatePagefilePrivilege	2216	msiexec.exe
Token: SeCreatePermanentPrivilege	2216	msiexec.exe
Token: SeBackupPrivilege	2216	msiexec.exe
Token: SeRestorePrivilege	2216	msiexec.exe
Token: SeShutdownPrivilege	2216	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe
1924	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3320	2352	Bootstrapper.exe	83
PID 2352 wrote to memory of 3320	2352	Bootstrapper.exe	83
PID 3320 wrote to memory of 4904	3320	cmd.exe	85
PID 3320 wrote to memory of 4904	3320	cmd.exe	85
PID 2352 wrote to memory of 1132	2352	Bootstrapper.exe	89
PID 2352 wrote to memory of 1132	2352	Bootstrapper.exe	89
PID 1132 wrote to memory of 5056	1132	cmd.exe	91
PID 1132 wrote to memory of 5056	1132	cmd.exe	91
PID 2352 wrote to memory of 2216	2352	Bootstrapper.exe	97
PID 2352 wrote to memory of 2216	2352	Bootstrapper.exe	97
PID 2244 wrote to memory of 1960	2244	msiexec.exe	100
PID 2244 wrote to memory of 1960	2244	msiexec.exe	100
PID 2244 wrote to memory of 740	2244	msiexec.exe	101
PID 2244 wrote to memory of 740	2244	msiexec.exe	101
PID 2244 wrote to memory of 740	2244	msiexec.exe	101
PID 2244 wrote to memory of 3840	2244	msiexec.exe	102
PID 2244 wrote to memory of 3840	2244	msiexec.exe	102
PID 2244 wrote to memory of 3840	2244	msiexec.exe	102
PID 3840 wrote to memory of 3972	3840	MsiExec.exe	103
PID 3840 wrote to memory of 3972	3840	MsiExec.exe	103
PID 3840 wrote to memory of 3972	3840	MsiExec.exe	103
PID 3972 wrote to memory of 4556	3972	wevtutil.exe	105
PID 3972 wrote to memory of 4556	3972	wevtutil.exe	105
PID 2352 wrote to memory of 4676	2352	Bootstrapper.exe	108
PID 2352 wrote to memory of 4676	2352	Bootstrapper.exe	108
PID 1868 wrote to memory of 1924	1868	firefox.exe	120
PID 1868 wrote to memory of 1924	1868	firefox.exe	120
PID 1868 wrote to memory of 1924	1868	firefox.exe	120
PID 1868 wrote to memory of 1924	1868	firefox.exe	120
PID 1868 wrote to memory of 1924	1868	firefox.exe	120
PID 1868 wrote to memory of 1924	1868	firefox.exe	120
PID 1868 wrote to memory of 1924	1868	firefox.exe	120
PID 1868 wrote to memory of 1924	1868	firefox.exe	120
PID 1868 wrote to memory of 1924	1868	firefox.exe	120
PID 1868 wrote to memory of 1924	1868	firefox.exe	120
PID 1868 wrote to memory of 1924	1868	firefox.exe	120
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121
PID 1924 wrote to memory of 4864	1924	firefox.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4904
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\ProgramData\Solara\Solara.exe
  "C:\ProgramData\Solara\Solara.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4676

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1531E6E015BB596925570ED2CD24D999
  2⤵
  - Loads dropped DLL
  PID:1960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 424F5939A4D590A01CCFAF40C3A3D2D9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2D80FAF697AAFAEAA2EE237D4672B148 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:4556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed839e8c-4c51-465f-bde1-2badbac8f281} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" gpu
    3⤵
    PID:4864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2356 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a6f9c0c-3358-4622-a32e-38e03074756d} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" socket
    3⤵
    PID:4044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2864 -childID 1 -isForBrowser -prefsHandle 3068 -prefMapHandle 3080 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {852b405d-f672-4b5e-a6a8-82656b356846} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
    3⤵
    PID:2188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3948 -childID 2 -isForBrowser -prefsHandle 3896 -prefMapHandle 3892 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c715418a-7594-48ff-9b9a-6bed31b5de84} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
    3⤵
    PID:3920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4876 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4904 -prefMapHandle 4900 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {612a5577-9563-402c-9079-6e7ba6b24418} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" utility
    3⤵
    - Checks processor information in registry
    PID:5540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -childID 3 -isForBrowser -prefsHandle 5476 -prefMapHandle 3028 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb70982b-3a66-49d3-80c1-18eee13b3d40} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
    3⤵
    PID:6048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 4 -isForBrowser -prefsHandle 5556 -prefMapHandle 5564 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {816887ae-af92-4493-b1cd-207a4e0336e9} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
    3⤵
    PID:6060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 5 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d444c1ec-f943-49d0-8caf-3b64e6d4c2b9} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
    3⤵
    PID:6072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3532 -childID 6 -isForBrowser -prefsHandle 4180 -prefMapHandle 4176 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0450d413-94e1-40ed-b0b8-fa5b38d38ec6} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
    3⤵
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6492 -childID 7 -isForBrowser -prefsHandle 6512 -prefMapHandle 6508 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca0cee89-ee1f-4778-8b8e-39281e8326bd} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
    3⤵
    PID:4656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6716 -childID 8 -isForBrowser -prefsHandle 6696 -prefMapHandle 6700 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e2b3a03-409d-4600-8bbe-21bfe426da29} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
    3⤵
    PID:5620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7060 -childID 9 -isForBrowser -prefsHandle 6984 -prefMapHandle 6988 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90597249-2167-4948-90d4-203c8a793e4d} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
    3⤵
    PID:4900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7184 -childID 10 -isForBrowser -prefsHandle 7024 -prefMapHandle 6988 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f63abcb2-4445-41f3-b9e8-6b2b55a154fa} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
    3⤵
    PID:2856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6736 -parentBuildID 20240401114208 -prefsHandle 5208 -prefMapHandle 7152 -prefsLen 30582 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f12f1011-a727-4796-874c-9c536193486a} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" rdd
    3⤵
    PID:5396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6536 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6812 -prefMapHandle 7604 -prefsLen 30582 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f3b12cd-7255-4331-9eac-e9a6476a5c94} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" utility
    3⤵
    - Checks processor information in registry
    PID:5308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7916 -childID 11 -isForBrowser -prefsHandle 6456 -prefMapHandle 7832 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cf666b8-08c3-4c5b-94f6-838c2f203ff4} 1924 "\\.\pipe\gecko-crash-server-pipe.1924" tab
    3⤵
    PID:5324

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d8 0x470
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57ea15.rbs

Filesize
1.0MB

MD5
9b036f4df6f91ea268c981e48ef823c9

SHA1
e0da833d41fe21212090121f76a6a3d80f36afe7

SHA256
1c44a7d5af2e5eb1b7630eb7502b7a184cda777323eac5d47040752fc4eb8797

SHA512
4d83266cd440cda528dc4ef06fc9c45b293dd09ec2aef7aa8daf1b9c243becb18838c8f94d577d7e43723c4b99f029ee492d5eebf88a522daf78b15ab452ea73

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
10KB

MD5
1d51e18a7247f47245b0751f16119498

SHA1
78f5d95dd07c0fcee43c6d4feab12d802d194d95

SHA256
1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

SHA512
1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
c6f770cbb24248537558c1f06f7ff855

SHA1
fdc2aaae292c32a58ea4d9974a31ece26628fdd7

SHA256
d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

SHA512
cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
c01efe68b7a51c13f317efcd0c132b7d

SHA1
a2dd1a48520c3dd0ad34a07a759ccd187a447926

SHA256
be8eabae805cc615a3a8d34f78a760f6ef4094586c1188b73de32fe8e5a86297

SHA512
221060e97c9e5dfc251509cf74332d65c1743e3ef871a1438f11ff88a579218cc9c25b024441edf17b29d30218f6a77e3de9ae68a18decdd8e4a4e73f90cb420

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\76485E6A712665F4EAE9838B3BADF0510EA2999F

Filesize
204KB

MD5
792ea97585385047f22ddb7b178bc79c

SHA1
1fab94b8275d9694c2f7922fb8b38a45d6ea526e

SHA256
f3389b16145c1e470d63b742d288a5d51bb82bab31148ee46eed63a90bdc724b

SHA512
62f8ce76fafe5c2b8b33d4a628421a9537ca5b198ed77b4833be3c4dd2e92fdb824f63e73a85cbcd68c022764c38416b08ef2b27a9bcb69c59c9d587485a2a6e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\C0FB504EB8D5022AF1CCEBDDE5137444D06410FD

Filesize
15KB

MD5
db101380d10764ee89567c55c24213b5

SHA1
378e331747a592692ded46b7dd3b3d2dfc2a505d

SHA256
c9534062cf751ce37a7d0a1de879822bfaff49955c5267d312239da2eaf1c9b1

SHA512
4899923aeedf2effec7e0c8c6e2eeb8f97b083504512ad921eb6fd5e4202455be4e00e65d37e19afb610c2b38f088b66055cacc99e978eb8de1b9ea00e1d164c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\D85F220783F9DF74B369CCFF2661EFE249FCCB38

Filesize
61KB

MD5
939157a3b448f6b118ebae586f055f39

SHA1
d96bdd302401b5d2b3114022832bfcb634289094

SHA256
08dff8f8a377adf081d60ae6630a970315c43956018c732deb00f78a3811b746

SHA512
0e490aa7da1663cfd817d298c872da61210d8afe4c4993bf4486d8a5359efdc57042b14ad8b7123d8ea4de4a483acd60352474f17593d85a201b3c019ed04d82

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\F685D6C5B2B5A655F3D7D3DF78BF6F3483EE7349

Filesize
18KB

MD5
62593c6ebfe72eb0b55afbd8742fed6f

SHA1
8fdf33d2fd3cba10a97909c623773eca2b01b4e0

SHA256
7c3803be64ed653f5caa1b100b926eec0712b61574d5df2c2bb57b1a7ab41e5e

SHA512
a87e9153a839c6f9a4dbd8765bbedb8044166e4cba450810ad4406e4d36422db620f76023f3ed898bf70a4d04885d5fc0dd601a788fb9775bb992321087ba6b9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\thumbnails\895212477adc792c77f61b22fcd086de.png

Filesize
33KB

MD5
1c97cede95f113901422e756e80733b2

SHA1
9db5a5f8c22a4b2c60cf23e76fc729804955bb58

SHA256
02fa13a1e384f525672ecd0c1a5b57e54f8c0bdc0db14e94703f3023019cb4fa

SHA512
0d7ca844d0bd7ecd597b0cf2f99d0c5541a78e61f6cb580edf72796171b5192a5fc781506f2fd8e45649e0a8237b872ba5ccebea21e00aa50f7dcba09fc58df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
6KB

MD5
66ec0e3e5eef5ebbb658fe3cd9af8815

SHA1
77fc56a5aa68eb3995c0b1959c6fb18e742ff837

SHA256
3363a6b63e04c82aaf26432510a340678f4acbad63864c9a879a5f7d409b288b

SHA512
1f2ce43839fb73ef8c3f4e02ab5614b35eed2f20d82d15ec2f9579b3d4dac862c4d45327788aeac392aa5dca40150b8339b0d7239b9adc92dcda21c3a71e6ca8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
6KB

MD5
e95942a65b60fb216bce664ddda41700

SHA1
53a641c283fc17d6bb9fddbc3f70ba7024878038

SHA256
0db789d1d2effa0587b222889e942ee35eb70e0651846146a98deb76c9a12fa2

SHA512
0b5a6e2555c531f9dd9503c2ec234aad6de1962475b047ee87a89aa4301305cf6a73d7c93e88713189a2139cc7a35d3dcc14b3a3d1ffbc3d1b9c7b0fca3dad6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
42KB

MD5
60dffd6718a045b888f433bb2cbbc895

SHA1
88152ce5727dc2652270b61e76a4fb69ea07d688

SHA256
6a172aa573aa03f1ec65324f20c0a61612188e4c2a8ad666e867444d4d3f31f9

SHA512
c7ef3849c69a5380a34afda14a33a8f9b40599d02e6d13286eba4eefe58e9b7de708efcc6e3eb6966965f29117211b52717acae6cbb9e90246232e2df620a5fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\SiteSecurityServiceState.bin

Filesize
5KB

MD5
ed73c4b63802586d58b180eecaf8ecf4

SHA1
8523ee017ffb87c8e4663f351adfe1cfc887e499

SHA256
82f6e62bc032b00d38770b5c4ea1d11cc932eecafa01acfc23a6985ade96fd06

SHA512
63c2d72114e78da1c2b3a4434d49f50698135d483d56750bc3058975d355cbb6629d553193f034138c985e847d0db426049151be9ff661131fc1a868cb78e1a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
2ad51a974c876c2f188fb5fa4172493f

SHA1
82b4e6cb465f0ab8f09e009855266351e7e6252f

SHA256
da481d170e9a5b2728238bad4cbca78fa2f075c261e12045f3dedab8d2d2fc21

SHA512
9e4026ed230b3777eca7182aed46047b3a0082e2472949a678d4fd0ff7ca9f1dcaa47881aa9e0bde82b9841108fa2c1a92d3a0aa0deea814f1e3900799e56b42

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
0e595c6f9bede3ad263ca12395f558e2

SHA1
dad48f3b2dd56ca6187e527f0c3e6925c63b538d

SHA256
7fa968b8a9b0295735ce1b34066f5835c0f8e15d98ab5f1ff877db4dfd48bd74

SHA512
5beeb0670a0fbf87bdeeb3fc4f89e1cca4f3b28a2d619b454c92226704b05c1392a13416a6e1e30edc5c83f5ec230dbbc8711f3ed428a5868c21812e8b341101

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\840e9d53-7b91-4402-bddd-bc8d210bc428

Filesize
28KB

MD5
26059ec7756935c977095552c0b20a81

SHA1
712c3b108be3de6f74907ae348745f56f4fe5a6c

SHA256
cf8c607c62a890395a3ec36244e789354439cb2e50c50f1f528f237fb8d41cc9

SHA512
cb5469596b79eb4bf6be58a239f4c03cf09879dada9dce5c07176f724c59dac6effd394af716097844bd70f2f83d3d8fb220a3d240ae39ccdd5e93ea9c92db34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\ad1f71a0-75d1-46bd-b6cc-59369e451b5d

Filesize
671B

MD5
82a2347d158868a6f797326bcbe60dfe

SHA1
77a7d9eec195d9418a27f6ee21eb7cce480047d5

SHA256
f8a7d5ff70c7bb1a453675dc0a4c45bb68c35d659b9092a5967dfc37b2f3ab8c

SHA512
0096dc5df262f5ab6810f6baf12d138b408f12123347895377a12c20868f5b8bd29585caf0806b6012ad72b2dc6fc5a137343224180a45935b228cb03f95fba5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\e3f559b5-4ab4-4de6-a8d3-92affff1dc60

Filesize
982B

MD5
4bbf71f1f07496e3ce14b21e99714fa3

SHA1
b0894e32307912bd0112712340c5aea167e559d7

SHA256
74a86219f2e086601235648052effec7d0383848241b6c52162e9a69dddcb1e0

SHA512
cd1ffd7665dde4771ac45c61a34340b8a5cd9586bfbcaf0d7086c6b2e0bbe1eb8a2f21854373f6759b39a82f11b455529b22bf3eb3d48cba92a20892da4148dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

Filesize
11KB

MD5
4bde5ce406aa95a0fdda8abf26fdbdc5

SHA1
6eb0c766b688e36a6afe27fc43ca4da2296c508a

SHA256
cdd901b19a643285d6f1b506041de6c8ad8dce46a0261b01b8b247baaa54b687

SHA512
0cc8c1546859b2628f7b0638db34273dc38b660e7a62aa1311b087f7b14154cc5714c75efc62dc67272a6167901d3817a67d9405ffe6f66a3677c57c5aeb2b53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
10KB

MD5
70b6990a58fcce457b84b2aabe3c216c

SHA1
75602bbe0abaf89834e004246d1257e47031c3e5

SHA256
9e751248e65035b031bf16fd108a6ef0792167264e8ef2f5610b3517f4e5d741

SHA512
3228bb0b060ae31cafcebda6182f447a8b03bc5546f94f5a732f8797f2332e417f6b79e602dc9d001c42603cfaf56f56b3e086b272263be51a31b3b7b10275fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
34dead2a55d572fd89ca010314163e0a

SHA1
f9b320045ec4225572f5eb4a60e8e65517318937

SHA256
04bc7ce88aaacf1ac84e068fc0c1774978b6b3e8fbb6f3a4e2a27971ee0668f0

SHA512
32ddeb1aa46d2b16cb4b556f77eb52a64431cb7bbd1b184cc8dc5540d4cd90d821fb33cd10cdce7b8806013335fcee34603981fcc33da6a8f10a9833f777f4e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
26KB

MD5
c2d9d79657c6319fa27a9b34db7cab8a

SHA1
ba0503eb9fc51be6eca1423902686fc648c94f0d

SHA256
00ca8a9baf928f1bbcb206707a5fb8631d0139e29be5320e14b550e38c5fcfc2

SHA512
07b4bc010a1615eaaca136f5005f8ddb4d4c45370fc1b17e7cd6979710216a48ec74a6122451b89708fba0b5b01d50f77222e7ad54b98dbde9fb4595e4de8d4c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
24KB

MD5
8a4f803efde8a3766e3295281dfdcb10

SHA1
2abf05cd441786eb13b2a3299a18c531b05bc598

SHA256
3bcb8becbf5571b1ab0995dec909657ec82c7017de2695b4d4ee9d0ccd3e6656

SHA512
1cd7de7c3f8e5676d0ac9152c301a09add03ff79d281337b8d469d8ae175f6d783a9c3dcb58e8ced6bcf2dcd7befe462c269ba1837aee818b8a7affe1daab1d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
27KB

MD5
91559a4d2171ec741888e1a432878c52

SHA1
6dd00061bbf5bc189e410a0c77c213b769b07d61

SHA256
a40801aa2e073e8c9a65e197ba073f1acf0d525005f4af1463afd09aaabc8013

SHA512
43c7a332878890e62729455d70d2c54b72cd6104575de9fe423997145c59b37ace09fbaba2051c388b59786ce5d488dda51e0af7a7d80c7c5b1ef1afeafae70a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite

Filesize
48KB

MD5
b93025def1ac55d365d95f71284f4d21

SHA1
450b947b6049447bb9e3692c7e063a0a339bfc02

SHA256
80f95b53f2634d0ea85376ba7d2ff732724daeadccf76d628d4fbaec6aa68fb7

SHA512
36fbd95454d587b4eb45d777e3647bff62cb4042ffb2e7d935872f496dd722ceeb3013bc6a1e5b2c4729ab1ac0147972f76a9a1e1a1e997285bad41b321325cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
368KB

MD5
30d5149fc2bd8a3f885dc92af509f046

SHA1
0674b231fa13f330915c50c567e018cf11a804cc

SHA256
99df754b6d415d8f0a88bc0d5db45e8a6e930d56b531d0a0f4deb5657300929d

SHA512
599726c761a424a33371b5d31e6d9a715c597bab37e145e64f89bcbd43f5245f28c2417e854568d5f01dc3af0bcfceafc5093bfebf422ed2b4f200d561545c89

Download Submit
C:\Windows\Installer\MSIEFCE.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSIF03E.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIF9B6.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
memory/2352-15-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

Filesize
10.8MB

Download
memory/2352-2383-0x0000010632090000-0x000001063209A000-memory.dmp

Filesize
40KB

Download
memory/2352-1-0x0000010615680000-0x000001061574E000-memory.dmp

Filesize
824KB

Download
memory/2352-2805-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

Filesize
10.8MB

Download
memory/2352-0-0x00007FFD352C3000-0x00007FFD352C5000-memory.dmp

Filesize
8KB

Download
memory/2352-2-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

Filesize
10.8MB

Download
memory/2352-4-0x00000106312C0000-0x00000106312E2000-memory.dmp

Filesize
136KB

Download
memory/2352-5-0x00007FFD352C3000-0x00007FFD352C5000-memory.dmp

Filesize
8KB

Download
memory/2352-2385-0x000001062FC20000-0x000001062FC32000-memory.dmp

Filesize
72KB

Download
memory/4676-2803-0x000001F3D00B0000-0x000001F3D05EC000-memory.dmp

Filesize
5.2MB

Download
memory/4676-2801-0x000001F3B4BD0000-0x000001F3B4BF4000-memory.dmp

Filesize
144KB

Download
memory/4676-2808-0x000001F3CFDE0000-0x000001F3CFE92000-memory.dmp

Filesize
712KB

Download
memory/4676-2806-0x000001F3CFD20000-0x000001F3CFDDA000-memory.dmp

Filesize
744KB

Download
memory/5304-3170-0x00000197B8430000-0x00000197B8431000-memory.dmp

Filesize
4KB

Download
memory/5304-3162-0x00000197B8430000-0x00000197B8431000-memory.dmp

Filesize
4KB

Download
memory/5304-3173-0x00000197B8430000-0x00000197B8431000-memory.dmp

Filesize
4KB

Download
memory/5304-3161-0x00000197B8430000-0x00000197B8431000-memory.dmp

Filesize
4KB

Download
memory/5304-3172-0x00000197B8430000-0x00000197B8431000-memory.dmp

Filesize
4KB

Download
memory/5304-3171-0x00000197B8430000-0x00000197B8431000-memory.dmp

Filesize
4KB

Download
memory/5304-3167-0x00000197B8430000-0x00000197B8431000-memory.dmp

Filesize
4KB

Download
memory/5304-3168-0x00000197B8430000-0x00000197B8431000-memory.dmp

Filesize
4KB

Download
memory/5304-3169-0x00000197B8430000-0x00000197B8431000-memory.dmp

Filesize
4KB

Download
memory/5304-3163-0x00000197B8430000-0x00000197B8431000-memory.dmp

Filesize
4KB

Download