11e329f394675a2cf12b6c20ccd696ba555838872e4ec93797186683fe68588e

Analysis

max time kernel
181s
max time network
244s
platform
windows10-2004_x64
resource
win10v2004-20220812-de
resource tags

arch:x64arch:x86image:win10v2004-20220812-delocale:de-deos:windows10-2004-x64systemwindows
submitted
03-11-2022 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Firefox_Setup_106.0.4.exe
Size

54.7MB
MD5

ab2e6fcc50ec1d0f150bda409b38fcc4
SHA1

1cad0f34fd41396b189f270a3c904dc59d1291c2
SHA256

62e587d3263950d2f34098d883fae4acc7e684fd83b545adf0c41f9b1ffe53a1
SHA512

da80f2111a1e6366239f57abe98623542df846835cb0f9ac0df985564898e2b7fa53ec2c1a6cc87460442652c11fccddcbcd6c24d9f9d5712cb2d1b3d44a061e
SSDEEP

1572864:0zKE4v0e7KYKpzUl1Razelodor4nC9JRix+WmzQ:KmJ7BOYaz+odRnCfRiQWmk

Score

8^/10

discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Executes dropped EXE 15 IoCs

Processes:

setup.exemaintenanceservice_installer.exemaintenanceservice_tmp.exedefault-browser-agent.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exe

pid	process
4980	setup.exe
4664	maintenanceservice_installer.exe
4100	maintenanceservice_tmp.exe
5084	default-browser-agent.exe
4480	firefox.exe
3456	firefox.exe
3836	firefox.exe
4404	firefox.exe
1308	firefox.exe
2892	firefox.exe
3828	firefox.exe
1068	firefox.exe
3328	firefox.exe
1456	firefox.exe
4336	firefox.exe

Registers COM server for autorun 1 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exesetup.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCA8D857-1A63-4045-8F36-8809EB093D04}\InProcServer32\ = "C:\\Program Files\\Mozilla Firefox\\AccessibleHandler.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCA8D857-1A63-4045-8F36-8809EB093D04}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{65D36A94-8384-41A2-BAB2-7BEA8C2E7166}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65D36A94-8384-41A2-BAB2-7BEA8C2E7166}\InProcServer32\ = "C:\\Program Files\\Mozilla Firefox\\notificationserver.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ = "C:\\Program Files\\Mozilla Firefox\\AccessibleMarshal.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCA8D857-1A63-4045-8F36-8809EB093D04}\InProcServer32	regsvr32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3492-132-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/3492-133-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/3492-204-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

firefox.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation firefox.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	firefox.exe

Loads dropped DLL 64 IoCs

Processes:

setup.exeregsvr32.exeregsvr32.exemaintenanceservice_installer.exedefault-browser-agent.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exe

pid	process
4980	setup.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
3748	regsvr32.exe
3748	regsvr32.exe
4596	regsvr32.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4664	maintenanceservice_installer.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
5084	default-browser-agent.exe
5084	default-browser-agent.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4980	setup.exe
4480	firefox.exe
4480	firefox.exe
4480	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
4980	setup.exe
3836	firefox.exe
3836	firefox.exe
3836	firefox.exe
3836	firefox.exe
3836	firefox.exe
3836	firefox.exe
3836	firefox.exe
4404	firefox.exe
4404	firefox.exe
4404	firefox.exe
4404	firefox.exe
1308	firefox.exe
1308	firefox.exe
1308	firefox.exe
1308	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
1308	firefox.exe
1308	firefox.exe
3828	firefox.exe
3828	firefox.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

firefox.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Drops file in Program Files directory 64 IoCs

Processes:

setup.exemaintenanceservice_installer.exemaintenanceservice_tmp.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\nss3.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nssckbi.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsm6CCD.tmp\	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\	setup.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	setup.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File created	C:\Program Files\Mozilla Firefox\Accessible.tlb	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsm6CCD.tmp\AccessibleHandler.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsn7077.tmp	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\uninstall.log	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\osclientcerts.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png	setup.exe
File created	C:\Program Files\Mozilla Firefox\installation_telemetry.json	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsm6CCD.tmp\firefox.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log	maintenanceservice_tmp.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\mozglue.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\	setup.exe
File created	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\blocklist.xml	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\install.log	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.ini	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	maintenanceservice_tmp.exe
File opened for modification	C:\Program Files\Mozilla Firefox\update-settings.ini	setup.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent_localized.ini	setup.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.sig	setup.exe
File created	C:\Program Files\Mozilla Firefox\locale.ini	setup.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\softokn3.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\	setup.exe
File created	C:\Program Files\Mozilla Firefox\nss3.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja	setup.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\xul.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\msvcp140.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\libGLESv2.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	setup.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\	setup.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	setup.exe
File created	C:\Program Files\Mozilla Firefox\nsm6CCD.tmp\firefox.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsn7078.tmp	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\qipcap64.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsm6CCD.tmp\AccessibleMarshal.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\xul.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini	maintenanceservice_installer.exe
File created	C:\Program Files\Mozilla Firefox\nsm6CCD.tmp\AccessibleHandler.dll	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Control Panel 1 IoCs
evasion

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Colors firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Colors	firefox.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exesetup.exeregsvr32.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\FirefoxPDF-308046B0AF4A39CB\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE30F77E-8847-44F0-A648-A9656BD89C0D}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32983FF-EF84-4945-8F86-FB7491B4F57B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppUserModelId\FirefoxToast-308046B0AF4A39CB	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\FirefoxToast-308046B0AF4A39CB\CustomActivator = "{65D36A94-8384-41A2-BAB2-7BEA8C2E7166}"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\firefox.exe\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "ISimpleDOMNode"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE30F77E-8847-44F0-A648-A9656BD89C0D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{65D36A94-8384-41A2-BAB2-7BEA8C2E7166}\DllSurrogate	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods\ = "9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{65D36A94-8384-41A2-BAB2-7BEA8C2E7166}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods\ = "18"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\ = "Firefox HTML Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{65D36A94-8384-41A2-BAB2-7BEA8C2E7166}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\FriendlyTypeName = "Firefox URL"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCA8D857-1A63-4045-8F36-8809EB093D04}\InProcServer32\ = "C:\\Program Files\\Mozilla Firefox\\AccessibleHandler.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCA8D857-1A63-4045-8F36-8809EB093D04}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCA8D857-1A63-4045-8F36-8809EB093D04}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE30F77E-8847-44F0-A648-A9656BD89C0D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\FriendlyTypeName = "Firefox HTML Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\firefox.exe\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE30F77E-8847-44F0-A648-A9656BD89C0D}\ProxyStubClsid32\ = "{DCA8D857-1A63-4045-8F36-8809EB093D04}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ = "ISimpleDOMText"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32983FF-EF84-4945-8F86-FB7491B4F57B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32983FF-EF84-4945-8F86-FB7491B4F57B}\ = "IGeckoBackChannel"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\ = "Firefox URL"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCA8D857-1A63-4045-8F36-8809EB093D04}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65D36A94-8384-41A2-BAB2-7BEA8C2E7166}\InProcServer32\ = "C:\\Program Files\\Mozilla Firefox\\notificationserver.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\FirefoxPDF-308046B0AF4A39CB\FriendlyTypeName = "Firefox PDF Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ = "C:\\Program Files\\Mozilla Firefox\\AccessibleMarshal.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCA8D857-1A63-4045-8F36-8809EB093D04}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\FirefoxPDF-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,5"	setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

maintenanceservice_tmp.exe

pid process

4100 maintenanceservice_tmp.exe
4100 maintenanceservice_tmp.exe

pid	process
4100	maintenanceservice_tmp.exe
4100	maintenanceservice_tmp.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

firefox.exe

description	pid	process
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

setup.exefirefox.exe

pid process

4980 setup.exe
3456 firefox.exe
3456 firefox.exe
3456 firefox.exe
3456 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

3456 firefox.exe
3456 firefox.exe
3456 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

3456 firefox.exe

pid	process
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe

pid	process
3456	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Firefox_Setup_106.0.4.exesetup.exemaintenanceservice_installer.exefirefox.exefirefox.exe

description	pid	process	target process
PID 3492 wrote to memory of 4980	3492	Firefox_Setup_106.0.4.exe	setup.exe
PID 3492 wrote to memory of 4980	3492	Firefox_Setup_106.0.4.exe	setup.exe
PID 3492 wrote to memory of 4980	3492	Firefox_Setup_106.0.4.exe	setup.exe
PID 4980 wrote to memory of 3748	4980	setup.exe	regsvr32.exe
PID 4980 wrote to memory of 3748	4980	setup.exe	regsvr32.exe
PID 4980 wrote to memory of 4596	4980	setup.exe	regsvr32.exe
PID 4980 wrote to memory of 4596	4980	setup.exe	regsvr32.exe
PID 4980 wrote to memory of 4664	4980	setup.exe	maintenanceservice_installer.exe
PID 4980 wrote to memory of 4664	4980	setup.exe	maintenanceservice_installer.exe
PID 4980 wrote to memory of 4664	4980	setup.exe	maintenanceservice_installer.exe
PID 4664 wrote to memory of 4100	4664	maintenanceservice_installer.exe	maintenanceservice_tmp.exe
PID 4664 wrote to memory of 4100	4664	maintenanceservice_installer.exe	maintenanceservice_tmp.exe
PID 4980 wrote to memory of 5084	4980	setup.exe	default-browser-agent.exe
PID 4980 wrote to memory of 5084	4980	setup.exe	default-browser-agent.exe
PID 4980 wrote to memory of 4480	4980	setup.exe	firefox.exe
PID 4980 wrote to memory of 4480	4980	setup.exe	firefox.exe
PID 4480 wrote to memory of 3456	4480	firefox.exe	firefox.exe
PID 4480 wrote to memory of 3456	4480	firefox.exe	firefox.exe
PID 4480 wrote to memory of 3456	4480	firefox.exe	firefox.exe
PID 4480 wrote to memory of 3456	4480	firefox.exe	firefox.exe
PID 4480 wrote to memory of 3456	4480	firefox.exe	firefox.exe
PID 4480 wrote to memory of 3456	4480	firefox.exe	firefox.exe
PID 4480 wrote to memory of 3456	4480	firefox.exe	firefox.exe
PID 4480 wrote to memory of 3456	4480	firefox.exe	firefox.exe
PID 4480 wrote to memory of 3456	4480	firefox.exe	firefox.exe
PID 4480 wrote to memory of 3456	4480	firefox.exe	firefox.exe
PID 4480 wrote to memory of 3456	4480	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe
PID 3456 wrote to memory of 3836	3456	firefox.exe	firefox.exe

C:\Users\Admin\AppData\Local\Temp\Firefox_Setup_106.0.4.exe
"C:\Users\Admin\AppData\Local\Temp\Firefox_Setup_106.0.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3492

C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\setup.exe
.\setup.exe
2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:3748

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleHandler.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:4596

C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
"C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4100

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5084

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -first-startup
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -first-startup
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.0.134315450\186679546" -parentBuildID 20221102214123 -prefsHandle 2196 -prefMapHandle 2268 -prefsLen 20999 -prefMapSize 233583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebb72f6c-c0a0-4d9d-acf6-7fdb08fe6649} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 2084 156aabe5b58 socket
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3836

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.1.142722219\1378436624" -parentBuildID 20221102214123 -prefsHandle 1592 -prefMapHandle 2012 -prefsLen 21172 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {61c2268a-89d7-4a9e-bfdb-7b0c09c74c5d} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 1676 156ab96c158 gpu
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4404

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.2.1087021560\594674358" -childID 1 -isForBrowser -prefsHandle 2624 -prefMapHandle 2736 -prefsLen 22404 -prefMapSize 233583 -jsInitHandle 1196 -jsInitLen 246704 -a11yResourceId 64 -parentBuildID 20221102214123 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a88e53a-f1ac-4cf9-9098-e57dedfdfa61} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 2704 156aef73e58 tab
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.3.435669266\1576899070" -childID 2 -isForBrowser -prefsHandle 3084 -prefMapHandle 3080 -prefsLen 22488 -prefMapSize 233583 -jsInitHandle 1196 -jsInitLen 246704 -a11yResourceId 64 -parentBuildID 20221102214123 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a39a00c0-ad92-407c-83fd-ee4191b0bf04} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 3096 156afad0d58 tab
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.4.1733334733\596327992" -parentBuildID 20221102214123 -prefsHandle 3240 -prefMapHandle 3384 -prefsLen 23409 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {85ee1888-7901-4c2a-ba72-f0bd50350be9} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 3408 156aef70b58 rdd
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3828

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.7.1201247868\1876779998" -childID 5 -isForBrowser -prefsHandle 4048 -prefMapHandle 4052 -prefsLen 23530 -prefMapSize 233583 -jsInitHandle 1196 -jsInitLen 246704 -a11yResourceId 64 -parentBuildID 20221102214123 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {038c747b-805e-45cf-9206-a0ee180982a7} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 4036 156afdf5f58 tab
5⤵
- Executes dropped EXE
PID:1456

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.6.735056764\1790531478" -childID 4 -isForBrowser -prefsHandle 3944 -prefMapHandle 3940 -prefsLen 23530 -prefMapSize 233583 -jsInitHandle 1196 -jsInitLen 246704 -a11yResourceId 64 -parentBuildID 20221102214123 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4b17531-f7a3-4a8b-b008-1d684c75a2ae} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 3868 156afdf6e58 tab
5⤵
- Executes dropped EXE
PID:3328

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.5.1630778699\534184802" -childID 3 -isForBrowser -prefsHandle 3716 -prefMapHandle 3712 -prefsLen 23530 -prefMapSize 233583 -jsInitHandle 1196 -jsInitLen 246704 -a11yResourceId 64 -parentBuildID 20221102214123 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b44fb843-87de-485a-9bd6-cf295a25a5e2} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 3732 156afa69558 tab
5⤵
- Executes dropped EXE
PID:1068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.8.1050797614\1660612911" -childID 6 -isForBrowser -prefsHandle 5472 -prefMapHandle 5480 -prefsLen 29630 -prefMapSize 233583 -jsInitHandle 1196 -jsInitLen 246704 -a11yResourceId 64 -parentBuildID 20221102214123 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c80a3d5-c198-4685-b1ec-471240a6654e} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 5416 1569f25c458 tab
5⤵
- Executes dropped EXE
PID:4336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\Accessible.tlb

Filesize
2KB

MD5
8104751de2a8e948284f3ed577fe4872

SHA1
f03832fadce708f9fbb21f7ef1a44929f1792e08

SHA256
2a27d969cc58cb2b453f15e50c6fba15de088fe99c9c44d9998ec00f7be9676a

SHA512
27bdb251cd6886a81c0b754a545937c23c92420d2fa9c311a525c30319c4506a5b77988506aea1085615a163d1b758659164e4e244f3b3079890fa0f649891a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\AccessibleHandler.dll

Filesize
179KB

MD5
38e9e07ecb5df089c23db1b6a243e9da

SHA1
d64bc531f22549f3ff0dd19343f5289462ecbc1e

SHA256
d8e9318627f5584b5c1b3a7c34d30ca8eb41c8a10302c3afaf86fc9b2cba03b6

SHA512
8eaae19ea30bf8a63be97bab01768e78c017bd1e46f1b027e5716f053bd733619951d5c7cb1254a9e4334182f2ef4317cb1a970dc9507c009789b06bfc8de657

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\AccessibleMarshal.dll

Filesize
32KB

MD5
31b9c31420785f39de1a17db1a28c307

SHA1
fa13d3afeb747e801b4bd2b1e700c969436e1db9

SHA256
7dd081f4f01f2d18a2b7a36d91b8179983b9c6df728c191f1a080e16da87c3aa

SHA512
5eed3030eab92d1e7a9dcfcbbe66186fc5abd55d25aa4a029420d6c454afdc6df4462ce40db97475edadd338501bd01513ecd9c9e90bd09c817a4428182039d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\IA2Marshal.dll

Filesize
82KB

MD5
2afb75bebbf17f2d4299165903c3a203

SHA1
bbf85910c8351128258d7d3e8c162d817987adbd

SHA256
3b531fa98809dab4c4edf913bd9ec89e363cfe075787f65095096764c28f2b92

SHA512
2234ece2dc2f767961b44238e694df2cb7e54b79b62ef50942b0c2b7b674fc74392c07165abb377671f99ebe6ba35cdb107b282517aa744c0fe8a9f45eb8b455

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
49c3ffd47257dbcb67a6be9ee112ba7f

SHA1
04669214375b25e2dc8a3635484e6eeb206bc4eb

SHA256
322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165

SHA512
bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
588bd2a8e0152e0918742c1a69038f1d

SHA1
9874398548891f6a08fc06437996f84eb7495783

SHA256
a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094

SHA512
32ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
d699333637db92d319661286df7cc39e

SHA1
0bffb9ed366853e7019452644d26e8e8f236241b

SHA256
fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504

SHA512
6fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
47388f3966e732706054fe3d530ed0dc

SHA1
a9aebbbb73b7b846b051325d7572f2398f5986ee

SHA256
59c14541107f5f2b94bbf8686efee862d20114bcc9828d279de7bf664d721132

SHA512
cce1fc5bcf0951b6a76d456249997b427735e874b650e5b50b3d278621bf99e39c4fc7fee081330f20762f797be1b1c048cb057967ec7699c9546657b3e248ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
f62b66f451f2daa8410ad62d453fa0a2

SHA1
4bf13db65943e708690d6256d7ddd421cc1cc72b

SHA256
48eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720

SHA512
d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
6c88d0006cf852f2d8462dfa4e9ca8d1

SHA1
49002b58cb0df2ee8d868dec335133cf225657df

SHA256
d5960c7356e8ab97d0ad77738e18c80433da277671a6e89a943c7f7257ff3663

SHA512
d081843374a43d2e9b33904d4334d49383df04ee7143a8b49600841ece844eff4e8e36b4b5966737ac931ed0350f202270e043f7003bf2748c5418d5e21c2a27

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
d53637eab49fe1fe1bd45d12f8e69c1f

SHA1
c84e41fdcc4ca89a76ae683cb390a9b86500d3ca

SHA256
83678f181f46fe77f8afe08bfc48aebb0b4154ad45b2efe9bfadc907313f6087

SHA512
94d43da0e2035220e38e4022c429a9c049d6a355a9cb4695ad4e0e01d6583530917f3b785ea6cd2592fdd7b280b9df95946243e395a60dc58ec0c94627832aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
c712515d052a385991d30b9c6afc767f

SHA1
9a4818897251cacb7fe1c6fe1be3e854985186ad

SHA256
f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1

SHA512
b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
f0d507de92851a8c0404ac78c383c5cd

SHA1
78fa03c89ea12ff93fa499c38673039cc2d55d40

SHA256
610332203d29ab218359e291401bf091bb1db1a6d7ed98ab9a7a9942384b8e27

SHA512
a65c9129ee07864f568c651800f6366bca5313ba400814792b5cc9aa769c057f357b5055988c414e88a6cd87186b6746724a43848f96a389a13e347ef5064551

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
f9e20dd3b07766307fccf463ab26e3ca

SHA1
60b4cf246c5f414fc1cd12f506c41a1043d473ee

SHA256
af47aebe065af2f045a19f20ec7e54a6e73c0c3e9a5108a63095a7232b75381a

SHA512
13c43eee9c93c9f252087cb397ff2d6b087b1dc92a47ba5493297f080e91b7c39ee5665d6bdc1a80e7320e2b085541fc798a3469b1f249b05dee26bbbb6ab706

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
ab206f2943977256ca3a59e5961e3a4f

SHA1
9c1df49a8dbdc8496ac6057f886f5c17b2c39e3e

SHA256
b3b6ee98aca14cf5bc9f3bc7897bc23934bf85fc4bc25b7506fe4cd9a767047a

SHA512
baccc304b091a087b2300c10f6d18be414abb4c1575274c327104aabb5fdf975ba26a86e423fda6befb5d7564effac0c138eb1bad2d2e226131e4963c7aac5bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
4dd7a61590d07500704e7e775255cb00

SHA1
8b35ec4676bd96c2c4508dc5f98ca471b22deed7

SHA256
a25d0654deb0cea1aef189ba2174d0f13bdf52f098d3a9ec36d15e4bfb30c499

SHA512
1086801260624cf395bf971c9fd671abddcd441ccc6a6eac55f277ccfbab752c82cb1709c8140de7b4b977397a31da6c9c8b693ae92264eb23960c8b1e0993bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
26KB

MD5
4e033cfee32edf6be7847e80a5114894

SHA1
91eef52c557aefd0fde27e8df4e3c3b7f99862f2

SHA256
dff24441df89a02dde1cd984e4d3820845bafdff105458ed10d510126117115b

SHA512
e1f3d98959d68ef3d7e86ac4cb3dbdf92a34fcfd1bf0e0db45db66c65af0162ab02926dc5d98c6fc4a759a6010026ee26a9021c67c0190da941a04b783055318

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-private-l1-1-0.dll

Filesize
69KB

MD5
50740f0bc326f0637c4166698298d218

SHA1
0c33cfe40edd278a692c2e73e941184fd24286d9

SHA256
adbb658dd1cbecaca7cc1322b51976f30b36ccf0a751f3bad1f29d350b192c9c

SHA512
f1331ab1d52fb681f51546168e9736e2f6163e0706955e85ac9e4544d575d50e6eacd90ea3e49cb8b69da34fe0b621b04661f0b6f09f7ce8ceca50308c263d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
595d79870970565be93db076afbe73b5

SHA1
ec96f7beeaec14d3b6c437b97b4a18a365534b9b

SHA256
fc50a37acc35345c99344042d7212a4ae88aa52a894cda3dcb9f6db46d852558

SHA512
152849840a584737858fc5e15f0d7802786e823a13ec5a9fc30ee032c7681deaf11c93a8cffead82dc5f73f0cd6f517f1e83b56d61d0e770cbb20e1cfff22840

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
8b9b0d1c8b0e9d4b576d42c66980977a

SHA1
a19acefa3f95d1b565650fdbc40ef98c793358e9

SHA256
371a44ab91614a8c26d159beb872a7b43f569cb5fac8ada99ace98f264a3b503

SHA512
4b1c5730a17118b7065fada3b36944fe4e0260f77676b84453ee5042f6f952a51fd99debca835066a6d5a61ba1c5e17247551340dd02d777a44bc1cae84e6b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
76e0a89c91a28cf7657779d998e679e5

SHA1
982b5da1c1f5b9d74af6243885bcba605d54df8c

SHA256
0189cbd84dea035763a7e52225e0f1a7dcec402734885413add324bffe688577

SHA512
d75d8798ea3c23b3998e8c3f19d0243a0c3a3262cffd8bcee0f0f0b75f0e990c9ce6644150d458e5702a8aa51b202734f7a9161e795f8121f061139ad2ea454f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
96da689947c6e215a009b9c1eca5aec2

SHA1
7f389e6f2d6e5beb2a3baf622a0c0ea24bc4de60

SHA256
885309eb86dccd8e234ba05e13fe0bf59ab3db388ebfbf6b4fd6162d8e287e82

SHA512
8e86fa66a939ff3274c2147463899df575030a575c8f01573c554b760a53b339127d0d967c8cf1d315428e16e470fa1cc9c2150bb40e9b980d4ebf32e226ee89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
6b33b34888ccecca636971fbea5e3de0

SHA1
ee815a158baacb357d9e074c0755b6f6c286b625

SHA256
00ac02d39b7b16406850e02ca4a6101f45d6f7b4397cc9e069f2ce800b8500b9

SHA512
f52a2141f34f93b45b90eb3bbcdb64871741f2bd5fed22eaaf35e90661e8a59eba7878524e30646206fc73920a188c070a38da9245e888c52d25e36980b35165

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
54f27114eb0fda1588362bb6b5567979

SHA1
eaa07829d012206ac55fb1af5cc6a35f341d22be

SHA256
984306a3547be2f48483d68d0466b21dda9db4be304bedc9ffdb953c26cac5a1

SHA512
18d2bdce558655f2088918241efdf9297dfe4a14a5d8d9c5be539334ae26a933b35543c9071cedada5a1bb7c2b20238e9d012e64eb5bbf24d0f6b0b726c0329d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\application.ini

Filesize
899B

MD5
1e828e0224f0e3ab0c9114759b4bf826

SHA1
a253a8e13fce4b834f0cf67d13a5195119486694

SHA256
881362dbf7179441161d2e519fb719c4937ca4d0b4d45ac40f6e6f45422acc9d

SHA512
3e02a1f7237612165e43c1540956f46040441fb5b6aa52b0b46c9cf260a14efd5327527490ce690c55b4578b4cd798440546290d273fb33452fe8d92016d445a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\crashreporter.exe

Filesize
262KB

MD5
d6a12aa88a03c51935933f11e28834b6

SHA1
62b9f6396d040a851ad454d59d330b9459dcb00f

SHA256
7b97f394eff065e269d2a9546f73c2d7e10f0d0e8b54b3f851c575977027b4e7

SHA512
8c2221e58c5898263d6fe024bb1f9f1fd13d8bcaa14862769af5b2ff1b5929f61916fd6b1926302eb0d80cb1803cd4bb1e5365362964729d06f284afafb034cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\crashreporter.ini

Filesize
4KB

MD5
7b862a77b2967205964f577473b00f90

SHA1
83c9e47a8595a35e24f8f738982a3a08799561f9

SHA256
b535dd5bd89577c1934ad22a17c5c57a070dea02f3f618086748149ee8479bc8

SHA512
c4ea9f1bed968c1ef81fe0dc480040c27428809f07e5d7ed121b18008c1d9251f1a8434a68c88b6d8c02cfab55592170b4ce65b092846134954ee0ddd212e14d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\d3dcompiler_47.dll

Filesize
4.1MB

MD5
222d020bd33c90170a8296adc1b7036a

SHA1
612e6f443d927330b9b8ac13cc4a2a6b959cee48

SHA256
4432bbd1a390874f3f0a503d45cc48d346abc3a8c0213c289f4b615bf0ee84f3

SHA512
ad8c7ce7f6f353da5e2cf816e1a69f1ec14011612e8041e4f9bb6ebed3e0fa4e4ebc069155a0c66e23811467012c201893b9b3b7a947d089ce2c749d5e8910c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\default-browser-agent.exe

Filesize
697KB

MD5
7422d416295642f03a7e367e4191723c

SHA1
807733502701783a2c1b623425ee50e450e83420

SHA256
c4cfc510428e429e69baa325347ee407eb6c914bcc0ca8652c6325afa08780fb

SHA512
ba0ace02587273ff376a36a4f1c8d351b795f84b9628cdac21a5d2feb180829663429696df32bfce0cc912f8047f23a995fe5b2d2260950a715007b8c7b91492

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\defaultagent.ini

Filesize
932B

MD5
88d7d32ad20bf89bb7785bd07c638e17

SHA1
2bd40f0b69c2edc64ab6b7e6dd2e7ca6a6fea6f6

SHA256
5cf0660a8f2624433c8c1022f93ff3c94c5611ccbc93118ee053566590eb53f4

SHA512
7bb3328ce42e7bb546a2192ade1e8e153408912f3582c27dc0c5cbe1c2d807365aaf4206c3ceab6cb3d6c34d3155125cb7509dbf800ecf70ab35f8a64f764010

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\defaultagent_localized.ini

Filesize
1KB

MD5
79e8ff88afb9012526d1cc7c3aae9b75

SHA1
7b1e97498b077b91f6b5df14fdd674da86452b0d

SHA256
899b3f66dd8c4164fc6507ef5fd5de10196e14dca7cc75d399e72a0b9a13a9e2

SHA512
cc6244814230ac9716deece5fb447fe6ee98b4733b856c7d3c2d542b2722c38721314fc9aa0b2bdc5a6883ea2fa1f4d52850929de776e32083c9412dfb9e7829

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\dependentlibs.list

Filesize
446B

MD5
35da5601932b6ade92ec29951942ec1f

SHA1
4d0b52b709c3e25b50dd53dfab9337ef8958d1ca

SHA256
3da3fa240910cc0aed83b17a81c87251a6bc6cf5db5be9e71a3e01d7b7d88f86

SHA512
0bd4ae8932d6f2d7bb1655b13f66fc24a858a17993be9354921406e63372242661a3bb52010445173fb856d4e5f98fcfbd44a155fe0760feca8cc65bebd777c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\firefox.VisualElementsManifest.xml

Filesize
557B

MD5
0aa43576f0420593451b10ab3b7582ec

SHA1
b5f535932053591c7678faa1cd7cc3a7de680d0d

SHA256
3b25ae142729ed15f3a10ebce2621bfa07fda5e4d76850763987a064122f7ae6

SHA512
6efb63c66f60e039cf99bfaf2e107c3c5ed4b6f319f3d5e4ef9316c1f26298b90d33c60b48b03699059d28b835fbc589417ac955fc45a2bc4c116a5200dfdc32

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\firefox.exe

Filesize
648KB

MD5
431a78cbe290fc2595b98f17f96665ee

SHA1
c4ba025448d8098d6ae23d83ac04821e8032402f

SHA256
a7f8b01220e0cbf4ba5ea8c80f7a45f25dcf11f5e2d6370aba509ebd68046131

SHA512
2cc38ed1ec9426d3f5f83b2c8350241d8280d01a7d7e138dc1163d43cd4246d97775bcbe3af314cd4f9f667316a7dd0e8cc747d1b1ec738095376717321af5f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\firefox.exe.sig

Filesize
1KB

MD5
b051e029a8ebc14436a73ab0b91d32b6

SHA1
8c99300e86914add64d153352d180b3216402fa1

SHA256
8d8cb814213eb2b7028a255b762d9d5b84f47ae4a061c40de30891836e7425ec

SHA512
4286c877b8afb4cf50b041e7f9b2a073b3c498f6a1926fcd6bc76cdf9eeee4bec3e58ea8d06410c5cc7a7200500a7db08a7b7993b5a3159bb78b6cc5c04a0db0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\freebl3.dll

Filesize
745KB

MD5
08f1c4078bfe81745171cfe35e6c40e4

SHA1
3ab40666f4c82362516bd7bf83e31693c066b5a3

SHA256
2f6e056d6f25bd7fa0b97c69b7ada742472fc15dadbd56eb51be9946c71c9096

SHA512
f90b2353b225216865f61f0a21163e45c0e5d23b92955a46454710d80272b876b997c2764650afd5c48b545d3ce684c8868f6e57de49bd6288fe786e44279750

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\ipcclientcerts.dll

Filesize
215KB

MD5
8d63626d87dcafef9ae8ff33d1af9553

SHA1
a660e310e2b690975f3265182a5d29fb88084020

SHA256
b9f1b29498211d2023d7320b6b0def80f7c247fbfbc134173f929716f3e8e783

SHA512
fc7c3dd474a0921ce57c04cae0bfe87bf4c67e1b1d2be0cf2cffb16ae6b100112439b289b8c13e3c4a34db50ce38607a74011c6c4c6720b29fd808184eb2a1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\lgpllibs.dll

Filesize
40KB

MD5
c2279043c50715ef0219a597f2cff45c

SHA1
03f6d34b93ec12dbe338430b7bd277d2f0bbc0ef

SHA256
d8925a25397d06c52d299a949e21a532b5e7efd9e3da59f906179c407e1ef3d7

SHA512
39a3e097b9acc67e3902508439621ea2b47c799c7083c3e4a22b07061dd5818d9239ffca490343b5d0474b7f642661435397e2ce652b02069331053e90f58649

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\libEGL.dll

Filesize
42KB

MD5
7cb9299fa71250e21c7aa34716c05733

SHA1
5d3c898cf3038a6ec29362f4e2f8b49dd0f7d081

SHA256
c407065c1d8bd89253283586dc57701e4ebbe9bf829416900b83c1f2eaf0050f

SHA512
bbb18a1a28aa72d104cdb74c40dbe389bb680c8859dfa3cfd0db0158a0465caaeee77f3040790b2664970c36814339b42bd4f4f039219b175d43828a9693b05d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\libGLESv2.dll

Filesize
4.2MB

MD5
e05f5009e006d5cd4fb007249105bac5

SHA1
5b2de4993222e5bcead9f1d9e9a165178b38245e

SHA256
d371e0e8fa1ca70fe6b62abffcffa1fa151d73f887b5e552c62289f51ca171fb

SHA512
8318cd64fb4e3da796b4fc461723f42bf861a819698c5f9428cfdf8bc6eb7dd3858542df815620701d40597002945ddb542215d205a45981166fc7c449d15181

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\locale.ini

Filesize
19B

MD5
3b4532620029ada7c83f40cbb621970a

SHA1
a0ec6f331e2e4a4756ab4a591d6ebff5629bdaa3

SHA256
81df279bf08e12181d8ad06bed345490db187b51a8637bddb22c8dee10ea371b

SHA512
d481dc0d03b5ae88f5cdf83404bed7ee1981f04b53a0ea174da7224eeeaf168f05a6aa78d6aede84b819bab53315f518e20c3403d08d5b89e487735fb70d9d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\maintenanceservice.exe

Filesize
227KB

MD5
efdde3f12f2432db63924a95a26f2add

SHA1
679d0d7c1e96ea1b3c74d13e9c0ebbe410bf1b64

SHA256
c1086687f5a2bbc61883c1e9299690db59421e0dba1ff51f9b8229a150a1d2fa

SHA512
d0f3c7cb244c4ba7bcbe52d7074486c291e4f6e573eead8f8c0f7ca7891faecea4121d1e72231c8acdba66eeadc04a7855858a7dd5a685cb880c9b29bc8d7d61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\maintenanceservice_installer.exe

Filesize
185KB

MD5
a4d02a65c2204168e83eff2aebf11149

SHA1
33911020ccffac28dc128385d8d099e34d26320d

SHA256
ec8f4e34c77c02fe50ef55ac2aded3000887c734ac8eb96ac2ad9dd9ec8db0f7

SHA512
178c1f21e70ec07c78e09f37a9cdcd0d0382f722438f8cdc3ced8f4777477356e603ccbbe5a920abbe1502c95c0c2e583b4364d0da7d4af93d2b5174661be142

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\minidump-analyzer.exe

Filesize
761KB

MD5
e20d64bc00bef9e498b9d1b017b4f41d

SHA1
25cd257a3be727ec58691cacb02f1f748cea9865

SHA256
88162eeaba148c79104b0448ce8faa080bf4abf4e3e8efa6569d6ccfff102dc5

SHA512
ba206831bd2e618ab455183dfcffea0ca3d4c5bccde9e3edc26d94e77c472af8bd8088d815068a1ef467fadad7a790138934edadc4ffeb58f0bba54cefb89d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\mozavcodec.dll

Filesize
2.9MB

MD5
8a69a3f61de378b704815da8a4a05224

SHA1
d821aa0c4f8ef6c57fca57c9b34b9c1308411be2

SHA256
5cc65411545c3f43cbb6e5fd1ba3073829c122b4947e25bef882ec744d6916ae

SHA512
13e0ba62e03e149a376ce17ae1b235f01c36f5419390ec493a113a6c591c442d6574e7716f70657cb6ebc1606e3dab7e121ccdef90a02248b53bdf9a3a8ea861

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\mozavutil.dll

Filesize
199KB

MD5
2c7122591e9b522152a79084af31fb3a

SHA1
940c0af0ad0b5e980a35d37c9b20ee9aae21001f

SHA256
77965cc49b54abd513b13c4faae11ad98a480401e015a376ad01cdeea3192ebb

SHA512
bfa50a92c5e65673016ea74c0e2a7aade644b6690b7b86148d22af4fbc30c0df569059cecb7bfdef0316c459ffcb74db89dee30dcb4e342ecbe640eb97be65de

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\mozglue.dll

Filesize
721KB

MD5
c498f8e64790ab5c41f7ed63bdcd8784

SHA1
b6c2136f3b092882523d990f6db0d5e93b698ac4

SHA256
b687044b60056331914e00c217ef3cbb33beff9786fa807bd367fc929dc20028

SHA512
112028a5fac672fd56c2336b940cff9d2fd2e01a1a87e126b064c22ec02f9224344fa923d101d5548a221bf677d8c01884f9da2188a1673ee911d778d6600d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\mozwer.dll

Filesize
305KB

MD5
bf1b07e0c631eb4fc0d4fbf2cbd10dea

SHA1
caafb6f91975e226d098cd2af48d13368bf234be

SHA256
10a201fadf21edb4e222c318c8ee72ed23b881b828dcfe167e4d6f88e0219e61

SHA512
f783f4835838e3d1caa5d39c14d86fced5802f1dbfbf594a64d5390aa407844a0f5775a43a153dd1441d68cb3f181dfb0ee438eed42c33953f7c32449bc42782

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\msvcp140.dll

Filesize
613KB

MD5
c1b066f9e3e2f3a6785161a8c7e0346a

SHA1
8b3b943e79c40bc81fdac1e038a276d034bbe812

SHA256
99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd

SHA512
36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\notificationserver.dll

Filesize
55KB

MD5
9e36049306ab87e0a3569ee3c57b8920

SHA1
6d247774c346ee7e5e98f2c184e48901f4ec9e32

SHA256
dbc13181ead4d207086bdce30d354a5ae8a5103922006a1390c19228631aea15

SHA512
bf661057378d23cef8b2db8e34088928ffbf8e3cf67c2c02a7782bb9f976ccdac8532111a1dfcbd20a730a08d909d2ac68da0d1b46f5013eb1a9e1ecfe1da9d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\nss3.dll

Filesize
2.1MB

MD5
06fa548be7beabd4a41a971b9f3f1794

SHA1
724d418d5111f48d9bff4128ea63a623a4732430

SHA256
048d3e0f826e0e02532bf0974300c46891e27a763e483b8ec91d86649c5a637f

SHA512
3c34b5cddb9702d9d7662764ec74f9917bc379956208a38316b89944fffd6aab8d6c7754fe74198bb8175c68f750abc7b4f7cccf2becb7e77963276234513e8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\nssckbi.dll

Filesize
434KB

MD5
23917bb7e6556006aec735c965ef7784

SHA1
cbe27e52fb9729dfeca1b751772c3a23687eaf9f

SHA256
62f0910393ecbcbd8495349b9359b5fab69f054d2656fb88fd9a74687ed2457e

SHA512
4e5de76ab7797a17eede7a981487c74c5c74e38c5c16aac058034e949c88e6d852f58e22fef1f9f38053e467fa96be45f063c31a9b5482c66e5e056aa91137d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\omni.ja

Filesize
30.3MB

MD5
3178dbaffb5d5eead929615a19b19b78

SHA1
a7d8f0b627de038f879bd92c996ce12d162c38ae

SHA256
749256c01a7635a4cea9435bc72d52eb9e4e7fb8d950bb305932df585e49e974

SHA512
4618482f381820f9b560cbff76c80bc8c74f7e1b563c445ee4da38ce1739f32c5ec95b5b5160f2530e88a99339f15a79cf223bb9a8a947bde30d7acbab8557af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\osclientcerts.dll

Filesize
364KB

MD5
dd993dab94cea7f79cc4189d02fe737a

SHA1
a6ba3834287310a3173aac7f65161b68aef2ed12

SHA256
d9ea929e0d106a89b0a21686115bb9f9172da72ce46bd6716f8ccdbcb8a443c3

SHA512
ac6242d3b1d3c4190be484d7d9f1f2fa66e3dbfc0ed0985d12eb0fdbbd543f12f683bbc76cd9c1922212f9a638e200013c7b4658a0ddb16dd1dc3ec7df624282

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\pingsender.exe

Filesize
80KB

MD5
3e10d423596b75ec72156bb498e4f82d

SHA1
27a977ea75c72ea553933d1833f3bb0aa3041be4

SHA256
e362ac6934086299db32646d2b7945d7e4609dda8333ecf0bfdebac4fc0ab6d3

SHA512
4e0920e705bba183c1f3e577934029b0397e001404f7cf092457fc6c0be303e956281d3d78e7b4574bd5ea44ab838e4bd054d1052c536cbe77dc53c817bf6248

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\platform.ini

Filesize
167B

MD5
4620bdc454d87be358cd15a3bf464cda

SHA1
7236a2111e3de824e9286f85f242c076c5d0102e

SHA256
752aae4208ad465bbb89617255e09dd7bcb0921e2c5ad65bb0364ff606a73072

SHA512
4e76dda0f20871a29257eeb32a0e3803ec1776efb9eeff4be3eebbbe05bd08a13b4f42125ecb0217600d8442b5221e1c8bd7d1568bbfdb3247ec7637c0a1f37e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\plugin-container.exe

Filesize
290KB

MD5
6c50f841e02748844209de1fdbdfea31

SHA1
7008e19e93abf900aaaf55c0bc103dc7dcab2d1f

SHA256
fb2b4c014ab51f95c659b29e25aea2a4a3295c9ebd00e69c6a492776abea8cd5

SHA512
4a284b9eeae4ad8c182b5b61702b266039de9ed146895f3adc29c4d1bbee08e73f7b964f61dd6db699888d251bc4e8338a4b62ca1aa1c5d9536868e7f1f2bb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\plugin-container.exe.sig

Filesize
1KB

MD5
7651c988cf7e6b801e79f11843763591

SHA1
5cbf675b5b692af5c3e29e6854c5a0d9703b83cb

SHA256
6945b5b2a8b121dfa5db6e6d3b0b9c4129e65ba138861acc5c53f9cf28cdad4d

SHA512
f7c82fc3becaadfbc013c6fe360bb9e5c1643f667fa3c38443c20f160c9ab976c490e7df7e22c51b10b0a0484040ac154cea4a8587fd891bf388c9cb184994e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\core\precomplete

Filesize
3KB

MD5
15f7c7608c49e5ee4d5fa79cfbf63973

SHA1
e716ef4c370fce86645d497740b03eb4d8d9edaf

SHA256
471b60c88e0ced613cd7e0bf021342a9ad3fa229f31993c7a49e5e0eb052e6b5

SHA512
f7e0f334e635deae7722ec050d5e16aa78be3d820ff5315a665daf8d2b00833860f58f141a45fa5d0b13ca03f53c69ec72ca1b8a07dc3d64870bff194ca66a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\setup.exe

Filesize
924KB

MD5
d80ee5255566468e449ea3c95a76871b

SHA1
0fb689491dc6c89036d7cb5df6956260e742a8b8

SHA256
e85b0b7b19e2bf7fbce993c4039f8bcd763d9e8bf6fb6b296456315836826882

SHA512
46666285a9925825e4dee8bbdee1db56eca537b649d6043736e43ad0d93aea1fc1df1c4c992b6cd885f586f465b08e42d7c99e882a93c892427d4eae3b43d03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4ADF5568\setup.exe

Filesize
924KB

MD5
d80ee5255566468e449ea3c95a76871b

SHA1
0fb689491dc6c89036d7cb5df6956260e742a8b8

SHA256
e85b0b7b19e2bf7fbce993c4039f8bcd763d9e8bf6fb6b296456315836826882

SHA512
46666285a9925825e4dee8bbdee1db56eca537b649d6043736e43ad0d93aea1fc1df1c4c992b6cd885f586f465b08e42d7c99e882a93c892427d4eae3b43d03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx7E92.tmp\System.dll

Filesize
22KB

MD5
b361682fa5e6a1906e754cfa08aa8d90

SHA1
c6701aee0c866565de1b7c1f81fd88da56b395d3

SHA256
b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

SHA512
2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx7E92.tmp\UAC.dll

Filesize
28KB

MD5
d23b256e9c12fe37d984bae5017c5f8c

SHA1
fd698b58a563816b2260bbc50d7f864b33523121

SHA256
ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c

SHA512
13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e

Download Submit
memory/3492-132-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3492-133-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3492-204-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3748-199-0x0000000000000000-mapping.dmp

Download
memory/4100-202-0x0000000000000000-mapping.dmp

Download
memory/4596-200-0x0000000000000000-mapping.dmp

Download
memory/4664-201-0x0000000000000000-mapping.dmp

Download
memory/4980-134-0x0000000000000000-mapping.dmp

Download
memory/5084-203-0x0000000000000000-mapping.dmp

Download