ececfc99e91207976c641fd66cd854c66187737381d8087326cbb90ccf3623fc

Resubmissions

31/05/2023, 22:06

230531-1z7vysbg21 8

31/05/2023, 22:03

230531-1yjfzabg2z 7

Analysis

max time kernel
350s
max time network
496s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31/05/2023, 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Firefox Installer.exe
Size

389KB
MD5

c7311f6f5023aa25da05696a626768e4
SHA1

8f5d3b33c0a29f65a641071a3e37a95fd0eb7da9
SHA256

ececfc99e91207976c641fd66cd854c66187737381d8087326cbb90ccf3623fc
SHA512

9c188ae67747fc10fcefadc314995f5fc2aef0ac6654b93fece6b99905bb4f303d043deea875492a94490acb24c86775eadf26161e506a17f224735d574ff640
SSDEEP

12288:BvHOmh9159ZWAnMmcto8v5LniRXIQXGOSjacFo:FZ15Fnvca8xiRHXGnjap

Score

8^/10

discovery evasion spyware stealer trojan upx

Malware Config

Signatures

Downloads MZ/PE file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2044-96-0x00000000013E0000-0x0000000001441000-memory.dmp	upx
behavioral1/files/0x00070000000133cc-282.dat	upx
behavioral1/files/0x00070000000133cc-289.dat	upx
behavioral1/files/0x00070000000133cc-294.dat	upx
behavioral1/files/0x00070000000133cc-293.dat	upx
behavioral1/memory/2248-295-0x0000000001350000-0x00000000013B1000-memory.dmp	upx
behavioral1/memory/2248-473-0x0000000001350000-0x00000000013B1000-memory.dmp	upx
behavioral1/memory/2248-839-0x0000000001350000-0x00000000013B1000-memory.dmp	upx
behavioral1/memory/2248-1202-0x0000000001350000-0x00000000013B1000-memory.dmp	upx
behavioral1/memory/2044-1269-0x00000000013E0000-0x0000000001441000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Control Panel\International\Geo\Nation	firefox.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\ucrtbase.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\mozwer.dll	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\precomplete	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nso172C.tmp	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\breakpadinjector.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\update-settings.ini	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\libGLESv2.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaultagent_localized.ini	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent.ini	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\qipcap64.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.ini	setup-stub.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini	maintenanceservice_installer.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	setup.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\xul.dll	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent_localized.ini	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\omni.ja	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png	setup.exe
File created	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe.sig	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files	setup-stub.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\install.log	setup.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\	setup.exe
File created	C:\Program Files\Mozilla Firefox\vcruntime140.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\installation_telemetry.json	setup.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\updater.ini	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\notificationserver.dll	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\installation_telemetry.json	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nso172E.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\lgpllibs.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\freebl3.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nso172C.tmp\	setup-stub.exe

Executes dropped EXE 17 IoCs

pid	Process
1176	setup-stub.exe
2248	download.exe
3048	setup.exe
2204	maintenanceservice_installer.exe
2276	maintenanceservice_tmp.exe
2876	default-browser-agent.exe
2668	firefox.exe
2104	firefox.exe
3036	firefox.exe
2960	firefox.exe
2200	firefox.exe
2112	firefox.exe
2864	firefox.exe
2088	firefox.exe
2196	firefox.exe
2096	firefox.exe
2776	firefox.exe

Loads dropped DLL 64 IoCs

pid	Process
2044	Firefox Installer.exe
1176	setup-stub.exe
1176	setup-stub.exe
1176	setup-stub.exe
1176	setup-stub.exe
1176	setup-stub.exe
1176	setup-stub.exe
1176	setup-stub.exe
1176	setup-stub.exe
1176	setup-stub.exe
2248	download.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
2128	regsvr32.exe
2128	regsvr32.exe
2128	regsvr32.exe
2128	regsvr32.exe
2128	regsvr32.exe
2128	regsvr32.exe
2128	regsvr32.exe
2848	regsvr32.exe
3048	setup.exe
3048	setup.exe
2204	maintenanceservice_installer.exe
2204	maintenanceservice_installer.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
3048	setup.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe
2876	default-browser-agent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	setup-stub.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods\ = "8"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE30F77E-8847-44F0-A648-A9656BD89C0D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\ = "Firefox HTML Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ = "C:\\Program Files\\Mozilla Firefox\\AccessibleMarshal.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1BAA303D-B4B9-45E5-9CCB-E3FCA3E274B6}\InprocHandler32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\ = "open"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1BAA303D-B4B9-45E5-9CCB-E3FCA3E274B6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "ISimpleDOMNode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE30F77E-8847-44F0-A648-A9656BD89C0D}\ = "IHandlerControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\open\ddeexec\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\FirefoxPDF-308046B0AF4A39CB\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCA8D857-1A63-4045-8F36-8809EB093D04}\ = "AsyncIHandlerControl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods\ = "9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods\ = "18"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCA8D857-1A63-4045-8F36-8809EB093D04}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCA8D857-1A63-4045-8F36-8809EB093D04}\SynchronousInterface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,5"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\ = "open"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\FirefoxPDF-308046B0AF4A39CB\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\FirefoxPDF-308046B0AF4A39CB\FriendlyTypeName = "Firefox PDF Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B32983FF-EF84-4945-8F86-FB7491B4F57B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DCA8D857-1A63-4045-8F36-8809EB093D04}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\FirefoxPDF-308046B0AF4A39CB	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\FriendlyTypeName = "Firefox HTML Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\firefox.exe\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\FirefoxPDF-308046B0AF4A39CB\shell\open\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1BAA303D-B4B9-45E5-9CCB-E3FCA3E274B6}\InprocHandler32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B32983FF-EF84-4945-8F86-FB7491B4F57B}\NumMethods\ = "8"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DCA8D857-1A63-4045-8F36-8809EB093D04}\InProcServer32\ = "C:\\Program Files\\Mozilla Firefox\\AccessibleHandler.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B32983FF-EF84-4945-8F86-FB7491B4F57B}\ProxyStubClsid32\ = "{DCA8D857-1A63-4045-8F36-8809EB093D04}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE30F77E-8847-44F0-A648-A9656BD89C0D}\AsynchronousInterface\ = "{DCA8D857-1A63-4045-8F36-8809EB093D04}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B32983FF-EF84-4945-8F86-FB7491B4F57B}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\DefaultIcon	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\DDEEXEC	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ = "ISimpleDOMText"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\FirefoxPDF-308046B0AF4A39CB\shell\ = "open"	setup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\FirefoxPDF-308046B0AF4A39CB\shell\open\DDEEXEC	setup.exe

Modifies system certificate store 2 TTPs 12 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	setup-stub.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	setup-stub.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	setup-stub.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	setup-stub.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	setup-stub.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	setup-stub.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	setup-stub.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	setup-stub.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	setup-stub.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	setup-stub.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	setup-stub.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	setup-stub.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2276	maintenanceservice_tmp.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1176	setup-stub.exe
2104	firefox.exe
2104	firefox.exe
2104	firefox.exe
2104	firefox.exe
2104	firefox.exe
2104	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2104	firefox.exe
2104	firefox.exe
2104	firefox.exe
2104	firefox.exe
2104	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1176	setup-stub.exe
1176	setup-stub.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1176	2044	Firefox Installer.exe	30
PID 2044 wrote to memory of 1176	2044	Firefox Installer.exe	30
PID 2044 wrote to memory of 1176	2044	Firefox Installer.exe	30
PID 2044 wrote to memory of 1176	2044	Firefox Installer.exe	30
PID 2044 wrote to memory of 1176	2044	Firefox Installer.exe	30
PID 2044 wrote to memory of 1176	2044	Firefox Installer.exe	30
PID 2044 wrote to memory of 1176	2044	Firefox Installer.exe	30
PID 1176 wrote to memory of 2248	1176	setup-stub.exe	44
PID 1176 wrote to memory of 2248	1176	setup-stub.exe	44
PID 1176 wrote to memory of 2248	1176	setup-stub.exe	44
PID 1176 wrote to memory of 2248	1176	setup-stub.exe	44
PID 2248 wrote to memory of 3048	2248	download.exe	45
PID 2248 wrote to memory of 3048	2248	download.exe	45
PID 2248 wrote to memory of 3048	2248	download.exe	45
PID 2248 wrote to memory of 3048	2248	download.exe	45
PID 2248 wrote to memory of 3048	2248	download.exe	45
PID 2248 wrote to memory of 3048	2248	download.exe	45
PID 2248 wrote to memory of 3048	2248	download.exe	45
PID 3048 wrote to memory of 1452	3048	setup.exe	46
PID 3048 wrote to memory of 1452	3048	setup.exe	46
PID 3048 wrote to memory of 1452	3048	setup.exe	46
PID 3048 wrote to memory of 1452	3048	setup.exe	46
PID 3048 wrote to memory of 1452	3048	setup.exe	46
PID 3048 wrote to memory of 1452	3048	setup.exe	46
PID 3048 wrote to memory of 1452	3048	setup.exe	46
PID 1452 wrote to memory of 2128	1452	regsvr32.exe	47
PID 1452 wrote to memory of 2128	1452	regsvr32.exe	47
PID 1452 wrote to memory of 2128	1452	regsvr32.exe	47
PID 1452 wrote to memory of 2128	1452	regsvr32.exe	47
PID 1452 wrote to memory of 2128	1452	regsvr32.exe	47
PID 1452 wrote to memory of 2128	1452	regsvr32.exe	47
PID 1452 wrote to memory of 2128	1452	regsvr32.exe	47
PID 3048 wrote to memory of 2840	3048	setup.exe	48
PID 3048 wrote to memory of 2840	3048	setup.exe	48
PID 3048 wrote to memory of 2840	3048	setup.exe	48
PID 3048 wrote to memory of 2840	3048	setup.exe	48
PID 3048 wrote to memory of 2840	3048	setup.exe	48
PID 3048 wrote to memory of 2840	3048	setup.exe	48
PID 3048 wrote to memory of 2840	3048	setup.exe	48
PID 2840 wrote to memory of 2848	2840	regsvr32.exe	49
PID 2840 wrote to memory of 2848	2840	regsvr32.exe	49
PID 2840 wrote to memory of 2848	2840	regsvr32.exe	49
PID 2840 wrote to memory of 2848	2840	regsvr32.exe	49
PID 2840 wrote to memory of 2848	2840	regsvr32.exe	49
PID 2840 wrote to memory of 2848	2840	regsvr32.exe	49
PID 2840 wrote to memory of 2848	2840	regsvr32.exe	49
PID 3048 wrote to memory of 2204	3048	setup.exe	50
PID 3048 wrote to memory of 2204	3048	setup.exe	50
PID 3048 wrote to memory of 2204	3048	setup.exe	50
PID 3048 wrote to memory of 2204	3048	setup.exe	50
PID 3048 wrote to memory of 2204	3048	setup.exe	50
PID 3048 wrote to memory of 2204	3048	setup.exe	50
PID 3048 wrote to memory of 2204	3048	setup.exe	50
PID 2204 wrote to memory of 2276	2204	maintenanceservice_installer.exe	51
PID 2204 wrote to memory of 2276	2204	maintenanceservice_installer.exe	51
PID 2204 wrote to memory of 2276	2204	maintenanceservice_installer.exe	51
PID 2204 wrote to memory of 2276	2204	maintenanceservice_installer.exe	51
PID 3048 wrote to memory of 2876	3048	setup.exe	52
PID 3048 wrote to memory of 2876	3048	setup.exe	52
PID 3048 wrote to memory of 2876	3048	setup.exe	52
PID 3048 wrote to memory of 2876	3048	setup.exe	52
PID 1176 wrote to memory of 2668	1176	setup-stub.exe	53
PID 1176 wrote to memory of 2668	1176	setup-stub.exe	53
PID 1176 wrote to memory of 2668	1176	setup-stub.exe	53

C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\7zSCF706C0C\setup-stub.exe
  .\setup-stub.exe
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\download.exe
    "C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\download.exe" /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\config.ini
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\setup.exe
      .\setup.exe /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\config.ini
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Windows\system32\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1452
      - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"
        6⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2128
    - - C:\Windows\system32\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleHandler.dll"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2840
      - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files\Mozilla Firefox\AccessibleHandler.dll"
        6⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2848
    - - C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
        
        "C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2204
      - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2276
    - - C:\Program Files\Mozilla Firefox\default-browser-agent.exe
        
        "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -first-startup
    3⤵
    - Executes dropped EXE
    PID:2668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -first-startup
      4⤵
      Checks whether UAC is enabled
      Checks computer location settings
      Executes dropped EXE
      Checks processor information in registry
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2104
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.0.1992357082\1869817524" -parentBuildID 20230522134052 -prefsHandle 1152 -prefMapHandle 1364 -prefsLen 22051 -prefMapSize 240155 -appDir "C:\Program Files\Mozilla Firefox\browser" - {556dce7a-0a5b-45a5-b232-dcd576d42872} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 1616 111a8360 gpu
        5⤵
        Executes dropped EXE
        
        PID:3036
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.1.1653069707\1069559805" -parentBuildID 20230522134052 -prefsHandle 1848 -prefMapHandle 1844 -prefsLen 22096 -prefMapSize 240155 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b095ae8-fa44-4348-b820-662fdfffcc98} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 1876 110c7ee0 socket
        5⤵
        Executes dropped EXE
        
        PID:2960
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.2.421430472\1564042649" -childID 1 -isForBrowser -prefsHandle 1204 -prefMapHandle 1160 -prefsLen 20054 -prefMapSize 240155 -jsInitHandle 916 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir "C:\Program Files\Mozilla Firefox\browser" - {84081981-2ae0-46cc-b351-d42743d72140} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 1164 11989560 tab
        5⤵
        Executes dropped EXE
        
        PID:2200
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.3.1487150342\699504145" -childID 2 -isForBrowser -prefsHandle 2140 -prefMapHandle 2144 -prefsLen 22230 -prefMapSize 240155 -jsInitHandle 916 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir "C:\Program Files\Mozilla Firefox\browser" - {135ec508-fe00-40ea-8ea7-3715ee9cfca7} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 2084 11989f70 tab
        5⤵
        Executes dropped EXE
        
        PID:2112
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.4.101191817\429782809" -parentBuildID 20230522134052 -prefsHandle 2452 -prefMapHandle 2456 -prefsLen 23148 -prefMapSize 240155 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be6d335b-6ba6-409b-bfff-5e2bf7e87f01} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 2440 12e59d60 rdd
        5⤵
        Executes dropped EXE
        
        PID:2864
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.5.867155149\673461963" -childID 3 -isForBrowser -prefsHandle 2892 -prefMapHandle 1560 -prefsLen 23186 -prefMapSize 240155 -jsInitHandle 916 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb584cb1-3cff-4186-b986-6eeef0992436} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 2904 16fba280 tab
        5⤵
        Executes dropped EXE
        
        PID:2088
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.6.2050397626\1480246953" -childID 4 -isForBrowser -prefsHandle 1380 -prefMapHandle 2104 -prefsLen 21081 -prefMapSize 240155 -jsInitHandle 916 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dff818d8-ca65-4ec9-94e9-1c0887293877} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 2060 11989560 tab
        5⤵
        Executes dropped EXE
        
        PID:2196
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.7.1173902295\1992448635" -childID 5 -isForBrowser -prefsHandle 2092 -prefMapHandle 2224 -prefsLen 21081 -prefMapSize 240155 -jsInitHandle 916 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa3e9f70-e8ba-4d16-8b98-f8d761230333} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 2116 16b21c90 tab
        5⤵
        Executes dropped EXE
        
        PID:2096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.8.378619520\121039090" -childID 6 -isForBrowser -prefsHandle 2880 -prefMapHandle 2592 -prefsLen 21081 -prefMapSize 240155 -jsInitHandle 916 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir "C:\Program Files\Mozilla Firefox\browser" - {511329f0-32b3-4f24-8d9f-9ae1f5fe55c9} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 2628 16b21e00 tab
        5⤵
        Executes dropped EXE
        
        PID:2776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6619758,0x7fef6619768,0x7fef6619778
1⤵
PID:1000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1220 --field-trial-handle=1244,i,7469994045836464117,817929500683131165,131072 /prefetch:2
1⤵
PID:1732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1244,i,7469994045836464117,817929500683131165,131072 /prefetch:8
1⤵
PID:1384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1488 --field-trial-handle=1244,i,7469994045836464117,817929500683131165,131072 /prefetch:8
1⤵
PID:1484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2180 --field-trial-handle=1244,i,7469994045836464117,817929500683131165,131072 /prefetch:1
1⤵
PID:1972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2292 --field-trial-handle=1244,i,7469994045836464117,817929500683131165,131072 /prefetch:1
1⤵
PID:1908

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1312 --field-trial-handle=1244,i,7469994045836464117,817929500683131165,131072 /prefetch:2
1⤵
PID:2260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --mojo-platform-channel-handle=1564 --field-trial-handle=1244,i,7469994045836464117,817929500683131165,131072 /prefetch:1
1⤵
PID:2384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3792 --field-trial-handle=1244,i,7469994045836464117,817929500683131165,131072 /prefetch:8
1⤵
PID:2460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3952 --field-trial-handle=1244,i,7469994045836464117,817929500683131165,131072 /prefetch:8
1⤵
PID:2472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 --field-trial-handle=1244,i,7469994045836464117,817929500683131165,131072 /prefetch:8
1⤵
PID:2184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\Accessible.tlb

Filesize
2KB

MD5
e49aeb412aab7c49a27e6feaa0ca40ce

SHA1
6a2f6ea9facc48a3f736e03fda2c1ce44b744af3

SHA256
754fd922f8c93b66f723c30d39083a6a1fe33fa4b6439d55ad2459be40c3151e

SHA512
8c3f957d032fa8edb523cd3f473a57e2cc020c9e6e33aea183cad8b435777660f4c7e87ba62c67bbb1aef726d109f0f34b2d86c159ca9bd98bfad43c89af7ad2

Download Submit
C:\Program Files\Mozilla Firefox\IA2Marshal.dll

Filesize
73KB

MD5
428f0e6ac025aa4974c87c672702d219

SHA1
4dccfd956060e7c9532c6b27fd1ee2b21fd60661

SHA256
9f53b28b79509c50001d51008d5f82c8c84ae2f61b17a51882555ae5c8889011

SHA512
0f4ef3cbb1b07bd4fbf740fd5a9342cf2ce3c6fc8042e6afd9528d8048c59078a583d013ea9a6e9b8edb83f829502f12a2ff2e33be607e9fb51cc0e901454385

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll

Filesize
17KB

MD5
79ee4a2fcbe24e9a65106de834ccda4a

SHA1
fd1ba674371af7116ea06ad42886185f98ba137b

SHA256
9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613

SHA512
6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll

Filesize
17KB

MD5
3f224766fe9b090333fdb43d5a22f9ea

SHA1
548d1bb707ae7a3dfccc0c2d99908561a305f57b

SHA256
ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357

SHA512
c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
23bd405a6cfd1e38c74c5150eec28d0a

SHA1
1d3be98e7dfe565e297e837a7085731ecd368c7b

SHA256
a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41

SHA512
c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
95c5b49af7f2c7d3cd0bc14b1e9efacb

SHA1
c400205c81140e60dffa8811c1906ce87c58971e

SHA256
ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1

SHA512
f320937b90068877c46d30a15440dc9ace652c3319f5d75e0c8bb83f37e78be0efb7767b2bd713be6d38943c8db3d3d4c3da44849271605324e599e1242309c3

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
6e704280d632c2f8f2cadefcae25ad85

SHA1
699c5a1c553d64d7ff3cf4fe57da72bb151caede

SHA256
758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893

SHA512
ade85a6cd05128536996705fd60c73f04bab808dafb5d8a93c45b2ee6237b6b4ddb087f1a009a9d289c868c98e61be49259157f5161feccf9f572fd306b460e6

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
c9a55de62e53d747c5a7fddedef874f9

SHA1
c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad

SHA256
b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b

SHA512
adca0360a1297e80a8d3c2e07f5fbc06d2848f572f551342ad4c9884e4ab4bd1d3b3d9919b4f2b929e2848c1a88a4e844dd38c86067cace9685f9640db100efb

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll

Filesize
18KB

MD5
a668c5ee307457729203ae00edebb6b3

SHA1
2114d84cf3ec576785ebbe6b2184b0d634b86d71

SHA256
a95b1af74623d6d5d892760166b9bfac8926929571301921f1e62458e6d1a503

SHA512
73dc1a1c2ceb98ca6d9ddc7611fc44753184be00cfba07c4947d675f0b154a09e6013e1ef54ac7576e661fc51b4bc54fdd96a0c046ab4ee58282e711b1854730

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
39325e5f023eb564c87d30f7e06dff23

SHA1
03dd79a7fbe3de1a29359b94ba2d554776bdd3fe

SHA256
56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a

SHA512
087b9dcb744ad7d330bacb9bda9c1a1df28ebb9327de0c5dc618e79929fd33d1b1ff0e1ef4c08f8b3ea8118b968a89f44fe651c66cba4ecbb3216cd4bcce3085

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
19KB

MD5
228c6bbe1bce84315e4927392a3baee5

SHA1
ba274aa567ad1ec663a2f9284af2e3cb232698fb

SHA256
ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065

SHA512
37a60cce69e81f68ef62c58bba8f2843e99e8ba1b87df9a5b561d358309e672ae5e3434a10a3dde01ae624d1638da226d42c64316f72f3d63b08015b43c56cab

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
034379bcea45eb99db8cdfeacbc5e281

SHA1
bbf93d82e7e306e827efeb9612e8eab2b760e2b7

SHA256
8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65

SHA512
7ea6efb75b0c59d3120d5b13da139042726a06d105c924095ed252f39ac19e11e8a5c6bb1c45fa7519c0163716745d03fb9daaaca50139a115235ab2815cc256

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
8da414c3524a869e5679c0678d1640c1

SHA1
60cf28792c68e9894878c31b323e68feb4676865

SHA256
39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672

SHA512
6ef3f81206e7d4dca5b3c1fafc9aa2328b717e61ee0acce30dfb15ad0fe3cb59b2bd61f92bf6046c0aae01445896dcb1485ad8be86629d22c3301a1b5f4f2cfa

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
25KB

MD5
19d7f2d6424c98c45702489a375d9e17

SHA1
310bc4ed49492383e7c669ac9145bda2956c7564

SHA256
a6b83b764555d517216e0e34c4945f7a7501c1b7a25308d8f85551fe353f9c15

SHA512
01c09edef90c60c9e6cdabff918f15afc9b728d6671947898ce8848e3d102f300f3fb4246af0ac9c6f57b3b85b24832d7b40452358636125b61eb89567d3b17e

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll

Filesize
71KB

MD5
3d139f57ed79d2c788e422ca26950446

SHA1
788e4fb5d1f46b0f1802761d0ae3addb8611c238

SHA256
dc25a882ac454a0071e4815b0e939dc161ba73b5c207b84afd96203c343b99c7

SHA512
12ed9216f44aa5f245c707fe39aed08dc18ea675f5a707098f1a1da42b348a649846bc919fd318de7954ea9097c01f22be76a5d85d664ef030381e7759840765

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll

Filesize
18KB

MD5
9d3d6f938c8672a12aea03f85d5330de

SHA1
6a7d6e84527eaf54d6f78dd1a5f20503e766a66c

SHA256
707c9a384440d0b2d067fc0335273f8851b02c3114842e17df9c54127910d7fb

SHA512
0e1681b16cd9af116bcc5c6b4284c1203b33febb197d1d4ab8a649962c0e807af9258bde91c86727910624196948e976741411843dd841616337ea93a27de7cb

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
9b79fda359a269c63dcac69b2c81caa4

SHA1
a38c81b7a2ec158dfcfeb72cb7c04b3eb3ccc0fb

SHA256
4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138

SHA512
e69d275c5ec5eae5c95b0596f0cc681b7d287b3e2f9c78a9b5e658949e6244f754f96ad7d40214d22ed28d64e4e8bd507363cdf99999fea93cfe319078c1f541

Download Submit
C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
70e9104e743069b573ca12a3cd87ec33

SHA1
4290755b6a49212b2e969200e7a088d1713b84a2

SHA256
7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95

SHA512
e979f28451d271f405b780fc2025707c8a29dcb4c28980ca42e33d4033666de0e4a4644defec6c1d5d4bdd3c73d405fafcffe3320c60134681f62805c965bfd9

Download Submit
C:\Program Files\Mozilla Firefox\application.ini

Filesize
899B

MD5
17963c10064f603fc6c5a0be669e33a2

SHA1
221f3d4a18e2df543593a0d924bfa179e33c6f07

SHA256
f190d5075b674ed3fd80c95531ca26b019c0d2e51bc4870405b2db2a582ff255

SHA512
5965ebf7fb02228122724cf9b2726e50edadf558a46a28606e7df25c93a4dc143635e06c2eb8589357f55531b9fd23df5d2cce670e247ef29f4570a82e423e2b

Download Submit
C:\Program Files\Mozilla Firefox\breakpadinjector.dll

Filesize
129KB

MD5
40a5d99b8bb9a80d4fb21bbf08ca53c7

SHA1
dc5f4197083371b7a047fdbfb98f72a66e94b272

SHA256
8ff62160235eb40bba03a6a94835044e397246c2544f2491a0eef1ae1a127c15

SHA512
8ca574922fddfff54fd000fa3cfd7f13791cb62dcb7d1d096b184faed1a5b5519846445d38a5d5a6d5bbdca41a1930677e84cb216719e5a64767bc876a468c43

Download Submit
C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png

Filesize
15KB

MD5
e9068cd977693bdab242de4280dda725

SHA1
35a5c8aee11597ec7cc6adaf15e8673b713d73a9

SHA256
1701ff395543f3ad6b25584fa7014073f74949baca0dd2552216f58131328fef

SHA512
29ebff0f99c9a8f47b8f145ee8d88877b17ae0e3eeed1bc017caa20c68a63166831f5feda768189e837d2390cc80790e3e69aa7ec26bf92da2e90b66e1be3362

Download Submit
C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png

Filesize
5KB

MD5
c9ae03c43b67a4e4986518fe3fe29756

SHA1
07221e0401f306487504ae9b3c46ef1cb5dec843

SHA256
adf41380b5ed3f73b8e5fb51f7f33b722f4db4600791cdf92033267c9971c4d5

SHA512
0ace7c3cdc18eb1e67971a5acd0a54e1c00d37ac556f8183dccede984cb6520660c9b27064a8ef5f7b706fdabd70e5e424b7b7271ff751bffd997cf2284f9fe7

Download Submit
C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png

Filesize
22KB

MD5
8e058139e0576b4ad8d424bb21071063

SHA1
f584d2412c935aa8a7cf73ecdfaaa6a3cf87c064

SHA256
e86ee493e89f5dfce2ce8817ac5d1c04d8ba2b07a06ff0f967c0167562510df7

SHA512
9ce457aa516fb2d3cb7b4a08f2dd81573de301fefc6ddc877142a35851151407367605f00862fb77067d0969ba745bc6bc612a4440aa3017e508e572ec88f2fc

Download Submit
C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png

Filesize
8KB

MD5
1a340e565e697e63b5a4ce51f7297119

SHA1
cdb4ca85700ed81db13b15d4bd5b77d41bb20d34

SHA256
c4bb210e61cd35f9a0a54fb941ea2e3bf6abde799bea1c78d24c761c9a3bc429

SHA512
92478fe26f9ea7454206a3106632534c5608d6940588f01fecfd799de636f11b003ffd1e5c762201f9a14f4ebb7fa6a711d99312b03914de817246a6008c7b35

Download Submit
C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini

Filesize
787B

MD5
2b7ce0c4a11c40593aa9e0873f3eecbd

SHA1
4b7a7317d6bf368c492dae08e8a029a8d0f0bb3b

SHA256
672d74e71ed426543fecc7b08a094ce9fa3cc768132923e31127386dccd1ce91

SHA512
d906fdc30b3d418b7ec8f3899f70b586658f73be4527f99b3b491bcf2d75c9d41ba05d5e983da3122bd01f6b59d5a75febd1b19088c3c744476680b467c0d2a5

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\[email protected]

Filesize
136KB

MD5
f160409b836b1bb8b5e742e9ddcf3405

SHA1
56e62af3bc00950ac320d670de5b67513e87781b

SHA256
5766668c5c00fc4d444df3bca1f09c057a50a3141ea1bdf9a5a378bf9a3b7bd9

SHA512
9b5e9f0ed8ae465d122af10a1ef7e5911a3afe4a59952f88b765a782670ade13fd2d68a2fb31941deccddc38182b1990aeca62a0d8d8188e1b67326308f59cc7

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\[email protected]

Filesize
52KB

MD5
c306d6da688549a6b6ed3d035b35e18f

SHA1
121a85812e14e92efd527a3f04c4ebfedcf8436d

SHA256
17cd9dab150ea56c281888eccb1db43bb7d2507c813dea41565d945c86b8c350

SHA512
a9c88e57e886f7e2db22848a03534ab196a9d5fa32bf7f0d4a30288b6107c5d34721d54e0b06ad1dbd2407d20cc0d766ec31dbace8820e9fe2a3da376ee9a05c

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\[email protected]

Filesize
168KB

MD5
f76532fc4e82d9cec7c80a994d1b02b3

SHA1
2b18b22beaaba1e270d4bdf5a5d7583c7973f545

SHA256
c4fb4d3f67b64f56ef0c27dd22ca6e02568dd936a84eb5c989bb91c437fa143c

SHA512
f55d03bbc8b0c8991cb560ff8b93c75ceb535c17200282c17c0e5d013bb364f852a0e85d991429bc6042a7c27c941607163de96c0f80cff92858d2e41af90cce

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\[email protected]

Filesize
26KB

MD5
132b759d0cd66ec96a9baef977f93466

SHA1
6d2b770e408ede86bed4f776fdb1f0af28ed0bf1

SHA256
2c139bd9412fc0702f789f9f531fb233b26a34f383bc107b071200ca979e7b49

SHA512
da6dcf659ea6dd8673b2a1e8462c4ab50460e8a0a9e929478d6963488d62790df07747a3a841265bf3f27dd7988bcadf412d3932c6beb499f9faad4f5f45f2c8

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\[email protected]

Filesize
382KB

MD5
fbfdea1b06477930a1eb01c22d6488b1

SHA1
a46b334bb2db5a55c5e883f8835babf4f1b0278c

SHA256
947fee4d2b45406425c5c153e90c5cfc0dcdbdeaecbf0653b0935cc9f9bb4e5c

SHA512
0b9b1cb0992abe83790163817ac3e5d4541314a74dae9b5d0ac54182d929356f6dc781ec420cf04a5b7c3dfeed356525e9bb195024a5bd8b1645ef93d47c8207

Download Submit
C:\Program Files\Mozilla Firefox\browser\omni.ja

Filesize
41.3MB

MD5
6e0d08351723ab17f3ee9e3c2a49d7e5

SHA1
8dcb9644612f9d39323c8a02aa91c0b82e1c0595

SHA256
1cf47a435de5af26008f91d75d4eeb5e9c61c4a79ca0d79da402d3469629cef9

SHA512
78180cb1fdfc3da45b2ccccbbf46e834d3b9e16c844904bf2c596610bf2ec8c037bf40eb6c17613c894e4d86d067a5c9b30fda5692b9f09151ee1d3b08904821

Download Submit
C:\Program Files\Mozilla Firefox\crashreporter.exe

Filesize
235KB

MD5
96343f1b62b10bda5c9a0aeda94e0f88

SHA1
723559a84fb27f91281d70237941640a7aaeeb16

SHA256
9b4311e5b9d0b3eb280da350f80bb170995fafff3420d4253f0c379751134d2e

SHA512
3fe5fea09c9dc54b8b808d4ee9b870d1fe39e1d177265822806d5736e86c83b9b5d938ae9c1992136c272abc33c8b000ab51ed75551096942ec792ed29e4d256

Download Submit
C:\Program Files\Mozilla Firefox\crashreporter.ini

Filesize
3KB

MD5
770268e987385bcd539808ba357dbe4a

SHA1
a1dbe8b6e2f58edf3024ae787884c8a647810a7e

SHA256
0a4039b4caf9c3f4732974d28d3817a40c901cd70cb4a7cead876f3d8f3a3594

SHA512
3c8ef7dc462dd74c2fced17b1a62f3cd3139d4f81deeabd29ce0dfa1ecbef31029113c7a7ea31c55d2625465d2604ce409e6bdae2d3bdaa689cc822f6cff73f2

Download Submit
C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll

Filesize
3.5MB

MD5
587a415cd5ac2069813adef5f7685021

SHA1
ca0e2fe1922b3cdc9e96e636a73e5c85a838e863

SHA256
2ad0d4987fc4624566b190e747c9d95038443956ed816abfd1e2d389b5ec0851

SHA512
0fa0e89ea1c1cb27ac7f621feb484438e378a8f5675eca7a91f24e0569174bd848d470d6b3e237fe6ab27ca1eb1ecc09b5f044e53a6d98bf908e77ac511183e2

Download Submit
C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Filesize
663KB

MD5
40c030226bc123d64167d684b572df2b

SHA1
180c8d57ec770638638acc3634191035f9b22e1a

SHA256
37c53da2051d900fbd9fa5af7df36e44ba5e0b98c1804b7d990d26b522c5836a

SHA512
55c7f848e3e3eee638cbfc28ddc2e0203f7ac8d212a36e24c730866c3a5ccdeb27733a7a40344e66a7e280e5f02806784b84fdfe5a1bc892290572192859eb19

Download Submit
C:\Program Files\Mozilla Firefox\defaultagent.ini

Filesize
932B

MD5
88d7d32ad20bf89bb7785bd07c638e17

SHA1
2bd40f0b69c2edc64ab6b7e6dd2e7ca6a6fea6f6

SHA256
5cf0660a8f2624433c8c1022f93ff3c94c5611ccbc93118ee053566590eb53f4

SHA512
7bb3328ce42e7bb546a2192ade1e8e153408912f3582c27dc0c5cbe1c2d807365aaf4206c3ceab6cb3d6c34d3155125cb7509dbf800ecf70ab35f8a64f764010

Download Submit
C:\Program Files\Mozilla Firefox\defaultagent_localized.ini

Filesize
1KB

MD5
e85004618b8048bf47cf67d22e6efdd6

SHA1
dd9df0aa2872b618be06a7c625a348318bb6448b

SHA256
1bb2201b759bae462fc84a8586b852834dca81df7bcfe304e67f8d073bb0a366

SHA512
e7e9b9ba2e903d7581265ff42eaf0b18b092924c4dc60f1a0145d74dc639c3c78b9aa80a202b76f33b87cfcbcaaa78cd4fbb07eb1e54093ce80eb033faa7c0df

Download Submit
C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js

Filesize
429B

MD5
3d84d108d421f30fb3c5ef2536d2a3eb

SHA1
0f3b02737462227a9b9e471f075357c9112f0a68

SHA256
7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b

SHA512
76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5

Download Submit
C:\Program Files\Mozilla Firefox\dependentlibs.list

Filesize
446B

MD5
c35d2da6df0f7abb4d0bd534c5d5b6b0

SHA1
a4da4ca15d97746796412c2bad3fc8fbea716869

SHA256
ce638d544efe50176888e17bfbf78f118dc733ce5c2fee2eb66436ba96341345

SHA512
d27f58fb344b2303db2f4a48a153c9f11eec1663020ba8b5b973fd001c4a8c27c11e29a54b6d1913888b4ddf376aa7f45c8218378abe39a64ebdae4feb6b25cc

Download Submit
C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml

Filesize
557B

MD5
0aa43576f0420593451b10ab3b7582ec

SHA1
b5f535932053591c7678faa1cd7cc3a7de680d0d

SHA256
3b25ae142729ed15f3a10ebce2621bfa07fda5e4d76850763987a064122f7ae6

SHA512
6efb63c66f60e039cf99bfaf2e107c3c5ed4b6f319f3d5e4ef9316c1f26298b90d33c60b48b03699059d28b835fbc589417ac955fc45a2bc4c116a5200dfdc32

Download Submit
C:\Program Files\Mozilla Firefox\firefox.exe

Filesize
589KB

MD5
b45a56bb4612ef277889779d44a41e8d

SHA1
24822ba11561483b6d06a778dec4c46bfbbfd94d

SHA256
b06e7a3debdeca7d3f3319e8fadd2bf78b73ad7801c4646b89ac2d0b1791055e

SHA512
5225cb3e6ee87f826774a8a18d2bc6828219b9ef9b32b2173f2fbd0bcc9d3cefc2ee6a11543eccf684b7d5af87020c1679799641d4f2e426158cd39de6e49137

Download Submit
C:\Program Files\Mozilla Firefox\firefox.exe.sig

Filesize
1KB

MD5
ec203d20fd3170db6ecd05c477e33452

SHA1
724cd23d7e099bc989e198038ad5eaa8a69d5f35

SHA256
89cd192312e2fe05fbaf2cafb0365018bf72494e445687fd3dcee4b90736410a

SHA512
dffe12eb41065f72d5755b3c1630d3853d9f9098d1f63f6ad120bee13198bde7c024315e85cfca79407d20efe29fde555c8042836ef24631c18fd7272bdfcc90

Download Submit
C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf

Filesize
1.4MB

MD5
aac75d901445bc0419d56e56dbc18891

SHA1
3ada434f3a727167ce6dce3b865fa6bfb70ed86f

SHA256
6d90152ee0d29e82fe2a87793af5aa4b7ad13e6538360889e141e81ed299ee8e

SHA512
83fd92ff444ab6de18d48997247f49845abb8420a07b74ebc8a65bda8da69d28f87b6abe0f607b2fd7da398dc0f8cbe7fbf655af6d25785ad8b2f1a3afca136a

Download Submit
C:\Program Files\Mozilla Firefox\freebl3.dll

Filesize
625KB

MD5
94d971f3b6e87b5596bf6b0bafc51177

SHA1
17c6efae15e91bd75daf99cd341c72291bcca7c5

SHA256
b08ec9f0391d8a0c9419a418c7d43894ea71569dc44299b85c774ab984681351

SHA512
9f8224b36881c18190d58c1e943978a6dad06ad2c5c54d2de3c27bcb6c0a9509abc4dd7f8125b63d443b77176dd6822676d1dd971769051a9483e08b970f76ed

Download Submit
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll

Filesize
94KB

MD5
5b4f43f63e0c16e8aa47839ed0cffeda

SHA1
7d3a57e6f03b53032601199c184f83cc1404120d

SHA256
65710d3d2ebe67b402578f31137d67853bc130b504e947113f3a121010664b78

SHA512
a39a3f0477c2d2f4442a00056a5e711d8a4f758415432b3dba8b1b4b36e34e766d211c7b598a2e58947a8f01f790204a74412a4ad202ed97d328e782a4f8edaa

Download Submit
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig

Filesize
1KB

MD5
4584cb2deae298f99a9449ff471a981b

SHA1
fb16bc931199ac460d3f2a76b5ecc001cc95cc56

SHA256
1bbb235b1ae6a7c67827dd56427a8f354ff82aa8dd1e963d0d5d9d20d2d4d9f5

SHA512
fef736c160188799fe7d6e6e07f9a537ef2a9019a05b97840bb1bb2ca408df5119e125ae1fbccca96ef26a80e7a311ba6f5f5aa53bafcca8dc2d3b17f130ede0

Download Submit
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json

Filesize
229B

MD5
cffdadfaeeaaf0a5a78e7f9a299aa7f1

SHA1
7a8f06d7c91877484301ce8474dfbb1bde08a040

SHA256
ef47e83036753b53f59d079fef62bfedc749abdbcdb0fe16f448d9920f11114c

SHA512
5a11e448389326ddbd3be792d9a10ae746c66e4a41f9c96f4979ec71fde385fc4deb205a40f1b4f24415abd9d41c453ca1285f4b813005b1d12a2701f214db85

Download Submit
C:\Program Files\Mozilla Firefox\install.log

Filesize
13KB

MD5
e4af4adfb5b95ac48354fb9eeb04aedc

SHA1
bc26d992d607176d0ed12c6fe3da9ec5aa8f315e

SHA256
734438f871775df6ed05a10761e1a3877cbd99e0c75db7c642f8e5c0877fd16c

SHA512
1fe49fc700e3bf138fe31dbd48a71118e8ef21084c46c83461bc0a9202f6786168e1b393fee585ef81ecdc2add44a7193c7585c2b535a9dbe33cd56a12b87060

Download Submit
C:\Program Files\Mozilla Firefox\ipcclientcerts.dll

Filesize
191KB

MD5
897910163544b68e6234623e2402e686

SHA1
a59d8746daf22a009218e950fc5f1c61b4133704

SHA256
d9064f7d78c9a63720c77819a980ef40f404531c3166d1156d2521bbd826c840

SHA512
b85a524659b8bb51e3bc69250ea4ab288d4f416505fd1257d4b9c1bb20389d01a320fde28cf1e568e666567ec078132d07e78b203714b0907abe3d7a7b9e2b92

Download Submit
C:\Program Files\Mozilla Firefox\lgpllibs.dll

Filesize
35KB

MD5
c9ceddb88166b7f56cd7c8e43ab2f5ba

SHA1
ed0ce41319ab8d3517230a202d7c0e3697e0d519

SHA256
13ebef50cdcc127658cdf68dd0f5cf470e2dd7837041ce6e8a9ac359579a5eb7

SHA512
a1648948df8966b040d19e3fcae3b725309c3f968e5104e3ddb17120bdb77a930d5f49353485bb027654173dd7d418ea81e0d79c1b0a811d0a7845c274dd7cf5

Download Submit
C:\Program Files\Mozilla Firefox\libEGL.dll

Filesize
40KB

MD5
e182dfc59093c2f0300d996c52696a37

SHA1
952e656e6a2731525670408482b07685c020bb30

SHA256
bd4d835dad459a2d203d3fdfbe1d484919883a72e0fb6a972962a1d7678400b0

SHA512
03f5a42eae449a9e3862ba2ca93e44e4d99b7b75879d92efd85a51d10f8df800fea0f329786334d9b888fb3644fa3a092adc057700fb59d7297988c73d4f4e78

Download Submit
C:\Program Files\Mozilla Firefox\libGLESv2.dll

Filesize
3.7MB

MD5
e908d46b8a1829ec12df9a3902d6386d

SHA1
c390232479efdf0663bbe21d48e43f51dc9f9236

SHA256
a08488b3d0577b7376bbba90001a6c415a517737147bb3aa561a1365e1446aea

SHA512
28bdc077b94bf578c0d7a2ef2c5d662d37f344ab36b32ea5f83a192411a00b506cb4f8afdabc9499d969c088cd2a8e76913624b8409a0f761e0c5d4711f83786

Download Submit
C:\Program Files\Mozilla Firefox\locale.ini

Filesize
22B

MD5
378b5198068ac8c0f51c2e50bf27bd3f

SHA1
cda0247247cfb9ec805cae8977350cac7983a565

SHA256
04edcb43f4a59307fe4e49828af0305ff6d16095524381bb080c870914e31546

SHA512
63ef44917394ec24f8b91ce20f8a8df4d66c116c6554a08968beaff2f555ea73179026c51d9f9199ac5fb98d1eda773546e61bbe825fbe8d7d29e7341b80ce8f

Download Submit
C:\Program Files\Mozilla Firefox\maintenanceservice.exe

Filesize
218KB

MD5
7329f49c0d86b198dba3c515a0fcba65

SHA1
cc86ef81bbcab0abbcb18ff76d6f28068af10cc6

SHA256
82b20e0b6d8b978855afaddbb7ee299100da3d6cb337d7dacfd8f35d9d00985a

SHA512
57250e894170d9b4ba01f90f6b422a5963394922e881926d3f2d7d23a2d93c3f4363f624678514535343557e79c38c12680f3e1ad451e88b98345315a717d35c

Download Submit
C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe

Filesize
183KB

MD5
148903e1ef74707807e895033fd86455

SHA1
efa17eb4c918701a6b68835ed02554e719070b2d

SHA256
f4d59982da5c7ab69478b50f1372377de5affab6956d90629e7a612cd44128ef

SHA512
9e559c8b25d4f95a71caafb29de001c6ec5a57a626ceb1dcb2e8423a619f47aa9ae9e39067bb58f537aa9968bfeb9cfa540cb82afe50cc7dda4e66eed9d76f05

Download Submit
C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

Filesize
744KB

MD5
797a5f111c839f6a05452c1c770029ea

SHA1
c033baef57c1d1b2144ad1b22746f5e4adcf1270

SHA256
22157dce6de7ce1c5e311ac590655f3868de377be537c5329d5481ee6eb421d7

SHA512
d7678b15ee247b1e7b892f7178016d50b3c407a7ff45f737c72ee43da806c4008765c0246072747870d48c045d6f303dfea468c2d97739c7dcc91d2ba3101e03

Download Submit
C:\Program Files\Mozilla Firefox\mozavcodec.dll

Filesize
2.2MB

MD5
dfa48e09036fb6b3fdaebb40eb3f5005

SHA1
9421cfac6f6dc1358188982fee3b5cdd9c50f2e3

SHA256
9bd81a5abecb5416100e260981451e3788cd38b6831ef7a91c3bb0990f02b5b4

SHA512
bba52939506cd4b2489d0e07e1ce11872628b82aee7c59b69b3a7785562da2ecbb9bf81ee36103c8e39879a5b964e29103904429fb983d795d0516192d9bdff6

Download Submit
C:\Program Files\Mozilla Firefox\mozavutil.dll

Filesize
189KB

MD5
86ee0a2ce0b1aaf22e9821d3e3f9ffd2

SHA1
c75f13ed70361182e4d87286ffcae4dc5fdbd322

SHA256
67460aff37a5642131309c835170935679a77957a58eb93ae546af31a145d611

SHA512
f20e218e62a81323236d0ae0236e32a38fb295a26d374fbc9fb63d63aaa75c5d834709939465ec51d099e7a3a59e354516b5098009848f3008d1e0f68f0dd962

Download Submit
C:\Program Files\Mozilla Firefox\mozglue.dll

Filesize
632KB

MD5
c50a1d932cfa8c0bf84f514d30122416

SHA1
0d4cabb85d5e361ec2e3758aa80ff4f37e9f7701

SHA256
b5e1cff416339e1c555a817c2090a7b127257d71e0158fea5374dba56da987a4

SHA512
c5f30680fa0c6be66cdfeb3eb930785399b042567fc380812c5e099456a0f2b33f6612043f94cab95cb661172cdc248ec6014fc3e433f30c54af4bc5d0ffacdc

Download Submit
C:\Program Files\Mozilla Firefox\mozwer.dll

Filesize
266KB

MD5
380191efd35f06c32a5493c7aca632d3

SHA1
3bcc7a70df554ab633f12717c4db21e49f2a4676

SHA256
eb4008994a6387e699bee1948bd9f5e092e078a49f959e521d26e54b4e8b4fb5

SHA512
5fa02708fc864d0f658f5efb85706911a20b022b071cc3cdf8bb14483a1186ca47d9704fd4b0c78e351431485d5b8fefa9c14751f379e59f39a55a38fbb43240

Download Submit
C:\Program Files\Mozilla Firefox\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Program Files\Mozilla Firefox\notificationserver.dll

Filesize
53KB

MD5
63b3f226ccca0ccada3fc5114d53355a

SHA1
f6960eadb11544ee9a3085889317f5d65b05c48b

SHA256
b14ee1846e2b14f53cb252750b67467041cd1dbccbc590941fbd4db0c9b52f74

SHA512
ddee7d4e864f37e753d6a7e1accb80df597977dd93488dcee433fd698a77199fb5f2dab678aa32ca5e534f12a416f97889cf59de2f8c67238083e092a129f7e3

Download Submit
C:\Program Files\Mozilla Firefox\nss3.dll

Filesize
2.0MB

MD5
34592a2e2c501752ee5e48dbbce946ce

SHA1
df51253f307a42dde23a300d16b8a82d19d0ae7f

SHA256
b0655e1999f7e0d2ed2535ffc710e4940624d472f848e114f4370e27c7e75485

SHA512
f46f9a327f19b43661e8675a6ab41810b12ae30819a0135e957cbe8b3349052f3afeed0f5715fe993393debc85dc9bc00eef2a48b6cbd510c07b824da7ae68d4

Download Submit
C:\Program Files\Mozilla Firefox\nssckbi.dll

Filesize
346KB

MD5
423fda1025c77fa2014280cda3de5ea7

SHA1
f2dde7d6307d6af92c37c05d3717b4c728fc3554

SHA256
ca42fa616d38a6bc5aeb7de1813a16cc639d5d15298bee3ae760a913f403aaa2

SHA512
4036419f1494b6c703882accc3852619c154cc47bc507fa81b8d41d929a91ffb2cb753843cd97364a44719f56b456f2299b8d32a22a15b88d089b9c2cea1e964

Download Submit
C:\Program Files\Mozilla Firefox\omni.ja

Filesize
31.1MB

MD5
7cf2f043ffd609a8a9adbfbabbdc034a

SHA1
7b60b610bf251df3ff374acdb203818cdb251588

SHA256
cd9b7bdb28ca2fa9fa3b07ac8d723df391e04005564b4989265bb1234b31fa94

SHA512
5c635da62b97dadf957be5b34c66aed7eac4985f9d8dd6db47ab1dfe3ef0039ed1f1854f66a81a26aea97de68317333de4619d6cfc7c9733237e4d567c2a4b6c

Download Submit
C:\Program Files\Mozilla Firefox\osclientcerts.dll

Filesize
329KB

MD5
8fcb235a8e9713834016d7ded819ba00

SHA1
6831773c58f109a0a0f7c83074100e228a4aadf5

SHA256
16523e6b2f1da3efef09372f4982d7378233158747b2837b755cfbc150aa9e98

SHA512
891a4bb33101e590554077f0d3ad3d432e7e13bcb7060ba24f012cb1469384f8cc5dae2ed9406df3db4900d9fc9f8907366307d4380e78858843ce20382cd4b0

Download Submit
C:\Program Files\Mozilla Firefox\pingsender.exe

Filesize
67KB

MD5
c1bba7d5e05cb084b582379fd3d1c140

SHA1
dea0542c7e4d06aa1c065e48a385ba4c16ff3879

SHA256
f4b18d1352ff088d0150ae7dbb9d4f7baa74914ccd0ab216e7871f0d025da48a

SHA512
7203f72c80bab514d839caf1e04962ea59ca0dec7b73bc46b70b108a0ade818f21e9a08f49268093b18a778762ae58efdeb4b631cb5cb7ee6d36b66241de9b8e

Download Submit
C:\Program Files\Mozilla Firefox\platform.ini

Filesize
167B

MD5
d6f29ea2b8b6cfcaa1466e264bb54636

SHA1
bd6341a87b9a02866b02b7194a57fe5a6f8b23cd

SHA256
95d583932ae9aed364580440dccd929921deb1ae5de9f9f6544bf56e2b0bd742

SHA512
c23bd01f6dff231bd7c069c638bc1aefd908d3e9e6a78eb2c78dbf5921e227222390669ec2093860842b6c661b76abcb3811fa987ffc4fde9e47b47cfbd72aed

Download Submit
C:\Program Files\Mozilla Firefox\plugin-container.exe

Filesize
238KB

MD5
6ce66ab71c09eb3653cf4f253c828858

SHA1
695a9d4a7eb29b8a11deb09db8fcb9d056dd40e4

SHA256
f77c581eec0ded997ef48692e95cf6e4fc07bd0e4626bfac2306ed03c63a0c37

SHA512
bc2bb11e494832052ad244a5c4758558e3be1024c69bc9a8ee4824a95f6ec75be51e37b78e8ad860632dd72b2086a287bf957aeb4eb59ad39b5f5a08c45c593e

Download Submit
C:\Program Files\Mozilla Firefox\plugin-container.exe.sig

Filesize
1KB

MD5
71129b29b4638777676aa45bde6db5ff

SHA1
a4ec7d1d58e88a3d4f1db7fc5239f5ff95fd3240

SHA256
3f03458a0cc3ba27b4074cf76a4206a9c16ab3b10e332917f822dad067874e12

SHA512
1fcb99c9b68a1871e5f18ca831f442b731bade6b1dfa20cee75bcb45412234b032a79f167cb2786d781ce93e0e21fe892d92dea46797f6737e3c4728049606c1

Download Submit
C:\Program Files\Mozilla Firefox\precomplete

Filesize
3KB

MD5
60aef832f1d822bd14c14a85ca9878d4

SHA1
7fa1d1abf4471b3a2a90f02d7d84331b9dc2764b

SHA256
f6d87668d86aec5a28b95bfebc60340865c7a631da2a4b87f1a56c803523172c

SHA512
34622660fe57b2af9b2b7cdd6b0bbfe9dab569bdd81d88967ce7bc62551b165d12b4100d3afc42a77dc80fdeba452d289912692eca363668335b8981704a2ac5

Download Submit
C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml

Filesize
559B

MD5
b499ede5c9228c742578086591193efe

SHA1
18e682ec73ed8fcea99893142fa8b08ee8a32b72

SHA256
9ea86a18d41112e25b17454044ac29b458f508d9814700a6f4c0f9370678f3ae

SHA512
b99ef0e9152da3bf6adac5fef67b44738ae7a2d1ef0041786a5700b8389acde7380f1bc9bf1402c7a356f1777aca7c2b05af5ee22b7297bc879fe2e6b9741f13

Download Submit
C:\Program Files\Mozilla Firefox\private_browsing.exe

Filesize
60KB

MD5
80f8a150f299e48b46250656080d6fa6

SHA1
c39a893fe7358bc971734a3202f30b6d9298326d

SHA256
6c147bc0a3f87874046e42c7c39cbb2d95e6f80f800ee1bab2921ed60e58e30c

SHA512
e0e80ac4d5e4c448f4f8544bdf8ab3f2cbca62704b3de6d1b722d1902099b23c5a18ac87d8c5a8d42b33e1d3a23f86c8e89fe176713a5ce400a6912095299ada

Download Submit
C:\Program Files\Mozilla Firefox\qipcap.dll

Filesize
18KB

MD5
382d9e61623eefd8616813c3c0b687a2

SHA1
21246d68a486520c837c4d06418b0358d9fdc6fb

SHA256
0da9ba015f3f2fcffebc8906475633b9b0003f109655192c0ac5200fc9a4d1da

SHA512
de35a8faa66753f2dc06d109f586c29dabe81f3d9aaaf6306b3220e2cafbc80960117d1ad8f2124f47306037432408ad6b9d7706aa4a0338e993b05445195e56

Download Submit
C:\Program Files\Mozilla Firefox\removed-files

Filesize
16B

MD5
fefbfac37461bd30e05f5befaa1f7705

SHA1
74f9024662db06184e645cab76bfecb0e6897545

SHA256
52523da24287c4d459131c2e4818a713a732765e06e9bbba1cf353888ba34f9f

SHA512
874d6bdef28dea531c858443810d0b026a3a5667e0b9985bce84b7c5ab63d06a015487bd1da2a914d28af7b6568335b1927f9fb9656715947929cd6671ccc4b7

Download Submit
C:\Program Files\Mozilla Firefox\softokn3.dll

Filesize
250KB

MD5
41db73a2ff05adb9937dc9d17e4dbae9

SHA1
05a326c8a4d49465bd28d182318154d9f43849c2

SHA256
4e971607b0a2440813cc19fbf07855bee79ac22af04c375540a40f5bd3d38b17

SHA512
149a76a0d4e9d573d8bd1b4a4d48844399d033789c966c1bce7635c9068a78bd0b19f71a53a19fcf17671090ce7bbd1abe553ce71cdb089e87b996178a9754a4

Download Submit
C:\Program Files\Mozilla Firefox\ucrtbase.dll

Filesize
1.1MB

MD5
6343ff7874ba03f78bb0dfe20b45f817

SHA1
82221a9ac1c1b8006f3f5e8539e74e3308f10bcb

SHA256
6f8f05993b8a25cadf5e301e58194c4d23402e467229b12e40956e4f128588b3

SHA512
63c3d3207577d4761103daf3f9901dd0a0ae8a89694ad1128fd7e054627cdd930d1020049317c5a898411735e2f75e2103ae303e7e514b6387a3c8463a4fb994

Download Submit
C:\Program Files\Mozilla Firefox\uninstall\helper.exe

Filesize
1.2MB

MD5
01a4d3ed145f303ddd7cf7dbaa75faaa

SHA1
4c1f1be1dbfd355e2cc71e5a422371607793f038

SHA256
83801a4898ee2fc396cf61973872d0c9ce45ad5809f6c43ab6305db459ba63ef

SHA512
9b5f5f891cef098a50c9167df8b7ee1ceb582370aa8e109fbb2cd776c24e3a3489cf716415c3b2306e68b6c95c4e86185f2246469bed388659d42e80e822f61d

Download Submit
C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini

Filesize
222B

MD5
4b8dc92a079f224935392f9b5a2dc051

SHA1
1027fc1b3e2e8ae78c60bfb25c5c9f87f9b3cae2

SHA256
79d1631316cd79bc5127f745aa6707b4445f7d0432b685ef2c3ec3cf3a62ecba

SHA512
ad0186cfc9df574e4a3c7c209b5dc3078fb86f6b1de0008bdede6768ec08d61b20f371d7b2d01dc50aa7d094b150db816358f03fa0d9135ce26d80d8886a1704

Download Submit
C:\Program Files\Mozilla Firefox\update-settings.ini

Filesize
132B

MD5
1413131f8cfad1e19d299667bf759087

SHA1
a0435cbf1a2817ec960c56a896d455e78adc226d

SHA256
c18489344fdc21ae366b4d957a0b9f11be772483ca46f9ffab6ed0356f946513

SHA512
590b53aff46903b1883c5fb14492ca85db2c6e0e900d0fdf62c3e6da10f1d10c3aa51224dc6db50f4eb12d42de017892f77e91d79aa16fcaefba10b27748748d

Download Submit
C:\Program Files\Mozilla Firefox\updater.exe

Filesize
371KB

MD5
b11981f87cdf970f6c74fb77a2d42f1f

SHA1
1be0ea411f6aa3f0ee92db3053efaa71367e2a77

SHA256
f0e0a650f616c3b3954b6291f1d46adbf67b35defc18012b657ec67b7ce7bb37

SHA512
62e4c932799f875182614c78650da5b6bb13530bfe16d64aa716273f86be1eb3824d5b108784e2442fc26b5dac27ca547286490d62a3d69cac177345d4f9af28

Download Submit
C:\Program Files\Mozilla Firefox\updater.ini

Filesize
1KB

MD5
c897f4890ff5688dc3257f397c6afb70

SHA1
ec4e7206128637731000fe1da8c5072c0b8c3c5e

SHA256
e74835209e7c22d2120d97c4007b3c83686e09a1e4569b0f6a629439d1f23d34

SHA512
88bebf92e9dde6ce89f3c53e7df068742c238519b5ae93ef2b6e4a123eb5b12ad1e819cfae13f60d5250365d38038202cd4b123805b9a83e323a1dcd4be5da9a

Download Submit
C:\Program Files\Mozilla Firefox\xul.dll

Filesize
109.1MB

MD5
b15faff0f64a5746a507ba449cc038ed

SHA1
e984790afc6ba138a9dd9a77949ae693aedaaced

SHA256
7898b40614d62582fabe9c504d803b63d8e65528ae6cb8c609e9377f91f2a17f

SHA512
c7999a5648212a78cc372116f0e13d5e831c6a6aab6d233b680e56d4fd44900999a89c24a3ab09190ee77a4d0158a7a2ed97fc420a75931dc7ccb24fd417d895

Download Submit
C:\Program Files\Mozilla Firefox\xul.dll.sig

Filesize
1KB

MD5
71e1cbfea86cdf48070fdcfa13345687

SHA1
b34c9c1b6f3c7aa2ab7b6b5a34a589b55fcc0721

SHA256
a64d58a55d8bc4ef7025bf9afc88ff088f580af8dc58df030497b60d8fabea9a

SHA512
20f864f80ecc4fb57435bce5a36f12c4b18d9c1a287a51011189c2fbdbac343f3f7783f670b3f5029ca79b396388e5d1b0e662ef2565e00b31bd36e17cbb2668

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Private Browsing.lnk

Filesize
2KB

MD5
5828168f926e2818bcc70706d0312bd9

SHA1
f85828df7c07f159d1be276654c6d2d0af3e4632

SHA256
f22191c13a56ed823023e5bfd49f54cdbbbdb378d87c98fd922951fdad92f64c

SHA512
91aa047d78534cab14cb26c4e7903d3f4cf6631cbeb7c7e30bb2c94636f28e3f6acd2660f2f1ac921aaf443f889970274d989c2a443abd5127e51a984036ff56

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Private Browsing.lnk

Filesize
1KB

MD5
0770f06ef9723a13e985d891548c93aa

SHA1
a8ead93d86dc46a35c6f0d2ad6b2049c77999df8

SHA256
1db6c4a178393becb289caebddc5e8294b8fb732a4d744f86e64b94898c2aa4a

SHA512
1ce0130f97530804baed6d3ca889791ef3c9b9533f02a16fb46813cc6381f0f7c3d880a749c6c51a3e210ce10fb3db4f177165262a39df1cad1d2a071e3846fe

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk

Filesize
873B

MD5
0aac098300b1618d77e39872c6cb7886

SHA1
72baa7959b2a644d6dc22b53439077b2011c42f9

SHA256
aa2bc7b8f024413e016cbfe80f92ff77b538e63b91c8865c76b1adeb048a68bb

SHA512
6390fa3984aee74ff6bb85d1a499c5ed67417f5ac39a3956966d2dab5da564a08631ea2b46573b874f52fce9ffdfc85715d3828bd458ea7ba7fa92946e92c645

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk

Filesize
943B

MD5
438548331e5fbd33eaf847b8c106bf9f

SHA1
a08e7c0e02db2b00b65e361fa41d56fc1a59010a

SHA256
5f67450066bd067eeff3be6638967f827788ab79d0e6086ccbe72b2fc551d1ff

SHA512
491a01d8b2415df63bf8fb67290040d3580b4c6e36025d2802ae63e97bde6d9b71406743c62575892ef18580db91aa469bb15333177507455a23af513b4f4f18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5064be1466c728a690f89e17b2a52ad9

SHA1
1bf00309b819934be4875e29918d0328b53b3e2c

SHA256
00035c8740d0e86c92fdeadb23d8edd15f784ccf8f4473d33a678da9ab14dea2

SHA512
748d7e9c530faa05198180087dd5e4398acf555759e923fc8c06ea8b120f392beec7b5dd4234bafb0b975c6407e6885308b6d381afaae177fda1022326d27afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87d0c44bd8d4869e82c544ab422fd46c

SHA1
fb9129a05ded20e25509323307c977d1b2a85d26

SHA256
6fca6e8c10067437b0ffba08e81b7827542c0964440a6a47bb1aadb27f659f78

SHA512
5ee2914983f1c3f0d5d162a8dd672ddf2690d172f67353e071dfb44cc67dc7473c9d761bd3bd6484480374e84663b204d8fab8f78d9c6948b70ec3a42efdee91

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\Accessible.tlb

Filesize
2KB

MD5
e49aeb412aab7c49a27e6feaa0ca40ce

SHA1
6a2f6ea9facc48a3f736e03fda2c1ce44b744af3

SHA256
754fd922f8c93b66f723c30d39083a6a1fe33fa4b6439d55ad2459be40c3151e

SHA512
8c3f957d032fa8edb523cd3f473a57e2cc020c9e6e33aea183cad8b435777660f4c7e87ba62c67bbb1aef726d109f0f34b2d86c159ca9bd98bfad43c89af7ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\AccessibleHandler.dll

Filesize
159KB

MD5
b8d00907d45cd038f64d6f57a4ac12c0

SHA1
5b442b8efac0b1d9ddd6d7da46b939b3bb1ae616

SHA256
00d4d35fb0659f9addc02dab52971d891a2c565477f6d89c7e1bde2801ae2b0a

SHA512
05654795c630cd4de87e7c8ce1b4aff12780e1f9b266b78f46275d252428810458b33d22fff16b4f2a9f6a94390a6d743c348caddffc49dd2d09c6f23005a39c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\AccessibleMarshal.dll

Filesize
29KB

MD5
4761b31d27eb28ea05b68fb6440dc107

SHA1
0cdbbed1c91b0560472de61c726f0a08306a4a39

SHA256
cb246683c05f372edc39ac7c6f1b212e1d76be7bbb3dfd3fe58d66ac0df0073d

SHA512
f6849f927d233c62ff37e7623acbcd7492ca70c995545dc7ea509108f93ae85a5150a56acafbc8220b70883d2f17dcaa49018d0c77b1cadac856473fd6b4f0bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-core-file-l1-2-0.dll

Filesize
17KB

MD5
79ee4a2fcbe24e9a65106de834ccda4a

SHA1
fd1ba674371af7116ea06ad42886185f98ba137b

SHA256
9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613

SHA512
6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-core-file-l2-1-0.dll

Filesize
17KB

MD5
3f224766fe9b090333fdb43d5a22f9ea

SHA1
548d1bb707ae7a3dfccc0c2d99908561a305f57b

SHA256
ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357

SHA512
c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
23bd405a6cfd1e38c74c5150eec28d0a

SHA1
1d3be98e7dfe565e297e837a7085731ecd368c7b

SHA256
a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41

SHA512
c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
95c5b49af7f2c7d3cd0bc14b1e9efacb

SHA1
c400205c81140e60dffa8811c1906ce87c58971e

SHA256
ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1

SHA512
f320937b90068877c46d30a15440dc9ace652c3319f5d75e0c8bb83f37e78be0efb7767b2bd713be6d38943c8db3d3d4c3da44849271605324e599e1242309c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
6e704280d632c2f8f2cadefcae25ad85

SHA1
699c5a1c553d64d7ff3cf4fe57da72bb151caede

SHA256
758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893

SHA512
ade85a6cd05128536996705fd60c73f04bab808dafb5d8a93c45b2ee6237b6b4ddb087f1a009a9d289c868c98e61be49259157f5161feccf9f572fd306b460e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
c9a55de62e53d747c5a7fddedef874f9

SHA1
c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad

SHA256
b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b

SHA512
adca0360a1297e80a8d3c2e07f5fbc06d2848f572f551342ad4c9884e4ab4bd1d3b3d9919b4f2b929e2848c1a88a4e844dd38c86067cace9685f9640db100efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-conio-l1-1-0.dll

Filesize
18KB

MD5
a668c5ee307457729203ae00edebb6b3

SHA1
2114d84cf3ec576785ebbe6b2184b0d634b86d71

SHA256
a95b1af74623d6d5d892760166b9bfac8926929571301921f1e62458e6d1a503

SHA512
73dc1a1c2ceb98ca6d9ddc7611fc44753184be00cfba07c4947d675f0b154a09e6013e1ef54ac7576e661fc51b4bc54fdd96a0c046ab4ee58282e711b1854730

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-convert-l1-1-0.dll

Filesize
21KB

MD5
9ddea3cc96e0fdd3443cc60d649931b3

SHA1
af3cb7036318a8427f20b8561079e279119dca0e

SHA256
b7c3ebc36c84630a52d23d1c0e79d61012dfa44cdebdf039af31ec9e322845a5

SHA512
1427193b31b64715f5712db9c431593bdc56ef512fe353147ddb7544c1c39ded4371cd72055d82818e965aff0441b7cbe0b811d828efb0ece28471716659e162

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
39325e5f023eb564c87d30f7e06dff23

SHA1
03dd79a7fbe3de1a29359b94ba2d554776bdd3fe

SHA256
56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a

SHA512
087b9dcb744ad7d330bacb9bda9c1a1df28ebb9327de0c5dc618e79929fd33d1b1ff0e1ef4c08f8b3ea8118b968a89f44fe651c66cba4ecbb3216cd4bcce3085

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
19KB

MD5
228c6bbe1bce84315e4927392a3baee5

SHA1
ba274aa567ad1ec663a2f9284af2e3cb232698fb

SHA256
ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065

SHA512
37a60cce69e81f68ef62c58bba8f2843e99e8ba1b87df9a5b561d358309e672ae5e3434a10a3dde01ae624d1638da226d42c64316f72f3d63b08015b43c56cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-heap-l1-1-0.dll

Filesize
18KB

MD5
1776a2b85378b27825cf5e5a3a132d9a

SHA1
626f0e7f2f18f31ec304fe7a7af1a87cbbebb1df

SHA256
675b1b82dd485cc8c8a099272db9241d0d2a7f45424901f35231b79186ec47ee

SHA512
541a5dd997fc5fec31c17b4f95f03c3a52e106d6fb590cb46bdf5adad23ed4a895853768229f3fbb9049f614d9bae031e6c43cec43fb38c89f13163721bb8348

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
034379bcea45eb99db8cdfeacbc5e281

SHA1
bbf93d82e7e306e827efeb9612e8eab2b760e2b7

SHA256
8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65

SHA512
7ea6efb75b0c59d3120d5b13da139042726a06d105c924095ed252f39ac19e11e8a5c6bb1c45fa7519c0163716745d03fb9daaaca50139a115235ab2815cc256

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
8da414c3524a869e5679c0678d1640c1

SHA1
60cf28792c68e9894878c31b323e68feb4676865

SHA256
39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672

SHA512
6ef3f81206e7d4dca5b3c1fafc9aa2328b717e61ee0acce30dfb15ad0fe3cb59b2bd61f92bf6046c0aae01445896dcb1485ad8be86629d22c3301a1b5f4f2cfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
25KB

MD5
19d7f2d6424c98c45702489a375d9e17

SHA1
310bc4ed49492383e7c669ac9145bda2956c7564

SHA256
a6b83b764555d517216e0e34c4945f7a7501c1b7a25308d8f85551fe353f9c15

SHA512
01c09edef90c60c9e6cdabff918f15afc9b728d6671947898ce8848e3d102f300f3fb4246af0ac9c6f57b3b85b24832d7b40452358636125b61eb89567d3b17e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-private-l1-1-0.dll

Filesize
71KB

MD5
3d139f57ed79d2c788e422ca26950446

SHA1
788e4fb5d1f46b0f1802761d0ae3addb8611c238

SHA256
dc25a882ac454a0071e4815b0e939dc161ba73b5c207b84afd96203c343b99c7

SHA512
12ed9216f44aa5f245c707fe39aed08dc18ea675f5a707098f1a1da42b348a649846bc919fd318de7954ea9097c01f22be76a5d85d664ef030381e7759840765

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-process-l1-1-0.dll

Filesize
18KB

MD5
9d3d6f938c8672a12aea03f85d5330de

SHA1
6a7d6e84527eaf54d6f78dd1a5f20503e766a66c

SHA256
707c9a384440d0b2d067fc0335273f8851b02c3114842e17df9c54127910d7fb

SHA512
0e1681b16cd9af116bcc5c6b4284c1203b33febb197d1d4ab8a649962c0e807af9258bde91c86727910624196948e976741411843dd841616337ea93a27de7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
fb0ca6cbfff46be87ad729a1c4fde138

SHA1
2c302d1c535d5c40f31c3a75393118b40e1b2af9

SHA256
1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df

SHA512
99144c67c33e89b8283c5b39b8bf68d55638daa6acc2715a2ac8c5dba4170dd12299d3a2dffb39ae38ef0872c2c68a64d7cdc6ceba5e660a53942761cb9eca83

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
23KB

MD5
d5166ab3034f0e1aa679bfa1907e5844

SHA1
851dd640cb34177c43b5f47b218a686c09fa6b4c

SHA256
7bcab4ca00fb1f85fea29dd3375f709317b984a6f3b9ba12b8cf1952f97beee5

SHA512
8f2d7442191de22457c1b8402faad594af2fe0c38280aaafc876c797ca79f7f4b6860e557e37c3dbe084fe7262a85c358e3eeaf91e16855a91b7535cb0ac832e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-string-l1-1-0.dll

Filesize
23KB

MD5
ad99c2362f64cde7756b16f9a016a60f

SHA1
07c9a78ee658bfa81db61dab039cffc9145cc6cb

SHA256
73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa

SHA512
9c72f239adda1de11b4ad7028f3c897c93859ef277658aeaa141f09b7ddfe788d657b9cb1e2648971ecd5d27b99166283110ccba437d461003dbb9f6885451f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
9b79fda359a269c63dcac69b2c81caa4

SHA1
a38c81b7a2ec158dfcfeb72cb7c04b3eb3ccc0fb

SHA256
4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138

SHA512
e69d275c5ec5eae5c95b0596f0cc681b7d287b3e2f9c78a9b5e658949e6244f754f96ad7d40214d22ed28d64e4e8bd507363cdf99999fea93cfe319078c1f541

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
70e9104e743069b573ca12a3cd87ec33

SHA1
4290755b6a49212b2e969200e7a088d1713b84a2

SHA256
7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95

SHA512
e979f28451d271f405b780fc2025707c8a29dcb4c28980ca42e33d4033666de0e4a4644defec6c1d5d4bdd3c73d405fafcffe3320c60134681f62805c965bfd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\application.ini

Filesize
899B

MD5
17963c10064f603fc6c5a0be669e33a2

SHA1
221f3d4a18e2df543593a0d924bfa179e33c6f07

SHA256
f190d5075b674ed3fd80c95531ca26b019c0d2e51bc4870405b2db2a582ff255

SHA512
5965ebf7fb02228122724cf9b2726e50edadf558a46a28606e7df25c93a4dc143635e06c2eb8589357f55531b9fd23df5d2cce670e247ef29f4570a82e423e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\breakpadinjector.dll

Filesize
129KB

MD5
40a5d99b8bb9a80d4fb21bbf08ca53c7

SHA1
dc5f4197083371b7a047fdbfb98f72a66e94b272

SHA256
8ff62160235eb40bba03a6a94835044e397246c2544f2491a0eef1ae1a127c15

SHA512
8ca574922fddfff54fd000fa3cfd7f13791cb62dcb7d1d096b184faed1a5b5519846445d38a5d5a6d5bbdca41a1930677e84cb216719e5a64767bc876a468c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\crashreporter.exe

Filesize
235KB

MD5
96343f1b62b10bda5c9a0aeda94e0f88

SHA1
723559a84fb27f91281d70237941640a7aaeeb16

SHA256
9b4311e5b9d0b3eb280da350f80bb170995fafff3420d4253f0c379751134d2e

SHA512
3fe5fea09c9dc54b8b808d4ee9b870d1fe39e1d177265822806d5736e86c83b9b5d938ae9c1992136c272abc33c8b000ab51ed75551096942ec792ed29e4d256

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\crashreporter.ini

Filesize
3KB

MD5
770268e987385bcd539808ba357dbe4a

SHA1
a1dbe8b6e2f58edf3024ae787884c8a647810a7e

SHA256
0a4039b4caf9c3f4732974d28d3817a40c901cd70cb4a7cead876f3d8f3a3594

SHA512
3c8ef7dc462dd74c2fced17b1a62f3cd3139d4f81deeabd29ce0dfa1ecbef31029113c7a7ea31c55d2625465d2604ce409e6bdae2d3bdaa689cc822f6cff73f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\d3dcompiler_47.dll

Filesize
3.5MB

MD5
587a415cd5ac2069813adef5f7685021

SHA1
ca0e2fe1922b3cdc9e96e636a73e5c85a838e863

SHA256
2ad0d4987fc4624566b190e747c9d95038443956ed816abfd1e2d389b5ec0851

SHA512
0fa0e89ea1c1cb27ac7f621feb484438e378a8f5675eca7a91f24e0569174bd848d470d6b3e237fe6ab27ca1eb1ecc09b5f044e53a6d98bf908e77ac511183e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\default-browser-agent.exe

Filesize
663KB

MD5
40c030226bc123d64167d684b572df2b

SHA1
180c8d57ec770638638acc3634191035f9b22e1a

SHA256
37c53da2051d900fbd9fa5af7df36e44ba5e0b98c1804b7d990d26b522c5836a

SHA512
55c7f848e3e3eee638cbfc28ddc2e0203f7ac8d212a36e24c730866c3a5ccdeb27733a7a40344e66a7e280e5f02806784b84fdfe5a1bc892290572192859eb19

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\defaultagent.ini

Filesize
932B

MD5
88d7d32ad20bf89bb7785bd07c638e17

SHA1
2bd40f0b69c2edc64ab6b7e6dd2e7ca6a6fea6f6

SHA256
5cf0660a8f2624433c8c1022f93ff3c94c5611ccbc93118ee053566590eb53f4

SHA512
7bb3328ce42e7bb546a2192ade1e8e153408912f3582c27dc0c5cbe1c2d807365aaf4206c3ceab6cb3d6c34d3155125cb7509dbf800ecf70ab35f8a64f764010

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\defaultagent_localized.ini

Filesize
1KB

MD5
e85004618b8048bf47cf67d22e6efdd6

SHA1
dd9df0aa2872b618be06a7c625a348318bb6448b

SHA256
1bb2201b759bae462fc84a8586b852834dca81df7bcfe304e67f8d073bb0a366

SHA512
e7e9b9ba2e903d7581265ff42eaf0b18b092924c4dc60f1a0145d74dc639c3c78b9aa80a202b76f33b87cfcbcaaa78cd4fbb07eb1e54093ce80eb033faa7c0df

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\dependentlibs.list

Filesize
446B

MD5
c35d2da6df0f7abb4d0bd534c5d5b6b0

SHA1
a4da4ca15d97746796412c2bad3fc8fbea716869

SHA256
ce638d544efe50176888e17bfbf78f118dc733ce5c2fee2eb66436ba96341345

SHA512
d27f58fb344b2303db2f4a48a153c9f11eec1663020ba8b5b973fd001c4a8c27c11e29a54b6d1913888b4ddf376aa7f45c8218378abe39a64ebdae4feb6b25cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\firefox.VisualElementsManifest.xml

Filesize
557B

MD5
0aa43576f0420593451b10ab3b7582ec

SHA1
b5f535932053591c7678faa1cd7cc3a7de680d0d

SHA256
3b25ae142729ed15f3a10ebce2621bfa07fda5e4d76850763987a064122f7ae6

SHA512
6efb63c66f60e039cf99bfaf2e107c3c5ed4b6f319f3d5e4ef9316c1f26298b90d33c60b48b03699059d28b835fbc589417ac955fc45a2bc4c116a5200dfdc32

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\firefox.exe

Filesize
589KB

MD5
b45a56bb4612ef277889779d44a41e8d

SHA1
24822ba11561483b6d06a778dec4c46bfbbfd94d

SHA256
b06e7a3debdeca7d3f3319e8fadd2bf78b73ad7801c4646b89ac2d0b1791055e

SHA512
5225cb3e6ee87f826774a8a18d2bc6828219b9ef9b32b2173f2fbd0bcc9d3cefc2ee6a11543eccf684b7d5af87020c1679799641d4f2e426158cd39de6e49137

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\firefox.exe.sig

Filesize
1KB

MD5
ec203d20fd3170db6ecd05c477e33452

SHA1
724cd23d7e099bc989e198038ad5eaa8a69d5f35

SHA256
89cd192312e2fe05fbaf2cafb0365018bf72494e445687fd3dcee4b90736410a

SHA512
dffe12eb41065f72d5755b3c1630d3853d9f9098d1f63f6ad120bee13198bde7c024315e85cfca79407d20efe29fde555c8042836ef24631c18fd7272bdfcc90

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\core\freebl3.dll

Filesize
625KB

MD5
94d971f3b6e87b5596bf6b0bafc51177

SHA1
17c6efae15e91bd75daf99cd341c72291bcca7c5

SHA256
b08ec9f0391d8a0c9419a418c7d43894ea71569dc44299b85c774ab984681351

SHA512
9f8224b36881c18190d58c1e943978a6dad06ad2c5c54d2de3c27bcb6c0a9509abc4dd7f8125b63d443b77176dd6822676d1dd971769051a9483e08b970f76ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\setup.exe

Filesize
939KB

MD5
9473048566115b9e723ff0ab94c7aa3f

SHA1
86bfc14e25de98ce4f4f64bd1e905f2b70460037

SHA256
17fe7eaec8b61c24510f5070357937980022a058b406dda3ba88fe276ed9cd67

SHA512
f7b0f65f7b2053637196167188a3bb9221ba95a6594f4583589a42dc2a993930406c52a7874ab39a26dffa8cef8aafab90baa12b92288e25242ac9ca4d484333

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\setup.exe

Filesize
939KB

MD5
9473048566115b9e723ff0ab94c7aa3f

SHA1
86bfc14e25de98ce4f4f64bd1e905f2b70460037

SHA256
17fe7eaec8b61c24510f5070357937980022a058b406dda3ba88fe276ed9cd67

SHA512
f7b0f65f7b2053637196167188a3bb9221ba95a6594f4583589a42dc2a993930406c52a7874ab39a26dffa8cef8aafab90baa12b92288e25242ac9ca4d484333

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCF706C0C\setup-stub.exe

Filesize
551KB

MD5
03870e58c01dc668a7d03789dcb2f7d8

SHA1
67fbd5a7c345c881861aaab76b02252e6222b013

SHA256
c0d0d3b11e1c54bbda394d92ce70a1effe0c22f5baa07a45ecd49db0a6b905e5

SHA512
c4ba596e5d8dc25607992f3b2e0ebc35866bfa8667feb5c7c6579ead3a1920e1237ab65be2b8126ed5e3b09cd54c2271c25f45941dd4ec6bd0da9eaa42b10093

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCF706C0C\setup-stub.exe

Filesize
551KB

MD5
03870e58c01dc668a7d03789dcb2f7d8

SHA1
67fbd5a7c345c881861aaab76b02252e6222b013

SHA256
c0d0d3b11e1c54bbda394d92ce70a1effe0c22f5baa07a45ecd49db0a6b905e5

SHA512
c4ba596e5d8dc25607992f3b2e0ebc35866bfa8667feb5c7c6579ead3a1920e1237ab65be2b8126ed5e3b09cd54c2271c25f45941dd4ec6bd0da9eaa42b10093

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab46BA.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46DC.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar49EE.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\ApplicationID.dll

Filesize
55KB

MD5
fdc0338e6faeaf6f7c271982e103473b

SHA1
9a41f7932abe8be7e32c6371f085cf14de355d00

SHA256
a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e

SHA512
a766eef11db4c94b1445d1cd70cf1d3b6141d6b3973562e9fa8d81c79195886b884dbc9b9f6952f8a6e8619534a6bf2d615d539d2cace9c8843dc19415051cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\CityHash.dll

Filesize
53KB

MD5
2021acc65fa998daa98131e20c4605be

SHA1
2e8407cfe3b1a9d839ea391cfc423e8df8d8a390

SHA256
c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14

SHA512
cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\InvokeShellVerb.dll

Filesize
14KB

MD5
79eedad48e956f125b4b518f5351db5f

SHA1
2bb8c4952a3310244394fa28b91797521ff7d154

SHA256
2bcab0487134238f5109d1f4364b99b6d03941c2c091fba6d660eb2b92f65adb

SHA512
bbab20281bd48b9ef285651c0fef385143465082254ec99435710e14d7389efbc93c6f4d571ada9d92e9e7648b230abf83d5a17b286f698c751026b8e8aa6f55

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\ServicesHelper.dll

Filesize
14KB

MD5
b9e8c2212ac8dae4b0eaf97c048529fa

SHA1
331d172323480b0518abdb0cc9e256dc7f46c357

SHA256
d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f

SHA512
d93aa032e27c8268a4f6883711cf41f7ee2b5d33673a26d78db24456f2c548af39b7b98ed4b4737245c278d524fffb3e4bf708b6815dc866acd371427ff6be96

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\ShellLink.dll

Filesize
14KB

MD5
fa94d120efb029b43217c66bbc8c650c

SHA1
1fcf2d76adf69b403b7400681ac91d50ed20385f

SHA256
5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db

SHA512
07ed0771d5bbb651ea7421a5f6b08fa234f9cc041315d9360a7135ba12180064fc99a27725385a8ecd3ceb25bed5c00de169f7dabb3ccf6e987f45254dff8158

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\System.dll

Filesize
22KB

MD5
b361682fa5e6a1906e754cfa08aa8d90

SHA1
c6701aee0c866565de1b7c1f81fd88da56b395d3

SHA256
b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

SHA512
2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\UAC.dll

Filesize
28KB

MD5
d23b256e9c12fe37d984bae5017c5f8c

SHA1
fd698b58a563816b2260bbc50d7f864b33523121

SHA256
ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c

SHA512
13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\components.ini

Filesize
44B

MD5
c9b5d86a9a0f014293b24a0922837564

SHA1
3cc73b4a30a1a0bfdc6812bbd17994f53eb5db2a

SHA256
775c85f3552754ad3794b88c0cb6d6fc43d412cd9a87a4b9e847386a5bd0a9c4

SHA512
790f365afbe4c5a37dbb56443d38f0c439eadca002e4001d373d6db8c1d80c4adacf3749e9d210cd0316381682fbbc46616a3fa36581c7ea6f5ce69119944b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\components.ini

Filesize
610B

MD5
d99af869f79f676872a8999b25e9dd22

SHA1
ff35f7cf1414cdacd7cfcaf79e4030a53be578d1

SHA256
9bcc1706834feed083da8e2d4fde24cb873efeac9c7a876c1b297bd3777dc83e

SHA512
65680e09d81515562e3fb81e89e273ce15dc76272cbddb7a1e47105c61f2b226044c05813aa689f6badb1626551c4f46d82398ef46ecb4a54aa52b1f9d2ca621

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\extensions.ini

Filesize
402B

MD5
2ed482117f3148d08f92e22bed69f5ed

SHA1
2ac31eb3b05d73d23bd946d6b7c9a7a461d1bdf4

SHA256
4e3f2413784c7e3666c667eb2c35084154536edf9335d96f24d18a1d17590066

SHA512
3b84ec3c4aa29e70b428535d9f34577d69d6373772d96ebae71b27a73cbe6d7a82de1163c71280e7b0ca906f4fc3b995f3626988776b6116a2d81a5e82153d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\nsExec.dll

Filesize
17KB

MD5
0e584c7120bd474c616013c58d51dc6b

SHA1
0bc980892341b52985d92fb3d8fbb6be77951935

SHA256
7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391

SHA512
aa3a471b3f33c3ffdbe1b1e3c1e5d04367bcab3c16049396a8dd12c5a8317e4b153761f74f39b756dd4fb1806aedc4f1bb38bfbc12f16480eed3fd3087a0d157

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\nsJSON.dll

Filesize
33KB

MD5
e832077eaee06f3b2ac9a8d2e7264567

SHA1
decbc329257c9c7fb67d3c449b4c5dfc1f87471f

SHA256
705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf

SHA512
c1bada98c52ee2318d23c48fe202380eb42c5e1f18226cdc017f264c8c34f548bfe4d9b6eef13caae69ba321a71b199431b249fdec65f8bb1c386810932ccf6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\options.ini

Filesize
1KB

MD5
f50ac2442dddb1ec2bd0dd5410fcfbb4

SHA1
13a4a1dbd6cad83aa6e5d9043b6d98e1bf4ec371

SHA256
89b31e3fe0c4390d252a686512bacec6f53e3f4da6d1f12bca2866d4ba37d021

SHA512
697bad94809681055d19fb03f8979c79bb948bd01888392a0fff37b30fc87f965e7f716c0c28de6df6746518a5d5c26006e3a313eecbc6f8bdbed25d39d6f8a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\shortcuts.ini

Filesize
874B

MD5
71851e095439dfcac9099254c0881673

SHA1
d31c9dfade1d31b937872dd6a8761c4c117ef588

SHA256
97ef03760837f339242d39927e0f9fa046669ed66b9a413b853ea8b6450ebfc4

SHA512
1025ff9cfed7f064670b43b401f80a2a805354cdd0f3a348c3935e15e08d67d9fb05d028b259a66003403425d842d5f10aa88e9bb57563765cecb91e85ab6c18

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\CertCheck.dll

Filesize
15KB

MD5
aed814f87d862cb5ceb00fd0a6d60fb8

SHA1
097418e9181e6b4d95f40410cd4dd962fe27c41b

SHA256
d56e2407b6050d669e94e452f1a54ee1859a1751179a3f1e2b4253305a23a0cf

SHA512
69593e12efe0736ada5a9e1b6f3c238a6434b88068361dfd2f7bb3e50addbf9b56ccaee30321362ce085ea700fbab03bae8494bba8c72e9e9983d3faa569b3d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\InetBgDL.dll

Filesize
17KB

MD5
97c607f5d0add72295f8d0f27b448037

SHA1
dfb9a1aa1d3b1f7821152afaac149cad38c8ce3c

SHA256
dc98ed352476af459c91100b8c29073988da19d3adc73e2c2086d25f238544a5

SHA512
ad759062152869089558389c741876029198c5b98fa725e2d2927866dc8b416ae2de871cb2479f614f6d29b6f646bf7191d02837c3cabc15b8185b563bc46268

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\UserInfo.dll

Filesize
14KB

MD5
610ad03dec634768cd91c7ed79672d67

SHA1
dc8099d476e2b324c09db95059ec5fd3febe1e1e

SHA256
c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df

SHA512
18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\WebBrowser.dll

Filesize
103KB

MD5
b53cd4ad8562a11f3f7c7890a09df27a

SHA1
db66b94670d47c7ee436c2a5481110ed4f013a48

SHA256
281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec

SHA512
bb45d93ed13df24a2056040c219cdf36ee44c8cddb7e178fdaabcec63ac965e07f679ca1fa42591bba571992af619aa1dc76e819a7901709df79598a2b0cef81

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\config.ini

Filesize
187B

MD5
ed23468cb20f1f37a967eb26f639faef

SHA1
5707e3d394b6a3e36e8b1e23317ec115bafa1e9c

SHA256
812217f840657b7d310c406d7224eb1c339079ad48541d922e3f15f1b2e3d913

SHA512
9a7d3073b2d7d234eee56464df7b58be4466171c3cad47ebf0d4742c0ed05555ac890a18991ef59bf8b0751a207ea04f86a728fe3b0cb19607b9f6e4f45e76f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\config.ini

Filesize
187B

MD5
ed23468cb20f1f37a967eb26f639faef

SHA1
5707e3d394b6a3e36e8b1e23317ec115bafa1e9c

SHA256
812217f840657b7d310c406d7224eb1c339079ad48541d922e3f15f1b2e3d913

SHA512
9a7d3073b2d7d234eee56464df7b58be4466171c3cad47ebf0d4742c0ed05555ac890a18991ef59bf8b0751a207ea04f86a728fe3b0cb19607b9f6e4f45e76f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\download.exe

Filesize
53.5MB

MD5
c367314a6d2879aa521def50fa7a90c2

SHA1
d8f276c6c82bb67418944e212fb01a4f8b1798bb

SHA256
18fa45adb09be5a19e912e8eebbc03dde66a3bd31c2702989ac3fbce70b1663a

SHA512
1a596134a64db9cf2a312edbf48618b1f7375254c3f59527d0b76339b65a6ff56816877b356692adedd3f9eb2a070358f9db17aedc326af9ab43de18d1252d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\download.exe

Filesize
53.5MB

MD5
c367314a6d2879aa521def50fa7a90c2

SHA1
d8f276c6c82bb67418944e212fb01a4f8b1798bb

SHA256
18fa45adb09be5a19e912e8eebbc03dde66a3bd31c2702989ac3fbce70b1663a

SHA512
1a596134a64db9cf2a312edbf48618b1f7375254c3f59527d0b76339b65a6ff56816877b356692adedd3f9eb2a070358f9db17aedc326af9ab43de18d1252d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\download.exe

Filesize
53.5MB

MD5
c367314a6d2879aa521def50fa7a90c2

SHA1
d8f276c6c82bb67418944e212fb01a4f8b1798bb

SHA256
18fa45adb09be5a19e912e8eebbc03dde66a3bd31c2702989ac3fbce70b1663a

SHA512
1a596134a64db9cf2a312edbf48618b1f7375254c3f59527d0b76339b65a6ff56816877b356692adedd3f9eb2a070358f9db17aedc326af9ab43de18d1252d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\installing.html

Filesize
1KB

MD5
32de55f44c497811dd7ed7f227f5c28d

SHA1
c111be08e7f3d268e7a2ed160d0c30833f25ae4a

SHA256
6259f3a41a703f13466503e6fbd37ca40e94f565a2f4b4087fbcd87a13bf3ee1

SHA512
48bb6f24b3ee2f4b7052205a3843ea34f917ee192b70261d2438c037b0e17d48bce8beb4c31be4141e9618922a45b6b47745b797e5618f18fe00bfc1625309ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\installing.js

Filesize
2KB

MD5
dfa7861bca754036ab853b3bb02b194d

SHA1
46d7c5ba614b39caa4857fcba4bdedbabb2c67c0

SHA256
2c286b6eefd38f032a385f3ac6a1f794deab3bac0fbff71bd0ba21453f477878

SHA512
c58d96fb2496a84261a5e4b18cf4156a30f9ad161bbabc3652b6b5c24976f1ac432dced31927a9443260cdca0292524d1f691766b7c0731f926d37be11fe0c64

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\installing_page.css

Filesize
1KB

MD5
6582e207592b60a995b4510cf959eb03

SHA1
08afdebde481b653e04f89bedad0cba6c8dbd999

SHA256
43c38801c1746880625f97eee3fe37fe94d1300adf812bfe26e47b094b87523b

SHA512
0a5a5ce944b89f552a38300674c44cc9de4920e87c2aa2c3c63bbceedff1d80ab35ab31274bfa89e0acc518470f466a2d67d483147f2ca8061d68b770e2ebe48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\stub_common.css

Filesize
684B

MD5
544b51f11ad19df720669478d28f129d

SHA1
d238b604fd3fa37dfd552eacdc6aacc474fcddad

SHA256
4d9495b6f0e18331659993b79440e414a6e607fcdaeacbc7477e0683cc0fa98b

SHA512
bbbb0f31839316c51464cfd225166145f968ce38995dc2748df5402b7e109ff6119d65b6774fc4738638ad4c9d89776516b00ab5a700097d9d74e1824a11dc5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\stub_common.js

Filesize
817B

MD5
58b8ac894c64370cfa137f5848aeb88d

SHA1
6a1ac1f88a918a232b79fe798b2de69cf433945f

SHA256
0e28aa770b0afade30be85c6dc1e50344db8f8cdd3fa01989d81a9e20a4990bd

SHA512
ae309518e0f926021e4d9378950c1a375263247d4f79d8a8cc09464cd01653ae5e707d52a4b0c36d532e649c246f4be6b5ba8648f58fb0e3e40c495ae63180ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81ei91hh.default-release\bookmarkbackups\bookmarks-2023-06-01_11_7La-iTOpFu75DJ+PtNMKnQ==.jsonlz4

Filesize
946B

MD5
a2a8348fb8e00cf14dae35aae54be18f

SHA1
7445e429f8dca3fcc36254a3cdecc7bcc2d47f54

SHA256
f924f75c45fe1a29a41c51b2eeb66cfe45f0444d8ca27d33d6cc86d30026d52d

SHA512
006116a9ca3590d8e297c672a3a088ef956f75ca1805a3c3aacb1840ac4cb175a2355fd77c012e7efd4bf97e168963ab416c6d4573344c77cf2afc37c5bc49a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81ei91hh.default-release\extensions.json.tmp

Filesize
48KB

MD5
de3d28d23bf077443514fc288dc74ead

SHA1
f21d4ac846c0b801a1b8ec7c3792ea1d37b905ad

SHA256
8c5932bd7ec9080a69f105d5d085775dba2fcaa780f806a8618cdc0ad63b7853

SHA512
744f43c36efef070aa15ccc4990280fb25da08d90edbc6604aca255b30b10133718e4bcb0bc4d76af4c1c894f5a7b64194a69a0872ae12373a133c5f5b65f692

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81ei91hh.default-release\prefs.js

Filesize
6KB

MD5
4569d945905e02c3f88c950312785dfc

SHA1
b4bb650a2f8b282f3203762d012f22556770bf90

SHA256
97e12518c95e61aab03fbf795d19babaf2ffe64a162047ac9abed426a16baae0

SHA512
321db42fe9ab0de6a846c137eb39c243b4780ac7510d227a7accc1c0760b08ea0c2691523cb52b1c4aa48f7821ffbfbfb6395fa3b85e57459686fe35152a7383

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
861B

MD5
dd1cf79333890deece3f6636baa9c9ff

SHA1
3481cb14c6b17901d260756a1f39c1dc6c56d692

SHA256
e328f434a86c9d4a416294d2543b24201083022fa11484ba8d1f5995b12fae51

SHA512
e52ebb9233c144ed5a40f4e57b85e19b62c71f6d14d36ac01337ff4f9f79f8ff57c758cac4ea487603e271dedc90275de96cc85082cf644b1a7b066b44dec184

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
931B

MD5
2637d4dded053c5fe90cb6491dfbcd15

SHA1
32dc63780ceb54339c278b02607949f3ac4bad7b

SHA256
c7338700af69d22f75a8a1b41e2f3f52c970340fc60c7e6a07c27736e858d815

SHA512
50301d5fe3307f447a8bf1fb7cf722523daeffabd20508b6008117826b4c5f66aac6520d09c9c2dcd42f47d65bbd4c27d9a9986b596b67c7fb7649e8610a855a

Download Submit
\Users\Admin\AppData\Local\Temp\7zS8C87D3DC\setup.exe

Filesize
939KB

MD5
9473048566115b9e723ff0ab94c7aa3f

SHA1
86bfc14e25de98ce4f4f64bd1e905f2b70460037

SHA256
17fe7eaec8b61c24510f5070357937980022a058b406dda3ba88fe276ed9cd67

SHA512
f7b0f65f7b2053637196167188a3bb9221ba95a6594f4583589a42dc2a993930406c52a7874ab39a26dffa8cef8aafab90baa12b92288e25242ac9ca4d484333

Download Submit
\Users\Admin\AppData\Local\Temp\7zSCF706C0C\setup-stub.exe

Filesize
551KB

MD5
03870e58c01dc668a7d03789dcb2f7d8

SHA1
67fbd5a7c345c881861aaab76b02252e6222b013

SHA256
c0d0d3b11e1c54bbda394d92ce70a1effe0c22f5baa07a45ecd49db0a6b905e5

SHA512
c4ba596e5d8dc25607992f3b2e0ebc35866bfa8667feb5c7c6579ead3a1920e1237ab65be2b8126ed5e3b09cd54c2271c25f45941dd4ec6bd0da9eaa42b10093

Download Submit
\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\System.dll

Filesize
22KB

MD5
b361682fa5e6a1906e754cfa08aa8d90

SHA1
c6701aee0c866565de1b7c1f81fd88da56b395d3

SHA256
b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

SHA512
2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

Download Submit
\Users\Admin\AppData\Local\Temp\nsj2B66.tmp\UAC.dll

Filesize
28KB

MD5
d23b256e9c12fe37d984bae5017c5f8c

SHA1
fd698b58a563816b2260bbc50d7f864b33523121

SHA256
ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c

SHA512
13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\CertCheck.dll

Filesize
15KB

MD5
aed814f87d862cb5ceb00fd0a6d60fb8

SHA1
097418e9181e6b4d95f40410cd4dd962fe27c41b

SHA256
d56e2407b6050d669e94e452f1a54ee1859a1751179a3f1e2b4253305a23a0cf

SHA512
69593e12efe0736ada5a9e1b6f3c238a6434b88068361dfd2f7bb3e50addbf9b56ccaee30321362ce085ea700fbab03bae8494bba8c72e9e9983d3faa569b3d2

Download Submit
\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\CityHash.dll

Filesize
53KB

MD5
2021acc65fa998daa98131e20c4605be

SHA1
2e8407cfe3b1a9d839ea391cfc423e8df8d8a390

SHA256
c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14

SHA512
cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948

Download Submit
\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\InetBgDL.dll

Filesize
17KB

MD5
97c607f5d0add72295f8d0f27b448037

SHA1
dfb9a1aa1d3b1f7821152afaac149cad38c8ce3c

SHA256
dc98ed352476af459c91100b8c29073988da19d3adc73e2c2086d25f238544a5

SHA512
ad759062152869089558389c741876029198c5b98fa725e2d2927866dc8b416ae2de871cb2479f614f6d29b6f646bf7191d02837c3cabc15b8185b563bc46268

Download Submit
\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\System.dll

Filesize
22KB

MD5
b361682fa5e6a1906e754cfa08aa8d90

SHA1
c6701aee0c866565de1b7c1f81fd88da56b395d3

SHA256
b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

SHA512
2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

Download Submit
\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\UAC.dll

Filesize
28KB

MD5
d23b256e9c12fe37d984bae5017c5f8c

SHA1
fd698b58a563816b2260bbc50d7f864b33523121

SHA256
ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c

SHA512
13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\UserInfo.dll

Filesize
14KB

MD5
610ad03dec634768cd91c7ed79672d67

SHA1
dc8099d476e2b324c09db95059ec5fd3febe1e1e

SHA256
c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df

SHA512
18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd

Download Submit
\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\UserInfo.dll

Filesize
14KB

MD5
610ad03dec634768cd91c7ed79672d67

SHA1
dc8099d476e2b324c09db95059ec5fd3febe1e1e

SHA256
c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df

SHA512
18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd

Download Submit
\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\WebBrowser.dll

Filesize
103KB

MD5
b53cd4ad8562a11f3f7c7890a09df27a

SHA1
db66b94670d47c7ee436c2a5481110ed4f013a48

SHA256
281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec

SHA512
bb45d93ed13df24a2056040c219cdf36ee44c8cddb7e178fdaabcec63ac965e07f679ca1fa42591bba571992af619aa1dc76e819a7901709df79598a2b0cef81

Download Submit
\Users\Admin\AppData\Local\Temp\nsy16CD.tmp\download.exe

Filesize
53.5MB

MD5
c367314a6d2879aa521def50fa7a90c2

SHA1
d8f276c6c82bb67418944e212fb01a4f8b1798bb

SHA256
18fa45adb09be5a19e912e8eebbc03dde66a3bd31c2702989ac3fbce70b1663a

SHA512
1a596134a64db9cf2a312edbf48618b1f7375254c3f59527d0b76339b65a6ff56816877b356692adedd3f9eb2a070358f9db17aedc326af9ab43de18d1252d4a

Download Submit
memory/1176-488-0x0000000004EE0000-0x0000000004F41000-memory.dmp

Filesize
388KB

Download
memory/1176-291-0x0000000004EE0000-0x0000000004F41000-memory.dmp

Filesize
388KB

Download
memory/2044-96-0x00000000013E0000-0x0000000001441000-memory.dmp

Filesize
388KB

Download
memory/2044-1269-0x00000000013E0000-0x0000000001441000-memory.dmp

Filesize
388KB

Download
memory/2248-1202-0x0000000001350000-0x00000000013B1000-memory.dmp

Filesize
388KB

Download
memory/2248-839-0x0000000001350000-0x00000000013B1000-memory.dmp

Filesize
388KB

Download
memory/2248-473-0x0000000001350000-0x00000000013B1000-memory.dmp

Filesize
388KB

Download
memory/2248-295-0x0000000001350000-0x00000000013B1000-memory.dmp

Filesize
388KB

Download