a9bc3c7b7ae1dcdb8bbfd8bbb2affef82c0810dd0db288cbac416877967e47cb

Analysis

max time kernel
1799s
max time network
1753s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2023, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Open-EID-23.5.0.1939.exe
Size

888KB
MD5

3e89bf19469ec8e19ee00c6062e97883
SHA1

141190992e5e4e79471cfba966c1cd611d3a5dd8
SHA256

a9bc3c7b7ae1dcdb8bbfd8bbb2affef82c0810dd0db288cbac416877967e47cb
SHA512

19e3590ec1819cd9b71cc8d76385bf6a78aae90d84c30591692e6230df42a869441125668672c8936c88e401aacd45215d3d3d4964dbb74651238b97ed768e19
SSDEEP

24576:wNsfiTdYSuVzZH9tH1v16NrqSemdvrqSemX:ET2pZ1ieSemdveSemX

Score

8^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
68	2088	msiexec.exe
70	2088	msiexec.exe
76	2088	msiexec.exe
81	2088	msiexec.exe
82	2088	msiexec.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SETA505.tmp	rundll32.exe
File created	C:\Windows\system32\DRIVERS\SETA505.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\atrfiltr.sys	rundll32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	Open-EID-23.5.0.1939.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{058adeea-c2f1-4a0e-8874-731a84f2b1cb} = "\"C:\\ProgramData\\Package Cache\\{058adeea-c2f1-4a0e-8874-731a84f2b1cb}\\Open-EID-23.5.0.1939.exe\" /burn.runonce"	Open-EID-23.5.0.1939.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	Open-EID-23.5.0.1939.exe
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	qdigidoc4.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAF2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAF5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\esteidcm.inf_amd64_c70614546d51c431\esteidcm_64.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\esteidcm.inf_amd64_c70614546d51c431\esteidcm.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File created	C:\Windows\syswow64\SET54ED.tmp	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\SET5848.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\SET5849.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\SET585A.tmp	DrvInst.exe
File created	C:\Windows\system32\SETA516.tmp	rundll32.exe
File opened for modification	C:\Windows\syswow64\esteidcm.dll	rundll32.exe
File created	C:\Windows\SysWOW64\OcsPKCS11Wrapper.dll	msiexec.exe
File opened for modification	C:\Windows\system32\SETA516.tmp	rundll32.exe
File created	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAE1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAF4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}	DrvInst.exe
File created	C:\Windows\system32\OcsPKCS11Wrapper.dll	msiexec.exe
File opened for modification	C:\Windows\system32\EstIDMiniDriver64.dll	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\esteidcm_64.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File created	C:\Windows\system32\SET524C.tmp	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\EstIDMiniDriver64.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\esteidcm_32.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\esteidcm.inf_amd64_c70614546d51c431\atrfiltr_64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\SET5849.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\estidminidriver.inf_amd64_ffc46e08d080e1d9\EstIDMiniDriver.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\esteidcm.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\EstIDMiniDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\estidminidriver.inf_amd64_ffc46e08d080e1d9\EstIDMiniDriver.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\SET5848.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\EstIDMiniDriver.dll	DrvInst.exe
File created	C:\Windows\syswow64\SETA536.tmp	rundll32.exe
File created	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAF2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\esteidcm.inf_amd64_c70614546d51c431\esteidcm.inf	DrvInst.exe
File created	C:\Windows\SysWOW64\scardspen.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\SET5859.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAF4.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\SET524C.tmp	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAF3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\esteidcm.inf_amd64_c70614546d51c431\esteidcm64.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\SET5859.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\estidminidriver.inf_amd64_ffc46e08d080e1d9\EstIDMiniDriver64.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAE1.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\EstIDMinidriver.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\esteidcm.dll	rundll32.exe
File opened for modification	C:\Windows\syswow64\SETA536.tmp	rundll32.exe
File created	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAF5.tmp	DrvInst.exe
File opened for modification	C:\Windows\syswow64\EstIDMiniDriver.dll	rundll32.exe
File created	C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\SET585A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\esteidcm64.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAF3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\atrfiltr_64.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\estidminidriver.inf_amd64_ffc46e08d080e1d9\EstIDMinidriver.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\estidminidriver.inf_amd64_ffc46e08d080e1d9\EstIDMinidriver.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\esteidcm.inf_amd64_c70614546d51c431\esteidcm_32.dll	DrvInst.exe
File created	C:\Windows\system32\EstIDMinidriver64.dll	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\IDEMIA\AWP\DLLs\OcsCryptokiEST.dll	msiexec.exe
File created	C:\Program Files (x86)\IDEMIA\AWP\DLLs\OcsCryptolib_P11.dll	msiexec.exe
File created	C:\Program Files\Open-EID\msvcp140_1.dll	msiexec.exe
File created	C:\Program Files\Open-EID\Qt6Core.dll	msiexec.exe
File created	C:\Program Files\Open-EID\vcruntime140_1.dll	msiexec.exe
File created	C:\Program Files\Open-EID\web-eid.exe	msiexec.exe
File created	C:\Program Files\IDEMIA\AWP\DLLs\OcsReaderPCSC2RUS.dll	msiexec.exe
File created	C:\Program Files\Open-EID\imageformats\qjpeg.dll	msiexec.exe
File created	C:\Program Files\Open-EID\eu.webeid.firefox.json	msiexec.exe
File created	C:\Program Files\Open-EID\schema\XAdES01903v141-201601.xsd	msiexec.exe
File created	C:\Program Files\Open-EID\schema\OpenDocument_manifest_v1_2.xsd	msiexec.exe
File created	C:\Program Files\Open-EID\schema\OpenDocument_dsig.xsd	msiexec.exe
File created	C:\Program Files (x86)\IDEMIA\AWP\DLLs\OcsReaderstdRUS.dll	msiexec.exe
File created	C:\Program Files\Open-EID\opengl32sw.dll	msiexec.exe
File created	C:\Program Files\Open-EID\Qt6Core5Compat.dll	msiexec.exe
File created	C:\Program Files\Open-EID\Qt6Gui.dll	msiexec.exe
File created	C:\Program Files\Open-EID\platforms\qwindows.dll	msiexec.exe
File created	C:\Program Files\Open-EID\schema\en_31916201v010101.xsd	msiexec.exe
File created	C:\Program Files\Open-EID\Qt6SvgWidgets.dll	msiexec.exe
File created	C:\Program Files\Open-EID\atrfiltr_64.sys	msiexec.exe
File created	C:\Program Files\Minidriver\ESTID\EstIDMinidriver.dll	msiexec.exe
File created	C:\Program Files\IDEMIA\AWP\DLLs\OcsCryptolib_P11.dll	msiexec.exe
File created	C:\Program Files\IDEMIA\AWP\DLLs\OcsIASMod.dll	msiexec.exe
File created	C:\Program Files (x86)\IDEMIA\AWP\DLLs\OcsReaderPCSC2.dll	msiexec.exe
File created	C:\Program Files\IDEMIA\AWP\DLLs\OcsReaderStd.dll	msiexec.exe
File created	C:\Program Files\Open-EID\D3DCompiler_47.dll	msiexec.exe
File created	C:\Program Files\Open-EID\Qt6Widgets.dll	msiexec.exe
File created	C:\Program Files\Open-EID\digidoc-tool.exe	msiexec.exe
File created	C:\Program Files\Open-EID\schema\OpenDocument_manifest.xsd	msiexec.exe
File created	C:\Program Files\Open-EID\schema\xml.xsd	msiexec.exe
File created	C:\Program Files\Open-EID\esteidcm64.cat	msiexec.exe
File created	C:\Program Files\Open-EID\esteidcm.cat	msiexec.exe
File created	C:\Program Files\Open-EID\digidocpp.dll	msiexec.exe
File created	C:\Program Files\Open-EID\schema\conf.xsd	msiexec.exe
File created	C:\Program Files\Open-EID\schema\xmldsig-core-schema.xsd	msiexec.exe
File created	C:\Program Files\Open-EID\esteidcm_64.dll	msiexec.exe
File created	C:\Program Files (x86)\IDEMIA\AWP\DLLs\OcsCryptokiEST.dll	msiexec.exe
File created	C:\Program Files\IDEMIA\AWP\DLLs\OcsCryptokiRUS.dll	msiexec.exe
File created	C:\Program Files (x86)\IDEMIA\AWP\COPYING	msiexec.exe
File created	C:\Program Files\IDEMIA\AWP\OCSMiddlewareConf.xml	msiexec.exe
File created	C:\Program Files\Open-EID\ID-updater.exe	msiexec.exe
File created	C:\Program Files\Open-EID\imageformats\qsvg.dll	msiexec.exe
File created	C:\Program Files\Open-EID\EsteidShellExtension.dll	msiexec.exe
File created	C:\PROGRA~1\DIFX\4CBAA680AB78144E\DIFxAppA.dll	MsiExec.exe
File created	C:\Program Files (x86)\IDEMIA\AWP\DLLs\OcsReaderstdEST.dll	msiexec.exe
File created	C:\Program Files (x86)\IDEMIA\AWP\DLLs\OcsCryptoki.dll	msiexec.exe
File created	C:\Program Files\Open-EID\msvcp140_2.dll	msiexec.exe
File created	C:\Program Files\Open-EID\qdigidoc4.exe	msiexec.exe
File created	C:\Program Files\IDEMIA\AWP\DLLs\OcsReaderPCSC2EST.dll	msiexec.exe
File created	C:\Program Files\Minidriver\ESTID\EstIDMinidriver.inf	msiexec.exe
File created	C:\Program Files\Open-EID\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\Open-EID\798.p12	msiexec.exe
File created	C:\Program Files (x86)\IDEMIA\AWP\DLLs\OcsReaderPCSC2EST.dll	msiexec.exe
File created	C:\Program Files\IDEMIA\AWP\DLLs\OcsReaderstdEST.dll	msiexec.exe
File created	C:\Program Files\Minidriver\ESTID\EstIDMinidriver.cat	msiexec.exe
File created	C:\Program Files (x86)\IDEMIA\AWP\OCSMiddlewareConf.xml	msiexec.exe
File created	C:\Program Files\Open-EID\schema\ts_119612v020201_201601xsd.xsd	msiexec.exe
File created	C:\Program Files\Open-EID\schema\XAdES01903v132-201601.xsd	msiexec.exe
File created	C:\Program Files\Minidriver\ESTID\EstIDMinidriver64.dll	msiexec.exe
File created	C:\Program Files\IDEMIA\AWP\DLLs\OcsReaderPCSC2.dll	msiexec.exe
File created	C:\Program Files\Open-EID\atrfiltr_32.sys	msiexec.exe
File created	C:\Program Files\IDEMIA\AWP\DLLs\OcsCryptoki.dll	msiexec.exe
File created	C:\Program Files\Open-EID\libssl-1_1-x64.dll	msiexec.exe
File created	C:\Program Files\Open-EID\Qt6PrintSupport.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI56B7.tmp	msiexec.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\Installer\SourceHash{31D91B4D-A8A8-4C60-8C6C-A9CF7CAB257E}	msiexec.exe
File opened for modification	C:\Windows\Installer\e589abe.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8C15E6D5-4FCE-4774-BF1D-EB41F8CC9B75}	msiexec.exe
File created	C:\Windows\Installer\e589aa9.msi	msiexec.exe
File created	C:\Windows\Installer\e589ab3.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9AB425B2-8F5F-4C59-98DA-842AF61A68C2}	msiexec.exe
File created	C:\Windows\Installer\e589abd.msi	msiexec.exe
File created	C:\Windows\Installer\e589ac2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4426.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{E8616345-2F3F-46E8-B8CC-11B6E5B701D2}\AWP.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D07.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\e589abe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589ac3.msi	msiexec.exe
File created	C:\Windows\Installer\e589ab4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e589ab4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589aa5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA081.tmp	msiexec.exe
File created	C:\Windows\Installer\{E8616345-2F3F-46E8-B8CC-11B6E5B701D2}\AWP.ico	msiexec.exe
File created	C:\Windows\Installer\e589aaf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589aaa.msi	msiexec.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI44A9.tmp	msiexec.exe
File created	C:\Windows\Installer\e589aa5.msi	msiexec.exe
File created	C:\Windows\Installer\e589ac3.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\MSI2D07.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e589ab9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A18.tmp	msiexec.exe
File created	C:\Windows\Installer\{9AB425B2-8F5F-4C59-98DA-842AF61A68C2}\qdigidoc4.ico	msiexec.exe
File created	C:\Windows\Installer\e589aaa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4BF8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18F.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e589aae.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{41A1F6B4-14CD-4877-883D-D9ECB772A1BE}\web_eid.exe	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\{41A1F6B4-14CD-4877-883D-D9ECB772A1BE}\web_eid.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D07.tmp-\FirefoxAction.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2D07.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA247.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA96C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e589ab9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{9AB425B2-8F5F-4C59-98DA-842AF61A68C2}\qdigidoc4.ico	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2EE8A8F1-7D2F-4C0F-BEB4-EE1451C6484D}	msiexec.exe
File created	C:\Windows\Installer\e589ac7.msi	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI4AFD.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\Installer\SourceHash{EA515788-340A-428E-8DE6-F79C84CBBFCA}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2D07.tmp-\System.ValueTuple.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e589aaf.msi	msiexec.exe
File created	C:\Windows\Installer\{31D91B4D-A8A8-4C60-8C6C-A9CF7CAB257E}\idupdater.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E8616345-2F3F-46E8-B8CC-11B6E5B701D2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{31D91B4D-A8A8-4C60-8C6C-A9CF7CAB257E}\idupdater.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{41A1F6B4-14CD-4877-883D-D9ECB772A1BE}	msiexec.exe
File created	C:\Windows\Installer\e589ab8.msi	msiexec.exe

Executes dropped EXE 4 IoCs

pid	Process
3360	Open-EID-23.5.0.1939.exe
2524	Open-EID-23.5.0.1939.exe
5004	ID-updater.exe
2564	qdigidoc4.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4140	sc.exe

Loads dropped DLL 59 IoCs

pid	Process
3360	Open-EID-23.5.0.1939.exe
420	MsiExec.exe
1988	MsiExec.exe
420	MsiExec.exe
4176	MsiExec.exe
2492	MsiExec.exe
4176	MsiExec.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
5004	ID-updater.exe
2268	MsiExec.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe
2564	qdigidoc4.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5606A547-759D-43DA-AEEB-D3BF1D1E816D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5606A547-759D-43DA-AEEB-D3BF1D1E816D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5606A547-759D-43DA-AEEB-D3BF1D1E816D}\InprocServer32\ = "C:\\Program Files\\Open-EID\\EsteidShellExtension.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5606A547-759D-43DA-AEEB-D3BF1D1E816D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000754718877b32d5760000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000754718870000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000000032000000ffffffff00000000070001000068090075471887000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01232000000000020ed0d000000ffffffff00000000070001000068091975471887000000000000d0123200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007547188700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	qdigidoc4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\GrpConv	grpconv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{058adeea-c2f1-4a0e-8874-731a84f2b1cb}\Dependents	Open-EID-23.5.0.1939.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5436168EF3F28E648BCC116B5E7B102D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4B19D138A8A06C4C8C69AFCC7BA52E7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B6F1A14DC41778488D39DCE7B271AEB\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B524BA9F5F895C489AD48A26FA1862C\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{EA515788-340A-428E-8DE6-F79C84CBBFCA}\Version = "3.13.9.16"	Open-EID-23.5.0.1939.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{EA515788-340A-428E-8DE6-F79C84CBBFCA}\DisplayName = "EstEID Shell Extension"	Open-EID-23.5.0.1939.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{058adeea-c2f1-4a0e-8874-731a84f2b1cb}\ = "{058adeea-c2f1-4a0e-8874-731a84f2b1cb}"	Open-EID-23.5.0.1939.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	qdigidoc4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FEF0E0F4CBD0B184D918802971047F18\4B6F1A14DC41778488D39DCE7B271AEB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B524BA9F5F895C489AD48A26FA1862C\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B524BA9F5F895C489AD48A26FA1862C\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B524BA9F5F895C489AD48A26FA1862C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{9AB425B2-8F5F-4C59-98DA-842AF61A68C2}v4.3.0.4438\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9AB425B2-8F5F-4C59-98DA-842AF61A68C2}\Dependents	Open-EID-23.5.0.1939.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1F8A8EE2F2D7F0C4EB4BEE41156C84D4\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{2EE8A8F1-7D2F-4C0F-BEB4-EE1451C6484D}v23.5.0.1939\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	qdigidoc4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D6E51C8ECF44774FBD1BE148FCCB957\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5D6E51C8ECF44774FBD1BE148FCCB957\minidriver	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.cdoc	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qdigidoc4.asics\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B524BA9F5F895C489AD48A26FA1862C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{9AB425B2-8F5F-4C59-98DA-842AF61A68C2}v4.3.0.4438\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\887515AEA043E824D86E7FC948BCFBAC\Version = "51183625"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\887515AEA043E824D86E7FC948BCFBAC\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	qdigidoc4.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{8C15E6D5-4FCE-4774-BF1D-EB41F8CC9B75}	Open-EID-23.5.0.1939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D6E51C8ECF44774FBD1BE148FCCB957\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{E8616345-2F3F-46E8-B8CC-11B6E5B701D2}	Open-EID-23.5.0.1939.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5436168EF3F28E648BCC116B5E7B102D\CertSynchronizer_Feature = "AWP.Full"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qdigidoc4.scs\ = "DigiDoc timestamped document"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B524BA9F5F895C489AD48A26FA1862C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\887515AEA043E824D86E7FC948BCFBAC\SourceList\PackageName = "Digidoc_ShellExt-3.13.9.16.x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	qdigidoc4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D6E51C8ECF44774FBD1BE148FCCB957\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	qdigidoc4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.asics\Content Type = "application/vnd.etsi.asic-s+zip"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B524BA9F5F895C489AD48A26FA1862C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{058adeea-c2f1-4a0e-8874-731a84f2b1cb}\Version = "23.5.0.1939"	Open-EID-23.5.0.1939.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4B19D138A8A06C4C8C69AFCC7BA52E7\SourceList\PackageName = "ID-Updater-3.14.0.1069.x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qdigidoc4.edoc\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.sce	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B524BA9F5F895C489AD48A26FA1862C\InstallDigidoc	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\887515AEA043E824D86E7FC948BCFBAC\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{EA515788-340A-428E-8DE6-F79C84CBBFCA}v3.13.9.16\\"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	qdigidoc4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	qdigidoc4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{8C15E6D5-4FCE-4774-BF1D-EB41F8CC9B75}\Version = "3.12.2.158"	Open-EID-23.5.0.1939.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	qdigidoc4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.edoc\ = "qdigidoc4.edoc"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qdigidoc4.scs\DefaultIcon\ = "\"C:\\Program Files\\Open-EID\\qdigidoc4.exe\",1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5606A547-759D-43DA-AEEB-D3BF1D1E816D}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\887515AEA043E824D86E7FC948BCFBAC\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1F8A8EE2F2D7F0C4EB4BEE41156C84D4	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	qdigidoc4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B519F6439D9037E4FA3C52D4D64CC57C\5D6E51C8ECF44774FBD1BE148FCCB957	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5D6E51C8ECF44774FBD1BE148FCCB957	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D6E51C8ECF44774FBD1BE148FCCB957\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8C15E6D5-4FCE-4774-BF1D-EB41F8CC9B75}v3.12.2.158\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5436168EF3F28E648BCC116B5E7B102D\VCRedist = "AWP.Full"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qdigidoc4.ddoc\shell\open\command\ = "\"C:\\Program Files\\Open-EID\\qdigidoc4.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.ddoc	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	qdigidoc4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{8C15E6D5-4FCE-4774-BF1D-EB41F8CC9B75}\DisplayName = "EstEID Minidriver"	Open-EID-23.5.0.1939.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{41A1F6B4-14CD-4877-883D-D9ECB772A1BE}\Dependents	Open-EID-23.5.0.1939.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qdigidoc4.adoc\DefaultIcon\ = "\"C:\\Program Files\\Open-EID\\qdigidoc4.exe\",1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qdigidoc4.asice\shell\open\command\ = "\"C:\\Program Files\\Open-EID\\qdigidoc4.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qdigidoc4.scs\DefaultIcon	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5004	ID-updater.exe
2564	qdigidoc4.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe
2088	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2564	qdigidoc4.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	4824	vssvc.exe
Token: SeRestorePrivilege	4824	vssvc.exe
Token: SeAuditPrivilege	4824	vssvc.exe
Token: SeBackupPrivilege	4404	srtasks.exe
Token: SeRestorePrivilege	4404	srtasks.exe
Token: SeSecurityPrivilege	4404	srtasks.exe
Token: SeTakeOwnershipPrivilege	4404	srtasks.exe
Token: SeBackupPrivilege	4404	srtasks.exe
Token: SeRestorePrivilege	4404	srtasks.exe
Token: SeSecurityPrivilege	4404	srtasks.exe
Token: SeTakeOwnershipPrivilege	4404	srtasks.exe
Token: SeShutdownPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeIncreaseQuotaPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeSecurityPrivilege	2088	msiexec.exe
Token: SeCreateTokenPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeAssignPrimaryTokenPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeLockMemoryPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeIncreaseQuotaPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeMachineAccountPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeTcbPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeSecurityPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeTakeOwnershipPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeLoadDriverPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeSystemProfilePrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeSystemtimePrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeProfSingleProcessPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeIncBasePriorityPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeCreatePagefilePrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeCreatePermanentPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeBackupPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeRestorePrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeShutdownPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeDebugPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeAuditPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeSystemEnvironmentPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeChangeNotifyPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeRemoteShutdownPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeUndockPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeSyncAgentPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeEnableDelegationPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeManageVolumePrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeImpersonatePrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeCreateGlobalPrivilege	2524	Open-EID-23.5.0.1939.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeAuditPrivilege	552	svchost.exe
Token: SeSecurityPrivilege	552	svchost.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3360	Open-EID-23.5.0.1939.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe
860	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
860	firefox.exe
860	firefox.exe
860	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2564	qdigidoc4.exe
860	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 3360	2572	Open-EID-23.5.0.1939.exe	87
PID 2572 wrote to memory of 3360	2572	Open-EID-23.5.0.1939.exe	87
PID 2572 wrote to memory of 3360	2572	Open-EID-23.5.0.1939.exe	87
PID 3360 wrote to memory of 2524	3360	Open-EID-23.5.0.1939.exe	88
PID 3360 wrote to memory of 2524	3360	Open-EID-23.5.0.1939.exe	88
PID 3360 wrote to memory of 2524	3360	Open-EID-23.5.0.1939.exe	88
PID 2088 wrote to memory of 420	2088	msiexec.exe	111
PID 2088 wrote to memory of 420	2088	msiexec.exe	111
PID 2088 wrote to memory of 3296	2088	msiexec.exe	112
PID 2088 wrote to memory of 3296	2088	msiexec.exe	112
PID 3296 wrote to memory of 4032	3296	rundll32.exe	113
PID 3296 wrote to memory of 4032	3296	rundll32.exe	113
PID 4032 wrote to memory of 1468	4032	runonce.exe	114
PID 4032 wrote to memory of 1468	4032	runonce.exe	114
PID 2088 wrote to memory of 1988	2088	msiexec.exe	116
PID 2088 wrote to memory of 1988	2088	msiexec.exe	116
PID 552 wrote to memory of 2344	552	svchost.exe	118
PID 552 wrote to memory of 2344	552	svchost.exe	118
PID 2088 wrote to memory of 1296	2088	msiexec.exe	120
PID 2088 wrote to memory of 1296	2088	msiexec.exe	120
PID 2088 wrote to memory of 1296	2088	msiexec.exe	120
PID 1296 wrote to memory of 4140	1296	cmd.exe	122
PID 1296 wrote to memory of 4140	1296	cmd.exe	122
PID 1296 wrote to memory of 4140	1296	cmd.exe	122
PID 2088 wrote to memory of 4176	2088	msiexec.exe	125
PID 2088 wrote to memory of 4176	2088	msiexec.exe	125
PID 2088 wrote to memory of 4404	2088	msiexec.exe	126
PID 2088 wrote to memory of 4404	2088	msiexec.exe	126
PID 2088 wrote to memory of 2492	2088	msiexec.exe	127
PID 2088 wrote to memory of 2492	2088	msiexec.exe	127
PID 552 wrote to memory of 4688	552	svchost.exe	128
PID 552 wrote to memory of 4688	552	svchost.exe	128
PID 2088 wrote to memory of 5004	2088	msiexec.exe	129
PID 2088 wrote to memory of 5004	2088	msiexec.exe	129
PID 2088 wrote to memory of 2268	2088	msiexec.exe	130
PID 2088 wrote to memory of 2268	2088	msiexec.exe	130
PID 2088 wrote to memory of 2268	2088	msiexec.exe	130
PID 2268 wrote to memory of 1756	2268	MsiExec.exe	131
PID 2268 wrote to memory of 1756	2268	MsiExec.exe	131
PID 2268 wrote to memory of 1756	2268	MsiExec.exe	131
PID 8 wrote to memory of 860	8	firefox.exe	136
PID 8 wrote to memory of 860	8	firefox.exe	136
PID 8 wrote to memory of 860	8	firefox.exe	136
PID 8 wrote to memory of 860	8	firefox.exe	136
PID 8 wrote to memory of 860	8	firefox.exe	136
PID 8 wrote to memory of 860	8	firefox.exe	136
PID 8 wrote to memory of 860	8	firefox.exe	136
PID 8 wrote to memory of 860	8	firefox.exe	136
PID 8 wrote to memory of 860	8	firefox.exe	136
PID 8 wrote to memory of 860	8	firefox.exe	136
PID 8 wrote to memory of 860	8	firefox.exe	136
PID 860 wrote to memory of 2268	860	firefox.exe	137
PID 860 wrote to memory of 2268	860	firefox.exe	137
PID 860 wrote to memory of 4376	860	firefox.exe	138
PID 860 wrote to memory of 4376	860	firefox.exe	138
PID 860 wrote to memory of 4376	860	firefox.exe	138
PID 860 wrote to memory of 4376	860	firefox.exe	138
PID 860 wrote to memory of 4376	860	firefox.exe	138
PID 860 wrote to memory of 4376	860	firefox.exe	138
PID 860 wrote to memory of 4376	860	firefox.exe	138
PID 860 wrote to memory of 4376	860	firefox.exe	138
PID 860 wrote to memory of 4376	860	firefox.exe	138
PID 860 wrote to memory of 4376	860	firefox.exe	138
PID 860 wrote to memory of 4376	860	firefox.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Open-EID-23.5.0.1939.exe
"C:\Users\Admin\AppData\Local\Temp\Open-EID-23.5.0.1939.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\Temp\{959A2ABE-C1AB-4F2E-B384-E9B6B5968FBB}\.cr\Open-EID-23.5.0.1939.exe
  "C:\Windows\Temp\{959A2ABE-C1AB-4F2E-B384-E9B6B5968FBB}\.cr\Open-EID-23.5.0.1939.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Open-EID-23.5.0.1939.exe" -burn.filehandle.attached=532 -burn.filehandle.self=548
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\.be\Open-EID-23.5.0.1939.exe
    "C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\.be\Open-EID-23.5.0.1939.exe" -q -burn.elevated BurnPipe.{F7D01C43-A5A0-4FED-B16A-3FB52646912B} {EB768F7C-B0BB-40E8-9493-9B6D8A0E6ADC} 3360
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2524

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7D4CEB423672D560B63924BA32B4A0B1
  2⤵
  - Loads dropped DLL
  PID:420
- C:\Windows\system32\rundll32.exe
  rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Program Files\Open-EID\\\esteidcm.inf
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\runonce.exe
    "C:\Windows\system32\runonce.exe" -r
    3⤵
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\System32\grpconv.exe
      "C:\Windows\System32\grpconv.exe" -o
      4⤵
      Modifies data under HKEY_USERS
      PID:1468
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 22C981631DAE981A4510C8B7AE398439 E Global\MSI0000
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\\\cmd.exe /c "sc config SCardSvr start= auto"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\SysWOW64\sc.exe
    sc config SCardSvr start= auto
    3⤵
    - Launches sc.exe
    PID:4140
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A927A9C8A753D75E7F480FCEC7C45558
  2⤵
  - Loads dropped DLL
  PID:4176
- C:\Windows\system32\rundll32.exe
  rundll32 advpack.dll,LaunchINFSection C:\Program Files\Minidriver\ESTID\\\EstIDMinidriver.inf,Minidriver64_Install
  2⤵
  - Drops file in System32 directory
  PID:4404
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 608B6D2A4B2CA1D2AC98B82CD9B7472D E Global\MSI0000
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2492
- C:\Program Files\Open-EID\ID-updater.exe
  "C:\Program Files\Open-EID\ID-updater.exe" -weekly
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  PID:5004
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0321B197CE6C08A14E0F514FF3B261DC E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2D07.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240791171 157 FirefoxAction!FirefoxAction.FirefoxActions.ExtensionSettingsInstall
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Open-EID\esteidcm.inf" "9" "411c40317" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "C:\Program Files\Open-EID"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2344
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Minidriver\ESTID\EstIDMinidriver.inf" "9" "41c60b1cf" "0000000000000154" "WinSta0\Default" "000000000000014C" "208" "C:\Program Files\Minidriver\ESTID"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -s SCardSvr
1⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3884

C:\Program Files\Open-EID\qdigidoc4.exe
"C:\Program Files\Open-EID\qdigidoc4.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4880

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.0.77147230\764362528" -parentBuildID 20221007134813 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4590d5ef-b426-40e8-91ed-8c1a08050329} 860 "\\.\pipe\gecko-crash-server-pipe.860" 1992 1f46a0d6a58 gpu
    3⤵
    PID:2268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.1.1312954\887591664" -parentBuildID 20221007134813 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e4ae704-2f44-4873-a9d3-d8d2a3968055} 860 "\\.\pipe\gecko-crash-server-pipe.860" 2392 1f469832e58 socket
    3⤵
    PID:4376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.2.1327833964\2051771603" -childID 1 -isForBrowser -prefsHandle 3100 -prefMapHandle 3076 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15948111-ca78-4c01-a54a-480a04289c1e} 860 "\\.\pipe\gecko-crash-server-pipe.860" 3148 1f46e01ff58 tab
    3⤵
    PID:1172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.3.121103719\1419858769" -childID 2 -isForBrowser -prefsHandle 3608 -prefMapHandle 3604 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fadce9df-3d28-432c-9927-9fdabecd6045} 860 "\\.\pipe\gecko-crash-server-pipe.860" 3616 1f46c735558 tab
    3⤵
    PID:724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.4.1684128886\1554304482" -childID 3 -isForBrowser -prefsHandle 4224 -prefMapHandle 4204 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b52fc40-26a4-42bf-8cbd-44320973acf0} 860 "\\.\pipe\gecko-crash-server-pipe.860" 4220 1f46f4cc958 tab
    3⤵
    PID:1652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.5.1603597700\2052286042" -childID 4 -isForBrowser -prefsHandle 5076 -prefMapHandle 5100 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f48324a-9fd2-4c76-998b-3688fba6d356} 860 "\\.\pipe\gecko-crash-server-pipe.860" 5104 1f4702c0558 tab
    3⤵
    PID:4928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.7.399456752\1872971283" -childID 6 -isForBrowser -prefsHandle 5436 -prefMapHandle 5440 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3748415-e63b-4abc-9835-1cd309203445} 860 "\\.\pipe\gecko-crash-server-pipe.860" 5428 1f470321a58 tab
    3⤵
    PID:2808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.6.1674717641\1335394195" -childID 5 -isForBrowser -prefsHandle 5220 -prefMapHandle 5076 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ea8089b-36b8-4361-ae79-9a069fccd39e} 860 "\\.\pipe\gecko-crash-server-pipe.860" 5208 1f470322358 tab
    3⤵
    PID:1988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.8.1487215334\1964672146" -childID 7 -isForBrowser -prefsHandle 6172 -prefMapHandle 6092 -prefsLen 29889 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63e1c3ce-c231-431c-b2c5-12f11fc1e91c} 860 "\\.\pipe\gecko-crash-server-pipe.860" 6160 1f47866fb58 tab
    3⤵
    PID:1480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.9.1894031559\2077614448" -childID 8 -isForBrowser -prefsHandle 4392 -prefMapHandle 4388 -prefsLen 30200 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a77fe12-c4cd-44a4-bdd6-0d1859ce27ad} 860 "\\.\pipe\gecko-crash-server-pipe.860" 4304 1f478e9ca58 tab
    3⤵
    PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.10.103391517\213582583" -childID 9 -isForBrowser -prefsHandle 5152 -prefMapHandle 5136 -prefsLen 30200 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62fa12f1-09cb-4134-85e2-497657437137} 860 "\\.\pipe\gecko-crash-server-pipe.860" 5164 1f478e9e558 tab
    3⤵
    PID:1384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.12.696974399\107369353" -childID 11 -isForBrowser -prefsHandle 9916 -prefMapHandle 10208 -prefsLen 30200 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9960001-60f3-45cf-a803-fd1a5977f1cc} 860 "\\.\pipe\gecko-crash-server-pipe.860" 10296 1f469eb7c58 tab
    3⤵
    PID:324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.11.1463100862\749220019" -childID 10 -isForBrowser -prefsHandle 10216 -prefMapHandle 10220 -prefsLen 30200 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e6ed0f1-2e5a-4418-812c-950b6f04a0a7} 860 "\\.\pipe\gecko-crash-server-pipe.860" 10208 1f469ec2958 tab
    3⤵
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.14.940244419\1085745590" -childID 13 -isForBrowser -prefsHandle 5164 -prefMapHandle 5640 -prefsLen 30780 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a12a9e48-ae86-4fa1-b309-24b87ec1fa48} 860 "\\.\pipe\gecko-crash-server-pipe.860" 6104 1f46c9bf958 tab
    3⤵
    PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.13.94591726\877354848" -childID 12 -isForBrowser -prefsHandle 5584 -prefMapHandle 5580 -prefsLen 30780 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c248b6e6-65ee-422b-a036-0cec188eb3be} 860 "\\.\pipe\gecko-crash-server-pipe.860" 5572 1f46a0d7358 tab
    3⤵
    PID:2036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.15.541693877\1204640489" -childID 14 -isForBrowser -prefsHandle 4352 -prefMapHandle 5248 -prefsLen 30780 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63337f5c-e59f-4667-a510-f9fa3a986171} 860 "\\.\pipe\gecko-crash-server-pipe.860" 9952 1f469eb7c58 tab
    3⤵
    PID:3544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.16.776410837\26043748" -childID 15 -isForBrowser -prefsHandle 10052 -prefMapHandle 10192 -prefsLen 30780 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4f53cf6-ff2b-4953-841a-785b07548403} 860 "\\.\pipe\gecko-crash-server-pipe.860" 9976 1f469ec0b58 tab
    3⤵
    PID:8
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.17.1706871512\624796754" -childID 16 -isForBrowser -prefsHandle 4732 -prefMapHandle 5432 -prefsLen 30789 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b3d850d-8492-4b5b-8fe6-d5b9ccbc3f50} 860 "\\.\pipe\gecko-crash-server-pipe.860" 9392 1f475390a58 tab
    3⤵
    PID:2060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.18.1062849795\542361041" -childID 17 -isForBrowser -prefsHandle 10124 -prefMapHandle 10128 -prefsLen 30789 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {476017d3-586b-4ed0-8a2e-8acd9ccf6a08} 860 "\\.\pipe\gecko-crash-server-pipe.860" 10136 1f478128858 tab
    3⤵
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.20.171502864\1527137469" -childID 19 -isForBrowser -prefsHandle 5456 -prefMapHandle 9932 -prefsLen 30789 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2774dbdb-ac2a-40dc-8b9f-917b4ab22b5c} 860 "\\.\pipe\gecko-crash-server-pipe.860" 4624 1f477952458 tab
    3⤵
    PID:3216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.21.1406386677\376588434" -childID 20 -isForBrowser -prefsHandle 9188 -prefMapHandle 9184 -prefsLen 30789 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebeb2b33-f166-44ff-b319-3841fb986500} 860 "\\.\pipe\gecko-crash-server-pipe.860" 9196 1f477954858 tab
    3⤵
    PID:2948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.19.968701959\749698014" -childID 18 -isForBrowser -prefsHandle 5524 -prefMapHandle 5520 -prefsLen 30789 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92df53e7-d3b7-4590-b135-c3df18cb9333} 860 "\\.\pipe\gecko-crash-server-pipe.860" 5532 1f477951b58 tab
    3⤵
    PID:3548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.22.1008486360\2012179343" -parentBuildID 20221007134813 -prefsHandle 1056 -prefMapHandle 9188 -prefsLen 30789 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b2456f9-1171-4290-955f-7973878daa47} 860 "\\.\pipe\gecko-crash-server-pipe.860" 9916 1f4792f9b58 rdd
    3⤵
    PID:932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.23.1943784985\1192740895" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 8936 -prefMapHandle 10044 -prefsLen 30789 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a706312-e63a-485e-b3dd-9fd40aaf3196} 860 "\\.\pipe\gecko-crash-server-pipe.860" 10040 1f479733358 utility
    3⤵
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.24.1196351016\1405956106" -childID 21 -isForBrowser -prefsHandle 8796 -prefMapHandle 8804 -prefsLen 30789 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e905455f-b6ca-45f7-a9f9-20ae7d749a54} 860 "\\.\pipe\gecko-crash-server-pipe.860" 8852 1f47641c858 tab
    3⤵
    PID:4668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.25.1642021768\206062185" -childID 22 -isForBrowser -prefsHandle 9752 -prefMapHandle 9756 -prefsLen 30789 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18c5512d-82ac-4fe1-9101-9e24f4525963} 860 "\\.\pipe\gecko-crash-server-pipe.860" 9744 1f473954e58 tab
    3⤵
    PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="860.26.177781540\366905421" -childID 23 -isForBrowser -prefsHandle 10000 -prefMapHandle 10024 -prefsLen 30798 -prefMapSize 232675 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f73bea4b-caa7-4337-865c-7837a2f4090f} 860 "\\.\pipe\gecko-crash-server-pipe.860" 10032 1f473955d58 tab
    3⤵
    PID:4008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e589aa8.rbs

Filesize
703KB

MD5
3980eef40ff305a41420eaf58ab9dd31

SHA1
e38c9df055ac980875440e759550affb52014673

SHA256
9ab0227df7926f87eeb04555795123852ce883edfc0f85cdd1751d192de2fa8f

SHA512
432128bb0d823166a1c123c41e83df38b27af416037a78889f2549a7a21825da656de08b217756d7802ae1ce74f774245b1c8083974b8493755b610633ef710f

Download Submit
C:\Config.Msi\e589aad.rbs

Filesize
718KB

MD5
795ad2a0622bd093aa632ef74c9a4eff

SHA1
771d2ca3af4a8ede1380d8418a7b3c2dc635dde2

SHA256
01145774ea33638475bc035ac70db1409ac30cb3714f9386486b32229baf6dc3

SHA512
e00496d0238216573d0f182b4d7ee96e8a84d73d4512efe44e9bab238fa6f2b7e8636c018dc2fe20bc25d90e422cbf407c2d48a82dd1db4f2558311feb995232

Download Submit
C:\Config.Msi\e589ab2.rbs

Filesize
9KB

MD5
7417502a08cb53ed6e2855728139fe41

SHA1
6a385cced489598706836d11ad163a9148344f83

SHA256
6852c9a35257114b825a4af99040105b4705eb8d59cf0416141e00fe4e09d52f

SHA512
d0bab98bdaf49095532d2bfb49321c7497b5e4ea258b1702a25ec6fcb3646ab9dbb2abacb2ee70246b5ba2c761028447018e45a56919507f37f82265e4f3eca9

Download Submit
C:\Config.Msi\e589ab7.rbs

Filesize
9KB

MD5
b05fd8d2372ad432412154fb10906fc8

SHA1
1f021698e88f887fabe87ce564458c602d3ad96b

SHA256
5ae9fbfb7f405d5222fa6e27f2c2aa7cedc4987e9b8a4bc616dde6cfdfd6a928

SHA512
2a9e68d8670632ed5986180b0ae13d8856114a1304a65fc6a198a5f7563192ebdcaa2bd1d7b1ca56afef5bf73ae859a52801bbb8088f1128e20b47956945c151

Download Submit
C:\Config.Msi\e589abc.rbs

Filesize
17KB

MD5
aea233e79d7a5d916db07b619a3c0011

SHA1
c201083f36c679b9c0cac22ad37a7d91a7c163ab

SHA256
6a24338621451489ac4b38714aea05bb48b548ac5c474c879246b389a6d807a1

SHA512
0bf18e862d277c26bf05e3b24777f0bac6ddf61a0932419d9f2533b94e0eee02ed9857c3ea66212bac5d7cab3f9ad12f22cadd2e0ea294136b9242722ca9bea4

Download Submit
C:\Config.Msi\e589ac1.rbs

Filesize
8KB

MD5
21d1d064e4586e17e39075b2b72bc177

SHA1
53d4d08b7df656022cc150a126587655e55d8504

SHA256
6b9d1902759626ebb84876bc46e117ac9f50bfdf58860cc61832bcac5b2eaeb5

SHA512
e615ff582078f1e40553548fa75eb640f1c9696b8233eed6ba4d0a6d5556847d134b483f2a204b35755d2c4af302d385c62067f7b02d2ce7c98b584b8f06cfca

Download Submit
C:\Config.Msi\e589ac6.rbs

Filesize
8KB

MD5
1c67781eaf6bdf06a674d0cd905b8343

SHA1
25e2646c3bf731608ee719ceb17b6fce6f571298

SHA256
edf8bfd9f9b924eb8caed55767b6a9645150258bd2a03154f23622d220b3dcf2

SHA512
285a07afc749e059037e2fe57f2a708eff43e058ecba8d8fd90b585ea2a3e3f6a8e307bde0f6b511062c85b424e37805cb77505360b36ede4a1a0ba9507d1e95

Download Submit
C:\PROGRA~1\MINIDR~1\ESTID\ESTIDM~1.DLL

Filesize
2.7MB

MD5
81a2591e90cf7fa67f06fb35a37976e5

SHA1
63ff8ff9cc38a8ecfdfba1953b323d63dc301e9a

SHA256
c245a0ef71b6c403096bb130480d1affeb8e46c84d10d6ed249f7fd98afb300b

SHA512
b1f30d1aa6840533ffea10ba6f307cc7a2cf16bea5ea3c460477b468f1b2a9aa69673d3a77abff5c4ab2da8bfa0a09225a232202eecbb2a2169895353bd7a7ac

Download Submit
C:\PROGRA~1\MINIDR~1\ESTID\ESTIDM~2.DLL

Filesize
1.9MB

MD5
918204efc529e4b9e790b0f48b80fef2

SHA1
1fd484d3a67bca4b6aadc0ec158d6a5b03644587

SHA256
8f0943215f7df56cf95af4630212ded199df52ce5354d8e1d0af47ec1e98ddcd

SHA512
70e312cec976347ad7d677b52694c59f9fa5c282758c81d8e48086ddc9b9f189605967b4c207856966b914a2b8fdef56bc06de0b5df65c8d783ed8024ac4f3cf

Download Submit
C:\PROGRA~1\MINIDR~1\ESTID\EstIDMiniDriver.cat

Filesize
10KB

MD5
c9cd015f03d18a8717152cc081f69f97

SHA1
602c77ad82accb711bd95d3421821f5e90a5fd6e

SHA256
a0eb9347f0fcc0d8c40794f3e18536b7d932419101876aed5acc0d8698f7bea9

SHA512
89586597e24dabaf909299beef20c17b10f3c465c789116b9097a753ba3870d50e1a49a8d4fe80971e8abcc51a0ed1c1603c887a7610df164df0668424de237f

Download Submit
C:\PROGRA~1\Open-EID\ATRFIL~1.SYS

Filesize
16KB

MD5
c964b0c90ba674bb0b593b3345ecf879

SHA1
d0e8ac8f17c472da4e0bdd9dfd8e05789739da6b

SHA256
e2fc73d80663205ea7fea42d8c8a7cd3dd33d937dc38baff7eecfb58bf19104d

SHA512
9a429afd8f82ab2c0795fcda1401e68364d1fa93469bbc5093f47e4e4cabf7f2506a8bb8a92c78e13e260bb5e7d8200b6f3f5d33ad829feae5ecb1df9f07719a

Download Submit
C:\PROGRA~1\Open-EID\ESTEID~1.DLL

Filesize
284KB

MD5
a392ca4a5e6e14a40ee395120b41832f

SHA1
f3055d3024f7b91b79cbc744e4605ff966ed9ecd

SHA256
a8f9c277aefee26727f15fea1ef66c7d9914eda7b570c44ae754b658cf6971a0

SHA512
04788bf2a886221ca96b89acbb4853c11a9828519b96c048f3b78c2edd5e06fbd3804a9aed6a8695e08ab2846e5aab4d6b89d01a2ca07006a2cb2ac7fca42e8e

Download Submit
C:\PROGRA~1\Open-EID\ESTEID~2.DLL

Filesize
236KB

MD5
3746a61dd5c38e527a1457d4040595c3

SHA1
94cda3bf8ccc289f82c08320e78cb0629fb76f1b

SHA256
15685306da9aefd07f40e2676603623225f090ffdee52227bd6aaa89beb38442

SHA512
d72f85ebaff242697208c991274a8cf5155ac52dd628a31a2a07ccdb3d5abe1dbd84475032d04b0c6b8ef6902c7b16ce903b782bb2c87aa34f7c9f393453910f

Download Submit
C:\PROGRA~1\Open-EID\esteidcm64.cat

Filesize
9KB

MD5
aa9d82922cdea902e1ef06243bbd37be

SHA1
84592378404a716d9d8362d3581c35fa7af17d0c

SHA256
493c3047c026981a92ae6f91d42e7ab1b1986f78cf239a5aaa64263bf8561da1

SHA512
3c8e79bbf7a9ed0f4add967fcca87395cca0da5c0dce40d0e512e5af76a0c26d6d8b5c91215a33da7314ee8c28eea6ee5c227debf86f20bca1e2dedb21c8f357

Download Submit
C:\Program Files\Minidriver\ESTID\EstIDMinidriver.inf

Filesize
11KB

MD5
1cbcc9f1e085ce1187a5836c3f52c2b3

SHA1
64f9b36f91c5ad6f7588eca0fa81e10d2cba7631

SHA256
16d0cbff3539288c83a0a001161f2930f34a21b815d41f4983e9946a319c62bd

SHA512
0596193c647e07b2cb8f94e06333f05dae14afd28d478f81b982c49c1de69fca7694216460090fc01a2fe2c35bcefc044dbbaf1dcb4ef712210f0f0a7386400f

Download Submit
C:\Program Files\Open-EID\ID-updater.exe

Filesize
514KB

MD5
0e3041020cc9a3c37603a58b23d301fa

SHA1
68d29c4133e527be885cca5a9dd79ca51319b883

SHA256
195c780420eb84c11644d58d2e639ec257e6bdd5073737a8d5f15b893ad236c3

SHA512
aa9408e82da05c42046fd7ac177bf5c7db06627b41943ca8a442f93f59789068fce750c6a5097a83ddfa6ecdda97a30c37137a75afd04be9de23b64f8096a578

Download Submit
C:\Program Files\Open-EID\ID-updater.exe

Filesize
514KB

MD5
0e3041020cc9a3c37603a58b23d301fa

SHA1
68d29c4133e527be885cca5a9dd79ca51319b883

SHA256
195c780420eb84c11644d58d2e639ec257e6bdd5073737a8d5f15b893ad236c3

SHA512
aa9408e82da05c42046fd7ac177bf5c7db06627b41943ca8a442f93f59789068fce750c6a5097a83ddfa6ecdda97a30c37137a75afd04be9de23b64f8096a578

Download Submit
C:\Program Files\Open-EID\MSVCP140.dll

Filesize
553KB

MD5
6da7f4530edb350cf9d967d969ccecf8

SHA1
3e2681ea91f60a7a9ef2407399d13c1ca6aa71e9

SHA256
9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da

SHA512
1f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab

Download Submit
C:\Program Files\Open-EID\Qt6Core.dll

Filesize
5.4MB

MD5
2e7b28a9c5bbdd914184fb1b8a8c9bdf

SHA1
1cea110780af2ae243bfb995a9acaeb3ec9e6aca

SHA256
352098400cc80eaef9db419308fabbfeda7c2ffd838062f30ba107c2c82325e5

SHA512
c9bb6a787778fb5838a0ec574aa7cc319f86b5ed62eb9d2cf2a90c76391807d5e886a9376c8105761cf0d46f3bc747cae6f21b972213e09f7026f56e986023a8

Download Submit
C:\Program Files\Open-EID\Qt6Core.dll

Filesize
5.4MB

MD5
2e7b28a9c5bbdd914184fb1b8a8c9bdf

SHA1
1cea110780af2ae243bfb995a9acaeb3ec9e6aca

SHA256
352098400cc80eaef9db419308fabbfeda7c2ffd838062f30ba107c2c82325e5

SHA512
c9bb6a787778fb5838a0ec574aa7cc319f86b5ed62eb9d2cf2a90c76391807d5e886a9376c8105761cf0d46f3bc747cae6f21b972213e09f7026f56e986023a8

Download Submit
C:\Program Files\Open-EID\Qt6Gui.dll

Filesize
7.3MB

MD5
d3d826591dbbc32c5ea8f5b55bd11a76

SHA1
217a1cb96b4f496e188624a65534f2d8360d7447

SHA256
8f41f79a2ce82b4ce6d0de259688502cb1db7110ef8fe1d5bda4dbc49671e014

SHA512
5407c361f1cec11d98f2ab685f5f2d9d8f98f42a79c8ef3886db1ed64545eb7f86c0f91065dd9e270238ab3456232b5ec4d628ade94f8b4e67d648732181e3e2

Download Submit
C:\Program Files\Open-EID\Qt6Gui.dll

Filesize
7.3MB

MD5
d3d826591dbbc32c5ea8f5b55bd11a76

SHA1
217a1cb96b4f496e188624a65534f2d8360d7447

SHA256
8f41f79a2ce82b4ce6d0de259688502cb1db7110ef8fe1d5bda4dbc49671e014

SHA512
5407c361f1cec11d98f2ab685f5f2d9d8f98f42a79c8ef3886db1ed64545eb7f86c0f91065dd9e270238ab3456232b5ec4d628ade94f8b4e67d648732181e3e2

Download Submit
C:\Program Files\Open-EID\Qt6Network.dll

Filesize
1.3MB

MD5
17fd08d25d66f9d9646fe16d533379a0

SHA1
0901780446580bd5f87670ff70b0984d71802b05

SHA256
8eb649e20f041baa55fc10e2c2a4de7695a65106a5bd56c5e474000efdcc6953

SHA512
05cb84d6812ca37b081f3b7d10c54ad0302c8195cc6096229fbdec0f8969b65cb2c0e8233c9cbc4ff323ba62375dc8f6d629d2954129eba075f22a616e85bf99

Download Submit
C:\Program Files\Open-EID\Qt6Network.dll

Filesize
1.3MB

MD5
17fd08d25d66f9d9646fe16d533379a0

SHA1
0901780446580bd5f87670ff70b0984d71802b05

SHA256
8eb649e20f041baa55fc10e2c2a4de7695a65106a5bd56c5e474000efdcc6953

SHA512
05cb84d6812ca37b081f3b7d10c54ad0302c8195cc6096229fbdec0f8969b65cb2c0e8233c9cbc4ff323ba62375dc8f6d629d2954129eba075f22a616e85bf99

Download Submit
C:\Program Files\Open-EID\Qt6Widgets.dll

Filesize
5.8MB

MD5
a8f5ce90c5793ce952a77e1d5e939a42

SHA1
ea327cf14511da16f401b356aa43cf5ae78a0de0

SHA256
75acdc0019acd50d05aad4a00c21bd6e7f049595802a225bba6e489f03c3c476

SHA512
d5dc5c707ebc1396d825299768ee6f83efb3f60c4454ff94d90768109c919bc1c661215d01b387dd782b8f6b06258291db6edb429f9e946a70d5d51ac0f8816e

Download Submit
C:\Program Files\Open-EID\Qt6Widgets.dll

Filesize
5.8MB

MD5
a8f5ce90c5793ce952a77e1d5e939a42

SHA1
ea327cf14511da16f401b356aa43cf5ae78a0de0

SHA256
75acdc0019acd50d05aad4a00c21bd6e7f049595802a225bba6e489f03c3c476

SHA512
d5dc5c707ebc1396d825299768ee6f83efb3f60c4454ff94d90768109c919bc1c661215d01b387dd782b8f6b06258291db6edb429f9e946a70d5d51ac0f8816e

Download Submit
C:\Program Files\Open-EID\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Program Files\Open-EID\VCRUNTIME140_1.dll

Filesize
36KB

MD5
135359d350f72ad4bf716b764d39e749

SHA1
2e59d9bbcce356f0fece56c9c4917a5cacec63d7

SHA256
34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32

SHA512
cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

Download Submit
C:\Program Files\Open-EID\esteidcm.inf

Filesize
24KB

MD5
1a66bf9fb59d0204084faf63da43f2c4

SHA1
8ecb20dc67c6d7323540f312290672739f9342b3

SHA256
7d5a382db9eb0534ed7db4c19248d34445089a9ae5fbba5482ec8663d9924309

SHA512
45d77f6e9fd2ff7fbd40d71c365426273bc04d5d685bc7ea2bda59ed936d07023606d5078ad291dd63b51cba4ebede1624a170fcf6b27ec5b9604c24e191ae50

Download Submit
C:\Program Files\Open-EID\libcrypto-1_1-x64.dll

Filesize
3.3MB

MD5
211976b2df81938838a6a53cbd73d4cf

SHA1
23b91753493e70b13f7040546944fa76ce0978b6

SHA256
2b369f387919936363a047a75246bda7c0170439eeed03613e6998deb9074b98

SHA512
3e5190f9b76c3e3e6c888e6e906e83afce80ad49e415f8ce9c1c6158096cdf79735b6658b5cef4acc3c90063ab9eb429ea9db9df73f453ab14102c81203fe992

Download Submit
C:\Program Files\Open-EID\libcrypto-1_1-x64.dll

Filesize
3.3MB

MD5
211976b2df81938838a6a53cbd73d4cf

SHA1
23b91753493e70b13f7040546944fa76ce0978b6

SHA256
2b369f387919936363a047a75246bda7c0170439eeed03613e6998deb9074b98

SHA512
3e5190f9b76c3e3e6c888e6e906e83afce80ad49e415f8ce9c1c6158096cdf79735b6658b5cef4acc3c90063ab9eb429ea9db9df73f453ab14102c81203fe992

Download Submit
C:\Program Files\Open-EID\msvcp140.dll

Filesize
553KB

MD5
6da7f4530edb350cf9d967d969ccecf8

SHA1
3e2681ea91f60a7a9ef2407399d13c1ca6aa71e9

SHA256
9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da

SHA512
1f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab

Download Submit
C:\Program Files\Open-EID\vcruntime140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Program Files\Open-EID\vcruntime140_1.dll

Filesize
36KB

MD5
135359d350f72ad4bf716b764d39e749

SHA1
2e59d9bbcce356f0fece56c9c4917a5cacec63d7

SHA256
34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32

SHA512
cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
147KB

MD5
92b3454befe1518d3ce27894aae2cf16

SHA1
dd6c675bfed90517b52f936a17ec83c4e9a4db7e

SHA256
39f83d62c36f601562da29fd68ba07044acc6a31594a97fca9217ebf8a0e3bc1

SHA512
63d01320f8c176b36286fd1608827715f8dc3bedf9e4a38e5bdff0315611d06ff744e985641021e1da17824a1717dc350e38c2873688076ee4a18dd8868c6ca2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\doomed\10439

Filesize
15KB

MD5
c3f89026a5e38f1a9585229ec0c808c8

SHA1
e031bedfadf90a01c3249ec0766b5d1834191a11

SHA256
67d23b1922b5ba514ccae6ea469e5f20c6d5b9df571e3c14c6484ec381232d51

SHA512
63f1bd9c52ce485acc6ed19097018450cc01fd1c1c4b1dc4935c49da1ec4d62f3140452cc34998785967a9e1952e1cf53e84df4d4b79b1d46e77b3f2b9830174

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\doomed\13128

Filesize
10KB

MD5
ac4fac13c1519973da89f216563bf681

SHA1
6656b2e73edbfd98b49828ffb35ec2beed11e752

SHA256
342a5b41145b7b4c433761ee34f484075421d5c5ebb9ed2eb5f0cea974a75336

SHA512
5765a1822dd823e13b912296f3b74bcaeda136bde3346ae6e87145ca8eaf3fab0067d1f854d2aa76ec0d9a2185948b0a4f707d6bf382ffa422cdbc2da444acf0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\doomed\1350

Filesize
9KB

MD5
96822e729e2d3efdb4f4935bba48f83a

SHA1
4344b9c78f78bde77ba8f2c8f547fe2057c07a58

SHA256
2b3d87ebedc49ec181f4fd72f44ac8eaee1fcf5596bc424315c7ca2f69c03133

SHA512
35d45f4022e1504bef76b64797f49a697626265bc4fd7d75906219d094deb8a4a825b0dd0f00c45ffccc0189a19dcb7f39f217faf621b84bd4cac6850e5c7cbb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\doomed\17036

Filesize
15KB

MD5
73020f4da685d0687579c5c338db92dc

SHA1
d2f70994913bfe7be5003fcadfff2c5cfd72f895

SHA256
2995aaa90e1ea3188f0e219a12890db9d5108817ab8749866dbafa0e5fa40b6a

SHA512
2e7f0f78f048acd7615e2ec3a926edc4cc7dfaa2c80067cd53fb325126e9746cd4154731e6ab531e647ad4498f5a4d17c3e0ecff096b0761e70ef8b4b3383add

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\doomed\19546

Filesize
57KB

MD5
d418ba8faadfdbb54a7936d7e6ce0936

SHA1
0d46a019e6d5834a31902bd6ee7211107f3d6cb1

SHA256
02dad47727f6eb0ddad70b667f3a59f541a9198029403b71b01cec1a99a15d61

SHA512
3643eb75d245734b42fb1707f2c0697b3ebdf92db0c3a3bcaaf5b00471803017bd8babe7eb26e7673b75cd6ededc039bfb913ecb3b3d2eb35b22b08da079d0a7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\doomed\201

Filesize
10KB

MD5
c0281e064c012a1069e05777c6fa9a96

SHA1
ecead9e0c78fb255cc6422457f67b97205d58848

SHA256
fa17e4bf6def4e8d81bf059ec40c93a8afa338a0a7572aab16950a44b641e9c5

SHA512
2dab68993f69205c1f4b921e7d8db39b1bda694f730075cf831d9bf4de64d0d86f234375f0972bfaf0b30263a4015165c995f69de2d46292a3aec513b57f1a98

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\doomed\29053

Filesize
20KB

MD5
f5a26e14417105d4dd94c4db0d2efb96

SHA1
610fa917fda31ec7bcece3effcc5d985f75cff9e

SHA256
8df27821ddc5c65ba7a7c02fcc627d0aa9e22f04649b7b7d15c384c1b4bc974a

SHA512
109e9c69a22eedfce1bbd80178542549fec9963c64541133750abb5fbfb60706c371dedaa7d108ce79a074fdface43356508b374bbfb1a18966d6a3ad4abd4de

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\0CAE7F01DED168463C0E78BC4D41BB6C04ECE0E0

Filesize
101KB

MD5
799862ac7ce55a030054ac5eb7333070

SHA1
976a1012bc77cbe0b64ff790bfa25d70f66ed0e5

SHA256
1e55a6b5576444a92b41ac7602dd2b7bb1311cd323c1ffdc7d0af8d0be98fd70

SHA512
e95fbff6772bf1cb973bbe5bd32c8734029678f3d8bbd0487e7eca486214a0e27bf7f4ee519c12ce7c00aada0fadf8fd47dbc6742d04577942aa89011d23d79f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\118BB2BA245AAA64B01692DF29396B97E11FC1A0

Filesize
14KB

MD5
d908795f752a075383d819b7b8b83b1a

SHA1
43513e3290ce5e168b06de01644e424bc388552d

SHA256
28b17ab2aab4d70ea5f24373125c4b0bcaa5f6c15c80faf4faa942a8003cd9f6

SHA512
999744d664b429623b9f62211dbce64fe33eed0af8736eb5ddcfbb45979f02728f1cdecc3b10959797a72206dc99f8e8e932a344b35924c6e3763faa8c7d368c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\12763D64F257F0EC64E2E46D2635D744BD252378

Filesize
113KB

MD5
42d712e5f918134e50e6ddc6b3da6589

SHA1
b262ecd3fc803515e9ce9bf24497ddb25d4c7ee8

SHA256
e7d8b1a08c685f5bac080d33225a8fda104b3f1f38cd1d91fb3bfb28b350fb01

SHA512
507699c0429b95322d12fa231c09e0514b8ac5e99be76dd68e6dc68750d08d6bd96c265484fe8ffcdc179739560aaaf2483b7191a423f3473199649e941f0c40

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\16F7285B4EF01826C69F3DFC106A9E2D88CF9F70

Filesize
1.2MB

MD5
fffecf2392ae2d83ec4f97e91ab18d4f

SHA1
529a50283e15ff2c8b65cf19cc3ec3917ea356c2

SHA256
36b2378491fdcfe03965ec000fac03fa2cb313aaf91e2f371ca47e4aafd3e9cd

SHA512
749a1cadca8d649da1bb82f2eab5f9c1ce2b5d9627e8bcb0710d6b20228fd0333149d480652c3a5d048892152ea80ce9ac0248ed77e2e8989b7d0a63db7decb8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\189702A6B3C21F8824571624B1E6ADA2019D5083

Filesize
769KB

MD5
9d0d4fd6e0e8dcea3e64ed0bab8b586d

SHA1
503957c1a2d6c1eea3e5337dd3cdc5557e022705

SHA256
ade447f27077f7195ba91a806bac88b67d082a89505d64ab48f0a2ca28d3dbeb

SHA512
5e2db66746931f5c9e086b983a4f6eca0eefe40456da02d4abf35369861ff15710c2b35d14874af44eb7ff9deea0be91cdbe0a117f8e786d3dbf6e001e641b6f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\20D28D043076485D2AA3EBA0880D25FE52F1D4C7

Filesize
98KB

MD5
fd2a685566d1f43ad1b70391995d2e0a

SHA1
4dccf5a58737ffb56bb5fa08d5ca625dd0360876

SHA256
a63e2521b756bb0462ece03a2e2fb2b1e1e02e0dfcf001602aedf58415aa8d5e

SHA512
9d9638a47d2be121d51fd3db7971d65feec6dcdd4ff5a4d2254bd806f5eacbe5097d051c456db3033eb44722a2f44d9e22ec2767293b04f88617191ebeb31e4b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\29418C20D1047DFFC69B5BCE6808FC8A21E509F8

Filesize
220KB

MD5
71a13b74fbed45fba37e20697eb17642

SHA1
0e009aec2db90a64fb4102b8b9e13f42f7224b34

SHA256
74554479f1ec033c684dbcf8eb205fe93170098f36abaeef64df12c856b9492f

SHA512
87d2dfd36e037d4427711af25a53d1361fbf650c7d01817a083544a00c5bce16c6813cff61d924dfe08dcd101baab0e7689a18f81271234e64efffe873aba7ed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\5CC78CCFDEF2E990B8ABA7F6E00D65DACB41A8AE

Filesize
995KB

MD5
bb43540ab98a4c60a9f4ba9599cc2a0a

SHA1
e649f07f99cc7f6f0e615c845b3c15caef5f74d6

SHA256
fc3eeef6c2dcf6c8da01b81edc1bdf16a0c7b7e34991b7667685541f074101ba

SHA512
bb4895d9f66236c9bcd366d3f96b7e3f04d2b69a2eef3954078b65b774e991a5d806e9851786ea85696d03e00e797699147a8b90a3ef9b085b818e6eebf2ea0d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\6B68CEFF6E5A7F960EA54103B712D55070203578

Filesize
15KB

MD5
77a31adcdb1013db628fb034f6a81d3e

SHA1
a2c508e34f09e7e8c162f6c181e89f5e26aed058

SHA256
c311a6da03c1c48e502b217fac718c8a8f89b736a9cad5e2a00805b59bcf1f19

SHA512
85c5182e2e160e2a92cfcbf0aceb7dbbb774860fcacde214a0753f4404e02f4fe1c4fa46a85464f058a7d2ab058262344209c00edfdbdc85d580d17d13386c07

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\7735E1B6BA51340E41DB76539F288026CAB47F8F

Filesize
120KB

MD5
8347f7fa0135d1cbec83b52f04a266cb

SHA1
642057830551aed1ab96d2f60faf86195ff19592

SHA256
8692f06bde53b735cf61e37fed2afdcf3be4bae0d2083aaf7041ec010b20f52b

SHA512
4b613d071922443756e608b4c77edcf6365d9504dfaf18e5489d57c7ec29021a1dd5e455aae053fb4907e936fb43f7b1cffdd4b4d6c5a479376f7c094a79ace4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\7D020EA0EF83F1ECB06960DFCEF303FE0C6F1D29

Filesize
42KB

MD5
70c59531461cf2f43c9334cb63dbbc98

SHA1
7f767d2c2f252ec9a9de2296253454206eb48f4e

SHA256
dedaee881b7ad4b6f7af90c68ad31ec3179458f381238956abae498360f2c910

SHA512
0020d4f48d38fe55cc06224c30cc0c4ee768d5bb2376ad06c435cee2a35e5693777976c716deb218ca5615f9679fd6ac1cd592c4a79971bc007c169dd8d85c02

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\7FB3DDB69DC46C5348E975B1F890127F91F9E462

Filesize
4.9MB

MD5
70737ac5ef5369b62b0b5440a8ff7a10

SHA1
da6eac2ba0af0b0c9b707d03aac0502995f37c3c

SHA256
bdadbe84c70c58747854d34487894dcef5b0516a48272d2a5ce7b5c53d4e1623

SHA512
2abeab654fa497a44fc3843f80cd5b73da1c52e5c880aba1db89d0ac52b19f731d04603835f9aafd00852856b59d5502aa7b990b136a38e060d24158a12bd0c0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\94E0A6237583362BEEDE8DFCB03A76C48701F762

Filesize
564KB

MD5
61ebd8cc4e92fd0fb4e27729b9f52aac

SHA1
1aa3873ed3508381aa0b036e7e7e9041cb320e66

SHA256
a8092692ec3381f9453aece1cc09e9686c5b4bd69340eeb2a9d0b1df872d17d1

SHA512
2f82153ce3a4a2dd519632bc9ea4d1bebb41c1fa3ceecea10660547cda2166eb0554f35616d75f639d06b6bc893b5e2157aaadd8f7fb17372e2cc21d851ab9c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\96CF9C9B5207C21485E97B9B0E4E89B9A7CFEBDD

Filesize
18KB

MD5
1b68fcd27b83e3d1a5bc2e41cad8a118

SHA1
91b1c24f88cad4999b2e85f05cb84fd984b5fa5a

SHA256
fefbc4ba56f044561d6805188aca608ac482a07859ea6fa2d3b8ce11a489ea42

SHA512
5893bf181c87d772f89d620fe98c22f285474f0d2f101de05d1b40b85d9d8a30a220272733f5dc4cbddbdca39847936dac7ed6dff92ef20c02edeceeb6e016e8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\9FCE26F3F9396D7D21E77BCBF4425300AE7270EC

Filesize
112KB

MD5
3cc1deefe164a261deb00dc266e66ee5

SHA1
ee03e81304dd65142f4a9f71196d8cdf5d225f4a

SHA256
34e2033ac89ecba47267596e7ae2289113bd198a1a22161a7c6bfc48a794fc09

SHA512
87f96543e80bf8d1aafa06e69e03e45f7ab88afc59337326af5ed68362b4c5516eeeb4de5ea8c337929f3283d4807708ed3e78e8e0a8d4c29eb8b16398c7eabb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\A92477713BAAC1B0CB93139BC3607AE9483F2B8A

Filesize
7.8MB

MD5
268f7a73077518a28f997fa9c3fd6f4e

SHA1
f4d427c3e3d27f9618e12dd876aa91ffccc0e456

SHA256
e0855058d4c69de33d50afb4ff35fee692e5592386f782eb4d74f78c1f746580

SHA512
7603fb74130ab36e5d479378158ecc0b5b5d86fe8b2b85cc6104911cdd134302da3f858afbf0b1b62a4f1894a3c368d039b60f47c2b56551524056d8c14c1f75

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\D618AFE2000B02B7EA9AD22CBFC93D26DF18C91E

Filesize
900KB

MD5
5b5f90b9e831007c7243bda6c26ee79d

SHA1
70ff036673898e8a3ef1b73f17de0356a821e5b0

SHA256
07edd386ee8675786130012007270cbb6c1fc9ef0d75ab9344dde523e5496e5e

SHA512
4126cdcebe6037f08165905d67b13017f7559c4ca37831e66abfc5663e4e0990c6e292779ad291d4de7a9b3d99e0dfe92a185a87d4b8c8023b55c7bcb49553b6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\E24AC8BCFE77BDE9B63705EBE77867574A674A78

Filesize
103KB

MD5
d83608be9ca60b5b0a66de42cad105f1

SHA1
ad8430e74d96096d033c64ad3cb3e4ffa58f12a3

SHA256
97811c4cc5ce0d183ad8927cec0ee683b555b797102b213f984b3630ab3330fa

SHA512
186fe813ef580a1708a6ca79b27e5e0640826bd9d8e397c1116021e41e6f28271c490cc93a646134869bebd09214292d8732f9dc29d5027f2ad8147e91ae269f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\ED9826654AE8BD972BDE17A9E0A449D3F881E430

Filesize
14KB

MD5
6974707aa8c39e78c1cbdb59f459a017

SHA1
04e0992cd7c2acad45072fa6b06124389b37c4b2

SHA256
66cee93cc2d91a7d575598de444b4c52fb1b907e2f0203a82fe45c1b49058eb9

SHA512
5126dd2a0b0c20d5e2cc53d7ff7d396b295ee1301190340c8d757998beed49132bb871b5a75f2bf8421e57e4f22a1c0fee9e7f5876a1d7ecd8859fa5f7870ed6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\F34169848D150254B2577C428045F82D1F1E23A6

Filesize
3.8MB

MD5
18b51af4baa33dd4768e21ba2cbb30c6

SHA1
adb50964633a0b179b01bec55a874872b86ce60a

SHA256
98b3304d1bb8c3182599ef73d0401e8f967490ac8024491ee14c0374e97476c4

SHA512
e646ab7d47a1fd4af9f1aa3f8b2adfc9448dc071e929b29190f817afb7af2edc4b32391c523fed1de58ada1168c4e3823b1088bf7b059e4c46e1f5ed8a0b6275

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\cache2\entries\F96A1A8368D3C3DD1FA81D170326E6C1C65D342F

Filesize
30KB

MD5
2907fc437a21b27e70355e6e7f9c64c8

SHA1
75219fdc92990a0a4618132c72205c599a954447

SHA256
af1b5317891b4eaa461193deef35b24bfa9fbb216389bc87433323d8c7278bf1

SHA512
c5546d673737e66343addafa479ad2762662554f356654ff24615ba760324f04c9eb15d6ca7ec19b62f0d3fcd1602ceae40adaf9fd49e80b5fa1760a1fe36c6c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json

Filesize
67KB

MD5
6c651609d367b10d1b25ef4c5f2b3318

SHA1
0abcc756ea415abda969cd1e854e7e8ebeb6f2d4

SHA256
960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9

SHA512
3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json

Filesize
44KB

MD5
39b73a66581c5a481a64f4dedf5b4f5c

SHA1
90e4a0883bb3f050dba2fee218450390d46f35e2

SHA256
022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17

SHA512
cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json

Filesize
33KB

MD5
0ed0473b23b5a9e7d1116e8d4d5ca567

SHA1
4eb5e948ac28453c4b90607e223f9e7d901301c4

SHA256
eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b

SHA512
464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json

Filesize
33KB

MD5
c82700fcfcd9b5117176362d25f3e6f6

SHA1
a7ad40b40c7e8e5e11878f4702952a4014c5d22a

SHA256
c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780

SHA512
d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json

Filesize
67KB

MD5
df96946198f092c029fd6880e5e6c6ec

SHA1
9aee90b66b8f9656063f9476ff7b87d2d267dcda

SHA256
df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996

SHA512
43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json

Filesize
45KB

MD5
a92a0fffc831e6c20431b070a7d16d5a

SHA1
da5bbe65f10e5385cbe09db3630ae636413b4e39

SHA256
8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c

SHA512
31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json

Filesize
45KB

MD5
6ccd943214682ac8c4ec08b7ec6dbcbd

SHA1
18417647f7c76581d79b537a70bf64f614f60fa2

SHA256
ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b

SHA512
e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_finance.json

Filesize
33KB

MD5
e95c2d2fc654b87e77b0a8a37aaa7fcf

SHA1
b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc

SHA256
384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e

SHA512
9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json

Filesize
67KB

MD5
70ba02dedd216430894d29940fc627c2

SHA1
f0c9aa816c6b0e171525a984fd844d3a8cabd505

SHA256
905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34

SHA512
3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_games.json

Filesize
44KB

MD5
4182a69a05463f9c388527a7db4201de

SHA1
5a0044aed787086c0b79ff0f51368d78c36f76bc

SHA256
35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85

SHA512
40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_health.json

Filesize
33KB

MD5
11711337d2acc6c6a10e2fb79ac90187

SHA1
5583047c473c8045324519a4a432d06643de055d

SHA256
150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565

SHA512
c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json

Filesize
67KB

MD5
bb45971231bd3501aba1cd07715e4c95

SHA1
ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a

SHA256
47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d

SHA512
74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json

Filesize
33KB

MD5
250acc54f92176775d6bdd8412432d9f

SHA1
a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65

SHA256
19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54

SHA512
a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json

Filesize
67KB

MD5
36689de6804ca5af92224681ee9ea137

SHA1
729d590068e9c891939fc17921930630cd4938dd

SHA256
e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52

SHA512
1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json

Filesize
33KB

MD5
2d69892acde24ad6383082243efa3d37

SHA1
d8edc1c15739e34232012bb255872991edb72bc7

SHA256
29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a

SHA512
da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_law_and_government.json

Filesize
68KB

MD5
80c49b0f2d195f702e5707ba632ae188

SHA1
e65161da245318d1f6fdc001e8b97b4fd0bc50e7

SHA256
257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63

SHA512
972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_online_communities.json

Filesize
67KB

MD5
37a74ab20e8447abd6ca918b6b39bb04

SHA1
b50986e6bb542f5eca8b805328be51eaa77e6c39

SHA256
11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f

SHA512
49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_people_and_society.json

Filesize
45KB

MD5
b1bd26cf5575ebb7ca511a05ea13fbd2

SHA1
e83d7f64b2884ea73357b4a15d25902517e51da8

SHA256
4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0

SHA512
edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json

Filesize
44KB

MD5
5b26aca80818dd92509f6a9013c4c662

SHA1
31e322209ba7cc1abd55bbb72a3c15bc2e4a895f

SHA256
dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671

SHA512
29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_real_estate.json

Filesize
67KB

MD5
9899942e9cd28bcb9bf5074800eae2d0

SHA1
15e5071e5ed58001011652befc224aed06ee068f

SHA256
efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a

SHA512
9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_reference.json

Filesize
56KB

MD5
567eaa19be0963b28b000826e8dd6c77

SHA1
7e4524c36113bbbafee34e38367b919964649583

SHA256
3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49

SHA512
6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_science.json

Filesize
56KB

MD5
7a8fd079bb1aeb4710a285ec909c62b9

SHA1
8429335e5866c7c21d752a11f57f76399e5634b6

SHA256
9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32

SHA512
8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_shopping.json

Filesize
67KB

MD5
97d4a0fd003e123df601b5fd205e97f8

SHA1
a802a515d04442b6bde60614e3d515d2983d4c00

SHA256
bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6

SHA512
111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_sports.json

Filesize
56KB

MD5
ce4e75385300f9c03fdd52420e0f822f

SHA1
85c34648c253e4c88161d09dd1e25439b763628c

SHA256
44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14

SHA512
d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\nb_model_build_attachment_travel.json

Filesize
67KB

MD5
48139e5ba1c595568f59fe880d6e4e83

SHA1
5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78

SHA256
4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa

SHA512
57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\personality-provider\recipe_attachment.json

Filesize
1KB

MD5
be3d0f91b7957bbbf8a20859fd32d417

SHA1
fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10

SHA256
fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7

SHA512
8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a

Download Submit
C:\Users\Admin\AppData\Local\Temp\eID_software_20230713064212_000_Minidriver.X64.log

Filesize
1KB

MD5
ad19fe3b1a328e237d4d97ea96a10c6e

SHA1
d0b1f3b0d2d1bb48cce65d568fff94ea18ce0706

SHA256
4faaa523d7ff96564649c59088199b0b019fc4ef985f2b73918cc499b6caac6c

SHA512
ef4eb6fcd7cc67832cdb78c7c98c0fcb93275f42dcb7b7a11965b15eac6ec773fe67f87d4120682926014618c6243873e1458fe0dee4a38e9dba69da7aaeb6c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\eID_software_20230713064212_001_IDEMIA.en_US.X64.log

Filesize
1KB

MD5
2c4d68ffdbaf092d1d8fd4312ea24e42

SHA1
180a8a8fbbdac40e7ff37729572a263135c9b43b

SHA256
a4d4a3ac3f6b325c830518061f998c57670c643ee2190b73b84a6a2b5e8fb213

SHA512
d8a02fdc1110de8eddd3351d03f66ab640753e8547a75e2081dd12a8a9f1f32121e572676e9f35ab8fe3aff4fefda62cdb30065813aeea1e8eb9ae6f6c594acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\eID_software_20230713064212_002_Updater.X64.log

Filesize
1KB

MD5
130955952d000e5e9666027a5702e9dc

SHA1
767be157a4b5c9d83238206c30128a7ae7f5c17e

SHA256
dc24a75971b288ac4f8ea6a4e13f1cf1ad8de7870388aeb9475d12a3d5b44ed8

SHA512
1b69747ea32cd18c82eda0277e9fe5f078dece0e4d569139294b65234f0019539aa6b9cbbe6ac035963f199e949f9dec65593c9b7dc411c66db170a52b533f99

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
a68fcf1ece7ccd1603bbea52b9a8805d

SHA1
eb99040c2495c1336afc0fbe0475a75d94ef2f8a

SHA256
0bacf1b976954e095c5679e158e0c4a388cc967087a2819f97e3ef211f380825

SHA512
84025bc18df2d8e220e753ae21d585d1a5e3df2755052daa0ebda8fc262ecf3cb78a6dbf2d20d87f1d79c71a77033bf609d83368ce72ec38cb240b286f9609f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
13KB

MD5
b3e904ae2549dfef0aa5874a98f21fb4

SHA1
3e46ea60740e65564db19c20771c61208d59c962

SHA256
be4bffe15668ed1c6c85bda6c0b0867cada42f0e95fd1eabd84dc0ef32d9d18b

SHA512
7c230adb9a8d240b5c11189750700a62ea7d36cbe2f5cd18b16a5a9e72b1910899e67eae8524183487988937282f70d60aca3ff5860276ed65ae313e019753b1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
ebdddf19f39358b418b63c772a92ce84

SHA1
c500a5fcdfcd66153d94191c8ba8183e166f535d

SHA256
5a4bd01087f9b35358795937996d9026de73ee5ba2764be90c74206093de5c38

SHA512
5c88677c90d3a91d330fd85b130ec3e96e1c2435a65715bd3a38329262f75eb1be2f284f1acfd4a5c4e0c4a0df2e4162f973677ab493f8002b60f387a808b224

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
16KB

MD5
8e6705d72bdfce582a625299b9b60b7d

SHA1
d6c1faa326a3d025f683411d1039a8311c8a1705

SHA256
d79a0f3bac5177e66490f147199121a23e200a7f80597d16c015bc8947b4d059

SHA512
049afa051ec3f04822d98f0726b25f69c3a88d973c6e51e9322180b28ed6da0a88479a632a276a524a21a24a291e2aec29dbd59321e7ba6283017a41b5ee63a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\bookmarkbackups\bookmarks-2023-07-13_11_-6Gi3IbLxlhswunjpUqQ+A==.jsonlz4

Filesize
943B

MD5
380329abae5900c1bfd31346a1daee01

SHA1
222cb860fedfcc784db0f21eba492ad6aed9e34e

SHA256
c2cc542ce7bee387eaf00ba2a9d425f8f4712584878b2744b0ec39c3f7d48c3d

SHA512
d12b1bea232b9140ffc706f62ff3c27f9e493dc414b60b027670a7892f305c08616221c842389c828a8a3316196f3503f33ad5c37bdee52f476350f0e4b2faf5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\broadcast-listeners.json

Filesize
216B

MD5
1d4faaf19387c5d791d381bbda1d56c5

SHA1
eb49e7cdf1224a0031d40f89edcf68717b847f21

SHA256
c779c47acc1f3d661e63c1ea91c22e5311d243a91bc5822430fac8e54ab6dfae

SHA512
a037d6b598275004c0d50f66c5f5f9c8306ff655bf086b7b8155211b25ce3ac6635a4710e3bb6b5a1ef9f562f3629582b406f523dcdfe96a7dc57eff81b1805e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\prefs-1.js

Filesize
7KB

MD5
0448aeae67af80efb7a2e6d08f129280

SHA1
b16dbe7fde3ebc970710fa071a0ce65854b2738e

SHA256
b3683a1b385109de22708ac1fbaa3675fb445ed1331302aa0974e9ecc8c0c30e

SHA512
3f5c9b904b0ee01f0d6d3660db04da5ba0616f1b3b3662b937bbaade65564dee9eae4830a9aa5542ebf94829cd89c7bde5b5ca22f95258819e9fd748eae8ab76

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\prefs-1.js

Filesize
10KB

MD5
9b32d779e423cd1c50c8f8e933bc5650

SHA1
5b1854b97ffc2c003b9500e2cb4c35e85114bf2b

SHA256
6281a9d74e55a0112601a44f66342c16c158e358f067ec9c9b9e958c343c6faa

SHA512
3ecfec8ed638e1e1da289b595734afdbfc4731a79947b8afd16671c3f898a2b1b5ccc221efb6319d4eb0d634e451cf7483184ae293cca16dba71563ca7157e2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\prefs-1.js

Filesize
10KB

MD5
4f651ab8431458054dac30467ea52271

SHA1
dd82d1602581fc169ce5040a9d9bc74fc6c948d1

SHA256
41f4a987d52c5b88ae68c8310179af7a029373b4a495dfe3640e275b63a8e2cf

SHA512
b5d9ddfa5c3437930e4511fa1a75ac3cda5cbc8100036c0089a82796726ea57c6a49e6155c35638e9d5bd8b7feafba5f0a4e9ca2eb00e7966fe0e665e0d10a48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\prefs.js

Filesize
6KB

MD5
f905d3e2c12e033edd677f526c1de8d1

SHA1
1ab55c90af3119dd79784b55b51857aa89327008

SHA256
5fe14b0589e9e71fa7462129f88db9f16cc3c978261216351f7705b390f18fe8

SHA512
e6e151daa1e735834d0b2bc69e8aa245bdfb843221cf837171b5ae63cf682c128daa15ea57c0b62f7786a0fb4c4231ba5bbbd3ddc303addb8c03df547def1ef9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
368130076e9810a0351ca6d7a17b19cd

SHA1
e801612d13756afadc4762f6c8535b7a8948ea7b

SHA256
08eecd0bab460e4f0eb8a3df708922488ca992406dc0173a705ee28b64e68701

SHA512
06af6d7b43831b0a9e47bce87e0070f067cb81441e3267201d82848a679969629bb5ab92dc19b1a3c7ba5df50f49d5cd3c991a614d58a2a3456d726c874155bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
506ba6f38f3a5a7b2ae2df30fe2a25ec

SHA1
a13e3b74c1e334040da603160f5d19dd3ae1c453

SHA256
41d4b086587f2b70f6f962d3b4e79934c31ca0e4efe02a17e31f8e7007e2019d

SHA512
39be646e08967ec0107f7b99adc78ce870af629fc467b83c2e763c59316143b5b0fa0bf9b85f2ff3ff903cde44acb08aa942d745455fac87d83e748be70ca4f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
da6c2060646c69fd1edb26956c8e9787

SHA1
96d083dd23561926740829d1dd276767b971c0f1

SHA256
a461fcd18c94c8e4177c7e407483be1b14cc6de40ccbb2e40cf72beed048bee7

SHA512
211eb490c921ad30fbfc97456622661005cf4f09ea97a658c06c3cfa513346cedea9d1ee1e953abe89fcc680fd8f8cdf84f48d07b4d80c68796daaef791a6367

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
0a07a9291adac0eceafae72c3111c399

SHA1
7e34b2ece01a766badcb209ec9b67bf194ed1aca

SHA256
a68f44cdf67bb51eb78200e54a7fbf029e79eba5755c62d366d8b5c65bdbc2d5

SHA512
b4062605f46cda4f461dd127050785e10c8f0cb1b03e0f0695553a5e2fd66991b34a5526f91ce1003031b33741c6a7a08c8e4a6db8c93df4b09d98a3057d729b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
cdbe77e9394b18c776601d80a6e99300

SHA1
aa01e014c0eec65e012af5d543c436bac0d22d58

SHA256
d9f046cdf517bf7d8f0a16a4609781d0bdaec6bbca3f6eb60f977464f994e115

SHA512
862722e3b7e532ece5269858878091372e4e1e8bea4c66d48f8a94efc5f62a96861a5bc7dad667d532818b75a510ccaf8c67f42268988b0a16cf66d501a26087

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
d1fd4a884edf3439e16457bbb703fbba

SHA1
31f3593bf370886e16bb27733cafee501e3576e8

SHA256
81773417521cfbc3c6ed951c2471bc33e4b74ef3ccda18eece3080755e4a2963

SHA512
af348d3ff4fb3684f242401c9e7d73656995aa6b272918eb4a6f38a77597f49e66babd708dcaf2af262a32d2c2ec3d4258f301df41d4c101a0029cb9aa2718e4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
0140719810f0ab19c4e013c03c20a523

SHA1
82b94a4b4d31b3287becfc01877c7d64fbdf563f

SHA256
16ed7bccbe2d22ea6c9e0fed1ec602c0be0b4bc55ab1bce43688e14fa7c7dc45

SHA512
76b1c65a7b8e1aef7d971c7639582ecccbeaf7de23447076efe0a28636d217bafbc766b62423695c328d8d1457783ecd34af234050c10cd1e507e8df7d20b41d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
6f79195ad3fef556fb3ad67aa3c1160d

SHA1
18e650c67de591672a32adfad9fbcc2cfb413394

SHA256
c551b5c68f4a01e12d24780acaa143cb0e2bff9444f3a1eb66cbc5308afc0239

SHA512
d084cb306c35fa6770acafabf334337a90e6b425f45f54ac19fb74ba4bd0ae1e9887cb550381e55fcfdf608d06dbd66f1b2969fa413a95f6f8d9328a01b48403

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
723ff7884326d11eff021eda5f166a91

SHA1
0cc02ab9b9e2908b52309656f42800b6a13c4c3d

SHA256
73cc4eb2e02c8f5d9ae9696816172a06670eefbb0c5f8832a3bf3edba2910e2f

SHA512
d66540ddaec9936efb5297bb0003c1935851e69b472f2f1bffe7aa83cc0fe1a3d58392c6da14b7a9d4c8c99b1f00ef24d1cd671d3e99a7ef9184f11822ca6fb4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
e07a66b72464e3885e5a2cb3cc6705fb

SHA1
8f4c2fe85dd235f09307e45c2056986878b99742

SHA256
5ab433ae0e01f9c5cfb38ac74ed5135e6eb1e3fe659c593f58c93902580f9fad

SHA512
387e17f7dca7d2c243efd23bc1ab302abd114d1ffa210dbdc5e7dd6afb75c414da180c41f1c822f8dd884cb8a6276272a4e1049cc66b995cf17c0f48a10c7d0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
939373ee202089b312a7ceebe0434e0b

SHA1
6b237681796e9f30a6a8dd6de5f6b1dfe59607db

SHA256
b202b8dd198f4c5047b9e30a8d1241811ba08b5d3039b856ea1e1add958bfb8a

SHA512
da5bcdc20cdae9472f44c8fa37f7bc6aa193addceaad4b5ef0b978afe98900d5fd858eee5450862494c3baf80c451a96e6e088cd8a809ce2aa53d8ba8aa22171

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
c977219cae3ab05fd26984c099d5c1ea

SHA1
ca76f2dce8a6e1db718a25ec0626c573da5df2c5

SHA256
5b4a0ee616e1e0cf1424cb2935b9f7be3a36c27545faadc6859f71c58af88d16

SHA512
604687ebbbbd92af64c829341ab1840b626d507d80215e0e007cb270ecae7d23c36fba31c673c616434eea6043d3d1a07d1ff72205d9dcb13165e8884afdf16a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
7e82433b191b278f263d9d559d2f51c1

SHA1
ec24dae8694b5729c8c96c8c2591940839a37663

SHA256
4a1a8aeaade97c9f94f023beb4269b6e80f119cb42ca6921706ec5c1ef40deea

SHA512
b97d34c475df592ee00359d21cc687c1177e07fd4ed4fea4d0ffdc5233d24eba7ce822487be6dce3ce4083ddb4c9f861621672f695efed69c160b7af1bdd6c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
05ee967cb4a8520fa17e8497fb7d0fe8

SHA1
3cabca3d2cfb58b75dda2bbd4d81b8a4c4ed58c1

SHA256
4d3372b9feaa48fd106f73e03bcdd33f7ffa003da830e05bfbec99504f9ea824

SHA512
3f4f47a51f90192cef6ab83dae7849bfc877b91cd0bab43d8db45b8b475ccabe050758e9c8a60fff82339c341aecf5ad33b5848f4a8cba597a267a399201d699

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
1b43c9e9affe53a946200983384333b7

SHA1
814173cb80584e83a382c35ea3f6587c7c666e12

SHA256
fe2657c992eb385ad6abea55d2bf366ff3437c0b893db93377f092260216008b

SHA512
897727a3e83b5ecf92bfeeada7524c3cae8a2dda213eb79d43e8558c1864381e8fdd5acc6d3e88561f162c02ac5b9a1ecebef2813b719acaaff7d7aed0cf2ab3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
4c4d351a5497703ac08f8774a25e851b

SHA1
330cd8e31cbdf48992d8ff11c63458ffc6b96ca2

SHA256
7658158e2c12e676a74d1b857c44f174c99f84dbdc13dd9ee0ffe96595fca335

SHA512
86ed0169eb85a80266d04dd5096d5d28d56287ed2282edbe672cbbf99ec71589e93db45754c54269191dcadcd33bb38d0b96fa0244ebd8da171f2706a7380fcf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
45b975ac1b31328124e93253533cd935

SHA1
5fc01d05834d5f65dc62b7e726012b0f4a0b8a42

SHA256
7ec6434c1ebc48e1b00324ce4021248764020db574b45ad57b9e3f8dd99d7a83

SHA512
7367dd10cbd60d62bc05af57c4eb13ce91c31d8abb019a99b70375434e2af76f5c9ed496f2a3ed01323fe12e52fa84a7f68592b5ec3dcee38562a41dcbf8f0e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
c98c720b5b2147dc4938905891597a39

SHA1
03d6722089864e40b6eb41a74a2b61b4e4a2d6f2

SHA256
223271b5e0934e63720a5938ebf7c57b385cf1b8d5bd5e1f24c1c644ca981a57

SHA512
de8cb96662fb7e29099eba5f186e75854ecd1dd90833bcf10303b5dda4cc41f442ea9dd2924acaccf5a7521cebc537c2e01b3cadb196cbb78e31e43dae4cd494

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
083e1e2387594ee5beaa79120e7d52b1

SHA1
a8cee2fc790be9802c1c04b96ace4848885120c8

SHA256
9af37c73992e6ecba377f18101c12c784412ea0fd8587333f6dff11cd978a8e2

SHA512
b301bdaaf4f0a4f1a6f2ec5ce2efbf57183887a86eec763a0d255d246f3d8da274f7b7ccaa6056a086d6d568cd3f54bf3cd2f284e92f97cc5baa9a213c050c71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
56f0fca0cc44b894230f1440bd9a1476

SHA1
cf02a086859b39a93553fd907886fbec908e1360

SHA256
dfa79cbbe2f667424d91cc111f133ddcfe757c70f8531bca867af4423f02f521

SHA512
570e4d1fed8a8e80eba03cc5d2316a89314009f71bedd89ba0ae107eb3e6aa760b0eaacfa01315dbf563507be43324d8e7f994982ac073ce424e3fc300bd7d14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
259e2aa9d0aa3891b3b0845704ec1c78

SHA1
f206306b364f8d2109f74ee2d54444d954fb28dd

SHA256
df2117bdaf801feb41190a09ad85489e64e6dffa88d09a6deb0e0ae589a222b8

SHA512
6e6cb59cbb604c46d6c5925fab1f12d376058ab5f98ad9fa0a27ac03362f950cab25c3109d4eaeee42a91b78d3a52c91be89d2899ee9b35df399882fd08f7fb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
65aa6500d9bbdd38073e9ced088af54e

SHA1
8bc30c8746b0d7a2dcba5c95993748d295edee4c

SHA256
3e489f4759ad134084461545ce323d1eaa8fc24bfd54560328cf74bca8ea0957

SHA512
bbbfb0cdd9d29f3d56e0d64d68de63f2f14b63b711b91f2132f635fe8196f910db7ebfc2dd95eb609160970a926b6285c5c0a19b1e852cde2080a2012fe52c96

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
86695a48ad388846d30b497112d733a3

SHA1
46f79a85e4f2b51ca75a7ad367f50dac918f13cc

SHA256
15fb5620e28ba8c5e930ad87880c9c1d35a625ebc6cb46914e55334e51cda313

SHA512
7674c7c978af9aa3f91d7ee6adc50ac0ca4f406e1f94bc108e06b0d354059615a6ef49b9444d49007e5667283302a38a653aab012ec0cb26d288053cf677d5e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
f6cf403e65cce393ce10b118ad20b6cc

SHA1
f644fb143d837ba8d98a6b717590a7c4dc955fc0

SHA256
4c4662a969c8948800f801a6f6f7ed1a2570c5e011e858775adf0580e1bb890f

SHA512
3f0fb0cfe11434d2212051ca72a03b878a0e59cf16de97ea3d14e118183ed449c08f0aaa8fe309c423866e7a8c54d1bc2961d2ac20f338b39aa8038918a48a4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
5bca6e4313d14b19eaba04feef355c93

SHA1
9b600ad1687ee4c8c768e74489c69d6b66f2e237

SHA256
0b56d23cdb58a1be9a7115789c5b0639874fb1e043dfe8ca1f9c7f170612e647

SHA512
8288c71fed4114ef779f3932bc2f14f7ae4997e47f1d0168aae65ae27fc76370f90a03aa7623d023ab374e1c741b22f3e778901c486e437e51970ac8a2c73b5c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
a35d53fee7b5a2af0ba933859fa0b740

SHA1
86eb8c9d54e978d23deb7166bae4b0e8da41c27c

SHA256
3846c2b8d4cf78a9b861bab23f446d7783919e866cfe6180c7a547c6862e8e6d

SHA512
88f7fd0f44c31fefd0041dc3bde45a5e0fd4e7a2a98e4b7851ffd18e90c85949ab8639e167e0e3b405791504064a6ea9fe3d0e3338a532c6a21473765862607f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
dd8d83144c2f6ddafe34f9b611087cb9

SHA1
633e05deae1f028830b70f6f96a0fb225a643e93

SHA256
ee4b7cef3d6ddde763860ff50221e8121a3b0f92693b86a798dee36e797e8903

SHA512
1ad1112d65df2c0a27977103e46469875b0cbfb2a6da3538003b0edeee88c5f8c2e5582fa02d1e063de6b8a5df0968b97df8feffdd567ab835a0e8ed21ad2933

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
cb7a73df470d57edbd8e6ef17ee68868

SHA1
b35e6a40297b6522a336da514902af155c4ef742

SHA256
1a3fedab4faa29fa04ec95554377139ad095cef1c234dc5faf27bd8a12cdf9a9

SHA512
5b1ddd026ffc73848e4989345c98b76d18854715d17553465996bac6f7c3527793e9023cc31af95271e76416259755d3654648ab95a55a345024f6298c55fedd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
432KB

MD5
fb5bce6f0a2087c46b4ad545ad49eb17

SHA1
9fe353649f170d0c30d7346d0276b2ec2c03b81a

SHA256
6dab05a6b1b54cf54616efecd28fab20b6939d769e9e5aa061e658faea61bf40

SHA512
8ea61c2f7daeab6a2d429bfddd5a93aec268ab5d4b86e261cd2a345264099ec9cc5a14d8b55b11c941f2da96f565d4064867043bcf662bab36a1936c49357168

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\05ypapi5.default-release\targeting.snapshot.json

Filesize
4KB

MD5
ff22bf41694e10294c6316d23dcf8484

SHA1
f3d4deb49f95856dabaf4b96d25ea28a7994c714

SHA256
95a958acacdd38b508b405cbc9d3f8d9be2123314f18a6bccc2addcda09eacdb

SHA512
f824d1a1f05b35af81b0a46cb2da2831c0316e8b72c70cdd287b2422734b1ba6868e858dc7a687b010da9c5d29af1743dc9772c77f8d95a9d85f3b4d91c3e7fa

Download Submit
C:\Users\Admin\AppData\Roaming\RIA\qdigidoc4\config.json

Filesize
70KB

MD5
d7c29dc403a672033c788fba063f39db

SHA1
9f14c6b947ced0ff541449b98094577493ccacaa

SHA256
43f5e0269216b4fc947eb31962665465e711386502b6971ddd29cb9ed29834d4

SHA512
d5d21ac3d8e52b64360627c555b21bc52f37636bb8d88403858f8e1aeafbf60e8c85c4a5848cfe11cfa8ebc2ffc4a4d52b3b66a8509b71937a8808ecd6de6e00

Download Submit
C:\Users\Admin\AppData\Roaming\RIA\qdigidoc4\config.rsa

Filesize
349B

MD5
874b5d7ab3184118a45ad60cfe729ac4

SHA1
22e492ada0887035f0c3e9e3067d8d4b8d5c9a88

SHA256
a9532836a0e987fc0c45e16d8bbef796b6542ef48123c26112539cf6914557fc

SHA512
dbfda142fefeb196d57ba4719b374e7a10d4c0c81541a1cd3c4b068dc575a0b7f6c3815b2d87a3f0de187c86eca8c3363587c55161bec421b735ff40be8c14c6

Download Submit
C:\Users\Admin\AppData\Roaming\digidocpp\tsl\EE.xml

Filesize
302KB

MD5
fb8f98636502c0e0441a98ff8c6bcfc4

SHA1
caae9dc72cd2a0e363a7e226c471fa163a07e482

SHA256
bd3af4bff5b1301d576d969668d5bbd2f8bc4e64e46be7513983d54757c71429

SHA512
6c18d3c5c465ee35e466d22807d230c8e1a589947131d6cf18c72e6929edcf754bb2d4dabf8368c8f942fe134f9c78e6371787cc6c713c57faf4a209cbc6d481

Download Submit
C:\Users\Admin\AppData\Roaming\digidocpp\tsl\EE.xml

Filesize
306KB

MD5
f329d4aef8ca53f0b67f0fcfc1473dd9

SHA1
3b7629c4fc59c8c9c9874afc14024f92ba2f439f

SHA256
580944991b2917508f5dc9fe49c7c506e6265356e1e7f8174db4a0effbf2c25a

SHA512
5c674aa2a8d7ca08495a94eb208c1bdcaa67b044207531ace6af8aaa8a6a84cec2ac23a30ca3bb9a44a2dc521c1db3dc91b0c55a488b139391ad2f96ee381724

Download Submit
C:\Users\Admin\AppData\Roaming\digidocpp\tsl\eu-lotl.xml

Filesize
477KB

MD5
be5e1e1f2fb7f6fd6c24ff5e2d2929f0

SHA1
9356e703947ba90a2301dcf8dc130bf9f40dc87d

SHA256
390210d31e26cdab57b8bf64cc2674e522afdf954d8b937631858d4c21eff08c

SHA512
06264177cc7377b19942583dea32de00839826e8310f9b376fa40b3dac1e72c024b658894c87c304ad8c0af22063cb61a3abcb5cb7467d1b4628efe6bad36e00

Download Submit
C:\Users\Admin\AppData\Roaming\digidocpp\tsl\eu-lotl.xml

Filesize
456KB

MD5
86ecdd00c49534c8fa74471b67afd2ed

SHA1
93391cbd68461959b85643456a9356120648e7a6

SHA256
3f28e47c097221301f6f0a399d6732ca47a3853eaecc81db2a8ddf54be55ef9f

SHA512
66ebe3237c64071c0d621143a10a3d774c3a9eeadb09d5ccf8f1d2197010def48aebfcb4bd997df38f923636a549f6917312a37747227535f6f4376137d07c96

Download Submit
C:\Windows\Installer\MSI18F.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI18F.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI2D07.tmp-\Newtonsoft.Json.dll

Filesize
562KB

MD5
486015a44a273c6c554a27b3d498365c

SHA1
cb08f5d7240dfcdcd77de754259b36c0d9a2a034

SHA256
6a168461c721fd14163751f7839fb8d67483cb5831f1b2b1ab3e96a68b82d384

SHA512
1578ed43e815017c269d2a37bb9cdc16d51209bfa6bdb7276ad67cbb39955708826973ac7f48c795e6a1361e7d2a14b14b6cea02ee9ecf396a4b02313aada1d6

Download Submit
C:\Windows\Installer\MSI4426.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI4426.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI4BF8.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI4BF8.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI4BF8.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI56B7.tmp

Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\MSI56B7.tmp

Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\MSI56B7.tmp

Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\MSIA247.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSIA247.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSIA96C.tmp

Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\MSIA96C.tmp

Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\e589aa5.msi

Filesize
1.8MB

MD5
6ab00232e925fe95e57aafd38139d807

SHA1
1c42fa462c0ceb7183b375033f179a0ee2f6273b

SHA256
bc2b15c2f550563baf56d1f612937a89e9667695c1707350544ec4746fedf8e1

SHA512
0a9554f5ef8388e6658d60f5bb80c87d0af9397f4c08c3d1c7deb655e45a2efa3570f866300e8b28e06670902a78d117bf3fae73a2fbcc1e59c3ac33646cc39c

Download Submit
C:\Windows\Installer\e589aaa.msi

Filesize
12.7MB

MD5
672836a235b5ab908b46273678307ae0

SHA1
8387f286acd55e09b9c5dfa94203a136a6af9a3b

SHA256
c4cd9ecfc61d98e14c83797d2abfc942312bfa43d9a37ba6eecb05605f1f74bc

SHA512
c6f34a5db8328ebc0f78228f919a9e82e6e9b2c4e590d4aa9b016df8791a6afc6e30b97223eb79ebdc83457d7d706917128567ffbb38fe412d6428ec3dbf5712

Download Submit
C:\Windows\Installer\e589ab3.msi

Filesize
18.4MB

MD5
4f1882ec2bb6afe81e0d4fe6143ff647

SHA1
8dff82078800bc0cd040c9282b8728ecb0e4c381

SHA256
9c78ca64c5af68cff1c435cfd9d9390de6a0478f863b85bf5eff59c0173eaea2

SHA512
c7287e1aaf6c01227bb6072190eea76e151acace479a55f228a03822b7e83abc9b1ae3be0b1a517c56534bc3cbb16d9a0ce862ee4dc15c742e16b1a67a6045b2

Download Submit
C:\Windows\Installer\e589ab4.msi

Filesize
5.9MB

MD5
c1f001137eeeddad89996c153e8714d3

SHA1
e221945b316308499dbf6bb9317664adc8470d8c

SHA256
d415636b8260bc42aad9b5142f321fd8cd5e1326a4ac433be97a82f581bc0f32

SHA512
c4c2605bb4ad3c2d6ee207b6c7b8771723a557383498c95837658135f5cc357509fd12c1725285656ac0c544c29a7955198fc54f475290d94d306c363054aed8

Download Submit
C:\Windows\Installer\e589ac3.msi

Filesize
40KB

MD5
69a3266d1658b83661cf0d32bf705219

SHA1
2cc95ed6da4debb18541850c7e440b81b406125b

SHA256
d51f8f3fbfdfbaaac87515786f7a6c7c4d1e319b053fa6bddcac5d77eec6671c

SHA512
916d5602ffb8dd605e26db70fd3b2138a10356487766afc6f5726fc9bb231bd038754bd7a55d9badb6107df36d85734d7357f6e26442f425733254c8944347b9

Download Submit
C:\Windows\SysWOW64\SET54ED.tmp

Filesize
1.9MB

MD5
918204efc529e4b9e790b0f48b80fef2

SHA1
1fd484d3a67bca4b6aadc0ec158d6a5b03644587

SHA256
8f0943215f7df56cf95af4630212ded199df52ce5354d8e1d0af47ec1e98ddcd

SHA512
70e312cec976347ad7d677b52694c59f9fa5c282758c81d8e48086ddc9b9f189605967b4c207856966b914a2b8fdef56bc06de0b5df65c8d783ed8024ac4f3cf

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
146KB

MD5
4aa02b658bcf77bf9e4f70c6cb49f399

SHA1
ad1a990372077672fec2612969d8e42e98749fc4

SHA256
a8beced9c793aa7cf01eccfd037eb8792c32fa88656a55d3a735b0a45c1593a0

SHA512
28dc60e5c6a34a9cdadae883190d46bf6c07c9e93aa44561c6a922242f994e5824ec7fbd4e5df3521b49017100e676ace3a263aa2ec8a28163378d1253f964ba

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
146KB

MD5
b6383ebf629cf300f2940d5adf241c29

SHA1
024463f6993e20b5fc21f5e55a952be12dd9318f

SHA256
c3fecebbf470921bc953ff9c546bce2f91736bd66b4aac59ed1d44a0d1335546

SHA512
716195f9b05e4c36d1d7e45634c9e7d2e3f3d0e4b5075ec679f904221fe2ba519a3a168110fa75eb23ad8e26b1908a1a8d894af217365130c543029fd84da16c

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
146KB

MD5
bd18938ec1c86eec40d686f2df343960

SHA1
ced7188108b0c30880e73a5274bda05a5beaab6c

SHA256
ddb8d9c9f2c7b630ab42c87b9458e99da705a63e3d0827e708a92bce281b8769

SHA512
a540a3afde950fa4900669a55a65b31732d85761d03fa57fcd99bccafcb9125d60cb0e7c1f077a58f087142ea393ef783eaaee8f541d70c596485d2a361280ef

Download Submit
C:\Windows\System32\DriverStore\FileRepository\esteidcm.inf_amd64_c70614546d51c431\esteidcm.inf

Filesize
24KB

MD5
1a66bf9fb59d0204084faf63da43f2c4

SHA1
8ecb20dc67c6d7323540f312290672739f9342b3

SHA256
7d5a382db9eb0534ed7db4c19248d34445089a9ae5fbba5482ec8663d9924309

SHA512
45d77f6e9fd2ff7fbd40d71c365426273bc04d5d685bc7ea2bda59ed936d07023606d5078ad291dd63b51cba4ebede1624a170fcf6b27ec5b9604c24e191ae50

Download Submit
C:\Windows\System32\DriverStore\FileRepository\esteidcm.inf_amd64_c70614546d51c431\esteidcm64.cat

Filesize
9KB

MD5
aa9d82922cdea902e1ef06243bbd37be

SHA1
84592378404a716d9d8362d3581c35fa7af17d0c

SHA256
493c3047c026981a92ae6f91d42e7ab1b1986f78cf239a5aaa64263bf8561da1

SHA512
3c8e79bbf7a9ed0f4add967fcca87395cca0da5c0dce40d0e512e5af76a0c26d6d8b5c91215a33da7314ee8c28eea6ee5c227debf86f20bca1e2dedb21c8f357

Download Submit
C:\Windows\System32\DriverStore\FileRepository\estidminidriver.inf_amd64_ffc46e08d080e1d9\EstIDMiniDriver.cat

Filesize
10KB

MD5
c9cd015f03d18a8717152cc081f69f97

SHA1
602c77ad82accb711bd95d3421821f5e90a5fd6e

SHA256
a0eb9347f0fcc0d8c40794f3e18536b7d932419101876aed5acc0d8698f7bea9

SHA512
89586597e24dabaf909299beef20c17b10f3c465c789116b9097a753ba3870d50e1a49a8d4fe80971e8abcc51a0ed1c1603c887a7610df164df0668424de237f

Download Submit
C:\Windows\System32\DriverStore\FileRepository\estidminidriver.inf_amd64_ffc46e08d080e1d9\EstIDMinidriver.inf

Filesize
11KB

MD5
1cbcc9f1e085ce1187a5836c3f52c2b3

SHA1
64f9b36f91c5ad6f7588eca0fa81e10d2cba7631

SHA256
16d0cbff3539288c83a0a001161f2930f34a21b815d41f4983e9946a319c62bd

SHA512
0596193c647e07b2cb8f94e06333f05dae14afd28d478f81b982c49c1de69fca7694216460090fc01a2fe2c35bcefc044dbbaf1dcb4ef712210f0f0a7386400f

Download Submit
C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAF3.tmp

Filesize
236KB

MD5
3746a61dd5c38e527a1457d4040595c3

SHA1
94cda3bf8ccc289f82c08320e78cb0629fb76f1b

SHA256
15685306da9aefd07f40e2676603623225f090ffdee52227bd6aaa89beb38442

SHA512
d72f85ebaff242697208c991274a8cf5155ac52dd628a31a2a07ccdb3d5abe1dbd84475032d04b0c6b8ef6902c7b16ce903b782bb2c87aa34f7c9f393453910f

Download Submit
C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAF4.tmp

Filesize
284KB

MD5
a392ca4a5e6e14a40ee395120b41832f

SHA1
f3055d3024f7b91b79cbc744e4605ff966ed9ecd

SHA256
a8f9c277aefee26727f15fea1ef66c7d9914eda7b570c44ae754b658cf6971a0

SHA512
04788bf2a886221ca96b89acbb4853c11a9828519b96c048f3b78c2edd5e06fbd3804a9aed6a8695e08ab2846e5aab4d6b89d01a2ca07006a2cb2ac7fca42e8e

Download Submit
C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\SETAAF5.tmp

Filesize
16KB

MD5
c964b0c90ba674bb0b593b3345ecf879

SHA1
d0e8ac8f17c472da4e0bdd9dfd8e05789739da6b

SHA256
e2fc73d80663205ea7fea42d8c8a7cd3dd33d937dc38baff7eecfb58bf19104d

SHA512
9a429afd8f82ab2c0795fcda1401e68364d1fa93469bbc5093f47e4e4cabf7f2506a8bb8a92c78e13e260bb5e7d8200b6f3f5d33ad829feae5ecb1df9f07719a

Download Submit
C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\esteidcm.inf

Filesize
24KB

MD5
1a66bf9fb59d0204084faf63da43f2c4

SHA1
8ecb20dc67c6d7323540f312290672739f9342b3

SHA256
7d5a382db9eb0534ed7db4c19248d34445089a9ae5fbba5482ec8663d9924309

SHA512
45d77f6e9fd2ff7fbd40d71c365426273bc04d5d685bc7ea2bda59ed936d07023606d5078ad291dd63b51cba4ebede1624a170fcf6b27ec5b9604c24e191ae50

Download Submit
C:\Windows\System32\DriverStore\Temp\{09215ee5-bd10-094d-b48a-26a8b1ec47fd}\esteidcm64.cat

Filesize
9KB

MD5
aa9d82922cdea902e1ef06243bbd37be

SHA1
84592378404a716d9d8362d3581c35fa7af17d0c

SHA256
493c3047c026981a92ae6f91d42e7ab1b1986f78cf239a5aaa64263bf8561da1

SHA512
3c8e79bbf7a9ed0f4add967fcca87395cca0da5c0dce40d0e512e5af76a0c26d6d8b5c91215a33da7314ee8c28eea6ee5c227debf86f20bca1e2dedb21c8f357

Download Submit
C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\EstIDMiniDriver.cat

Filesize
10KB

MD5
c9cd015f03d18a8717152cc081f69f97

SHA1
602c77ad82accb711bd95d3421821f5e90a5fd6e

SHA256
a0eb9347f0fcc0d8c40794f3e18536b7d932419101876aed5acc0d8698f7bea9

SHA512
89586597e24dabaf909299beef20c17b10f3c465c789116b9097a753ba3870d50e1a49a8d4fe80971e8abcc51a0ed1c1603c887a7610df164df0668424de237f

Download Submit
C:\Windows\System32\DriverStore\Temp\{0c87ba00-a0b4-9243-8f2c-64484ba8c0f6}\EstIDMinidriver.inf

Filesize
11KB

MD5
1cbcc9f1e085ce1187a5836c3f52c2b3

SHA1
64f9b36f91c5ad6f7588eca0fa81e10d2cba7631

SHA256
16d0cbff3539288c83a0a001161f2930f34a21b815d41f4983e9946a319c62bd

SHA512
0596193c647e07b2cb8f94e06333f05dae14afd28d478f81b982c49c1de69fca7694216460090fc01a2fe2c35bcefc044dbbaf1dcb4ef712210f0f0a7386400f

Download Submit
C:\Windows\System32\SET524C.tmp

Filesize
2.7MB

MD5
81a2591e90cf7fa67f06fb35a37976e5

SHA1
63ff8ff9cc38a8ecfdfba1953b323d63dc301e9a

SHA256
c245a0ef71b6c403096bb130480d1affeb8e46c84d10d6ed249f7fd98afb300b

SHA512
b1f30d1aa6840533ffea10ba6f307cc7a2cf16bea5ea3c460477b468f1b2a9aa69673d3a77abff5c4ab2da8bfa0a09225a232202eecbb2a2169895353bd7a7ac

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\.ba\logo.png

Filesize
83KB

MD5
b310962761dfa4cd14f2106e866e217a

SHA1
ccd234088ef5ebd63d97789f9eb09ae0a3aaf8f6

SHA256
f57104a45d12b37c5158292a47d8f12366ff5545df9c6bb135b44feb07f6c07a

SHA512
d983638d3a913141dcf25fb29add224a341a2badd2d68e277e5a9de6bc7aac9aca3e57f9fb44a327f6c793dd48c8b40a6fb5eebe891567867df0fc09d567e8be

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\.ba\logoside.png

Filesize
685KB

MD5
40ed6b96424fedc5631b5ade501d14ca

SHA1
289aeaf395682acbefb94db4a39a86df2926a62d

SHA256
6740578bf7627e7dd45127e19227ae9ffe8d0f9cd74776b5db273405b32608ec

SHA512
c35f47de59db9814b07dc919b974682a84acf13cc12bf1d618a6b00378f2879c6067465e58a0a0facefdee06ff3730b6ffcb2f2d61f496ba44e21559887ea591

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\.be\Open-EID-23.5.0.1939.exe

Filesize
634KB

MD5
e9e26669f4bc874c59f32d027b3352fc

SHA1
39975fd7ec7925392234ae74c5396fa90976df10

SHA256
9cf066e5369e5b4c92c178ddc55920dd38b1bc388054f0a77eba161209647ccb

SHA512
a98f785bf6347337d140adb0b73b0630c854f7ab62093c6e9a2fdede3484d33f44c7a9b38520e7e70cb77fbbaea7f2073777cc0ea6ea8d21d3bd7ad4300710b9

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\.be\Open-EID-23.5.0.1939.exe

Filesize
634KB

MD5
e9e26669f4bc874c59f32d027b3352fc

SHA1
39975fd7ec7925392234ae74c5396fa90976df10

SHA256
9cf066e5369e5b4c92c178ddc55920dd38b1bc388054f0a77eba161209647ccb

SHA512
a98f785bf6347337d140adb0b73b0630c854f7ab62093c6e9a2fdede3484d33f44c7a9b38520e7e70cb77fbbaea7f2073777cc0ea6ea8d21d3bd7ad4300710b9

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\.be\Open-EID-23.5.0.1939.exe

Filesize
634KB

MD5
e9e26669f4bc874c59f32d027b3352fc

SHA1
39975fd7ec7925392234ae74c5396fa90976df10

SHA256
9cf066e5369e5b4c92c178ddc55920dd38b1bc388054f0a77eba161209647ccb

SHA512
a98f785bf6347337d140adb0b73b0630c854f7ab62093c6e9a2fdede3484d33f44c7a9b38520e7e70cb77fbbaea7f2073777cc0ea6ea8d21d3bd7ad4300710b9

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\IDEMIA.en_US.X64

Filesize
12.7MB

MD5
672836a235b5ab908b46273678307ae0

SHA1
8387f286acd55e09b9c5dfa94203a136a6af9a3b

SHA256
c4cd9ecfc61d98e14c83797d2abfc942312bfa43d9a37ba6eecb05605f1f74bc

SHA512
c6f34a5db8328ebc0f78228f919a9e82e6e9b2c4e590d4aa9b016df8791a6afc6e30b97223eb79ebdc83457d7d706917128567ffbb38fe412d6428ec3dbf5712

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\MetaInfo

Filesize
40KB

MD5
69a3266d1658b83661cf0d32bf705219

SHA1
2cc95ed6da4debb18541850c7e440b81b406125b

SHA256
d51f8f3fbfdfbaaac87515786f7a6c7c4d1e319b053fa6bddcac5d77eec6671c

SHA512
916d5602ffb8dd605e26db70fd3b2138a10356487766afc6f5726fc9bb231bd038754bd7a55d9badb6107df36d85734d7357f6e26442f425733254c8944347b9

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\Minidriver.X64

Filesize
1.8MB

MD5
6ab00232e925fe95e57aafd38139d807

SHA1
1c42fa462c0ceb7183b375033f179a0ee2f6273b

SHA256
bc2b15c2f550563baf56d1f612937a89e9667695c1707350544ec4746fedf8e1

SHA512
0a9554f5ef8388e6658d60f5bb80c87d0af9397f4c08c3d1c7deb655e45a2efa3570f866300e8b28e06670902a78d117bf3fae73a2fbcc1e59c3ac33646cc39c

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\Updater.X64

Filesize
18.4MB

MD5
4f1882ec2bb6afe81e0d4fe6143ff647

SHA1
8dff82078800bc0cd040c9282b8728ecb0e4c381

SHA256
9c78ca64c5af68cff1c435cfd9d9390de6a0478f863b85bf5eff59c0173eaea2

SHA512
c7287e1aaf6c01227bb6072190eea76e151acace479a55f228a03822b7e83abc9b1ae3be0b1a517c56534bc3cbb16d9a0ce862ee4dc15c742e16b1a67a6045b2

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\WebEID.X64

Filesize
5.9MB

MD5
c1f001137eeeddad89996c153e8714d3

SHA1
e221945b316308499dbf6bb9317664adc8470d8c

SHA256
d415636b8260bc42aad9b5142f321fd8cd5e1326a4ac433be97a82f581bc0f32

SHA512
c4c2605bb4ad3c2d6ee207b6c7b8771723a557383498c95837658135f5cc357509fd12c1725285656ac0c544c29a7955198fc54f475290d94d306c363054aed8

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\qdigidoc4.en_US.X64

Filesize
5.4MB

MD5
461c551d0ca30b034a2bc44d9968298f

SHA1
9378719dce5c2aa0e1819311f2c0fd7c194e2fe5

SHA256
2235a06921e94113809bef0bdda1cb6649de3487761c606d220ee7565814dee7

SHA512
84009ae28591c662bd4befcc69addd5f8e5d45b9f1d468c7610b5ef5fac82f83666c65052753021aed4e42bbb352a89e5b3bb6fa3220ae85c1977b2b094224dd

Download Submit
C:\Windows\Temp\{1BF26491-0080-46A8-92AD-ADDC7D6D4B1D}\shellext.X64

Filesize
720KB

MD5
51853ed4901fd9519d42fd8e0b1e9570

SHA1
c262da65bc660dfa26f6e7eef28f366fce3f8360

SHA256
c3535003d8af9f9a9bde493d6383d6d0e9a3c6571c47e0058ddc498dbe15addf

SHA512
64de87c67d59dbff197120b079ed990a08f59a349ddb8594b757f1bd63f7463b2ed16ad2931604115b8d9ac8dd7223b0fb5de7fbffcb73c54bca0699233f1f11

Download Submit
C:\Windows\Temp\{959A2ABE-C1AB-4F2E-B384-E9B6B5968FBB}\.cr\Open-EID-23.5.0.1939.exe

Filesize
634KB

MD5
e9e26669f4bc874c59f32d027b3352fc

SHA1
39975fd7ec7925392234ae74c5396fa90976df10

SHA256
9cf066e5369e5b4c92c178ddc55920dd38b1bc388054f0a77eba161209647ccb

SHA512
a98f785bf6347337d140adb0b73b0630c854f7ab62093c6e9a2fdede3484d33f44c7a9b38520e7e70cb77fbbaea7f2073777cc0ea6ea8d21d3bd7ad4300710b9

Download Submit
C:\Windows\Temp\{959A2ABE-C1AB-4F2E-B384-E9B6B5968FBB}\.cr\Open-EID-23.5.0.1939.exe

Filesize
634KB

MD5
e9e26669f4bc874c59f32d027b3352fc

SHA1
39975fd7ec7925392234ae74c5396fa90976df10

SHA256
9cf066e5369e5b4c92c178ddc55920dd38b1bc388054f0a77eba161209647ccb

SHA512
a98f785bf6347337d140adb0b73b0630c854f7ab62093c6e9a2fdede3484d33f44c7a9b38520e7e70cb77fbbaea7f2073777cc0ea6ea8d21d3bd7ad4300710b9

Download Submit
C:\Windows\system32\EstIDMiniDriver64.dll

Filesize
2.7MB

MD5
81a2591e90cf7fa67f06fb35a37976e5

SHA1
63ff8ff9cc38a8ecfdfba1953b323d63dc301e9a

SHA256
c245a0ef71b6c403096bb130480d1affeb8e46c84d10d6ed249f7fd98afb300b

SHA512
b1f30d1aa6840533ffea10ba6f307cc7a2cf16bea5ea3c460477b468f1b2a9aa69673d3a77abff5c4ab2da8bfa0a09225a232202eecbb2a2169895353bd7a7ac

Download Submit
C:\Windows\syswow64\EstIDMiniDriver.dll

Filesize
1.9MB

MD5
918204efc529e4b9e790b0f48b80fef2

SHA1
1fd484d3a67bca4b6aadc0ec158d6a5b03644587

SHA256
8f0943215f7df56cf95af4630212ded199df52ce5354d8e1d0af47ec1e98ddcd

SHA512
70e312cec976347ad7d677b52694c59f9fa5c282758c81d8e48086ddc9b9f189605967b4c207856966b914a2b8fdef56bc06de0b5df65c8d783ed8024ac4f3cf

Download Submit
memory/1756-623-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/1756-647-0x0000000071520000-0x0000000071CD0000-memory.dmp

Filesize
7.7MB

Download
memory/1756-636-0x00000000050A0000-0x00000000050C2000-memory.dmp

Filesize
136KB

Download
memory/1756-630-0x0000000005030000-0x0000000005038000-memory.dmp

Filesize
32KB

Download
memory/1756-622-0x0000000071520000-0x0000000071CD0000-memory.dmp

Filesize
7.7MB

Download
memory/1756-631-0x0000000005040000-0x0000000005048000-memory.dmp

Filesize
32KB

Download
memory/1756-628-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/1756-627-0x0000000004FF0000-0x000000000501E000-memory.dmp

Filesize
184KB

Download
memory/1756-625-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/1756-633-0x00000000050F0000-0x0000000005182000-memory.dmp

Filesize
584KB

Download
memory/2564-805-0x000001B120580000-0x000001B120590000-memory.dmp

Filesize
64KB

Download
memory/2564-760-0x000001B120580000-0x000001B120590000-memory.dmp

Filesize
64KB

Download
memory/2564-758-0x00007FFD21620000-0x00007FFD21BE5000-memory.dmp

Filesize
5.8MB

Download
memory/2564-759-0x00007FF60E450000-0x00007FF60EAD4000-memory.dmp

Filesize
6.5MB

Download
memory/5004-590-0x000001B0FA340000-0x000001B0FA350000-memory.dmp

Filesize
64KB

Download
memory/5004-589-0x000001B0FA340000-0x000001B0FA350000-memory.dmp

Filesize
64KB

Download
memory/5004-588-0x00007FFD228C0000-0x00007FFD22E85000-memory.dmp

Filesize
5.8MB

Download