hxxp://bing[.]com

Analysis

max time kernel
1117s
max time network
1121s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bing.com

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe

Executes dropped EXE 7 IoCs

pid	Process
4560	Blacksmith Installer.exe
1520	VC_redist.x64.exe
3416	VC_redist.x64.exe
2964	BlacksmithBootstrap.exe
4040	Debris.exe
3608	BlacksmithBootstrap.im
3220	BlacksmithIM.exe

Loads dropped DLL 64 IoCs

pid	Process
4560	Blacksmith Installer.exe
4560	Blacksmith Installer.exe
4560	Blacksmith Installer.exe
4560	Blacksmith Installer.exe
3252	VC_redist.x64.exe
2964	BlacksmithBootstrap.exe
2964	BlacksmithBootstrap.exe
2964	BlacksmithBootstrap.exe
2964	BlacksmithBootstrap.exe
2964	BlacksmithBootstrap.exe
3608	BlacksmithBootstrap.im
3608	BlacksmithBootstrap.im
3608	BlacksmithBootstrap.im
3608	BlacksmithBootstrap.im
3608	BlacksmithBootstrap.im
3220	BlacksmithIM.exe
3220	BlacksmithIM.exe
3220	BlacksmithIM.exe
3220	BlacksmithIM.exe
3220	BlacksmithIM.exe
3220	BlacksmithIM.exe
3044	firefox.exe
3044	firefox.exe
3044	firefox.exe
3936	firefox.exe
3936	firefox.exe
3936	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
4028	firefox.exe
4028	firefox.exe
4028	firefox.exe
4388	firefox.exe
4388	firefox.exe
4388	firefox.exe
3008	firefox.exe
3008	firefox.exe
3008	firefox.exe
5452	firefox.exe
5452	firefox.exe
5452	firefox.exe
2284	firefox.exe
2284	firefox.exe
2284	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
5692	firefox.exe
5692	firefox.exe
5692	firefox.exe
5880	firefox.exe
5880	firefox.exe
5880	firefox.exe
4248	firefox.exe
4248	firefox.exe
4248	firefox.exe
4228	firefox.exe
4228	firefox.exe
4228	firefox.exe
316	firefox.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{c649ede4-f16a-4486-a117-dcc2f2a35165} = "\"C:\\ProgramData\\Package Cache\\{c649ede4-f16a-4486-a117-dcc2f2a35165}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	firefox.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3220	BlacksmithIM.exe
3220	BlacksmithIM.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5bc06e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC214.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bc081.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{19AFE054-CA83-45D5-A9DB-4108EF4BD391}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC60F.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5bc096.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5bc080.msi	msiexec.exe
File created	C:\Windows\Installer\e5bc081.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC4F4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bc06e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AA0C8AB5-7297-4D46-A0D9-08096FE59E46}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2FF.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\450EFA9138AC5D549ABD1480FEB43D19	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "5"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.38.33135"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\450EFA9138AC5D549ABD1480FEB43D19\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.38.33135"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\450EFA9138AC5D549ABD1480FEB43D19\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\450EFA9138AC5D549ABD1480FEB43D19\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{19AFE054-CA83-45D5-A9DB-4108EF4BD391}v14.38.33135\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BA8C0AA792764D40A9D8090F65EE964\PackageCode = "1688782943A356649B2B29F7077E1BE1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\450EFA9138AC5D549ABD1480FEB43D19\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\450EFA9138AC5D549ABD1480FEB43D19	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Blacksmith Installer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5BA8C0AA792764D40A9D8090F65EE964\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\450EFA9138AC5D549ABD1480FEB43D19\PackageCode = "F31F6C1FFC7AAFF4D8FF3C825AB567E9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\450EFA9138AC5D549ABD1480FEB43D19\Version = "237404527"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\450EFA9138AC5D549ABD1480FEB43D19\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{c649ede4-f16a-4486-a117-dcc2f2a35165}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.38.33135"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BA8C0AA792764D40A9D8090F65EE964	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BA8C0AA792764D40A9D8090F65EE964\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BA8C0AA792764D40A9D8090F65EE964\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\450EFA9138AC5D549ABD1480FEB43D19\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.38,bundle	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\450EFA9138AC5D549ABD1480FEB43D19\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.38,bundle\Version = "14.38.33135.0"	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BA8C0AA792764D40A9D8090F65EE964\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BA8C0AA792764D40A9D8090F65EE964\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BA8C0AA792764D40A9D8090F65EE964\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings	firefox.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{c649ede4-f16a-4486-a117-dcc2f2a35165}	VC_redist.x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Blacksmith Installer.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
5040	msedge.exe
5040	msedge.exe
2176	identity_helper.exe
2176	identity_helper.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe
1764	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4560	Blacksmith Installer.exe
2624	firefox.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	firefox.exe
Token: SeDebugPrivilege	2624	firefox.exe
Token: SeDebugPrivilege	6072	taskmgr.exe
Token: SeSystemProfilePrivilege	6072	taskmgr.exe
Token: SeCreateGlobalPrivilege	6072	taskmgr.exe
Token: 33	6072	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6072	taskmgr.exe
Token: SeDebugPrivilege	2624	firefox.exe
Token: SeDebugPrivilege	2624	firefox.exe
Token: SeDebugPrivilege	2624	firefox.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeDebugPrivilege	4560	Blacksmith Installer.exe
Token: SeBackupPrivilege	3668	vssvc.exe
Token: SeRestorePrivilege	3668	vssvc.exe
Token: SeAuditPrivilege	3668	vssvc.exe
Token: SeShutdownPrivilege	4920	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4920	VC_redist.x64.exe
Token: SeSecurityPrivilege	1764	msiexec.exe
Token: SeCreateTokenPrivilege	4920	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	4920	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	4920	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4920	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	4920	VC_redist.x64.exe
Token: SeTcbPrivilege	4920	VC_redist.x64.exe
Token: SeSecurityPrivilege	4920	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	4920	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	4920	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	4920	VC_redist.x64.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe
6072	taskmgr.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
4560	Blacksmith Installer.exe
1520	VC_redist.x64.exe
4920	VC_redist.x64.exe
1780	VC_redist.x64.exe
3252	VC_redist.x64.exe
5920	VC_redist.x64.exe
2964	BlacksmithBootstrap.exe
4040	Debris.exe
4040	Debris.exe
4040	Debris.exe
3608	BlacksmithBootstrap.im
3220	BlacksmithIM.exe
3220	BlacksmithIM.exe
3220	BlacksmithIM.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 2504	5040	msedge.exe	83
PID 5040 wrote to memory of 2504	5040	msedge.exe	83
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 1432	5040	msedge.exe	85
PID 5040 wrote to memory of 2488	5040	msedge.exe	86
PID 5040 wrote to memory of 2488	5040	msedge.exe	86
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87
PID 5040 wrote to memory of 4288	5040	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bing.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb923546f8,0x7ffb92354708,0x7ffb92354718
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,564058827172308919,15661341438536459052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,564058827172308919,15661341438536459052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,564058827172308919,15661341438536459052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,564058827172308919,15661341438536459052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,564058827172308919,15661341438536459052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,564058827172308919,15661341438536459052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,564058827172308919,15661341438536459052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,564058827172308919,15661341438536459052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,564058827172308919,15661341438536459052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,564058827172308919,15661341438536459052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2140

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4232
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Enumerates connected drives
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 1964 -prefMapHandle 1956 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {03a35e80-8242-486c-bbbf-cecdaa61b0c0} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" gpu
    3⤵
    PID:448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 25793 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9acf6632-6cd1-4086-a7a3-27be278c737b} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" socket
    3⤵
    PID:4464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1640 -childID 1 -isForBrowser -prefsHandle 2992 -prefMapHandle 1512 -prefsLen 25934 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d93cf061-63c4-42b6-9649-4462d480ad3b} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    PID:4384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3112 -childID 2 -isForBrowser -prefsHandle 3740 -prefMapHandle 2792 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59677278-4615-427f-8b8a-b6cab5be3230} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    PID:3244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4736 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4468 -prefMapHandle 4744 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b2a2f3c-0fec-4a8e-9219-2ac907eb4a7c} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" utility
    3⤵
    - Checks processor information in registry
    PID:5224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5332 -childID 3 -isForBrowser -prefsHandle 5308 -prefMapHandle 5156 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c56825b3-a4d5-47c0-8117-58216f170a15} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    PID:5660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5352 -childID 4 -isForBrowser -prefsHandle 5484 -prefMapHandle 5488 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {134329fa-d454-4dde-8838-016f82ebd75c} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5736 -childID 5 -isForBrowser -prefsHandle 5656 -prefMapHandle 5660 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9410fa8-5e20-4db3-a07b-489b5bcd8212} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    PID:5684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6028 -childID 6 -isForBrowser -prefsHandle 6016 -prefMapHandle 6040 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40bb01f8-34cf-4944-9e32-c5ba7af6678b} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    PID:5132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4908 -childID 7 -isForBrowser -prefsHandle 4032 -prefMapHandle 5148 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {742f10cb-52bd-475b-84a6-403f6c31a4e3} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    PID:5572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5224 -parentBuildID 20240401114208 -prefsHandle 6584 -prefMapHandle 6604 -prefsLen 30532 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {742f9f4f-63d2-49d3-8e68-5e8dc6e03c74} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" rdd
    3⤵
    PID:5932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6792 -parentBuildID 20240401114208 -sandboxingKind 3 -prefsHandle 6776 -prefMapHandle 6780 -prefsLen 30532 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da41c059-35cf-44bf-b553-ca4c64654391} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" utility
    3⤵
    - Checks processor information in registry
    PID:2616
- - C:\Users\Admin\Downloads\Blacksmith Installer.exe
    "C:\Users\Admin\Downloads\Blacksmith Installer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4560
  - - F:\Blacksmith\VC_redist.x64.exe
      "F:\Blacksmith\VC_redist.x64.exe" /install /quiet /norestart
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1520
    - - C:\Windows\Temp\{EF1230E2-69EE-4E1A-A77C-7536706D37D5}\.cr\VC_redist.x64.exe
        
        "C:\Windows\Temp\{EF1230E2-69EE-4E1A-A77C-7536706D37D5}\.cr\VC_redist.x64.exe" -burn.clean.room="F:\Blacksmith\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=560 /install /quiet /norestart
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3416
      - C:\Windows\Temp\{30E457F6-EEFE-4F88-8C0C-FB6E90EE3871}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{30E457F6-EEFE-4F88-8C0C-FB6E90EE3871}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{31417D36-61B1-47E7-9DD1-E328BFF6CFE9} {3E024A89-083D-4645-B511-3F2677948F6D} 3416
        6⤵
        Adds Run key to start application
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4920
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1380 -burn.embedded BurnPipe.{F5581660-DA3D-4E64-BF6E-877D7606F4BA} {BCC12A79-1769-4588-BC36-3E0108DF6B10} 4920
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1780
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1380 -burn.embedded BurnPipe.{F5581660-DA3D-4E64-BF6E-877D7606F4BA} {BCC12A79-1769-4588-BC36-3E0108DF6B10} 4920
        8⤵
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3252
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B9C569E5-53AE-4C6E-86DF-FF70C495A201} {AFEBC43D-74B4-4422-96B0-9A8BF770479B} 3252
        9⤵
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:5920
  - - F:\Blacksmith\BlacksmithBootstrap.exe
      "F:\Blacksmith\BlacksmithBootstrap.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - F:\Blacksmith\Debris.exe
        
        F:\Blacksmith\Debris.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4040
    - - F:\Blacksmith\BlacksmithBootstrap.im
        
        F:\Blacksmith\BlacksmithBootstrap.im
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3608
      - F:\Blacksmith\BlacksmithIM.exe
        
        F:\Blacksmith\BlacksmithIM.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5816 -childID 8 -isForBrowser -prefsHandle 5636 -prefMapHandle 5648 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c379e9e3-e168-4dba-a48e-7d6716a92d58} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:3044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4904 -childID 9 -isForBrowser -prefsHandle 7640 -prefMapHandle 7744 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ab7cd39-387d-41bc-a96b-f0518dfa1508} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:3936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7992 -childID 10 -isForBrowser -prefsHandle 7880 -prefMapHandle 7984 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bbbc46b-8bc4-43b0-91d3-8df5f3a9f20e} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:2904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6364 -childID 11 -isForBrowser -prefsHandle 3024 -prefMapHandle 5404 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3af464d-4462-48d6-a69f-32ff679d5d83} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6968 -childID 12 -isForBrowser -prefsHandle 8108 -prefMapHandle 5788 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d2ed4d7-c497-49aa-a49b-2e9416fd400d} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:4388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8196 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 5552 -prefMapHandle 8276 -prefsLen 30628 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87811ece-d485-48c8-ab6e-02ed7b3ed7c1} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" utility
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    PID:3008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8516 -childID 13 -isForBrowser -prefsHandle 8584 -prefMapHandle 8580 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {758f43d0-f699-4fd7-9980-27604e444687} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8964 -childID 14 -isForBrowser -prefsHandle 8932 -prefMapHandle 8916 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6477149-e657-4da5-82bf-c2926e936853} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:2284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9080 -childID 15 -isForBrowser -prefsHandle 9132 -prefMapHandle 9140 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {210ce275-5d9e-4e67-9387-e8e0db302d44} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:5968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10500 -childID 16 -isForBrowser -prefsHandle 6972 -prefMapHandle 8708 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48b8ebb1-336c-4e12-806a-7f10ed8006a5} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8912 -childID 17 -isForBrowser -prefsHandle 9460 -prefMapHandle 10388 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ae2458d-a5f2-4119-991f-81529c5fcd43} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9020 -childID 18 -isForBrowser -prefsHandle 9032 -prefMapHandle 9028 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73be36eb-c629-4812-88b4-69ab4b2c5747} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:5880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8720 -childID 19 -isForBrowser -prefsHandle 8300 -prefMapHandle 8280 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {392ade9e-49d6-432d-8d67-e001bbc84bcd} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7900 -childID 20 -isForBrowser -prefsHandle 9588 -prefMapHandle 9580 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65d1a51d-8024-4344-98d4-8cbbd53a20ac} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:4228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9700 -childID 21 -isForBrowser -prefsHandle 10268 -prefMapHandle 9580 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6045320-e928-43d0-98e9-f43ee381cebe} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" tab
    3⤵
    - Loads dropped DLL
    PID:316

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6072

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5308

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap175:30:7zEvent24594 -ad -saa -- "F:\Blacksmith"
1⤵
PID:4136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x2d0
1⤵
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5bc073.rbs

Filesize
19KB

MD5
3535979085a700d651c1ca0f58666bd3

SHA1
c7002546eabb0e35d8f94d77fa706baadd3b8d78

SHA256
f6a38a2f87f593a43b76441b93c4482908e973fcb8f4a848231cb119cd9d6048

SHA512
3ebcbabc2955b8f221ac86082560a7229a817e089643992050da62b2c0281507af1910388168d7e80d62db246364aaa35d32594786b57a661f69c36e8a33a061

Download Submit
C:\Config.Msi\e5bc07f.rbs

Filesize
19KB

MD5
8846acbfa34fed08f65ffd7ea0657f6b

SHA1
e2dde911cecb59616119edd68d8c1a8a6584709e

SHA256
35a2b2348a3ca9127b14e937ae5251c4f64f388119959670daec1f73934fa349

SHA512
e9e13497d35b44336fec5a387ff97b112d86bcfe4fa8e4888e5d86c06f94abf70ef059caee181aea4c4cedc7c613cc552387030c967d794e89b6f974e68bc3e2

Download Submit
C:\Config.Msi\e5bc086.rbs

Filesize
21KB

MD5
b756cb6afc82322f28c50b58ffd0f693

SHA1
c8376c280194c7c1fc7cad49fa2e41f52e4a7f3d

SHA256
48775cf5949a88e5aa96e85018fdd6f541eeace96be56d5840f0c1f0a5f27a66

SHA512
a7f03affe30bbeb9b4a697da18977804cb9b8f7d7ed48cf77a79ae03a273958ad0ae8fa5f24b6b8b7deefac9efe78d4ba7bc65da32ebca97dafa4b013b8257d2

Download Submit
C:\Config.Msi\e5bc095.rbs

Filesize
21KB

MD5
2d09318677391583aa2a24741c201301

SHA1
93de2ce78d6acdf5238a7f0637c435467a50f40c

SHA256
cb96dd5216ef734920c211b56e3d4be860e51845e202a40c5a8ee5077ff6b38b

SHA512
20028ed8ce5f0f853d05b2b90d4aa01b51bedfadace8971d4c3721e6bd414e37ca37bb0036c3f107ce566e1030f78a9726e4dd3f94991faa209555463a680043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
39b8b73502290d1a2613eb5a4ee16dea

SHA1
f1a767420d054fe68522145c60c04e14d89172e1

SHA256
c549a96ea0bddbb77a7fe8483948ae8f606d645bb0f18b2cda8f616f398de340

SHA512
f83e44fc65ba8bd467acf2b9279f429261a00c154aac529a7f4cc7bd13d57c7ae4a0ab5e27e65063ca8f5b537b6a71bb3bc08f1c94647da2ef3d7361daddafaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
770B

MD5
79f9902397f51b2ae166f977ca8e60e6

SHA1
94013d1c0e0fa4b752925211342e5a837cf3c8d4

SHA256
be3df3b5f0ecc3e5f773bb002be0755b428fc4daeee5f1f071f482e6d9073164

SHA512
1295717c32c909e1498aa9a41c1ff0b426e7bbfacbf506837d642bf61e9edfc9fc63def63b763b587f57e1fd4955f0fdc75924c4aeeabeabcd0694df8cd5b5bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1a9d3825b954bc572deffcd2c23b0c0

SHA1
77ec9a7078a48e8aaad3d9b0f312c280db27f93d

SHA256
374a6d1c4832c438e2f39e8f9598b2ba68c3e3ce5cf062adbca0e875c19579e0

SHA512
a958238d30292607b39a4b6d32d21530b5b4cd87fbebcd009ad3339178c96b38254036db684be477d806eea77b4e1cb2627b071d2f7d352309275a2cd3c3df78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8be3da59ab4bf96aff058c4394715632

SHA1
8962dcd63b81463c74f65ebd90298be414e6a8a4

SHA256
478b8bb96fac6c73aaa7ce784c9478cdd4911443cc5f38d4b085fd68b749e846

SHA512
8c44cc0098ea7b98de8966813974766510f86589fe1a0c41c20aee0503dd7d2a773f81f7f03602cea52ef1cb7fe3969a02fe13af062f50a884000170bfae2531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2433881d1393b436c9f06ab7037b6398

SHA1
16afe684f0bc1e8ca2feedb4f10ab03b836339ed

SHA256
08ecbe6825e2a81fad0cba83bcc7ed161cb44c823263d0b509339c69c631076f

SHA512
3acc9ec6d36da2e224dab47056e1ac6f6a2c63ef70aefdd3ef4e463f06f7c3be35de93256580a8c6b0623bdd49659c035d9a9f8600b3ec5a391cab8ee623d8b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
317d77b1453ab9d672264b4f8188c400

SHA1
2870ec858edab8ecebb4e0778ee0ea554082a925

SHA256
934a65df062cf1d9c8be92d21af26284478ae7b3cc8d46e2aa63b1a5109d8eb4

SHA512
7186b6b7216a5c4d9d0c076484fa99be39e59b3c987b56e4832301b9f11af8d8e81fa909607f6a3043582dae59bb83594f6786fb6d43758c395bfd204822f450

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\doomed\22804

Filesize
1.8MB

MD5
bfa592b61844faf5dc1eed74b2f8e612

SHA1
bc1a31b389bb97a04d88c2a9528ae06b76ddeba9

SHA256
0c27a37877219fd69f6861cb3c1bed33e02e2ac7faaddc05b54483da603ed167

SHA512
585e6b764dd555c5c701f4099307cd84619d95f630ade7502ff574dd047a774af5b1cb627cc243acae40c8964e2a6bcead3f348618bc9eb99a96dbb1f81d8131

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\1019680A1EEDFEB1CD228847477B1C4456103C5D

Filesize
59KB

MD5
ec7a190d46aff2e2ea4d62ce7cf04a8a

SHA1
2de4aa067ef3479c00f5119d0266d82d933d0bba

SHA256
740daf66b2d86d7f938a9ee2ab95b250f2ee7795944616807c59afc82be4c2e9

SHA512
5b4d6dc53a797071e7952d1a298f65ddf29c9db3ac360f1f02cffb106a373915e4cf6b362bbe4d08fdcf25473ce96c4ff5958b0ebc698585eb8e0b6d41f235ff

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\1D659B82D64EB61C2E2ED101C403982554DDAE85

Filesize
3.9MB

MD5
86f60ff705e694ce99745f39fe81a08a

SHA1
42ee1f174e988e9f9900646bfe50e220fd23aa27

SHA256
989fde8aa5ef874934587cc00303358a5b4a644967e80817d6c1e84af0e9f356

SHA512
116d336427db82c90212ceecacd28e5eeb29fda4adf5ed887e975e8948cef2a8d39f9c584bd7e8bef5c59874fc76241de941be2786dfd3e00f7f58300c0ce81c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\2547F4F8D6358638CDE0B31A1322D63360CA032C

Filesize
219KB

MD5
bff2e015f5e3e3abd303dc3ef75b9e42

SHA1
4645d9fe33a67277d866768cce3b56d12acbb49c

SHA256
b722e46c15de1334e47787f861f75bd47cc2a6e8a605694a9677e29e7c6229c5

SHA512
dadd3f46a56b41ff561f01de6cb2bcbb9d628a1dcc2632f9eca359ae693095596861ba630838bdde705fdf2641c6aecb69fc7a8803a5eb7430f90c834a6bc5e6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\54278AA708E48BAEE8461A96499F4F35F7501289

Filesize
1.9MB

MD5
e283aeb69318e60101f1f0d6b4b668bb

SHA1
9674815fe895ef2175c86c528363cd3e49d6ac4e

SHA256
d8cc879a80b3da58620fc5749bd126f37f2e9f4bf05d468dccfe574167012fc2

SHA512
b40e88e8d52ed2141ceb17ecaabdaa7685b659c64f02c11ef2628866d4f2385f40703f56e314b9204668f87dfa56505e1d0e9c36faf05f217bfa1dfc5343a402

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\646829319C67DD4727104CB4F8B6606414E30D3D

Filesize
132KB

MD5
c4a2daa040cf157fcb6c8394c20987b1

SHA1
5468d3d3f4d2de7b5b0482b015e099c64f525210

SHA256
627b3f044140813ee7b393d9bc8696fdf47b7edcead419480502721ff69b33cc

SHA512
f8e0795b2f8a70e49d274fcd444bba51b9cc7b0388616e979650a861381829725ebd4dcb6e3907cd39b48e56fa62bae35d59ae67b204c349e1b3ee18bb27812f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\69AE7A954AA6984D4B6D396C1AD6E6F3367130A3

Filesize
139KB

MD5
cd4909e09cc3330a9008265122446677

SHA1
b3ce8c71e46b0113f6cadbca29ee6a44ef96b0b4

SHA256
2016e7c279f04baa431a8cd9ce607f1b8c58de88dfc0aee342b4007e95797521

SHA512
c0f19bbcb4cd2b640fa7e87360782791583eee059fc4ff70dc967d68133adbe7733608c32c1e2ee69066d52ec8ab8e9bf267ba7fb862c3050f3e90772d51897e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
15KB

MD5
a2b3bf7582e6b3672f2563c74c40d68b

SHA1
ddcbdd896ff9ecc0ef8160b8a92ade481c58f03f

SHA256
ff36bb47808449dbae0aa6ad14597ccec60fcc66bac94617f3b2ad26ca1ca4c2

SHA512
9d52ead59418a0d07a784391e25c2cc9419518824e0da33f2f9b0e16bbe09016b389c473fdbd07de20d35493742759b4753567d67a27f621fc7a7ed1563b7d57

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\6F92CA5317C6E42300D652915BD6A5EC992474B3

Filesize
1.5MB

MD5
c289e0e1e69a44dc0fa27dfd91ab3fe5

SHA1
6a95c5d8e42dc1d4019cf1722a076d8306bda512

SHA256
6d29d1730b4a2995c39b8f7a67b3247367d7fd2df47d82f5b6abd880cc44e8f2

SHA512
e45bf9217fd01a642cf90fabf1a532da82ef98a9eed3a140b4a7774cbefef4d4f2b579097d5229bd36a8afc22250e858d524ad365d49cafb0a912c573ca8bd4d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\73EAA0767ECF1BFF6C0396D2598362046273B2CE

Filesize
30KB

MD5
9c5d84b8c3218d11090701d23f1eea08

SHA1
c327e8b4b5808ab80dae4a8666549640db6e2da6

SHA256
80e3add9f0ac51e50eae9a09ad85355aa3c6e501b1f9729cffb2b75433b06535

SHA512
436711a5465c94f748023398119bcfefe405ae81e509506c2166d8d85a3bb9c5e2c23d070c7ff2f49e6b5e808b34061832b208219e874082e3937e016721a8ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\7DB36831923151E6F75BD91D37D635CF5ED2DE7F

Filesize
351KB

MD5
a8126b2986fbd2842d0530b9e61dce71

SHA1
09a4d4843379f1028da439eb1d0e5aff91443585

SHA256
8cd60cd69d60d840d31c0bd2598f5bea46e8c13a4a3e583c0260f638056136ee

SHA512
edf840c57bae28e866a1fa25e66949606f16f2f10b61bb80c0ad288942b954a90c93ce91b9eae4a81cdffea265fd6f110db3da9cb2967bd6555c8f51f616c387

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\8740D34638930B86C867BDFAA83E497B16674A3F

Filesize
46KB

MD5
a99390f838970543d6dd0c61d99261e9

SHA1
7f13356ecd4ad70511aa4145f906b40fdccfc6c4

SHA256
3cfd6224c1013edf61648635cbfe4cba320f31fafa02545a605a3ce706b3aabd

SHA512
53b22975518336124b48f5ae1f882ed9b4954d9cb5bc9f8ae66e54acc766499e09e1f65fb423be04d7f129daf70355fbcaa423abbcaa00df0a9bf2773e0ba154

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\8DC80CE17C2073213E4056A2BB39620795277B21

Filesize
1.2MB

MD5
f53032d5755c83db4cadd2b9b57117bc

SHA1
b8c4de5a337c161e2d383d205b701574baaa28e7

SHA256
9249996ab81980605cb2e8e6576ec01c6cf4c14cebb5c61d159de11d715b9786

SHA512
80a57d9f2820307edf5ca0213a2c363ec847128e195bed4cb206ddec7d20e5fe2f3c3c3e06faf016ba905c7922e6a7513b027cf603be3a1c54303417afbd33e1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\A555CE7334E1DCFE188A60AE451872DD08824EB6

Filesize
22KB

MD5
791ffd9ed6f36bc0dd2d1c68bddb9551

SHA1
a0be9c3a2c54d3b4f623c6813ff9722d58a93dc7

SHA256
f4a928e849a2a1cf9a51f5d7f6e5ad23becc17d2a692c4a002631b9a0072c6ef

SHA512
e981a5535f6e73dee15ceae6c8a755ebbc167ee49f7d979c04c7e2857cdb5c9d6f4e9312c87b275212fbd98fe157aea10beab5ead6efa9781963bbe66a5dc427

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\A5845580CE56C7F370D06DB6469E686D83EC4275

Filesize
138KB

MD5
f32fe4f6542ca8a34118da9e12a2d5ab

SHA1
67eb55222c69017830362401b9ce8674ea25ecb6

SHA256
bedc2a5fc41f4dbbb4589b933691adfa501307859317f650a96f3276567c3a0e

SHA512
cc2bc13651c665a14df0e62c5b118e568986839a13f83e1c9d4a5e646a08caaff824b84c34e7ed49f83a00610711e4a74784323334fed38e13b01be61b3d2dca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\AE92BDA175417F9C0FABF3F0E3394C826723AC5D

Filesize
68KB

MD5
095d992cac3c13c6686c67159f1f2d12

SHA1
53768090869e0ca3132c090a3fae5e4f205c0bcc

SHA256
551a5a5830e2c70a158c090bb2ca9ee1bdfeacaae1fe37d01cbdc355d01fc28a

SHA512
87e7c26b3489332baf1196131f6932daed84bf9ea30dea633a906c60af21969e5a2a392e3368eebb5dc398016efcbc37e9185522a967ef8f4260945e117e1d66

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\B2B7BF7B7E97BFBE184CD56BD596A995B9D9FD32

Filesize
1.1MB

MD5
8404d6ee85835c91e5d66266143ca3f5

SHA1
c862919b821e66dc523e5c20556047976edb8427

SHA256
79402369e1cfda1508e1dd9ae89eab7870c8b09cf3607f0e7ec3451baab2e9e4

SHA512
08bd1674115cd679b9228a57a02997d0e4cdb2f7f3c772df4c323fc90b507ebf4da5c9321e86cbe8847e40bf7790877f6dc815c1aec45617f6012e7c0555c024

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\BA30A8866A8313A16394DA2599448520494928BB

Filesize
30KB

MD5
7b011b9f9f2e5c86a23c8cb7f9c5f958

SHA1
5491287ab480757806745a6ec24b886181a3d3fb

SHA256
8fb4d9dfdee5cbccf4f87857a6bc8dcfb3c9cb4392064bf6494e50341720814e

SHA512
a2cf4299f875ac02697abab9cd31f3c08aa7523741614095bc5ea31f43d2a2a26dd8825348d39925507225700d528bd4689b823d7857597028ef469de60ff5d2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\cache2\entries\E5045FE458CB15CCF71407DEDCABE7C40590DFF2

Filesize
480KB

MD5
55f7cc2a2bf940621b815e0bec095c20

SHA1
13878e958df5c792465affc69678a9c6c63742ac

SHA256
33f3863d3c622bd5f095a7ba89259ada92f42a5a3d141e9df69c2d9f1eb1236f

SHA512
579c61e5efdb3543b7a2e0ce6e967582cf5f6cf8a961da6a951a6d571b179305448a08a9589b645007fb3ba1e836f72f33c252a1985382580c9cb989c7f4b9ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\jumpListCache\QmWOM2VVLaYBKQCPp3xAT1wVprsp3ojy5kawfM6pKcc=.ico

Filesize
965B

MD5
c9da4495de6ef7289e392f902404b4c8

SHA1
aa002e5d746c3ba0366cd90337a038fc01c987c9

SHA256
13ec8c9e113de6737a59d45ea5a99f345d6cba07f9a820bb2297121b8094790f

SHA512
bb72f0cc815e7b4c44959808b153aad28dbced8d97e50f83ef90229d19ea1c4b3fffff650bf49efe562451fcae0325cdbdffc1a5c4ec5d2c7c70ae9d1a0d8a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240711142355_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
07797fc31bbe8ca0b6c4477d541e339d

SHA1
f483b56a700077af3a8c1f7dd84e214282be391e

SHA256
e9a298a4785d516bac5b8120aa2940997c5d8a1aee22e8a917f808b8d7d3f648

SHA512
d564a1003fa149b1b1bb3b32f192fdf10d7fcba19c1323b826d73647ff87d916aa50905daef0590209603413d387824c42cfa46af4cd1b7fc51eab606077b91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240711142355_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
5273e8d314e98a618b6ac8885634c3b9

SHA1
50dace9cc19a3feef24824a08ec6cbcb9050a216

SHA256
04f126c1c4840a09582cdaafe46a53648388fbcb69b189dab94715432c829034

SHA512
b7c32bb22e0ece55c9df7a650cb9199fef90fe62cc526ee5c9782c4eec4cbe427b855e0dc1fe0ac38d2afd59bdd0f93c7e73e357f233295c1037960241d3a999

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb1C7E.tmp\AccessControl.dll

Filesize
15KB

MD5
d74bb4447af48da081c7d9b499f3a023

SHA1
dadf6e140e6fd8e49a1851cc144bb022e0adb185

SHA256
5fd5d8aec97cffaad9b7df6371b348d436cf1401e86fab614dc4cb8575428e52

SHA512
9a15de5c6b08914f5e5bbc1c318fb0e84da28a316cf51ccddca8dfb64cd67b7ad06acac307b41d5086a0740055d327007ff890807d6853bb2e767179a3b3d758

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb1C7E.tmp\System.dll

Filesize
12KB

MD5
e38d8ff9f749ee1b141a122fec7280e0

SHA1
fbc8e410ef716fdb36977e5c16d3373a6100189a

SHA256
00f7604d4f36a728c7759f4d9cf3e30c9728c503557aac49bbcd55cfc3e4fcb4

SHA512
2b1dccf42d435445331291db94f869c4e8f6dcdfe4371969e76ee275d4e845e1d2e947c216f80484a7dd4b8e85158298e6ec7ed9add6d4259c07fdf87c316a8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb1C7E.tmp\modern-wizard.bmp

Filesize
150KB

MD5
e888dec89a10d1db77a7613d5703b58b

SHA1
0e722426d7356a427d9f9c1d32b6568a00c18ff8

SHA256
e96f31fc07d79fae20554f5292d1ef7fd1fc9fb6f6aee2f549fe5b649da5fe03

SHA512
6e0066783cc87d9f2c14dfdcb2e28c26d3fcb7f75f15e29387fb8e0a64de1db3d89589d2d3aa733491c319d0b2ca2a3176c7c2b95d78ada4e288c5b428402b6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb1C7E.tmp\nsDialogs.dll

Filesize
9KB

MD5
8c66fea5c0e0ecf39d1aafe2c19f191c

SHA1
57532648191cc8f9f379fe2d7cb8e7afc117d842

SHA256
a4116316142bbbfd9eb495d07bdb67df0570eee458a228849ed9abe2eb9c69f3

SHA512
9d27fbd0773d0fb08133ea2deb8365e3ab9a926099f1fd5c8bc3fd70857356be9d8a7461c557ddb0300a9aff89f4ac337102a18b2cdb84bee3f69944c96d97a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
01495c446a0cf73fb2b4e294c183807a

SHA1
24d1752444d7c690e7404b027020289d8fbe6fb3

SHA256
e85dae0c52de1026d57eadadb8b7beda2dcf762cddc8d4a8fd08b4d757ddb14e

SHA512
0721538c9c5b2be40b5c84c631657402bd0b00578f3db563e0498b9e9ec5efab3b3436637d8468aa33a741a9cf5bc8fc06752d74ff40da9f84007185d8c7b8d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
14129de2cdeabc750722d72f477d2da1

SHA1
38ceae2b16c4579c6eb36e84bb1866393bfb4fc3

SHA256
09161446be095aa6cf5bbf93edd53cdcfeb1bdb8744b46d03163d3cccaef36e9

SHA512
7ade2c50ec25c1148fdecf7e89519ae9abe1037c721603ad1223658a5aa89405c716717abc5f95616e19780cb5e9583b3e5b60415661e387b5a408f7e9538410

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
2e9554008b48ad39448a9e598e6e5471

SHA1
156a108a66c0161556fb899b385ea7840319e6b2

SHA256
7c19773e9cb02f9165752c82c3044fb92876aff948b7d6229b7413bd3389b0ff

SHA512
76a7d7a7cc62f5978f5a0aad1549f36977c4f2ed3370bcd6bcd7ed359f7e7bec7f913a84484a667451d7f8e1455d5d49ed00285a005568fe0c4ba66d1ea461ad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
47952ef776797fc01142ce94f2d29a8d

SHA1
9d4fe3edaab38a1d334f5c7b9c8c30b2377a2495

SHA256
ce38bd94a7ecba01dbbde66686564a6d030c1fbc5992d7126972171fb4364a1f

SHA512
79d79d3c113291d52b3394a88f248c590777e88ffb9a06c27361eb405bfe09bc7f5d322092a01ca4d014b06959dcd83a080baa52e7dc129d2aec8fbb5d01fb3f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
3f691730f048951e7e258a7c090dd0f5

SHA1
ac817641056f2bec00ce2cd670416d9b0fe3fd91

SHA256
3020959afeee9fb66751be0c1f0bcfccf9c1f9280f65be0532efce31b6f4dd03

SHA512
2d36e7bb74d757186a78f781a458991edc1ee5dd1fc36f100836641d32a706e936d43de536ed86dad2d50c4c74265ae463ac2157d6bd7cfdf8ef62b56c08ef83

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
fb24043a3e79101760a6f041e361cc4d

SHA1
1eb0eb0d5a98e3f2dddc9e34861de113311daaa0

SHA256
e5321872782f9b5f593ab38dd7c3ab13f07af175a2b98b99455f70acfcc35ae6

SHA512
7d7b8fd3fb19202ad2842b4beffd41060c3ea59b6370d8422a91de2c403c3ee706aed0f1b7c77e7f5ba60ae2a2afbcb3f8e2f1e1da5eadbf24c1acc2b1601bf8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
3759f6b88b722e3b2ff2148b6252b509

SHA1
5943bab00ec89a84e9ac0de6731b337813aa5d75

SHA256
c16eaa7db5354a431a7a3d3277d803e223085149714ea9677ad1da8c21c6894b

SHA512
dda132077e6aee46541737f94ee8ebb2484516a50f1aca6f16c5038b59b8ccbaf208e2fb5231061c605bd44b37ed0e762ba095c91254aeec988c6219ded1c7d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
80e919f1c7a9bcadafef8ca17969b248

SHA1
e8e1c114f7b138c34de3fd8eee0205e8eed4c8b4

SHA256
e50d09fc30602958ee7e463aefd7990b460ba4362fb8e9294bbc752ae4c33eeb

SHA512
ed24f6891b098b5496a3cf49589fc37cba21a91f897f6232fe6c2e0a9b03ea0c5f7aefcd78ce6fd947d9f4ecac2d09e5c1d4525f13fe0f8ee4f5214af0489451

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\AlternateServices.bin

Filesize
15KB

MD5
255e73f4596fd7f2196b20683e18bfb6

SHA1
f288d53f0d3be2af67c7bea6baf9b215a8e78d09

SHA256
d12bfa41ed5225910ecfc7b214507f391a341311b8836bed0de070fb153b1be7

SHA512
04a87f45040332b3e5cc0ea4ead89c17023c0484cf7239948b22d42b93b21ecb94d2d08baf75d874682a0829d8d566b14f64c500223a9bfeb9da4e33a20e6599

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\AlternateServices.bin

Filesize
8KB

MD5
7a44509acd39238709fb087259581ac1

SHA1
905413bcf77bbdf97d9a0bd4497743de82559c3a

SHA256
b1180d7b7ee398a627ca2ae18ea3e68dec11e31f4dba7b803d6053a8e179169e

SHA512
b2c9d06e137fda2c7f168956a292161dfe51b1fbc98c3ba0b5fcb4d3d734a469e7389938a37f2d909ff452d3e68fb71eac0c4821ac1d6e8c33be9a78628d8b90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\db\data.safe.bin

Filesize
6KB

MD5
b455af34acba0da1f9bf86038cdce48c

SHA1
82fca5652dee4ee7643d0d220b8b5ec97ea62be1

SHA256
1b351dd1040d564d34cbf0887dc3b9ffc5053ad497097bacab991bec564772c2

SHA512
a285b6f2a69da62240ca97180720f9d5cdbc98227c9d375bc0881189c13053891f8aae2e4284652be61c72edf30dceb4d77ac4859be890c51a813ad625ccbea6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
f62ffb55bc649f2b95b994d3df7f32aa

SHA1
9aa435ffe7f08e1080064fbde8887c25f35636e3

SHA256
c338ef2aab7cd482cd5544e1bafdd4edf002467ecaefd54e724c0c53321df435

SHA512
4ccfb8c9914da59bc77fb39cb5688f187f7d29e61a51d87cfae43a78b7cd0aec6523abdc7dfceda1260f1f2428934e1e0462df29b6c046e1b0e7ef3324f031e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\db\data.safe.tmp

Filesize
94KB

MD5
ee232c256c2bb4214a2ac67d6ec4039c

SHA1
82039d9e5df6b27db787c34eac9a942a66117f04

SHA256
8e764043c02d41a8405a8a10c54fc012b5e104161532229f52b299a17ec9f158

SHA512
870e598da09e2559c0c6e453a3a00249f3bfd7bf7381a76d72d3741763cce64fde134061963e1336100e9618acf77254be4be861451a3c00d627df51cc6ef757

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
5bcb7daaed56c9d860a648f65cb18d88

SHA1
1de9c161bab53fcaa0b4e9a762ac9fd4752ebd7a

SHA256
db00756848d3bee1cab01d79189176d092d0adaeda6b37767729cf490d3e059c

SHA512
ab20213691c1c1ddbdcba3470d129990d2951a6d0e7ac874341b99f32d43daa2d15e955d4a1159813932395eab5fee699f65f564176bdd11b526a3f03c05c9b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\events\events

Filesize
5KB

MD5
09d7e12cd24b8621b44b1c034077ac3d

SHA1
946246af7904a2bdf4388bf51029124e3316be0a

SHA256
054ec01e5fc8de4f56d2a3330e72712c4e3053709ace1af3c6c2143cb6d1c3ab

SHA512
d66d3ab0ef0ef06af0b7a2d7906336e1db8f198477a06f9bb5ac7a96e4721d7793a8bab2100c2e463134a84dbd3c503e70c8c2280b048de8bf41ff2b175687ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\pending_pings\4f17b2b5-b6a4-42e6-99a3-e42543dc21e8

Filesize
982B

MD5
3fd6adb171e46b5f165a8fdb44d3a7ed

SHA1
a3959241d92adc0741634ee9015081f015389037

SHA256
c38468ccd1d7df39428cefc351ad342abb0239a2ef215ad1981ba77a2d56d120

SHA512
9717882d3c49679361756d3102b0731f2eac8ade47c7c87a73f0c1743fdb773d0904ae8b1d85645dd8dae68ed4bbda0ae450ae3ff5cb1356567fc60c55278c7c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\pending_pings\8345b54c-39ed-4816-9313-8a83092b3a72

Filesize
671B

MD5
5ce609b2a8ddc4b2432e9c2eb7a01c21

SHA1
cb09ade591d6f0287ba168cc539cd708d5c06e95

SHA256
0a6990d14a33d27a7cbba6e2c76afc9ca656e22ce4178e3640529486e456cdef

SHA512
c4ace51c1569f9fa79b54cf9b9773299e3d548782d2df3403133c5150669fd1d67522f5f7f96cfcaaa7e2dd8d0334494a861241f633f7cebeaac61e9374ed0a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\pending_pings\caf90b9e-3e65-4558-977e-e5e9cfea1260

Filesize
26KB

MD5
e6523014b1df1d0fc9b6e275c85c84b6

SHA1
dab4f87430d1b3c3c1b6d5e642d251802f43a4aa

SHA256
f7bb6ab9772c9d051104aff745e6606f10ff4fae06cd1622b62d0483cce56728

SHA512
67de923b9ee7ecf58fd7939b92d45a6190516a7d891086ead19f8fafd286ca0decbc61711cb976b2164aca0ada47505b0c73ccb223ea14936dfab27252a53486

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs-1.js

Filesize
12KB

MD5
4ac427b20501cc08649e42a7d023dc1b

SHA1
e2aadb03d7ab84a0bb64fc71c8cc7f935bad50d0

SHA256
a0237eb1c4e2a815f98babc4346a4f10e630fd68abbc1add32ada40502eae864

SHA512
80c38275bb9c043b153a38bd85ee985c07a676d6b875ec1a027ba66506fa792c58febee5f1fabc3c082860293b32b8e2763f223efdbe25b0d0467feeaafbbb27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs-1.js

Filesize
12KB

MD5
d8fddd6819e28f9351f0456c3aa71c52

SHA1
934da4c6f00cdeafdd5731c66cecd6798b833739

SHA256
c7af8f3517f1523e534d5adbc24ce916da66606e43733484b6191d285c79421d

SHA512
259399008e1c51c3180853ad84f092295269e927f8f7fb5c592a07abf8a7f727e9af41292484932cdcb7fc33e02810f5bc2bb396ef28ceeba1545833e1791aef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs-1.js

Filesize
11KB

MD5
943400063975f76ea525246a30607933

SHA1
cb54ea62d3ebb970cf59c4a9fbca5eee3565af7d

SHA256
0792b08e10e1cd7747c6421b6220f34446b4165f62158b219a2a51d530b5ab0a

SHA512
7eb7655994c7f3a07e786c7048a12713d5f39bd0806238fca43d62747e1fa0fda47cacbffac2f618ac09592fb35110e5cb0c88bb8c19e16d8bde6b670514e970

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs.js

Filesize
12KB

MD5
83f76f7ab07dc419ed249e149302a2a0

SHA1
a2a13aa03f3b691267082b12f76ac6dffcc85b27

SHA256
dbad0381628e5d3f9955e26a4329edf6dacb93df02494fbc31c35ce7d347e116

SHA512
6fec1c2bd424a64b88fcfe02b8ff35a8a651a89c43749d5316ae40974e6bc7167cbc8c3a98f5fdb7624d50323305a47ac99b35c84cf84f561d266b9622672705

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
9f7e543c199b9aa729c0f8826bc5c218

SHA1
905ce2a9f2213e7a858e6d8573c4a16c0214ee6c

SHA256
17097b6ee978de62a7215cdfbc54d6d97ebe2dfdcfe9457aff0306c88a7f38f7

SHA512
2f5c5d97c9f4e972dc2fbde9a2afaab72eda6fb95c912ea5e315ec7176c2d0c61b7954a0384a45067f080d35b9cd12101485506f25d72a1e9ec86d2ddcf258a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
5a9995bd749b3c4380b2cd0154060d57

SHA1
5e8745040261add4182b05f931cda783f4c44036

SHA256
24bf9caf078fcbe34cb4b53a1b974de3ab7299199130e68f4dc6fec7b713471a

SHA512
d482426257f2f472d4f11588caa18a16ccf15a9cb0b404e508d21fc87b4f90c9ec78c3e42e1e4b0764207c11573bfd3c5df398b4b71180f7d62054f4b632bf0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
4ec21526665a1cf7dec9e6e6b3ea9732

SHA1
7d43ace140f591e88071eaf86c437ec48fcd57bc

SHA256
483a9883d9b41f32262909dc113a53f623c347aafb22a6c948016762311b3a44

SHA512
2ddd4528ea4b0ad5ed1fb5373b80f30d88eca629a28c9953101d262b69a9c9e06980a3d2212849f9860c3e89ba6d0cdb26e33ff78bcefdb71735715fb32ee35f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
f7d77b1dbf0b5b536b9b02c5a7909418

SHA1
e414d1063797fc87fbea1c4f765bda1e07aab8e7

SHA256
c9421af15851a67fb229741ae4bcb76b87c16fb4d6e76cd2762cb7d4167d5dea

SHA512
1bb954f5f4c260505d7c9b23f2434e98061c0f143f9980656799f262d3e8b6c2a3d25358549a380f75b520819fadf974d2ab7d07c48b1e99cf2781d9a9efea3a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
b18ba369e1bff9c83ecdd8ffa70bb237

SHA1
044bc95e1c0779a3236dca245d87fed8eb8a212c

SHA256
966b807ee405f724cdbf9045e4ba356e655e060918a53382bc971c79ac176d63

SHA512
3eb4977075611be4bfe3ef214bc432ee82c83508c1731a324c0ac6523aa3dabbaef336bc1b2337fde8b43f0665047f2bc7c75c0e2f0a5056b99924f5d40c27ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
1da78396dcf74b7c15156d71cd95f91c

SHA1
7cf8eb4eb80dd5bff90839015757ffb815d0b9fc

SHA256
15312b99db10ada2117351ad56c2251d664b78d6edb85b0d024c70f9edd313af

SHA512
e5867bac76dbd54f9daa761493ddf93e711e65184b910c8b78c5d3edef12f774bafa1e5acd922e2a5141087de482b37a5fcc0066e427e786c919019cffd46bae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
15KB

MD5
1fdd7796b57633d1589232d229088e74

SHA1
868fb6608947b3d4d3ea13c066014ab7b0dca844

SHA256
7e385fab4c82b6bd8270a6da140f20519599e0b26d3edcc2b0bcc99a851c29c5

SHA512
75a789db0c8f41504a40fdeb3ce8f142001181a085d87042a774067b814d96144e0862ff20eec5bbe98da0da0e2e178d41e26bf8760dffa3cc85bf909aab0ed4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
8d9252bd9f80059a526eb1c389a07c4a

SHA1
7a2a1c471884bef5e3d1899eaff76c629ed00754

SHA256
ded3193d73710d844b3222aaee30ad8bbe79a0111c3d29905f9bdb270f5fe531

SHA512
f83922fa0d4f7d499195155d1ceb7f015dd7719e43f0b8750a39dd9cf3b2fce17eda0b9f42c9bd0a1a1df34dba9be33f7f01b912d6b1536fb9b6fd9635ffa231

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
21KB

MD5
3c5ff812d33044da5106009b3986dfc0

SHA1
87122fb9c4cb7631b8b3e3f1731c5db3f8be5f0d

SHA256
515a166719b8b7d9ad0b06c13b915ad6a3dab502e3841eddd9c3c60af6946dc3

SHA512
f96efbd3420c76efd8378b285d1c218e769862d1f8f6da09a0b301e2ec9f31cfb3183b21353f4857a91e0d1e23b7eb32a440439d38098a5c7aac922dfea9b020

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
4c910759b7c4afea85fa3ec969a996ea

SHA1
f84765fb9893b914eb3a5e2432d0b939c2830161

SHA256
f84f8843711e226014ceca4bdf5fd7c939ca61f8bc0690fb649101b115c3e82e

SHA512
1bee229721f598009616b40fe9c884bc345d0da296c540b7c98fee690d6c5304740cdba0e9659ce8d0c3d3e49ad376bc86d57f0825c5491a1d33adc6b82d1cf8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
23KB

MD5
fea49511c3cc50a1461b7f5e957471e5

SHA1
57592aee19a8fdb036021e4c3b9929c9840ac752

SHA256
75b8b2f6bb36589374f1df5076136b0f7c5bd00b45cd350c2fef1c1513f854bd

SHA512
5dd53fb8d1415673604d1ffd181cfb694ac5b139cd6a983e521ff24a45662ec17c8f2652b853c2ac8387908b4f52ae29e0d12d26a258ce4b5972af81c52b8806

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
a3c18bdac581bcbdd1de34ca1166fdcf

SHA1
099498be01d6fd3e1a2c4740b67d47ae0f869169

SHA256
a08be8f0c9476d30476a4981b96065f6aeb1c53a6c78b3fb8b300e6031abd2cf

SHA512
eba93ff14af43027936d10aa45a0f244e1175877d09d9bd5e84a2ad0753563410c0ee437182c3da11f04eeca1584029f23d3fc26aa41e2d17ca4b1df557c8dca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
23KB

MD5
98d268c2304c115f9c31e4f03ff9af60

SHA1
433369cdeef38395962576c70b5aa05a731e93f1

SHA256
5cda8719496ce0c958912d6007fcc55212fab2ac5c21c45ff58e4530f57608b2

SHA512
fe22fd7dfa6e2162aa5bfc1cb50f73744b0e39eb588a6271483d65967f01458edb3fd27f870d5561f0a0925f4ab7a707798cfc8f76a846ac148cd1cad84ed6ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
27KB

MD5
5dc2b8522dfbad330ccb7391d6224100

SHA1
796aa8a23d18b571db0d8239da57640e2f1c0096

SHA256
414098badfd3fc837c525daed54bef544381b1a26e916a0371e7431e54e7caa5

SHA512
0af3052787e08d7afb1c93cb48422ea6de89927f00bbe4462ddf452a6cef8c8f5722d350c07f31102a412f2cde92916fb0375525e748cba04efff1f131b8d50d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
30KB

MD5
c671512abec10f1cf4a9cbfcfa8dadbb

SHA1
e88a4112a097f7f3032b34309a7ac8e6cc590e50

SHA256
9266d6fe1a8f8d721836a253307e9a6f3820976a7b17eec946f47f849c45426b

SHA512
ed154c7c5d38e9b638196475ac276d9709dd7a53e1a6a1388cab4c577f32715a703e1026d5f686638d050d08eff8b290d758ae6b37d8cfb7533d61b36ae9e424

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
23KB

MD5
f68a346a45e7b2c72d7821d13cfb0f37

SHA1
fbdb735a35ad228008a1f591793cca3f01244309

SHA256
788de67592de5fd07b0025105428076f9c57d6f8b2a8a9107f77451f2851112b

SHA512
3bb243db20f46a51c5606134f27b6d48794257f65961f7a1b522b0dd81f1499c486d7e0a22d1bd4a636fdbd3ed2350d38ac1937266099b96976afe24a944211e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
30KB

MD5
090abbc2e75bf8636e397b84766ef7fa

SHA1
984e0099f1677027fc07ac32aab90c90a4df3116

SHA256
2eff2def984d5875eed4550e55d7b5368cc2e0764ccbc0acefdb24fb3a95ef6c

SHA512
4e2b872b38967cac80821e97bf2f78e1a714fdfac3036dd3dbafedcc721fadd287d75d62003424ced4742d65ec9d4cffa3fa895eb0685abb6b0cf1dc280f10c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
33KB

MD5
dfe32922acb3efb65ffa3bbaf86ce54f

SHA1
862e04c2082173aef6a7b9c9a0caefdc54f023fb

SHA256
72b9c7da0b5c3187f93359ba7cab8e147a7758c52057cef6bbacf0df0e02accf

SHA512
6eee69652dd56ce5fcfd3b51bce671ffab4e73b8c6cfc9a039bb218d27f8542967b81db5b08379216ce667e828dd44ce4b637844e9fe0506b7367a4a9fbc0aed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
28KB

MD5
30ad3d1991950d433615b0ddcd2e3e27

SHA1
fa1c7ec296f5910df438a09b2f509c60d6d115b2

SHA256
2ec424d7c15fc5e03f40d7f59caebd29dc781635517a649d95e3698109646d22

SHA512
e96fac3bd85a017edd8aba9d32966841b8347e62a2150fa8a167352995e7d388910e4f8059561f3610dd8dea7b7770452b5117d1da8c4833f4f184aaca5c5e5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
33KB

MD5
39057fe705b941744b65b2534e822048

SHA1
00cbab16b523edc657f5835c8cec8782864bd39a

SHA256
4e504f5b8c4a6de0989323dbc51c05e0ee679b941dbd8514199205a2a8853578

SHA512
915eac483f6160fd3fe825fa638dee9b4d9cf44750b45a172ae827b5de250e5bdba31c619522b2b51c4baccfca71eb364df1d4993d7f1d9208f9027ea413a3c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
30KB

MD5
b0a205eeeac4f6f67ac47f9c276e80ee

SHA1
1e6682405251dc50b02205043a03e47dd907e176

SHA256
31594407713afada860a5c8bd6e6cde7f44498145ac70d17aece9f9667e21cd0

SHA512
f4184e0a5b9b9147ef5a1dbe8d5edaac3bf57dfa28e264a1892f420cfdd0dcc147af148abc4ea32e0d3b3269251430bcad182e9864ad6b0bceefaae9d7d69647

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
26KB

MD5
fdc2380c8dcb4d4ebc0af954e1ad066c

SHA1
e07ecfc943f88ceee87ee033661fd53369fb581c

SHA256
076510321c961cee02ea567dc1513d336b2a9d9b5c554b86a2d4fa2a88e70c88

SHA512
beffad0b2c5964d7edf0ccfbefb33b5f1ba76cdf2e45792d5151cae8afa9b49da19ac7ce8b358c93cf05c2a5e0b774dfe31a7264249ab9c3f074943605feac25

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
33KB

MD5
d81c5fbe77965d8d3c9cc2d571406356

SHA1
7474f9c0826088eb2905530fa9cb75c76b9d77cf

SHA256
e807b02bb78ec1019758b8c926713591180c53de80e93ffe3437496b1a8ba683

SHA512
1a074daed92a722d3d30c6ad41d5bb7cc7f393c517d0cd8a18ffdd73d5736fe912de210b9b8c09462ec9711f3b8190080d979658f8a6ed6fab89746bbe3d1bba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
33KB

MD5
5ed27ec5f97632a4583465f10079abf6

SHA1
3c1135d7314f5b31d2737ecbb48897863395c08a

SHA256
006572c6f53a463e741a7270bddd8fbdbd4ad121e2e09b41fb29eb22cb15f6a3

SHA512
e21b5e2b624101e31164e9334f29885ba6af0cb0fc9767380553fe84e4a863edae12ec542f8f9e010c359270547339a6c7c56d2fff6498b51b27a42e21ae65d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
33KB

MD5
80f2ef6230e69974597c127bdf49255b

SHA1
7dbb38870b3675ec486f4f9d522e700f031d4ae0

SHA256
f3e3db584012268f863ee30832d468bc201c66aa24d29c9114e475215dff84f3

SHA512
4e7104524a26eb10d63ef0f8cb5d3d6e88979278f713697a05cd4f566f7b0ab560272752143eb83eccdbfffd8d3771f0901706de612a1d8ebcd8604b3b30d683

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
33KB

MD5
3c85cad37cc1835e6ab26aa8bc28ab7f

SHA1
79d393484b13c2ea22a17a8ee3b17ffc12fed0d7

SHA256
8f37acdf97d99bbd2ebb6878c90b8dd510f5abefad440d5e797eb42659a29f17

SHA512
a13b6362eca742bc062552e0c30f38e1b6ea250b2a0053b857f48ea48eab3ae4200192cf2b67b364d5761f7eeaba1897382b9f4acdb3c2f6934842ae7e158942

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
33KB

MD5
5915d53b23a806df1572843077470096

SHA1
e5d2f966bdb4298631395965d7af49b64a1577cf

SHA256
eea399453c469a3e78351dacd6a0187d23e26a9623b25d2123bb795be1f932a3

SHA512
9875492c3f4f86df35e186e4cb6612ec74b44f203b167b7dd8b2ea9e466efa6f8d208cfd2849befe4b6b3bc30f22575a1adb57452cd6be0ff39a00c943a29ce8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
33KB

MD5
91b1c9ef418993f72470aaf07d1c4402

SHA1
fea18c360a65c1627cd413ec687315574555fd82

SHA256
b1a01cc8a85b00adf8e492ff8d7d4093a066909b88634a3ae75ccfaef9e93eee

SHA512
1d7d4780322284de465d814e1531e375ec67b684b96b9bebedbf9b9a30ed724463a09151284fc04419d3efdebbae7ccb57f8f9945df71d0bb052d4e3911dbdb0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\storage\default\https+++dropmefiles.com\ls\usage

Filesize
12B

MD5
8c76267deb754bbb1f7a9a798d626a9a

SHA1
bc35122c891d132da3dce2d9c1198f4d5929b55f

SHA256
7853acb32a99b8240be46b33dae3d1e92c61cb16693e1fb42400f779401b5113

SHA512
ced7c0acab588fba70a1fc202d519747797faf37d0c2f81b4ef1f9061eb2cdb414cc955f480a6db31384607fbacef9b52e5852f7f54688ba3b01fd6634d82193

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\storage\default\https+++www.terabox.com\idb\262324155ifdabx_.sqlite

Filesize
48KB

MD5
46689aa45d18a4653e912bbb38b26d45

SHA1
50e29a5a3d86fa4f4ff9170635e0ee99146a5f4b

SHA256
8d25a0b20e2cde50dedec4e9fd1c00dd2d0500a5ea69022940471fdf46be504c

SHA512
233397096bacbb889e39fb401fa8edc584687c8ad180afb5c4fde6e3a50d6f92081ccc47a14a3fbd78f3d29a0bb797b8fffb53057002cfc3e361bea9cbaa43f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
576KB

MD5
7f5b633f705fe8bb33b6b9c854d39623

SHA1
8aa73c8a638cdf1b5be9b0a9f3b933d636903cb8

SHA256
93dcd610784b5a9e18e7a75ac4e1c0eb31e9549ee92d4758821f1c58943f98ca

SHA512
957d017271411b2ea2473eb27f876896ba68f3d8a83668acaf9a0d9b536637651252c952ac49a271c7dc3963aab82df3c9681409f0b4fc6661195955361fb30e

Download Submit
C:\Windows\Installer\e5bc081.msi

Filesize
188KB

MD5
d5a907e3b279f26804af0c56b0c65d52

SHA1
63bf7f0afd12ef21781dc14dd3b14c59d9e66518

SHA256
401ffa2ef4f070e211ef3f6e4f8a2a7af2bc9ea0119bbacad040669ab6221bba

SHA512
8d23fed4d26f0e2d1e40d5993ab2f588be1e7873cbcbe2064351ca8ef705bf74535225e9d0c2adf93fabfd45691077c7abb3991a013c8b4b234b9751c991f327

Download Submit
C:\Windows\SYSTEM32\VCRUNTIME140_1.dll

Filesize
48KB

MD5
eb49c1d33b41eb49dfed58aafa9b9a8f

SHA1
61786eb9f3f996d85a5f5eea4c555093dd0daab6

SHA256
6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e

SHA512
d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6

Download Submit
C:\Windows\System32\concrt140.dll

Filesize
315KB

MD5
9485d003573e0eaf7952ab23cc82ef7b

SHA1
75b1dcafc21ddc7c3877caeac06bb04ebf09ea40

SHA256
5e0e8eac57b86e2de7ca7d6e8d34dddea602ce3660208fb53947a027635d59a1

SHA512
50bfdcc4f889cd40fe1b79bd3b32515c18836bc533d5590c95ecf4af5041df61c87df6ad87ef9323e19771de00d7d483fecd07fb7674df380be8839f6ff3256a

Download Submit
C:\Windows\System32\msvcp140.dll

Filesize
559KB

MD5
c3d497b0afef4bd7e09c7559e1c75b05

SHA1
295998a6455cc230da9517408f59569ea4ed7b02

SHA256
1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98

SHA512
d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386

Download Submit
C:\Windows\System32\vcomp140.dll

Filesize
192KB

MD5
ef76327ff132a48f3bac24598c99b373

SHA1
71d2bca744724aa55c16e74b1ed22b61ccfd8920

SHA256
d49b394de1154176b39611c37c669ebff50aa5a818dbd5ff3d2214a299368ddd

SHA512
b3aa61ec77ce171b6a7910f0d973e8393dfc457db0d5e6035e18eb4cf9d75ca9e4a9fe012e91c2acf4e9b944535b15cc99ad15a1273e1fdd651ff5406a26ccfa

Download Submit
C:\Windows\System32\vcruntime140.dll

Filesize
116KB

MD5
e9b690fbe5c4b96871214379659dd928

SHA1
c199a4beac341abc218257080b741ada0fadecaf

SHA256
a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8

SHA512
00cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c

Download Submit
C:\Windows\Temp\{110A0843-0DC3-416C-8A54-0A61D30AB981}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{110A0843-0DC3-416C-8A54-0A61D30AB981}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{EF1230E2-69EE-4E1A-A77C-7536706D37D5}\.cr\VC_redist.x64.exe

Filesize
635KB

MD5
b73be38096eddc4d427fbbfdd8cf15bd

SHA1
534f605fd43cc7089e448e5fa1b1a2d56de14779

SHA256
ab1164dcaf6c7d7d4905881f332a7b6f854be46e36b860c44d9eedc96ab6607a

SHA512
5af779926d344bc7c4140725f90cddad5eb778f5ca4856d5a31a6084424964d205638815eab4454e0ea34ea56fafca19fadd1eb2779dc6b7f277e4e4ce4b1603

Download Submit
F:\Blacksmith\Blacksmith Uninstaller.exe

Filesize
181KB

MD5
17a2439cf36e1cfc455edebd9d2cda5b

SHA1
073e6eafcf46c3e606ad01b1a3dcf4e4aaedf082

SHA256
9ce5dbcd7ac7abeb80cc751decd32d30e429ad1d0455c9670890c267376efcb4

SHA512
cd28d19fcb956280b2bfbf4dd8e598eed020678797d0b0d8e34329305c2b91c4e3f32d38ce5d463c2f6bbe73089280b851e8836e547c320514422dab6617e1bb

Download Submit
F:\Blacksmith\BlacksmithBootstrap.exe

Filesize
594KB

MD5
aa4ed4394d1085b62fabd44ec791b76f

SHA1
e73266c2f2d479632b3fa5b6c607a7a7663486c3

SHA256
210e2bac76e267d26131e14c38a5276e5d08c683ca07c5b7b242f3525599a138

SHA512
5bb82ba31045d6ca50d38aa87c37188154401217d74e708286a46ad261362402a04227ec79e97a0355eb3faed94472d57c4ae83933ec4b0058bc81fd9cdf9863

Download Submit
F:\Blacksmith\BlacksmithIM.exe

Filesize
19.4MB

MD5
ffc9878d0e0e6c52ef046d1af256770c

SHA1
c5fe4d8677f6cba77839f8629e7f55b1bf51c01a

SHA256
4887a0b70bd983118d85ddeb27df52b15ed97113b0dc95ea3e0251b5908ef6cb

SHA512
340a57e080f041365faa2a26455006468245beb66a42f93a35362a2d5ab69fcfb1118c5326548c2537a1585a69b71656994371c79fa3c64990192145e202dc3a

Download Submit
F:\Blacksmith\BlacksmithWorker.exe

Filesize
205KB

MD5
a485c11f3f0103771a7edbf55bd29534

SHA1
3ece4a95504071a9da2a4af49515ac11d0aa0d04

SHA256
00bc0c95040307092b74bb6daf44c48498554aef5348e8b329d3fe103e3ccb96

SHA512
0c615d7b9c243aab723dfaadf4b7f59514992a2b140ee0af1f5c3c3e77c964a95aebabdf57c1de0bdea04b57145aceb75971ebfaaedfa326bfb282990a499616

Download Submit
F:\Blacksmith\Data\Blacksmith.bin

Filesize
1KB

MD5
acb4d82ba3ac8cdfc0fdc2e0efa5ec2b

SHA1
9cabddbfef0306f548902f0b09961e51c57bbfbb

SHA256
258b68c71b59f6882a5ecaff0ae67be2e93058f1adfac23386af59544c065c4b

SHA512
75a0d4067c6ffe2c277e1e0961eef2ca1a90d04dd625a40b72dc520e13f8d67901eb4e03f4af50b46b5775f4e9d5b580a38c9526a926c83f792daf693956af72

Download Submit
F:\Blacksmith\Data\Blacksmith.bin

Filesize
4KB

MD5
a701b8ce36a9498a601eee2ea3a63bdc

SHA1
4e1723e04122c4e1d5adf9d763a8c1d3d345e287

SHA256
db8ff7805503ccaa97738b0d9cd4fd22a96c5db1fb3aac5d3356dad36233733e

SHA512
3fe85751498b70d06ed657bb195dfc72111a853a0a069250e6c14aab17c9dc55fd11195d7a7e38f7ca6e77f84a8c8ce352ccbf6f80b0e4a2d53fbeddadc36c45

Download Submit
F:\Blacksmith\Data\tdat0

Filesize
21KB

MD5
c3cd6f4635e09e88bc9c03f40f8bed19

SHA1
03801acaf6b97cf9ded3eebcaeef154eacd2bd03

SHA256
8dc6f513b7324fa01b27d6c58db4807e34aa05e4865d8029fb5c8a43666fc27a

SHA512
3b231a97713af3ef8e0be5a414cd609e693b7516df57af12088fe33c5d3a1423c54e520d46cb52a898961a714164f4fb89d07beec19d2cda255a194d763dd5a3

Download Submit
F:\Blacksmith\Data\tdat1

Filesize
29KB

MD5
b82fd961fe47e4d0b38f9c793bc4f98c

SHA1
8c1e6c828465db1200672e3a0bf7479051677e3d

SHA256
555eaf2b9f2eb5c4a380db3335afd92d494761580a46e04d197b88ff858c91e5

SHA512
52fb78937e94d0fb348f6c4e252a32e5233ff4e54e7e20ac5acd4fcd59218680feb3f11ff2ca8733549ac506f4b1c3b09384fedb970fc6a3f1be0b3a0b188653

Download Submit
F:\Blacksmith\Data\temp\610

Filesize
38KB

MD5
08e58f1ec6648cbf3d749b076fb1723a

SHA1
7640e0783c3af9b01d6093b07847e77e7f598bf1

SHA256
5ae6092a536fcb6a59fb5f08db4f8a1ae6f312e1af719e97235c46a6d827bd43

SHA512
b5cc973972479173e3666e379609307cf1d76327dba8cb8f817e9db2e67b789fe4da53ea1249e2f86c87d04de5d982d0318af9c626bb15bd2d7969b9021f7dde

Download Submit
F:\Blacksmith\Data\temp\611

Filesize
38KB

MD5
a6d73ddb6d298c20db73ac82a00aaae4

SHA1
74ef4ab53efe06bca3a9396029d2e113f6ef7934

SHA256
e03fd88ecc03b6fb76fd7b7999b1afbe2e993986b0e08e955900caca8b79d2df

SHA512
890003c4bfd4f1c5474ebbb6fefe6fd45e3999dbb7cf8056e4b82e68246d1fe783eac2e2ca0b5dac6c1a89ec27e832246303c2595784f2cc4dd15885d3d81f4d

Download Submit
F:\Blacksmith\Data\temp\620

Filesize
40KB

MD5
7a3ef2e871b20f9d4fd5e40772e86ff3

SHA1
b2feecbea20cb2ce9760e495363b702db022f860

SHA256
b209df467c57929dda97b79de343d2fff986c0f714fddeaeaf385904ea12a50f

SHA512
8c9c3fc62ddf0430829cabf395412befc4cf6edb28ebabf9ddfbdbd5e79f7811b8295bc01e286d35a815a6104d4a60db4ae100a662bdba91f4b00708c54ad78e

Download Submit
F:\Blacksmith\Data\temp\621

Filesize
40KB

MD5
a1ef0ac2ec1763e6556b2de16e90cb42

SHA1
39e15e5edb1ef5b1b4ac6a9efb04eb9c1f245000

SHA256
6992008339b9751074e1cd48708eb551bc6fc664a00ece4b1eb5fa99ef944bcd

SHA512
e6e857db0157f80ab51f89aa3305a092a148a3759ae9cb46090370914e424cd83eda09682f2131672d543f52ba45d24bbcad6c844fc2289a4b0bea068639a1cf

Download Submit
F:\Blacksmith\Data\temp\630

Filesize
34KB

MD5
c20a5025a2db389f3e5d2128d3c298f9

SHA1
d33cd532e91a88925616815e30db6266fe5110c6

SHA256
482a4f097a076b7159a59ac0893dd3a2005ca95e69aaa22de626c2a7240b9560

SHA512
785f7358b7075f00a7114b541ffbfd67fbb1fb201d79271ee06fc0e75f1fda4a812c534a88ba8a5f33fecc90029653db6830f38aaf789445b6b627e9646c774d

Download Submit
F:\Blacksmith\Data\temp\631

Filesize
34KB

MD5
ea0003ce9aa840cc033c5e718efa1cd9

SHA1
d1a5764b8622298fbc855d0b94d8c624cb2286de

SHA256
a589e3bd5919b00734ecc4f8f93b44a3e43f295f2149468925204259a218aa0d

SHA512
f1d70a8a8402cd336af2b72974d8f5cd18bca83cb89b24644be34a650d05725025499ef04b57eea42e778323351670f59c038043c6d97498b0e628cdddadea61

Download Submit
F:\Blacksmith\Data\temp\640

Filesize
203KB

MD5
f9844b3a6cdcfc65056c6bba55ec9160

SHA1
b93312fdbbbcf732e565bc4bf79bd5beca206a49

SHA256
843d7e0c7b485ff46d74fda5dbbc87bdf9bacc0314038c00ac7b84ccc97c678a

SHA512
272bde457d16e4163947405c80cdbd385e21e3a7119257bedaf1ba1caa0319e7752c2a9bf9d99f41b5e9bf50b7ee5dda8dda02ca9762818a1305d0738a963c29

Download Submit
F:\Blacksmith\Data\temp\641

Filesize
202KB

MD5
cb83bcb8dc1309a568c70c4a91a0e3fc

SHA1
14464f3f5cb06424129fabac729ce779a88e23c9

SHA256
d4a5f22e5973d0c59cad610cebed5c237eed44a26d87313e33662637ffaf373d

SHA512
d49b3709df83a49a3ed1fafeb620a4d9c8b56cc1810e24bc6891206703df9373fc0fc6acf13fddc009ad4558088bbf3506505ea4c575262b862d48251289c65b

Download Submit
F:\Blacksmith\Debris.exe

Filesize
4.0MB

MD5
2889fef77cb97917fc56773ab2a74fc5

SHA1
795ee727d837bbd4a4dba20ca3c2c7f952f4b544

SHA256
231d8dcd0148e8af74eb1111252ff260800f14e7b894976c63b909c451ea939f

SHA512
594924db6b177c7938daa849dbe5e7ca133545d1d5d5595d5383d1301ebcad0b304ac2807388fd5e8d7900512c02be41cda0b3f411924153c58bf95be85a3058

Download Submit
F:\Blacksmith\Fonts\NotoSansCJKkr-DemiLight.otf

Filesize
15.6MB

MD5
82967d53f162f2751ce29c6e33bad3ec

SHA1
44a28ebec602318bfa5abe91fa458160a402f5f9

SHA256
6913976f7c49070ca536c2f0a9e2e33dacd904311e38b1d8770996a0520e25b7

SHA512
b47a9b96d99ec15734c29a909bec28af26a8c9f1601187ee0ecc6272e6cf7481fc587950c494e26f98c22e713957d8906e4f488c17ef959cfc1761a029503e1c

Download Submit
F:\Blacksmith\VC_redist.x64.exe

Filesize
24.2MB

MD5
a8a68bcc74b5022467f12587baf1ef93

SHA1
046f00c519900fcbf2e6e955fc155b11156a733b

SHA256
1ad7988c17663cc742b01bef1a6df2ed1741173009579ad50a94434e54f56073

SHA512
70a05bde549e5a973397cd77fe0c6380807cae768aa98454830f321a0de64bd0da30f31615ae6b4d9f0d244483a571e46024cf51b20fe813a6304a74bd8c0cc2

Download Submit
F:\Blacksmith\cpprest_2_10.dll

Filesize
943KB

MD5
2b4667be5bf2c0f000097885fcd0c91d

SHA1
52749baafd54b1aa458737a24c60114c4d395b9c

SHA256
1413d79dd930784b08aa765415f16452e4830c7bab04a9ecce23dee0593659f7

SHA512
ea6c4af6899493def669f18a8fa6277c02676a0d5fec8fc290cad3769c2bf0ccd2556a70578301177fc5abeb5d532b33a8f7dddec897813585f7426f3ef2fe32

Download Submit
memory/1780-1273-0x0000000000930000-0x00000000009A7000-memory.dmp

Filesize
476KB

Download
memory/3220-1359-0x0000000140000000-0x0000000142C00000-memory.dmp

Filesize
44.0MB

Download
memory/3220-1357-0x00007FFBA0AB0000-0x00007FFBA0AB2000-memory.dmp

Filesize
8KB

Download
memory/3220-1356-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/3252-1272-0x0000000000930000-0x00000000009A7000-memory.dmp

Filesize
476KB

Download
memory/5920-1235-0x0000000000930000-0x00000000009A7000-memory.dmp

Filesize
476KB

Download
memory/6072-496-0x000001DCAF460000-0x000001DCAF461000-memory.dmp

Filesize
4KB

Download
memory/6072-498-0x000001DCAF460000-0x000001DCAF461000-memory.dmp

Filesize
4KB

Download
memory/6072-497-0x000001DCAF460000-0x000001DCAF461000-memory.dmp

Filesize
4KB

Download
memory/6072-502-0x000001DCAF460000-0x000001DCAF461000-memory.dmp

Filesize
4KB

Download
memory/6072-501-0x000001DCAF460000-0x000001DCAF461000-memory.dmp

Filesize
4KB

Download
memory/6072-492-0x000001DCAF460000-0x000001DCAF461000-memory.dmp

Filesize
4KB

Download
memory/6072-491-0x000001DCAF460000-0x000001DCAF461000-memory.dmp

Filesize
4KB

Download
memory/6072-490-0x000001DCAF460000-0x000001DCAF461000-memory.dmp

Filesize
4KB

Download
memory/6072-499-0x000001DCAF460000-0x000001DCAF461000-memory.dmp

Filesize
4KB

Download
memory/6072-500-0x000001DCAF460000-0x000001DCAF461000-memory.dmp

Filesize
4KB

Download