strela | 698c0b8ece8ae240667c4c2e024851e61693ab0c516e7ecd588ffcc1b6f4a2b2

Analysis

max time kernel
540s
max time network
544s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
29-07-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MPEG_ActiveX.06.36.0233.x86.msi
Size

37.3MB
MD5

d6ce324f669b7481db57dcb6569d1303
SHA1

0734fd85d74af7e5bcc64f959352a926abe0b384
SHA256

698c0b8ece8ae240667c4c2e024851e61693ab0c516e7ecd588ffcc1b6f4a2b2
SHA512

3f9d885380115389c6668b54d37987f8deb7c6dd819f7cb52839eb66e8ef2b3b4d899bffcdba5fa3f70a7cd47d5795176372a4c5d72047aa9db3155e623cd026
SSDEEP

786432:N0AfMHWjYBBrduanOx4482GzRh8NX5NBHNvjzm+TgtcJ5g:mHA6uUOx4482gRhmJvjzPkcJ

Score

10^/10

strela discovery persistence privilege_escalation stealer

Malware Config

Signatures

Detects Strela Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/1932-294-0x0000000009F70000-0x000000000A38D000-memory.dmp	family_strela
behavioral1/files/0x000100000002aa1d-293.dat	family_strela
behavioral1/memory/240-1414-0x000000000A220000-0x000000000A6DF000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	2732	msiexec.exe
3	2732	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SETBF8A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_7.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SETBFD9.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETBFF9.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_5.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File opened for modification	C:\Windows\SysWOW64\SETBFFA.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\atl100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\SETBFD9.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_43.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETBFF9.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETBFFA.tmp	DXSETUP.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	C:\Windows\SysWOW64\SETBF8A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_tamper_ar.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.BVIP\DivarIPCommunicator.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\Cameo.tlb	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_ivmd_de.ts	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_630_en.chm	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_ivmd_us.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.manifest	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_tamper_nb.ts	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\iva_wizard\route-32.ico	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\BVIP.tlb	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_iva_ar.ts	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\iva_wizard\CountingWizard.xml	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_iva_fi.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_display.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_iva_pt.ts	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\iva_wizard\MotionRegionDetectorWizard.xml	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_ivmd_de.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\style\Bosch-Icon.ttf	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\iva_wizard\alike-24.ico	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\flow_wizard\tampering-32.ico	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\GCA2.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\StreamItems.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_tamper_da.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\iva_wizard\CrossingLinesWizard.xml	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\iva_wizard\removed-32.ico	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK5\Redistributables\Installer\	MPEG_ActiveX_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_iva_hu.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_iva_da.ts	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\VSDKManager.exe	MPEG_ActiveX_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_atext_ko.ts	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_tamper_es.ts	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\iva_wizard\lines-24.ico	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.BVIP\pd_dlls\sensormatic_speed_dome_ultra.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_mob_en.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_iva_es.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_motion_cs.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.BVIP\pd_dlls\plettac_speed_vision_dome_svd_206.dll	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\Audio.tlb	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_motion_en.chm	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_motion_th.ts	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_atext_nl.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.BVIP\BVIP_VDP2.dll	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_550_ja.chm	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_tamper_th.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_atext_pl.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_tamper_el.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_flow_cs.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_tamper_it.ts	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\iva_wizard\lines-32.ico	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_tamper_th.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_atext_nl.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_atext_pt.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_flow_hu.ts	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\flow_wizard\crowd-32.ico	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_flow_nl.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_tamper_fr.ts	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\iva_wizard\OccupancyCounter.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_flow_zh.ts	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\iva_wizard\idle-24.ico	msiexec.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_iva_es.ts	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_motion_de.ts	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK5\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_motion_fi.ts	MPEG_ActiveX_Redist_5.90.0086.x86.exe
File created	C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\VideoSDK-Versions.txt	msiexec.exe

Drops file in Windows directory 48 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF7A0C596D13CFB834.TMP	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e57df08.msi	msiexec.exe
File created	C:\Windows\Installer\e57e0ce.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEA2E13D39BFC5EFA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{8F9CFDFD-7E96-4875-841C-1B63391B096A}\install.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF77DD874AC6629E35.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9AF285679323D9A3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e0d6.msp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5D1A1327985777F7.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{DB972D9D-758A-4ED9-98B1-289E06982AD4}\install.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D75.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1C0D9764F359B5A0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4660563E99DDA991.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB29.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF88116580B9598F28.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA440EA762E48B2FD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD9DFDE7F4D3EA6E7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE4D565FDDBB82821.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57dfea.msi	msiexec.exe
File created	C:\Windows\Installer\{8F9CFDFD-7E96-4875-841C-1B63391B096A}\install.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF658DCA9AF0A4421A.TMP	msiexec.exe
File created	C:\Windows\Installer\e57df06.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DB972D9D-758A-4ED9-98B1-289E06982AD4}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC4C2FC34E81141EA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE3769CC7F8B2225D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE598.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8A47A552C3F95CC9.TMP	msiexec.exe
File created	C:\Windows\Installer\{DB972D9D-758A-4ED9-98B1-289E06982AD4}\install.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF761.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEC4693B9898E3B7D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4AA2A7075A8213BD.TMP	msiexec.exe
File created	C:\Windows\Installer\e57dfea.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8F9CFDFD-7E96-4875-841C-1B63391B096A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE06.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF26DD1B44CCAE3DE3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE251.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF34E78E3ECFFADC1A.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\MSIDE25.tmp	msiexec.exe
File created	C:\Windows\Installer\e57e0d6.msp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID676.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57df06.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC118.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF89D7A3CF6A1C6BDE.TMP	msiexec.exe

Executes dropped EXE 9 IoCs

pid	Process
1932	MSIF761.tmp
240	MSIEE06.tmp
1848	MPEG_ActiveX_Redist_5.90.0086.x86.exe
3912	DXSETUP.exe
4652	vcredist_x86.exe
3172	install.exe
3332	vcredist_x86.exe
1904	Setup.exe
4432	VSDKManager.exe

Loads dropped DLL 64 IoCs

pid	Process
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
1932	MSIF761.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
240	MSIEE06.tmp
4924	MPEG_ActiveX_5.90.0086.x86.exe
4924	MPEG_ActiveX_5.90.0086.x86.exe
4924	MPEG_ActiveX_5.90.0086.x86.exe
4924	MPEG_ActiveX_5.90.0086.x86.exe
4924	MPEG_ActiveX_5.90.0086.x86.exe
4924	MPEG_ActiveX_5.90.0086.x86.exe
4924	MPEG_ActiveX_5.90.0086.x86.exe
1848	MPEG_ActiveX_Redist_5.90.0086.x86.exe
3912	DXSETUP.exe
3912	DXSETUP.exe
3912	DXSETUP.exe
3912	DXSETUP.exe
3912	DXSETUP.exe
3912	DXSETUP.exe
3912	DXSETUP.exe
3912	DXSETUP.exe
3172	install.exe
1904	Setup.exe
1904	Setup.exe
3392	regsvr32.exe
3392	regsvr32.exe
3392	regsvr32.exe
3392	regsvr32.exe
1720	regsvr32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2732	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MPEG_ActiveX_Redist_5.90.0086.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEE06.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VSDKManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIF761.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MPEG_ActiveX_5.90.0086.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001aaccdaf60c91fbe0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001aaccdaf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001aaccdaf000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1aaccdaf000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001aaccdaf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133667658579427780"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\GCA.LiveDataStream	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CF32D15-1B04-4364-A5DB-6086374001EE}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46992C14-4A34-4299-871A-1D8F27CEDC2E}\ = "_IBVIPMediaFileWriterEvents"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA7499DE-4FCB-4B50-B5F2-0CD6A3D75087}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{53AEB469-A05F-4C24-A3CA-83FFDFBEF547}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B4A1A61C-5AA5-4A49-8EF8-DCB5A66458AC}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1ED9E841-2831-49AC-8851-F1B1382A0049}\TypeLib\ = "{157E83C8-70E4-4797-847C-5ADCA62A8797}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D6490969-05FA-46E4-ABC7-3BC6E6530BD0}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE25B4DB-FF4C-429D-B3A8-03EAFA49625E}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5CF32D15-1B04-4364-A5DB-6086374001EE}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36FBD273-4190-425B-9EF4-83FFC8CD3D81}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BVIPStreamer.BVIPDeviceReplayMediaSession\CurVer\ = "BVIPStreamer.BVIPDeviceReplayMediaSession.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B3C55693-BDE7-4342-BBA5-E18B63E53945}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9013DB20-F147-4179-9718-BF4474972B92}\TypeLib\ = "{157E83C8-70E4-4797-847C-5ADCA62A8797}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9742527-DA3C-40C7-A7D2-7379DA38036B}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3ED34221-983F-44CE-A0CE-6A0274360948}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF918A03-8368-4b04-BDEC-0BEAF1604DFF}\ = "BVIPStreamerOpenVDPCore Class"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBEDD9D7-61AC-4EE9-9D70-E9A4A848DF59}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F945287-3F75-4273-8CE7-ED93F6867055}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E421B6DF-86ED-47ED-8EFE-54D69BFA4D7D}\ = "_ISearchSessionEvents"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C321429-2C9A-488B-B286-9352017676BA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF88EF2-4478-4B99-B994-4960974EF6F9}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CF32D15-1B04-4364-A5DB-6086374001EE}\TypeLib\ = "{157E83C8-70E4-4797-847C-5ADCA62A8797}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39A55D25-641B-4500-9BF3-E4CA247B7287}\VersionIndependentProgID\ = "GCA.VIP.BVIPStreamItemProvider"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C36EC7F-7848-408E-922D-DAC241447F81}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49277289-156A-4757-8789-D93CEAFAB039}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6334CB61-79B5-4F92-A98F-30C017804F2D}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{10157276-ADB0-4851-8EAB-23F212BA4EB4}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD503BD3-CDC2-434E-A881-43AAB7C7BE1A}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E134C3C0-677B-40E1-B267-10F3524F697F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GCA.ExportPlaybackController\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF929CE0-C2E2-44BF-9E2C-675C62916CDB}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B85D51D7-ADD5-430D-B5D0-ED1B224B973D}\ = "ILatencyStatistics"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ACF365A9-F452-4CD5-8FAC-35658E3E686B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E421B6DF-86ED-47ED-8EFE-54D69BFA4D7D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BVIPStreamer.BVIPStream\CurVer\ = "BVIPStreamer.BVIPStream.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{72452DB5-5FDE-4A04-ACD7-D420E4433810}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5F34B8B-4EB6-45F2-A3DF-838841967CC1}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{066E244E-A861-4A06-BF74-A5CC277522CE}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23BF1E0D-B071-492D-88C7-86BD45B7C846}\TypeLib\ = "{157E83C8-70E4-4797-847C-5ADCA62A8797}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5733FE7A-6CD4-47AD-A614-FA3C5DDACF9E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{E4875319-E8A1-4DF8-87C8-E59D79EB7345}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BVIPStreamer.BVIPStreamHandler\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C64E251D-765F-4A69-B7D1-EB077DF6726E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{825A53D4-CD87-49D1-971D-30CCDAD033C0}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EF163EF-C0D3-4709-8946-A35B6441B0F6}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BVIPStreamer.BVIPStream.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GCA.BFile.DeviceProxy.1\ = "CBFileProxy Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GCA.SearchResult.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GCA.VIP.DeviceProxy\CurVer\ = "GCA.VIP.DeviceProxy.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{496977A6-D7ED-403D-971B-8BEAA51C0A48}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CF32D15-1B04-4364-A5DB-6086374001EE}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00BF2FDC-56A4-4307-997D-5BB12A504C7F}\1.0\ = "StreamItems 1.0 Type Library"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\GCA.VIP.BVIPMediaFileWriter\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB9DEF71-BEE2-429F-8B50-D36B9C6DD6F3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAE81E62-8A70-4c20-B49E-A6FE2090F00A}\ProgID\ = "GCA.BasicLatencyController.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08232B55-A024-498B-8D2B-4F84D0747502}\TypeLib\ = "{42022D01-E49F-4376-863E-AD6ED461A335}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{926B7EC6-E14F-49DE-B500-1E69303930E7}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A4EECA1A-FE29-49BD-A48B-827E9ED4CB31}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93F233FE-44D1-4CA6-B0C3-B97D58712E72}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7D599498-1819-427D-8E60-ADB6BACCC830}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B42FA3EB-E099-40A4-AB74-16940A6D64B8}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBC635BE-29DA-40D2-A52A-A0916683EC4D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1697ED67-2A1E-4422-9AF7-FC0E7CAB5ABB}\VersionIndependentProgID\ = "GCA.VideoOutputChannels"	regsvr32.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MPEG_ActiveX_6.36.0233.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\MPEG-ActiveX_6.13.0084.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\MPEG-ActiveX_5.90.0086.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
884	msiexec.exe
884	msiexec.exe
3552	chrome.exe
3552	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
4448	chrome.exe
884	msiexec.exe
884	msiexec.exe
884	msiexec.exe
884	msiexec.exe
884	msiexec.exe
884	msiexec.exe
884	msiexec.exe
884	msiexec.exe
1904	Setup.exe
1904	Setup.exe
1904	Setup.exe
1904	Setup.exe
1904	Setup.exe
1904	Setup.exe
1904	Setup.exe
1904	Setup.exe
1904	Setup.exe
1904	Setup.exe
1904	Setup.exe
1904	Setup.exe
884	msiexec.exe
884	msiexec.exe
884	msiexec.exe
884	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4924	MPEG_ActiveX_5.90.0086.x86.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2732	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2732	msiexec.exe
Token: SeSecurityPrivilege	884	msiexec.exe
Token: SeCreateTokenPrivilege	2732	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2732	msiexec.exe
Token: SeLockMemoryPrivilege	2732	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2732	msiexec.exe
Token: SeMachineAccountPrivilege	2732	msiexec.exe
Token: SeTcbPrivilege	2732	msiexec.exe
Token: SeSecurityPrivilege	2732	msiexec.exe
Token: SeTakeOwnershipPrivilege	2732	msiexec.exe
Token: SeLoadDriverPrivilege	2732	msiexec.exe
Token: SeSystemProfilePrivilege	2732	msiexec.exe
Token: SeSystemtimePrivilege	2732	msiexec.exe
Token: SeProfSingleProcessPrivilege	2732	msiexec.exe
Token: SeIncBasePriorityPrivilege	2732	msiexec.exe
Token: SeCreatePagefilePrivilege	2732	msiexec.exe
Token: SeCreatePermanentPrivilege	2732	msiexec.exe
Token: SeBackupPrivilege	2732	msiexec.exe
Token: SeRestorePrivilege	2732	msiexec.exe
Token: SeShutdownPrivilege	2732	msiexec.exe
Token: SeDebugPrivilege	2732	msiexec.exe
Token: SeAuditPrivilege	2732	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2732	msiexec.exe
Token: SeChangeNotifyPrivilege	2732	msiexec.exe
Token: SeRemoteShutdownPrivilege	2732	msiexec.exe
Token: SeUndockPrivilege	2732	msiexec.exe
Token: SeSyncAgentPrivilege	2732	msiexec.exe
Token: SeEnableDelegationPrivilege	2732	msiexec.exe
Token: SeManageVolumePrivilege	2732	msiexec.exe
Token: SeImpersonatePrivilege	2732	msiexec.exe
Token: SeCreateGlobalPrivilege	2732	msiexec.exe
Token: SeBackupPrivilege	3200	vssvc.exe
Token: SeRestorePrivilege	3200	vssvc.exe
Token: SeAuditPrivilege	3200	vssvc.exe
Token: SeBackupPrivilege	884	msiexec.exe
Token: SeRestorePrivilege	884	msiexec.exe
Token: SeRestorePrivilege	884	msiexec.exe
Token: SeTakeOwnershipPrivilege	884	msiexec.exe
Token: SeBackupPrivilege	2796	srtasks.exe
Token: SeRestorePrivilege	2796	srtasks.exe
Token: SeSecurityPrivilege	2796	srtasks.exe
Token: SeTakeOwnershipPrivilege	2796	srtasks.exe
Token: SeRestorePrivilege	884	msiexec.exe
Token: SeTakeOwnershipPrivilege	884	msiexec.exe
Token: SeBackupPrivilege	2796	srtasks.exe
Token: SeRestorePrivilege	2796	srtasks.exe
Token: SeSecurityPrivilege	2796	srtasks.exe
Token: SeTakeOwnershipPrivilege	2796	srtasks.exe
Token: SeRestorePrivilege	884	msiexec.exe
Token: SeTakeOwnershipPrivilege	884	msiexec.exe
Token: SeRestorePrivilege	884	msiexec.exe
Token: SeTakeOwnershipPrivilege	884	msiexec.exe
Token: SeRestorePrivilege	884	msiexec.exe
Token: SeTakeOwnershipPrivilege	884	msiexec.exe
Token: SeRestorePrivilege	884	msiexec.exe
Token: SeTakeOwnershipPrivilege	884	msiexec.exe
Token: SeRestorePrivilege	884	msiexec.exe
Token: SeTakeOwnershipPrivilege	884	msiexec.exe
Token: SeRestorePrivilege	884	msiexec.exe
Token: SeTakeOwnershipPrivilege	884	msiexec.exe
Token: SeRestorePrivilege	884	msiexec.exe
Token: SeTakeOwnershipPrivilege	884	msiexec.exe
Token: SeRestorePrivilege	884	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2732	msiexec.exe
2732	msiexec.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe
3552	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4924	MPEG_ActiveX_5.90.0086.x86.exe
1848	MPEG_ActiveX_Redist_5.90.0086.x86.exe
3912	DXSETUP.exe
4652	vcredist_x86.exe
3172	install.exe
3332	vcredist_x86.exe
1904	Setup.exe
952	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 2796	884	msiexec.exe	89
PID 884 wrote to memory of 2796	884	msiexec.exe	89
PID 884 wrote to memory of 1932	884	msiexec.exe	91
PID 884 wrote to memory of 1932	884	msiexec.exe	91
PID 884 wrote to memory of 1932	884	msiexec.exe	91
PID 3552 wrote to memory of 4524	3552	chrome.exe	94
PID 3552 wrote to memory of 4524	3552	chrome.exe	94
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 1988	3552	chrome.exe	95
PID 3552 wrote to memory of 564	3552	chrome.exe	96
PID 3552 wrote to memory of 564	3552	chrome.exe	96
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97
PID 3552 wrote to memory of 1064	3552	chrome.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MPEG_ActiveX.06.36.0233.x86.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2732

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\Installer\MSIF761.tmp
  "C:\Windows\Installer\MSIF761.tmp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1932
- C:\Windows\Installer\MSIEE06.tmp
  "C:\Windows\Installer\MSIEE06.tmp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd101dcc40,0x7ffd101dcc4c,0x7ffd101dcc58
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2216 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4472,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4696,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4868,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4876,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3748,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3424,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1456 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3376,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5392,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1456,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5496,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3496,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5632,i,16197888225854967870,11300982738386488386,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4852

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:2108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1728

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Temp1_MPEG_ActiveX_6.36.0233.zip\MPEG_ActiveX.06.36.0233.x86.msi"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:3068

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Temp1_MPEG-ActiveX_6.13.0084.zip\MPEG_ActiveX.06.13.0084.x86.msi"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:1316

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2684

C:\Users\Admin\Downloads\MPEG-ActiveX_5.90.0086\MPEG_ActiveX_5.90.0086.x86.exe
"C:\Users\Admin\Downloads\MPEG-ActiveX_5.90.0086\MPEG_ActiveX_5.90.0086.x86.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy "C:\Program Files (x86)\Bosch\VideoSDK5\Redistributables\Installer\MPEG_ActiveX_Redist_5.90.0086.x86.exe" "C:\Program Files (x86)\Bosch\VideoSDK5\bin\MPEG_ActiveX_Redist_5.90.0086.x86.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1380
- C:\Program Files (x86)\Bosch\VideoSDK5\bin\MPEG_ActiveX_Redist_5.90.0086.x86.exe
  "C:\Program Files (x86)\Bosch\VideoSDK5\bin\MPEG_ActiveX_Redist_5.90.0086.x86.exe" /S /DIRECTX=Yes
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1848
- - C:\Program Files (x86)\Bosch\VideoSDK5\bin\DXRedist\DXSETUP.exe
    "C:\Program Files (x86)\Bosch\VideoSDK5\bin\DXRedist\DXSETUP.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3912
- - C:\Program Files (x86)\Bosch\VideoSDK5\bin\redist_2008\vcredist_x86.exe
    "C:\Program Files (x86)\Bosch\VideoSDK5\bin\redist_2008\vcredist_x86.exe" /q
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4652
  - - \??\f:\e6488f8145be761ceaaaa2691c15d9\install.exe
      f:\e6488f8145be761ceaaaa2691c15d9\.\install.exe /q
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3172
- - C:\Program Files (x86)\Bosch\VideoSDK5\bin\redist_2010\vcredist_x86.exe
    "C:\Program Files (x86)\Bosch\VideoSDK5\bin\redist_2010\vcredist_x86.exe" /q
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3332
  - - \??\f:\04b28df0238720a84a44ceee6d\Setup.exe
      f:\04b28df0238720a84a44ceee6d\Setup.exe /q
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1904
- C:\Program Files (x86)\Bosch\VideoSDK5\VSDKManager.exe
  "C:\Program Files (x86)\Bosch\VideoSDK5\VSDKManager.exe" -a:5.90.0086 -x86 -mpegAx
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4432
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s GCA2.dll
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3392
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s BVIP_VDP2.dll
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1720
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s BVIPStreamer.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2508
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s MpegActiveX.dll
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2128
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s VSDKAudioBackchannel.dll
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1976

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1748
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 25749 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e9e010d-7292-4b3b-a8b4-3c3e6136f648} 952 "\\.\pipe\gecko-crash-server-pipe.952" gpu
    3⤵
    PID:5020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 25785 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3acc8eda-ffb9-4b5d-b398-15ecf54d6f3a} 952 "\\.\pipe\gecko-crash-server-pipe.952" socket
    3⤵
    PID:3288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3228 -childID 1 -isForBrowser -prefsHandle 3264 -prefMapHandle 3144 -prefsLen 25926 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6788a0b-d11b-4134-8896-cbed20120b74} 952 "\\.\pipe\gecko-crash-server-pipe.952" tab
    3⤵
    PID:4304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3256 -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3296 -prefsLen 31159 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ac5746c-cddf-4b21-b699-1b10edf74403} 952 "\\.\pipe\gecko-crash-server-pipe.952" tab
    3⤵
    PID:3592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4788 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4800 -prefMapHandle 4796 -prefsLen 31159 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48eb7fb4-fb12-4a06-b612-34af3dd52e65} 952 "\\.\pipe\gecko-crash-server-pipe.952" utility
    3⤵
    - Checks processor information in registry
    PID:5288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 3 -isForBrowser -prefsHandle 4068 -prefMapHandle 5472 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6915c72d-86cd-4e7f-82c0-da482d73c98b} 952 "\\.\pipe\gecko-crash-server-pipe.952" tab
    3⤵
    PID:5980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5728 -childID 4 -isForBrowser -prefsHandle 5744 -prefMapHandle 5740 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {200d5dcc-ef23-441c-bb6e-000f3b2b18c0} 952 "\\.\pipe\gecko-crash-server-pipe.952" tab
    3⤵
    PID:5124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5828 -childID 5 -isForBrowser -prefsHandle 5904 -prefMapHandle 5900 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3236558d-8b10-40b7-80de-35d88299c443} 952 "\\.\pipe\gecko-crash-server-pipe.952" tab
    3⤵
    PID:5172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5792 -childID 6 -isForBrowser -prefsHandle 5804 -prefMapHandle 5808 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2ed8abf-f298-41f6-a667-84145ba7bc98} 952 "\\.\pipe\gecko-crash-server-pipe.952" tab
    3⤵
    PID:5156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57df07.rbs

Filesize
204KB

MD5
bcc857bf0091f4080f759cc5c1b2907c

SHA1
a5cb86a6e120e83f8f84092895cdfc7d347a869e

SHA256
e707d8f599401720b040942582edadac6c4824da85b76f4d8bf8bf30c2335874

SHA512
9eb83998688fd1db0fea6d0829111de3f450c1c795f0c9f394cf43c8b4862328b9fc2fa4d72563e4370896e86e5911819f2aae44b2dc1ede6a58941d26f3623e

Download Submit
C:\Config.Msi\e57df09.rbs

Filesize
709KB

MD5
fb11083072fa98b2df3d3352645c5d6a

SHA1
732326cea282e2fcea1f1232ea130e9bdaf7bf9d

SHA256
4718aaa2a7576d4fdce4fa43b7f7af456a2915c8764f786865009b002455814b

SHA512
8ed047d0b715c163273772c4a6cd42c6104177ddbb1d6adafd8332579a53717e697e9d6385ab7a49590accce54f48d3add1b86add9da5a2b07a29132b359007f

Download Submit
C:\Config.Msi\e57dfe9.rbf

Filesize
2KB

MD5
6d7ef6cdb365b368b26410395cba0a87

SHA1
f4743311840a5f5e49a150c6e9190ec816df97f6

SHA256
91cf20db246b2cbadb4b628f0dde138c5670be68479987b84b86f2d2023d7fae

SHA512
180254423f17208ec6c0e24b20fb23add19035b820b159f484452d2a0101c79c338a8d7ed1ccd3d5afe4b427c218302fad067154496b001a537daa096d650392

Download Submit
C:\Config.Msi\e57dfed.rbs

Filesize
686KB

MD5
77cabe64677b9d0eda49ff40c35bd933

SHA1
77dedd3b8d47b41d13ea81a901c72cea2f774f5f

SHA256
0851a6928d07c027f202f2f6448d9b283cbd2f543e32b17be9fa40303721a431

SHA512
736a38587124404752bee3f3c0b34fc26e15a297bfd83ca0172a7a4390dca9bfae88561a9b7c228096a90699ffe4fc68fe9c6cd28665dd76fe3410ab1678ea53

Download Submit
C:\Config.Msi\e57e002.rbf

Filesize
1.1MB

MD5
a0c1b6e29f37ba9a5e3d65b55e5f45c8

SHA1
b128bdcef122f8502b5786fb8a0ad2f21352978d

SHA256
6fabc2604e51845a8498d6b16b7d2f1f7a0adb71edd5122c031a45cfffeed72e

SHA512
abbcb419a0385517ad6e77788c1ed6f05b30c29fe088661e84cd486f2a023d0469d68a8fa544ea3a8da65936374965db51003e6bf874c69fccaa229395514395

Download Submit
C:\Config.Msi\e57e003.rbf

Filesize
1.2MB

MD5
1f36a10310f01b8376e3826464fcec99

SHA1
7a9669e6c8ce8e7c6d8a4c79d73462db9d02e3da

SHA256
380ebe62c7e8410dc66cee71370bd96d6b3ed402d4f4a152560cc64598091d5a

SHA512
31228de4449f06b4c68d3853423d90e4ce66b3c3333e567ff2c36fb07709b461188b90a4b2fe64b45a6fb7eeebfaf7c27112fbf3448b493f2af1f2b4a1d64581

Download Submit
C:\Config.Msi\e57e004.rbf

Filesize
2.1MB

MD5
51b2136cd675235587bbe74d38861c4a

SHA1
6f5f282b7174165bcabea65b31b918876eadf999

SHA256
5047ddabfaf9c41c40d20d73da7860e3ba201f7750fbbf2f8e8e6bf123ec54a4

SHA512
9d3540ad917edf94da2327d3c3624ec7778554cf76f87fcc3fcb66c100bb64f02aba18052e3dc9a0a6111dee87fa6d69b3e01d5505579c7894dd497ef6af146c

Download Submit
C:\Config.Msi\e57e055.rbf

Filesize
678KB

MD5
9be116eeb19f6a88c3f45023df5bad13

SHA1
7b0df6daa39aba6433f5e27ab845b605a9d60acf

SHA256
39a36512193310cbf79200fc06fa051d283bcd771ce6dfbe7dd515f319d85ecc

SHA512
5853604bc26f3bb243dc37504837187174fd1b8cc4d4c204e51efcb3188ee1955a7e1097a98d1353ee65b1db1f6e42d92d8bc98c45e8f4d6c3a4fd57336830fe

Download Submit
C:\Config.Msi\e57e0a8.rbf

Filesize
10KB

MD5
7b8ed65dc352c888ca43c186b9e6ad67

SHA1
89a1719dd05568e15b719bc72364e7a3c1371ad7

SHA256
fb7360d9bea06e093e7914ade86efc0dea9051e0999e2a9add9e6ccb8b02aa1f

SHA512
3b1c398b7879fefd94a5661d55307e02f2ffa8639197eb8471816ba53bfaa948402f6a8a8f3236b6be2cf7477bf193a935987209be0344f3ce458e52736e1877

Download Submit
C:\Config.Msi\e57e0a9.rbf

Filesize
8KB

MD5
1128dceb9d29b6ecabf424b1f04e9327

SHA1
56f30695e3f70522ca87845c47cca3127b84bb0d

SHA256
9578f010a14f42f8c18879d69b2361c20985e2948c3cf5686ee437926ded84f4

SHA512
7325e4a78ad42682d4d54900df96f7c2897e7c18f7f75a3b35af410278c20ddd5dc4dc5b0242a70097574ecba778758e316f8aefe8d3f52ca1eea4c9d94576d0

Download Submit
C:\Config.Msi\e57e0aa.rbf

Filesize
8KB

MD5
bd10f622a32e3d8f31e7d1f131e2d81a

SHA1
95fe3132ac1bb5d175d38a7daffb4baa8a2bd1ec

SHA256
6954471767377d257be4228a1967fa49d0e61b8309df23d5cadfd01995309a5f

SHA512
d4c66a4cdbe0b99d52bf42f68cc89a5777c97bdc95954a5756a745825b36779d54e756bdf0f358713f99535c3cb514cd52a592e244b247c3280387703d03da69

Download Submit
C:\Config.Msi\e57e0ab.rbf

Filesize
1KB

MD5
c812a7bfeea1bf46beab36a6945bdde9

SHA1
d69a1678af3834f3508861c11b064ce77ef22016

SHA256
8abec2ffc96bc3e4f6eec5988707b73eec411a450008bb01bc1d79bd62463f92

SHA512
c03cd462eab2f6eb53f3c367e5b8d202999bdd5b15ea0a29c604fa003f05f006fa672247e73a12cfe4cb98275dd47abaf51cd8e48aee390f48323e6f7f3da8c6

Download Submit
C:\Config.Msi\e57e0cd.rbs

Filesize
210KB

MD5
30a35655f9dd889f8167bf33ca948e5f

SHA1
442fb36f38e0374e8c1ed3e981797924937ef6d5

SHA256
ebfc068970064897b319c7dedeeb2e1d92c27b667fa71210b5f1fc32a83fd5cb

SHA512
4b06f1f15100178c61b156d6c0c5af6e514140fc8cd03ebe24c31bc4b97dd3ace20de77221df3d25fae6a330584e69ca58d59f22d04f4ec9d70f7f0e4c98678b

Download Submit
C:\Config.Msi\e57e0d1.rbs

Filesize
30KB

MD5
fe5d54fe64415af81ca0fbd7b78d5753

SHA1
f58221e17d6de475b2b266d25d6924236e8a4143

SHA256
8069a05380ee69843ce459779dd6a283a61c52cfe1f082c5ddc8b56ce808442e

SHA512
d26a2c10cb46124443b140b992431f05df85da12583b4151ce8ec09bf8bddb5b63c0e1bd225eab60f9b1204f6febb4979e5bd353c606465c9847cb836e8c22fd

Download Submit
C:\Config.Msi\e57e0d5.rbs

Filesize
4KB

MD5
81e32540751a6aff3c748e1c1c1dc24d

SHA1
bcfe333d17d3fd74008e5bdf2d3aa451db61f2cc

SHA256
df0961f0e30106a29184389fe0711d73db07650a0d87c09c91a36afcf1f84c41

SHA512
ca27d1447b26daa8984f5c14e4c2cdf6a89786176a453835fd27fd2f0c89cc449de1ee07776f64647c50a26400cbfa5aafa06af2928ebbff54ab80e2df3de6cf

Download Submit
C:\Config.Msi\e57e0d9.rbs

Filesize
32KB

MD5
07c8fe18fc0a5d6f95d84ba9172ecda0

SHA1
df0640426b4c3a8686eca9cb14f862cb7677de51

SHA256
e18eb8fd9ae9a0cebf38b704b4049679feb0fc51800655aaff23414624868165

SHA512
e8ee895e544809a604bda205578515a00e91da11aa01ec6669977ae9aa227c1c6c160b89499a89717af2fc265472ad718716f171a22264a32eccd9f41e8e0c89

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.BVIP\BVIPStreamer.dll

Filesize
3.0MB

MD5
3b895091096d14a49d276bf596caea01

SHA1
60e63c1b14569afa4a93ad12dbf2f260b774259a

SHA256
1f93cea8de7dc808150e57e096ea7e44c528abe7349de7b3087364815dcb9006

SHA512
80cdae18e3f16e06d64c7b7f8b1132232710510b31fb6196bcd3e787d93fdee7c450f30d0d607d9158a320becde3fee8c297323d6cd1cd39bf4913a96e675fb3

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.BVIP\BVIP_VDP2.dll

Filesize
4.0MB

MD5
cfc1a860d77805ac23a97b1c34931571

SHA1
5997d095fe67161f64452b8b328930559357acfc

SHA256
ed807ef6887a7cf08a9f3a3e938aa714e2dc9ae56dfa74c66474c949483ed176

SHA512
a907ac29dd047337ca33f64bc9f93ab7c3c08152191eafadad3e69cff79b559b0fdfb8e9297aac522660a3e607db809b18fc779c6dbbe16328834f243fb54223

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.BVIP\rcpp4.dll

Filesize
932KB

MD5
a87c3c747cb225ac006465b3dc821d36

SHA1
5ab6e6031dce2047449ca634d470d1cd8d0faba6

SHA256
5898eb5abe10fd0922d83a5028ab22403c40a69e9d23368f5e0fd8ccff2ffa52

SHA512
edd63b62599341627bfa149ce3a5e4851405ef216cebbb790e106407212886489a332407bedef2d81866205341c95d5297afa6585ccb3e7cc546419a3f47ea0d

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.BVIP\rcppmedia.dll

Filesize
1017KB

MD5
5c9434d7a08897d878fae0cf8d51802b

SHA1
c20c35ce80c1ee6e4938d688a34de9c98f039a58

SHA256
bfb0b63b30716db6354c81f5f81ef817fe51b1d039b11cf49943c7fa449197d9

SHA512
b3ad4e795fda28523f7dad4110af468849352afb35f9325919c50ecd6ad24c14eafb6ebfa4cf09e8c4778282da6172215afff2e284642c52f479b334e6772626

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.BVIP\vj_generic.dll

Filesize
8.8MB

MD5
6a16a0ff25ab49561ee574084f3d2ea7

SHA1
ec584fa4623de9c74634859161e1bc8bdd1284ba

SHA256
8ee36b5d797fcf45e43d308b46d75bb594d00e7bdfd9056972df3409abdfaeec

SHA512
0cbba4ae198b05a83306c89021ee6e286088160891363954594f242c276108ff2559eebadcb27773d34984fe24ca58e0d7308531fd4eea29577456300991ed83

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\GCA.tlb

Filesize
135KB

MD5
fa1029cc566b34b8846280b1fff8a9bb

SHA1
debfa0e7d1abc9a0895141eaeafc0b4719e01884

SHA256
f39108cf5b99b36d428857c99055a656a68d4b7d73a530cba6524511fccc363d

SHA512
04ef15d34e2d38b241feb3a3fd8c1c4765cc2e46c4d7a30c745124a4263acc60010d6a33b50589a241ec3bb7812ecc5848c50c7e4b5b6bbe3a1fd791df82f03f

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\GCA2.dll

Filesize
16.0MB

MD5
481fd96a3ee0108b153eaa9152f4ee50

SHA1
626225d2a96e4f2dd4ee937e1f9124bfe983dc8f

SHA256
6b2a59a90bdff052af1b95b2881750c852ba1b578a7b3ebd433c01e21dd3a81e

SHA512
28f66e9eaa0b2d3a4b4352e903ebd590717c9186e774617b9a4d5e2ac286aecbaf0e8f11c242d6f0d3b283f6e756ec0edaba85edc8c10f13d4a9f590ae35fc0a

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\VideoSDK-Versions.txt

Filesize
607B

MD5
4c2e72548bdbf9a0dfdae0fd35c7ddf5

SHA1
20d9c889b7a945f911a7430eff45a9f834ed5743

SHA256
bdec10d73cb4ab2f40e41d98cd8635cfb74ddf7027b6e2a455ec60573fbec84f

SHA512
60802d5c1280917cea7aad1d3cf9078e703da5a0ee879b65a784e42196c3f0caf541367f84da86cd4b35c764640160acb88a15191ea0fb1dd56d1e332b943f9b

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\avcodec-vsdk-57.dll

Filesize
5.7MB

MD5
af068789cc8c76e539930131f93c1b55

SHA1
9dc71a2398517ddb43d01aefc4eaddfae4202092

SHA256
c215d927f313511a0127c5de8c76a9bccb446777ffa893f4fdcb42edba9b275f

SHA512
4ff2d2db57ac3dd6b0a52f86fd30af974f0d2de27c8b7ef92af1a3bd840beaa749b81884f4f6fa31027d26949de25d642c501f8b324b0364a2935676ab2ba120

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\avutil-vsdk-55.dll

Filesize
1.6MB

MD5
cb9b23a956eadbf975bcbe3bfb85b8d3

SHA1
f87ab4acfbd97791b415df1347ef6e85e01ffd8a

SHA256
96015fc0b067f5a645308c464c67ed95a51a71cc7c1f0a4ac04206738ec25176

SHA512
ae1c38c3c27b4d18a25f9e732e9197af19a4e99b3cc1740c1a3cdd435bd9707cd9729db32ed5c707726e9e7cdc6b0ea5d1c940281eee43d1f6fcf7a248b02420

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\defaultconfig\08000103.evl

Filesize
682B

MD5
cd58c2aea299c5db095521114c249fc3

SHA1
da3e06dc350cd7d2896fbd4baac5f63675034959

SHA256
13e4eb7faf2302b42912d27a845dab56149ca7ce1136cb55562d4bf8cc4439fd

SHA512
427e92da36a6a1ed80d21fd865c629c729f3acbe47ea08d7dafe0c2d79cae63db7f619a37c6c9d88400a3fc871308df8ef5df25f9dcd6929dbb4523ee530927a

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\flow_wizard\MotionRegionDetectorWizard.xml

Filesize
1KB

MD5
f73c2376d52b8bc55e8e04af833f3450

SHA1
5c5749e3e0eaea11650d493efec659328403a6fc

SHA256
bd7638e8901cbdbb7960da281d1b2eeba1dae498feb1e167a0de1129fc813b4f

SHA512
5176ee47559e2402e2eb48b44ce59ab480d81928a6dfc69e17e02ff17e14a6b9b750d20ad4d8295267802d967df4612c8d14fe8708f4ced8f107f55159c00b86

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_atext.dll

Filesize
4.1MB

MD5
b28d053b25a8dd03beee4ef56c521c69

SHA1
df436dcff051a6be85107fb6d0765994f4565df0

SHA256
c6a3a3a9773d217bb2c0d8421155a9fdd24dd00175ee4e2b4b75ef01bb1481b2

SHA512
37405a41e58534ea0c8f6acd252991131c9f3447ee1e1350cd95877542fb502d3ac1fca07cb28163ad6b07188bafed68ce72c4d8a06d035c2b8d5704a5836a20

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_display.dll

Filesize
4.4MB

MD5
ddcb4d6d6185cf836da835f5f3b52ed9

SHA1
9e2393c53adba1d58067efb859a7acbb516a40ff

SHA256
81d7df958bd56a0331816811e2df77e576722f802937ac14fa43425e4e65de07

SHA512
ccc4789aed90193e8c03f76a2dd85a99a2c200a31ac8b9e27062f1958a4e3f401a8146d1262cf174c16e6696a931c7aac4b1313db98cda502228d1ad7a938beb

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_flow.dll

Filesize
5.6MB

MD5
eaf650da61f32f06ea27452327d44dcb

SHA1
9a061c985eb5fc243c17c3dde9ca732c4093aa9f

SHA256
e03837da78328f848c242b32cd3f570fd3e641a3c15ab0bf3832bbb0bc3b3cff

SHA512
eb54c4361b37b31db488bbb9a53835de23636cd1f7e7cfde66ac24534eaa90b1dbc795eac998464b12bac6e4a527d5b329e26d2894a90db62d2d571c52c0a62b

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_iva.dll

Filesize
6.5MB

MD5
ad737f6f444092f305ecf3f6190566b3

SHA1
e14d74ae407ba1ac4709b4fe8ea77d972be05868

SHA256
0ac3fb6ee70a47d90532c1e70689a7698915e912007f854b8312b5192542e0f0

SHA512
58760f83caa51e8981b4cf97dce5b3f1351ab30b2aa95c7c6c2aae1083d988e0b9edf5bb687899e7084fba4f7d32180220487326be74f9fc944bde9f855a0fa3

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_ivmd.dll

Filesize
3.8MB

MD5
8c3d6f7be999ebba15744ff8160648f6

SHA1
03ad340857c59898671ab58fa349fa10bc0450fc

SHA256
8ea09ef29f94308966c83e0f6f169eeb8028888bb13183a6ef3909ae0ae63f16

SHA512
0acac9ae136e39cefdd1cb21abfba478409940e97598e44583250724e448cac8346929687030e50bce31e453b237f9ff7b0c80f9af2b2bb6b8037974b5c16ff0

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_mob.dll

Filesize
5.8MB

MD5
db953596faedb428b4d4f4829468a138

SHA1
353fa7fa3c5684e7f080f6a00e408d93f9a452ed

SHA256
30a6da5cc7ba52085a08c5984bdc53f71ffcb03085c004bf78de67547f6d070c

SHA512
af7915afcba1b27502023ad3418ee68f3e971a863db5976f9d3f7c51a60e7e39ee39b46267618300160c2dac1de4c9ad2b060f6f9d7e311fafea1fb692cee4ed

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_motion.dll

Filesize
3.8MB

MD5
d5499aca495970c063b599c53b7f0b97

SHA1
ea7c38366d09b52ec1a7a2b325e08c06ba3354d2

SHA256
0e1f885adc04674aa9d143c54fa6c920e04025e7e54e5961744f4c4792a2800c

SHA512
864d7bdf842e042bf5c9e1029c812cc0f6bdecf6a37132a23eec90bdfc1f59dd677c0dbcdf11350e3f00364604cde26fafee2b7d00c71822539da9052b7aa68e

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_sod.dll

Filesize
4.2MB

MD5
1aa58cb24a3c62d4766d09b8259f6769

SHA1
1fb3d4b09a524ec5940cccc8be185dbf566a2ca0

SHA256
ad66164a4ef327cbeb83050921662ce14cd5750011a9efdd63a3c57f7763521b

SHA512
67693c043d736fd7712cf3cb591a28bbdddfb4f9b38f6fc2a71966eb9f480be4c4e46a8a0fa6281f4870d0ae42793a46695b299fbc449affcf111fcb864dc7df

Download Submit
C:\Program Files (x86)\Bosch\VideoSDK6\bin\Bosch.VideoSDK5.Core\vca_plugins\plugin_tamper.dll

Filesize
4.0MB

MD5
e08d39c38ef0b4244f68c69f9a6de580

SHA1
f875475c8dbd3eba45cd60cc7f66ace740dfca94

SHA256
185702bc5caf4ac211932053123fb11d3ce15ca6166cafa8e9bca8e72abdc0dd

SHA512
67536634fe59ef138d4c34065bf24cd271f9b12ea5831f53e6eb17a65eb28872aa61db05b19ea55b1d440d26e862bb590c476a9a05738e37601c73799847fecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

Filesize
471B

MD5
22576cec9fbeb5a7918655b13b1bce26

SHA1
d99600ffc5459e47ea351b02736cf7cdecd4dbdc

SHA256
65a10732b19ff468e8ea64b022306a663dd29b48db71a994b41be1165e815383

SHA512
65f4aacd9a832cbe9319d152902f98b76e7632af0554542c79f6a69dcbff3f346ea9785757ccfa5c43de8bf24a13a2a8425ced0f61e94254843acf0250e734d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_FE48501F050015229950C05FEFF13F24

Filesize
471B

MD5
83232ed24f6c7aadfbe66f09d732f4df

SHA1
213c6f323d48b87152a21030d6db8f210ec674c6

SHA256
9c73a81e9fbe7c6dbd0c9707afbcaaaa1bae7a3f7eaff50769e9e64a74398e5b

SHA512
5a18cba498f57a1ac770be96166e644a1d57f3c386f83e9ec1cf9a66907268fedafce16da19204791c69a7e09abf616215140ac0445cb76f4131a16d9a7b5742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

Filesize
396B

MD5
ec7c14fcf28be9bb69d49c5ffdfe1d92

SHA1
a25ace040f24197c40278af1b21e4f5e632faafb

SHA256
112bb9583de54fdd22be9ceb296cac706490c45189920ad1a3ea208c60b497b1

SHA512
5c37ff484ec2d3881a15a9c64372bd9e6221239a3dcbdde49ed526c1a090862a99a61af9ca0fd1efe6972cd37fdd05599bf14b076381c893322331fd05e104d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_FE48501F050015229950C05FEFF13F24

Filesize
408B

MD5
585af9f89535566d7294bf18416a0244

SHA1
4a7c7de41ccfe58065d2b37ba9650792e69869d6

SHA256
347bc2b2fbcc1d6320552e9105bc762aa5281c6fb2574e69bb5954676f5294dc

SHA512
ee86407093ff11e39a82c286b80c27b1f54c1c44581d7639bfc56903eb652ff59135d88d3de401615dc8e13d5e448db11cbcac14c67fa87610d2e5ba2d358f4d

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
72a22d231b05a2240e7367a02b537bc0

SHA1
ddc06ded04c36567366acfdc5090195f225be95a

SHA256
fc0a5b8e4e24dd3662ddd9870806149fe2b6da781d0ebdef65250190242e1029

SHA512
667c57c57ee90f78fa338362ee1a9ec756ae23070c060d742f753f106ac8032056512b0af5fc30211775b4125ea933598424cec0fe359592bd273a7d32daf66c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
210KB

MD5
5ac828ee8e3812a5b225161caf6c61da

SHA1
86e65f22356c55c21147ce97903f5dbdf363649f

SHA256
b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

SHA512
87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
097964210f7d764a567ebd4e73ab5388

SHA1
02b8db8ac1ee40021db2ba95fa841d51edae420b

SHA256
86a09e44f1d1c6fb86d09f51538eed2f86d3658dbcf3a3f62f2658ef17d1915a

SHA512
fd7047baf831eb6cc5d138b742df6dfea2ebfdd78e61a8a1ea2490acdc4d14e2653909962392a95732113962e7b141958273f39a3b4e7c837e05073f405a2b24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8506a2f22f14fd42970c731c3a400a68

SHA1
7fd5410660d89853296a9396a5660da9985ebef0

SHA256
b2099b18ff3cd78ab7f9943f6dd7a774b2437c3092ec77c7bd46d765c0f63612

SHA512
56cdc50bfe63154b9a23151328044abc621c5d1e60c2d708eb98d8976167b11fa5179b47347577624b8afd05dc1478c4973a3ea46ce76ed90a12cdec1b37a4ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5cec8738090b918ffafda4ce13c7fe28

SHA1
63b37c0b0adfa4cedfc983d4b029fce7ac405d01

SHA256
56e39c930f1137f8d56fd30138d9ae136a3b8be737d404c69f6d3ba792c4f820

SHA512
fd7661c9df2108b4d4555e867d94eb4535bd7d00ef2c7611b5027830de68d7ae92d22a7855a35299625e4eba294bca0c3fd8ec5a7a9b2151053c8dcf77747446

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
36c0ae141adf786c017a00582c0f23ec

SHA1
9ed258fd0312f1eb4958a5d0a9cee4da44bd8784

SHA256
34451274f42702bfc4880bb1932547cd1eda2994924e872f832d5413ac76b1e1

SHA512
435b3eb9514240c071051e1d4757408c23a64cf747d169a0ffa6d1238ab2f0e09123fd91d0992df1e0ec36a4be3af459600f25dcad8a8725e88c187e1a5e0533

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
76328a7c4a7b2f03787ce2c93fd45c1e

SHA1
68cdaba055ff9ae4ff5b43899647a66b8c67151e

SHA256
bc2fed8c7cfd69abe7021d2c5b43299856a008cc12182e26ba44d7b017b41698

SHA512
26900e176cc52a5971ccc626cb485c13c7f39cf0fc80fbc826b9487490ec88e8d71116a92aab4eaec05c64d7e6d0d9b923b9dca7841113d873c4c0bdf6ce6d4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
64972678d26bbc1821c501ab9d8f5e86

SHA1
6a241009ad2a4dcd938bd55e6539226b261366df

SHA256
ce2f0325ffc160a0e181edadabf3f9fd157b320be51190638bb9baad63c0dcc9

SHA512
98039f4257739bcea40bf4d3dce5288df930c841283d3d4f142977ea83863a8df51995ae6a0c25e4f5890a101aa62cdcbf31d517d2edfc021bd327cd8b3079e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
065037f53ce92b5556d90ffafd6f2fa5

SHA1
fe0b942bc6693d624d3328da7e6591acccf64edf

SHA256
7da76ce28eeae6f6d0d1c8ed80ff38838d3d4bcef00a06d631822a66612d22b0

SHA512
7b4582cee38f8730e447775be0c347c700d91382257a11c5e964acaabe2523d51133f607422f9ab218adbb23fc28c9dfdd45fb423cf92a09f3c9127ab81946b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
522B

MD5
3babef75d56530128b4d215b38b68449

SHA1
f9ef17279eae8914f0703e7edbe2f3ba345a6be0

SHA256
67c75f4d7c909929a7a229f61e00a1b38bf396694597a327c8145683e7d7f549

SHA512
508df42ce30e6f3dd1d5ea631eb0464bed5bafe88eeaf32bc729632faa07289cc0969fc7c221e8ef0c8252618de8eef7a012c7514df1aeb9999cab85f359f317

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
bb6e98db456ca19ebc37eb4bbecb502d

SHA1
c9fb42b296770b6a0d5fa38433d445cd15400d43

SHA256
3beda2f4735045525b7c14a80b7d2913fd1a62397695e0d389c91a20fe1fc58a

SHA512
50943dcc4f3e2b350201cc8b53c458d5acae2408fd8cfe4feb7334869b94da032db46aa7c7291fe07fe86725a239a4f50a8086c2c4ffaa3dc70cf572939ae750

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
401026ebc36e98d1cec4c9b6f600282f

SHA1
07deba5a789523c880f6f8aac2f15579b38cdb5d

SHA256
c3bfd5094416f1d3a02a56605c1a3e50d4aaa5c066e9b8a9503c166fdb915a83

SHA512
05defb51018b8eee744bdb45da7f3f88b0e76594d7ecb03aa01ec03de9f3b939b585170dae35a54a452732f9fa4e3235cdc4695b6192d3e75da76df6deb435d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
522B

MD5
1112b29a5aada6f2eae29aba9b5e3ca6

SHA1
c383bddd281774e297fbfe0e15f26d29475f9b1b

SHA256
495b22eb8e05e965233bff1be983dbdc9db80e3d7fcdef37e1762bb43c8a31be

SHA512
6a2514da3f5c42195ee48e04c015871c9ffa2387394f2498040d297372eda376c2841acc18b5fbfa962f68de7eb181b043428cba39b6d5f0aedaaa55b4e31e9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
79fcb67788d5c0752d9d777ff1cb5299

SHA1
15611601635b8547f442e4273afc1f2301f65740

SHA256
cce5ef1e5fae09fa5bc2d56c4ffb3e93a623772b6c022729a3b3c743922cf14d

SHA512
332fc8e509e2692ba406dfda497ca930e0fe5ff15ad4760cb930cfe906e66540b71944e154738e007544c27e341d3418a44160397a5452ea77fc040227b7e511

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a7a7cdc1-9b88-4bb0-b838-fdc938620e4f.tmp

Filesize
2KB

MD5
6c7be2f40de5cdd32bd3589e98653f7d

SHA1
2948a4240f119d9293fd8909206bf93f13095b9b

SHA256
ebfb36daf5521976b1f8c62e988800d7ff53ba8ee68c0fd922d3fab1a313c0f2

SHA512
d6bb819910f767542a2636aafabf086bd3d4797d20377e0f549205881f0b2fee2ae20777e94dbdc3d95573bf0ab4b78e5bf9d55c2bb433c732cc68bb6e168096

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0b6349d0e0df2035f6e586f8794bdb3e

SHA1
77c92ef53801e8aebd35bca3425cbd64e9c4f022

SHA256
e9123fa905844ab4f58ca0da34a4a127c79df9ca5e6308d7663be2012f8b5a7a

SHA512
7b744bb92ccf0360781319d98ffc435a90774ec33e643c98baec40753e1fdf9efcec93c54a2c6df941147e93080807660910e7ba4bcc9eba937e86aad77340f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ce315e6e211025f88d89bc8a5ad9dc16

SHA1
09baceb0e0eadb404f07279d1fce9a46bda24479

SHA256
b6538cacd0b5e1e17a83072fc446581ada8d318b6bdee3f6fdbd0f469f9e9efe

SHA512
2a945b48b3137c12c90fe27ac40e04cfa2c21e4461f9d07725b6ef560e9b1ca658217343d69b236857d5e00947b1617b67ef1454d6774e8e34d57c51f8206fd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c3ce065b11f870626c539a977c7bac5c

SHA1
815179b7d1255dacf5819394b4c6b9a4179bdae9

SHA256
a596f5c68fd13b4b4f1072a0df86a2aba6e68058614e8e4061552fce512e5cdc

SHA512
30332e6323b4a2688396450f97b65d96898b2cc9b5f42072e6eaa921002a46e1a857eea6be8f4c4fd75c6182c4ef259232d9c1b272f0c157ca3515070f453f38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e61d0ceb16219f365adbc8bc0265677f

SHA1
3df850b7f1e6f648e879827b9ce5198d1b25f101

SHA256
0baf06af1c0c1d51ebd00f3e0d1b8773e08c7e318fd3febc8eaf6a8be9c1b075

SHA512
72cafe070d9aeff685ec4afcdb6e055c5fbb47eab9f5de75f043e6946b18419c4b361c156fd496f5bc46b1410c33d53733ef91917e90fa22d94c131221fed3e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
28e7f4d44a2920f7015b8bebf4752f28

SHA1
470cc450648e38000d6086dc7f8268421e67080d

SHA256
ea9fd7ee4d0d6126b08992f489e233fe8e47c875d27e27c4fd467526365a5e0c

SHA512
24537f8994c62758c135c0c8eb79e74081584004767a2f458325595f97540e05c060b42ea06e3f4f24776b4d2eb956c7957eb421badf2a64735d1d6797f972dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
98287c47722eb0d2e6750407f17db54b

SHA1
8c2c4561d0ad73f944545541db82572cf323abc4

SHA256
492d87e0965d292d624f9506c1ff186f8fe343deb2b5a027306f7bf110e55e92

SHA512
82db17cf887272fb1747f29e6284d982fef971b03921d1b4ebe95b3c823e8a83689cae7a2b5e4d0cb324d3bef028b74ed78baabcc3b8164d858b5f086342a23b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e88765e0b44f0f2efd5a2e6be69a9fcb

SHA1
01bad966bfb7b8a5194e3b6abe0d38193b4af643

SHA256
810a345434b8c5223ddea5b27081d3c475d2d89428ffb801161dc055fbc87fed

SHA512
dc1fb75552d5ce5761602a48505ad246b577467ee03f6516515d151359cbd3166ddc18d24ec58ad17d15958d4c25f424644c54995cbcc17035bd9fb7ff3ecc13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ebc4f80458cb969aeadf78de3546d6e4

SHA1
016d63a38af28eac4c2fa0a05e532e42f914fee4

SHA256
e0fc7cec0caa9cf21f46df4bfc5bcc270845f0adcc9fee7d5d4b300c8f75cc72

SHA512
eeec742ae4364c07d5d32df66e04f43e4fc03a74b537f8808097e5c04e616d9cfb31d59511e239c053120bea0ffdc746cf57a81ff2808f6f67f87c5a798c1d03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
071f1373c3b67d1307beeb382390c0f5

SHA1
2400d331ee1c2dd0ae2d983af546501a99d5982a

SHA256
329417cb33c8db205f8437b95adf71e9edc651a7adfdba168f085feb3485e8fe

SHA512
d0ac7a402d933b8a6d74abee06c67955875498003207bf30028ebd2c515a0d339ecde5437fdfe0f0ce3ef7891de98354e854f564c59fd78e3abadd8cfb291702

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
38c3381d813838adbe1f5a2190b5d4ec

SHA1
bc96313d4d2b00b57a4816c119e757958b491956

SHA256
b9a9995581e490b88c4b25efe0dc919ad8bc185539ce6e4ec0230fd7ad25c151

SHA512
29cff63d014bdb2c6f2012ec72ced4926ea88f91d47d680e4e0b18bf83d8b4c23b8427af438e6aba35fdbf97024651836e1c7814c28175ba2dc0877cb615ad9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c9199b5f26d07b0448030254a15112c3

SHA1
70b36eadd1798ff13410844166e7dd72368e50b7

SHA256
af91baf2ea7931f19f5ec3275fcc84411fa3fecc436ad387ec2da9843b931336

SHA512
da78e9a68391ad1d8fb8ff7d58fac188060e14d6c994a229ae232f38a8b2f0112c8783e1392aaa1387144b0db16b9d11846e8cef9ea99581091e593b04f88909

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7224794c4aeedc4ae9fc4d3481d2f15e

SHA1
04425469b353e0ab11e9f6a9b6432a743a5ead9f

SHA256
1566bd3aca7fac7ba6e808fe542e2f779d1292d24f944f3150d373eb8593c97b

SHA512
6eef0e36225626a690f0a0840772fce895343ed8446e5104c4c1f01e7fe7ff2cccf78d9f672269e50eb7c51216332479c7062ec9a817d0e1ba83b9106f10d38d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
48bbcca66dd1e226d4f87d4ced78e9c2

SHA1
887714255e3649a4df379a37159411e97197b81c

SHA256
d2f6cee37b06fbeac31fcc000d8c3600a735c946e8c6244f499e28f5266a4600

SHA512
15796ae3b828c3d46d9a2f5d31b3b540b0f1e358cc741138ecd23b64a0091a68d9ebfa895b45de2c739271dd7653455908f651fc9779f03bf8f7be8456a72c5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
306a7429eb282ff781dd5449682931ee

SHA1
19d22a93feee3ac73cccdab83677b4555e9004c6

SHA256
1eae8579b3f64be7f7cdc5c75aab97e5ae7d617433acf247330d258cddc90a17

SHA512
8d263be19baf66a614f9634b19ab911c4b667c762bd521f3d2aa31a99c79fab12317c97d76fc8d93928e49a8d9039427ab5dce5c0ca64b449c48ff5b54eb87ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
eec7c4ae9619b5c8d17015a317e72bf5

SHA1
70be02d1b4f36657be63995195620db0460285cf

SHA256
7e71bb7859ff7dd6b18bd1f5c20b3a01420360c10d38ca3df79679d7699c6bb3

SHA512
e4322dfc271eac45c018fd02d6a049b114ff08a43e79c996e75ab4e692b645331be388eec40dc5326203f7e2a2ec8427793130e3fe9b688655c6cd7f976d6a3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
73084ccc6d6938985b282484e69ba97b

SHA1
038f3d909a1a052ff22ee75d195ebbab6c361449

SHA256
f241bb7a3c6cda145567bfeccc44e4c3c38b04166046aba84e4eaa91eba72f54

SHA512
983bb0713401b96e5ed6dad644db886db8e9fbb84231aae2381770ff07efa2f47e0788ed136f3fd3abddd74ca839a70bb4c4a7e6a971f43fb5bbe5d0ee6ccc9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
283b45108ff9906b3c5a2aa208cac15d

SHA1
7f89348ccbf3474b8af1a7dd0257629730eeef04

SHA256
f408b45b3c991288af34a1b3a0c1b0d1b86ec02b8b97b226e9121fb22773ffe3

SHA512
a6968025531f8d7e009424bcbc471bd3674b561de90d41d32aee38de5317859cd193507af51880c7ba50401cdb685566b4f7f74d129fe58227b928ae5e839dfc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a71af74afce3e996a2a3bb6c9434617d

SHA1
86037f84e667c860314a4ebb565f24b2e765f9f8

SHA256
1b664bf948d7a306c858f43590fa2a10f235fb18bae161b32af7d2485e589efc

SHA512
b7c94435d6ac1f86f2168c7981c2959a5b05ba9612a8acfc2c40cf7008cc2b59472b0aad276d68bfc2029c8e21b054c0db14bcc44630df013eb7b48144e0da9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9fe94dd1799b7678ce47c1e8c2ed8f92

SHA1
df7ce7ea5a1ddcbb15aad6557fb974b59e2ce5af

SHA256
d1e2c8f26b3b59032bebaeb7d4c2ffa7154d492d76ccff1b69e2b82c9b7d0bc5

SHA512
da479fd9786d7d8f85c771203f068ea637dcb5b2e0a124d9b06e6566152c334dd4c69b5541239edeadc4f1a9fc44207c7beaf4ac8419efed4df2022a3c6d3dbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3b9165038f81acc395be4d74f42a7aed

SHA1
a623f5f8bd0a36ed87cb3d468d31054e1607f0d2

SHA256
9341edcdf2b24a0a52916d43839543d944ac4fae985a9bfad0852f78ea40fc8a

SHA512
de9098238650972c90cc4f0d6dd92ba146b2d3841dca6ac4fb5be6e6131a3b012347e5a27ad0639db6b387aca8ef6dd370c3808753ab680a111bce285c33464f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b338beefbf796902526b3434930bfae3

SHA1
3a9952cece3486966f94daf053cb6998eb252dad

SHA256
28236671936badb623a2b58cac91147aa71c57fcffd7a7d244fb1f0e819775cd

SHA512
b0e18aa27dcc14d3cbfd4610aae54f4d9f75f6d5aea906e0cb11324242ce8d381bdae4d6f1f2131881d3ce35686ef6e752908dc66e2bb5c65907c1a833eeb473

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
db903b142faaaf1c7e34cbb020753e55

SHA1
889bc4b68c6e1920dce48de7d7305b0033357874

SHA256
821435bfdca90dfa5bdd9590f830e0e1d33d902a553e299b43a2457948bf60f1

SHA512
6fb8dd2d317214d62ae58574483d5a8f6e73faf5e49dd19b6f567cb2836f79a8caf72660d1958bdd3efc18feb89adf52ea6699ecbef5bf020f9d6103d12964cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d776aaf2a1f96fc1b920d2883ac14569

SHA1
e3bae160697fe34b9877bb787b1fb5505bcbe3ba

SHA256
e8919c800fff7b837d7a5866eb8b17e98819d879680f25896bf86ac22b0f04ed

SHA512
4d0b55bf1d7f4e9909bf70a04eb2b0971a9a9a793f54ade0fcaa8c8b69807155e3b9999d67e4c08b71e15bf93f06f37cb82dac68d05bb8736d7ef24a819615e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5e175649fa3924bf7a1b5948a847dc33

SHA1
f25d73253ebe5d441de3ec58ca485f4875b283dc

SHA256
5e83bdefc040b3ff6eb18b2c3b41813f4e7b72c04b79371b58b53fb5bd3a7364

SHA512
10cb7c2de5f4f197be2ed72248a9cfba83a362b83f6bf3f50e7f202015d35badaa9e9658e3664de14f90e02a5d6cd73fd1f31a08f478b18c80f14f7aa037dd72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d43e4a2150806ef6c90cd035805d26de

SHA1
a97961d764a7189a2adcb3a134a9aeae1d46938b

SHA256
f1846667bc2bbca645a7afa8b6f7ca1e5cd89f89c779fe2eccc3c44269e9c883

SHA512
d7f74ff2ec284d93a748309286b085f48c500d5f25084af07d58e6f5ea0e6dafb091e27e96640f875f7d55bf6323551241dc672126ca118c4c6d168347391076

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e87d4ceb10cae2fa9949890b03646ccb

SHA1
754630641c2960f7f8de7e925896597d442d286a

SHA256
d6f14bf524ae237c58a382fff0e9fe27805d99dd4349ade76ce080a65c4005e7

SHA512
b5ef8f4bd8593198bed8a26ea5083273ee32191ed38050f777d947569a05541b6db619b40d2c848d9c9c227f9227223a6adb82def1503dee7ce578b3cadc7730

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
abcc5cf65e345e505cc969a7d9c9708e

SHA1
ba2920abc3368dca5c76ace9a4a34dfc14f1e483

SHA256
d3505bae43e3b334a74f0b95c3f6ba146063c8e4987877be71a0a8ebd762d3f3

SHA512
899566fe3e1260f7bea3b92f7d0676ccb935bf07521e217b404c8045bde6e6a8e6dc8902133f4fe645a69ff5d64305f2abf02d1c05af2b5e713786a524298e6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
348b506d672bc0edf69b4d3c4d51115a

SHA1
47465e9aa47ce7211318d09345aee129171e773c

SHA256
910646947ea83c60bc6ce966c983c02e6539a330543861fe8f2ae0aced186334

SHA512
be552cbdc99a3c03f2ef3fada65cd8a8a3a8158e9c759519341ee646b865d393890ee5d195eae222a4c59dad3ba6fd5fd33f4f85593b4688caff2c04566ce0f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
44fbeeb33526543903795b07b9e45416

SHA1
90c78b4d38ff40a409028836ca18ae61d3639325

SHA256
70d00c5a4db18415e5332468ac4997eda8c758913ab44cb724e5ae56494ccc02

SHA512
8f775cde695714c9182ef73544f721dc2cd3e47809a3618b60bbdeddd2df617eb40577132d4d6a0f865d8f0f1351ff2cd719dcfa94a0762027457d1e2c99de8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5b6c9011288455c749022f1a5d1e1274

SHA1
15216886252e32d4f3d291cb6db97575a7c650bf

SHA256
3601e49348a54eaba9683bfa142f694385b906df92b7a0f7e90c039cb318eb81

SHA512
f6d7dd4afc1c36d3559bcae474f17eb5ff994dd3cde18307ab906e06090eb98bdd6ad1d45dd094763b5233a59e0adfd215ce2c0bca239b8e278e786b780d30fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6a41b3dcefb55378f08fac127df9b1a1

SHA1
78a76cb16d47bf5d9711a651a8969bfd7b905521

SHA256
030ca314aea4055fa47d15b2afa4a2497d3118feb39101caa2664efd68b021d5

SHA512
5ee3c7a0308a870c130f889e8a26d3b6d1a76c680bfe29d083c25a193d60aafea93beb05d0131788c4bb89c7b6e2d3883930094af11a52322ec5ab689982a675

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bb2033a060f4f7b13505b7e640d87d31

SHA1
9182dafddfb0c56c04771f3691434303a7afa30b

SHA256
1db898b562ec8c1fa451bfc1f4696b1fe37484fce3744f3c5df6433ee38243fe

SHA512
c03f691d21fb41e6a24455db45689766b4a1291cdb948f5547493c9e0883379cafc52f388877be8f7dc312bb84ccef618042745e376e5536ce40cd18a9585bdf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
0d631a572b6f4fb504336fd8317cfbbc

SHA1
7646e3d7bf447e080e95bd5ed4b67206e5e6b7a4

SHA256
5eac14e14a3e1714a66c5055eb3c389e0fe9aeadda2a850a939d23c0bbbc22f7

SHA512
44a154b95278a83fe5ceb6f28fc3fe68f596151af982b551f289fd8c9542a4c4baebe17db3a4f1c84477d4e083dffa2a61a60236930e3e3f63b0292155eea275

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
189KB

MD5
4369775590d5b4035c30697362439216

SHA1
09ba52892c685f28b9c4ce26fd6f5dece4932cac

SHA256
e6f405bd89e22a3b83617527e6a1d1aeaed71ae607d189ace94e47a78463cb07

SHA512
35f1893af8dc3f27529878bffdf8a8d1bbbffe75510cb10c043ade6698342299b2948601c83f711a80f6df2649bdf35481510cf761ca0dabf9b1257c6078e274

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
189KB

MD5
8bb48d7c6789a595628b3530b2f03adf

SHA1
9e309d301f5dd2825d86559239dab9928fae4d24

SHA256
bf1dfd768252d78caa7bde8615a535b1c9bcf43d15de4d64e0fcd306b1a6ae5d

SHA512
c0c962a2c1c90c9088647a6be9d6e0e5ed51f4436051fce13b4616b12693a7f297531d23ffc35e806ffb054a4c3669c4e70272de20d926a24ca09211fc33a2e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
189KB

MD5
d7a748715042a5024534fb14e7cabc41

SHA1
b4e853554ef9499729c51d1f174306a1a89e254d

SHA256
ce73e8b8747ca0158185c484e4d38925269dac5dd7782fbdb38517b1433bcdbc

SHA512
3315d692bda397d8f567cf93bd8c7b694ff7462fff2b031f65d4435046ccb68df7a99d4d90eec26d816bb14a905d13607d5f8eedcb9d9807dddd5ae9b31000f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
189KB

MD5
54a5b8d763e007ef89599dcdef8e8def

SHA1
e06c6b0895ff8e071215f80bf4c286a32b21abeb

SHA256
5fda7ba7c8cfca4d496de2347cc35d2bc540f9645aa682fc7ce02e01c6198909

SHA512
e1ede68c06eb951379cec9d0a0cae24e5de0751e614e37281d89afba955121e633781c38c233a909fc4f45bc86b07a4f8fc9cb0962cf66503a8a65923f603b09

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
189KB

MD5
3306090e5245403e692f9ff486f232fb

SHA1
db072d7c73575427409e623379fb9de9f9b78a44

SHA256
a421e1b38d5e2649b3cf14e7169bf0ba15c1131317070c0f9a4a833ca9b19531

SHA512
f54f573cbe7d5de7235b5b621050300a14e807d1462a58e456bec2a6b46a6ec293c085be5d9b43f607d998cccfed273081e51974d04e1af1703d2669617ba969

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
189KB

MD5
b6fa6e64e2344d8dc7ecc0cb0293fc39

SHA1
ef3381263868d934c446a2df288514ef4062191d

SHA256
181870c85ffb548c7f0601edec8db9c64a8596dbf082b188c4bd0d7878a0b349

SHA512
f2df66345ffb32fa49d808f80d30ad23a19a955052acc481d6b6dcadcb36cacb22b0ad62d06e5620d9d6dc0ab4f95c43981e5db10d6f6c3c70e9590a920b8dff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
189KB

MD5
03f88504a89650a0044031a4d9995cde

SHA1
2ba9e833f52e177519f571f61687c62252d7cec5

SHA256
ad1b06afd413c9574f0198c9e2007642647a9b881982ec741a531177a590eeb9

SHA512
a6073d9f37eb6e998ab5c47dceaf3c2819fc1d2c03eca917b6767f12b234aa41b222eed4be2b6d72cd095b4a159401951c713073a5d5ea045b3abc0dd30011ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
e4324005d3c652b63ad2578e16ec8240

SHA1
3507df400092bb574879d12b6a02bad8885d2822

SHA256
19a3ab88ab2c307cdcb01db610c3dc17de1f378e8081b8ca5ff83782f1028ecc

SHA512
0559d48f93b071e6f0f723324c88e3d7e78328b9fa800cbbdbb62de0c0d4710e0a835370b00d0565ef18dff1a2655bc8a5987cd6fb2d498302bfba50fa3c0c5a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\activity-stream.discovery_stream.json

Filesize
18KB

MD5
4c21f57f445afaf25ed173a1a961d033

SHA1
48ecb14c6020cad2e0fa2e8216ce8e416555b49f

SHA256
dceee095e115057159a8e8cabf3d34fd62be5816e6963c928e197dd7d7475627

SHA512
20f1c372bbf183c6e101264cb9bd4208151a49d8f391f022f6c446cff3a13c91399a780c2b6c61e31cc0c9c192c80fa6fc56425a329c7485abfb021e3620b442

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXBD09.tmp\D3DCompiler_43.dll

Filesize
2.0MB

MD5
1c9b45e87528b8bb8cfa884ea0099a85

SHA1
98be17e1d324790a5b206e1ea1cc4e64fbe21240

SHA256
2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c

SHA512
b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXBD09.tmp\JUN2010_D3DCompiler_43_x86.inf

Filesize
1KB

MD5
1a86443fc4e07e0945904da7efe2149d

SHA1
37a6627dbf3b43aca104eb55f9f37e14947838ce

SHA256
5dd568919e1b3cbcb23ab21d0f2d6c1a065070848aba5d2a896da39e55c6cbbf

SHA512
c9faa6bb9485b1a0f8356df42c1efe1711a77efa566eee3eb0c8031ece10ffa045d35adb63e5e8b2f79f26bf3596c54c0bd23fea1642faae11baf2e97b73cf5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXBD09.tmp\JUN2010_XAudio_x86.inf

Filesize
1KB

MD5
31d8732ac2f0a5c053b279adc025619f

SHA1
c8d6d2e88b13581b6638002e6f7f0c3a165fff3c

SHA256
d786d06a709d5dc26067132b9735fc317763fcf8064442d6f77f65012ba179da

SHA512
abc37922307f081a1ffdc956ce59598c19ad1939ecfb6ea3280aa6aa7a99c3eba5462731586ca262f7d7257d7d2a74ff57a45abf6b93521eb6f1c9f22f8eb244

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXBD09.tmp\JUN2010_d3dx9_43_x86.inf

Filesize
1KB

MD5
a11deb327119b65bacce49735edc4605

SHA1
0be2d7fa6254b138aa53d9146cda8fedbba93764

SHA256
6b33d32da02f664092d44b05237990f825b4062c105a063badcf978648b5e95b

SHA512
b0134a3d6f2d576e5fafb601014ab66fef91d661013acc8a7a9129940369a1d9ed5c0f228bb1666a4e891f09b4b18e83f0cb2080047aa84fa45ab663e5739a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXBD09.tmp\XAPOFX1_5.dll

Filesize
72KB

MD5
8a4cebf34370d689e198e6673c1f2c40

SHA1
b7e3d60f62d8655a68e2faf26c0c04394c214f20

SHA256
becfdcd6b16523573cb52df87aa7d993f1b345ba903d0618c3b36535c3800197

SHA512
d612e2d8a164408ab2d6b962f1b6d3531aed8a0b1aba73291fa5155a6022d078b353512fb3f6fff97ee369918b1802a6103b31316b03db4fa3010b1bf31f35fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXBD09.tmp\XAudio2_7.dll

Filesize
514KB

MD5
81dfddfb401d663ba7e6ad1c80364216

SHA1
c32d682767df128cd8e819cb5571ed89ab734961

SHA256
d1690b602cb317f7f1e1e13e3fc5819ad8b5b38a92d812078afb1b408ccc4b69

SHA512
7267db764f23ad67e9f171cf07ff919c70681f3bf365331ae29d979164392c6bc6723441b04b98ab99c7724274b270557e75b814fb12c421188fb164b8ca837c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXBD09.tmp\d3dx9_43.dll

Filesize
1.9MB

MD5
86e39e9161c3d930d93822f1563c280d

SHA1
f5944df4142983714a6d9955e6e393d9876c1e11

SHA256
0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f

SHA512
0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXBD09.tmp\dxdllreg_x86.inf

Filesize
724B

MD5
8272579b6d88f2ee435aeea19ec7603d

SHA1
6d141721b4b3a50612b4068670d9d10c1a08b4ac

SHA256
54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40

SHA512
9f1311803db1607e079b037f49d8643daa43b59ce6eafb173b18d5a40239a5515091c92b244ffe9cfef2da20530fb15deb6cf5937633b434c3262e765d5a3b21

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXBD09.tmp\dxupdate.dll

Filesize
168KB

MD5
94202f25810812f72953938552255fb8

SHA1
c1e88f196935d8affc1783ccf8b8954d7f2bfb62

SHA256
6dcad858cc3ff78d58c1dae5e93caf7d8bacb4f2fcf9e71bccb250bf32c7f564

SHA512
65b66d07ef68e0d1e79f236a4800c857e991ee3ff80ece4cfdd0b5f6083ea16f8a52d351c3af721cb05c06394ec91b4b5e3cfa4b0f0879f7549f3e3ed035e79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXBD09.tmp\dxupdate.inf

Filesize
12KB

MD5
e6a74342f328afa559d5b0544e113571

SHA1
a08b053dfd061391942d359c70f9dd406a968b7d

SHA256
93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca

SHA512
1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup_20240729_223702079.html

Filesize
16KB

MD5
15afe7ad1865e1a1f11310565de5baf9

SHA1
7f37cb873e906b2601621bb91d533f751e5452c8

SHA256
26953ca333f4781a84c62da623d1f137c3816201750ed8bd54ac811e6cef5430

SHA512
f1cb4d3364d1e21a0121e544eba92ba80cf97a819357c89cce26ac5d3d292bdd5c4f9ee72239b6741b34e0cde6c088548add767fc1b472b16f14a831b0b3ad56

Download Submit
C:\Users\Admin\AppData\Local\Temp\VWLD1F9.tmp

Filesize
392B

MD5
f0b63284f733143044029e0587b79dc2

SHA1
c430754476225ef800e6e7d3e65750d52a0c986d

SHA256
eee93e25bf82be0b29f19548bd54a39e031e9bec158be2f6b32c4494bea57f47

SHA512
9c47c4c134dc551614c6d096de63e7832d998a9e78ec621677824383b58cd92ac7a24c815b852f5166e6aa28b331ab196ff2486d20ad00a929b289ada1fb26a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf9F81.tmp\System.dll

Filesize
11KB

MD5
960a5c48e25cf2bca332e74e11d825c9

SHA1
da35c6816ace5daf4c6c1d57b93b09a82ecdc876

SHA256
484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2

SHA512
cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr7F27.tmp\InstallOptions.dll

Filesize
14KB

MD5
714e0ecd29f9ec555f350f38672726c7

SHA1
555b1492e782d7a30f280f2aecb64c642c1aaad3

SHA256
21fea4cf18de8e25d0ffa3375699150fcd04e6d470358696f2dffdd3fc09d7f3

SHA512
ced5814f25b688d1ede5a1395bcca69e1a0cba260104f156dc03de6ebb2015f6d832fed86ac234c36a10a75be33f489a63c8bd6111e3aaf4b078af1d94b00312

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr7F27.tmp\UserInfo.dll

Filesize
4KB

MD5
1e4995d182c923924c325888930eea33

SHA1
034591ef595ee80ebf03b5ac2078faf142b0c130

SHA256
ba1b821d08f7fbd4d9c59ff90296d8ad816f4f771b2d7ae6cabbe46d28c0d851

SHA512
5b97955be470eb2725d8e6da07ef0350c2959a50f49d420d57171ed5075a1a4e18f0310b2f72d9afd859d8943437a3e6ddc473c4240476270cc1ba64d921e507

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr7F27.tmp\ioSpecial.ini

Filesize
1KB

MD5
1385a8b115f790419448457373120434

SHA1
9ff3c6db699b37137496716aae938819f38109ce

SHA256
fcad368de3720f8d714437065e5d7bb0216775e912bfc4504f711eab5b91c17b

SHA512
8ea68cc871aec7378b7a78177afe66d898d2d7316c4fb2e5421d432d9929c96557b1967fe4af039e866c9de44a03ed14c610a896835b436e5dbc124a0c0ba4ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr7F27.tmp\ioSpecial.ini

Filesize
581B

MD5
5bda7fbc61889361f0287048e7392369

SHA1
ae4350112805dd25be1efbf4ab1dfbfdf9f05df4

SHA256
8662837a145237ec536589376b8154549249e1a440ae130d771a66faf421ac8a

SHA512
eac044eeff19325827433f3054e84af29ea4e26acd4be9a8b0a4528273edbe943333cbfe8a2811f135738f682669f5b8806a5d4aba32c4e2af517268bb7c1ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\AlternateServices.bin

Filesize
8KB

MD5
52cc3f5a5725f7f89727e3bc42947250

SHA1
f553bb513f18019eb69b05b1b6f53d7259d76cdb

SHA256
3bdac1c9c91e00444fe6e51fa0854a9ba6d1e371286aebd109383538200fee52

SHA512
73972c5fbfbc8e99e35e3fd28f9c2091e489387c6129769d5991828fb4ba92848722f4ebc518d3cb078f937799ffaf11ffdbeb4fa9fcbf8943982f34fe9376b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
e80c3e0f2b18e211c96fb6bff34c7c5c

SHA1
ad35d34af235646ce7f6d188d52e0bb6a0ca0878

SHA256
85af2db823bcd4faa5cea5c954ea0977c4c303b242571ab0d24896684083d89b

SHA512
f83640f706fd43270dd3f7b35b4c4b6a82b162bcb279e0b7ba8a84643539ba370e656fcaa9f4af4a45c25e82af08d902a55dd355f552db82eadc6bb8648b57bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
114b1d24f5a22ff709db777ea54883e2

SHA1
d9d8628d281b2e20fd8a4cc52aa429e2d162bf78

SHA256
c4f5aec634e12de2ec23be7929f10b1ec8192202cd47793189cae17f0949ce0d

SHA512
1b25859a51de9287d11961c453876a8fccc28f898d79ac7ea3a4450090e119ecf093a3b9727233f2a2ac3986c322bb1d7c46bdf92c59db2c18588ebba8ec73d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\pending_pings\17fb8eb3-4598-4445-8816-fd9694e7f035

Filesize
24KB

MD5
b38b13343a19c393291bdd1057dcf913

SHA1
355bf356df8a7264767fd834aacc64dd2a912c21

SHA256
29506378bb16e30099f4b3258b7d50f7dc8b07204f7c5019208f7b03c92a97a9

SHA512
ca6f6007c77b83b1ba9f5eba7c6da4e8a1891519781c84d5cf947a99f87742f9b9b7816aff568196c30c70a4f463a15ef576fdd6fd893c0121b2ef4f0b7400cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\pending_pings\4cd2e512-8c81-4681-821d-f9828c8f3753

Filesize
982B

MD5
2cefd1bc0094e1c2fff63f87fa3038a3

SHA1
5a6efd375d9e058c8a7f186e797eae981504266a

SHA256
4db241dcdee8c400b3a35b6f314dad884a1a8cccfebbde8281bd77b8d6ef0a32

SHA512
98c5e64aac223aa9f2c63a44fef77f0a8cf7490e0120673f0cbe6f63c277b0202779358afe7ddaef9d6ea11ea3758c23ba4a68328488d1e599c1c76dc5b73027

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\datareporting\glean\pending_pings\54382cb2-9fde-4813-8e17-5e55af1462b5

Filesize
671B

MD5
4407694c8a3529cd757231b311e1b3a4

SHA1
f6c0106c093488a1e157845ab69333c700217cb2

SHA256
eb1267efdee12ce5d31ab9bad4d6e1132a933391ba76661a48ac739e444b3a20

SHA512
ad2d6d31ed2450c21f865258b998c69822b906cd98eb82985619eff6a18abe094a441736d400c88d4bff917dbc9591699d4ba2abf4d9ac14f06de65e70ad75a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\prefs-1.js

Filesize
11KB

MD5
01c24611305974389ea1e657b6f99a70

SHA1
3018168be3707721ed80aecfdebef677a123105b

SHA256
fe5d4b76d2a2e292769dd9a7c4dcd5654170395c555b7ffa8a0823001d270283

SHA512
d8336b6dc2dba9654471a5dd6274d899a2eadd5872369de9da9de3112b04f6a68a4d62b91444d086808b2753c324e8d03239977519c9e11c0a2e44a6e95db4c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\prefs-1.js

Filesize
11KB

MD5
9b4f51e5fd165e37472c2ecfa5acb998

SHA1
66ad1eb0aace9a79252d247c82947a868e1259f4

SHA256
9447760b550a661468c18256a098138ec3bf96e1d8b7483d1d3f9566796bc0b9

SHA512
745be8d3b4e17d032df792badedfef30db403d2967477e08b153b1f56716696cda546728abef7f6d16fe4f16f65fcdeb1a49a16a451323e8060e1b921784a35f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\prefs.js

Filesize
10KB

MD5
9ffc07c0faff4064507e9a41fa9d981f

SHA1
969262bdd3b23087fe578e1107aaa3212ee53996

SHA256
078f9f8ac3d115103085621fa4b2c2dffcc35ad18ce204809a065cf37169a5b3

SHA512
48a961285d5bde65163f16d18c1b88f5732df4c09cc150949d05adf6ade74806f10bbfef483fd7a42572f69e93271df1346ce4c2db77a3a009e708e17da43f69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ywkpx7r6.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
39c2fea145133ff777328edbfaeff703

SHA1
a374bb52c8616507f5095d90dfa4db00b6ad1cbf

SHA256
76a02d6e60e146d05e08de04c873c9a193e9df42c6020255325c3ddfa6700a4b

SHA512
1204a9ab1380d62cf04efef70b72d71ce6649322733f8382f76e1cb3c390cde76b59050590f2b9c7d0f2fb96976de725671e7a70e0b159445b3b924e50e46822

Download Submit
C:\Users\Admin\Downloads\MPEG_ActiveX_6.36.0233.zip

Filesize
37.0MB

MD5
263022a1e3e34a8426bc5886464e0299

SHA1
780aa17fd6057fd75e2085af06d4f98279fc49c2

SHA256
eabd9a0d285cbf7bfc11ef9ec75f4348409a784a5bcdd445dcf2bdf2ebd361a6

SHA512
4ecc6a8560013146ea94af818d018f91196c56331312113ca23a792136b537e54f8e283c59f6e6399568526947f1deaed715b5b86f6b1de6271b23e3672fbb08

Download Submit
C:\Users\Admin\Downloads\MPEG_ActiveX_6.36.0233.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\Installer\MSIF761.tmp

Filesize
270KB

MD5
5e55ee18cce1e1d57f1982aaada62925

SHA1
8f957a302eaa31323cc7fb894045a0f9db73cad5

SHA256
7480aa56f7496b5259c2d954b19e2554e1d174d3de5b4e4185e737d2ddcb6077

SHA512
8d70051f592512d8a098917c0f645ef29af865a2435f6fe2fffab40f86ac6eebda1ee2e653b40a88a73e8dfdb1bd3f1b3b22d819896e2ff6eb52108042ed8d3c

Download Submit
C:\Windows\Installer\e57df06.msi

Filesize
37.3MB

MD5
d6ce324f669b7481db57dcb6569d1303

SHA1
0734fd85d74af7e5bcc64f959352a926abe0b384

SHA256
698c0b8ece8ae240667c4c2e024851e61693ab0c516e7ecd588ffcc1b6f4a2b2

SHA512
3f9d885380115389c6668b54d37987f8deb7c6dd819f7cb52839eb66e8ef2b3b4d899bffcdba5fa3f70a7cd47d5795176372a4c5d72047aa9db3155e623cd026

Download Submit
C:\Windows\Installer\e57dfea.msi

Filesize
26.3MB

MD5
f45a33ae85a49dfa6f5a72f96c2af913

SHA1
9eb1519f630eac18aad8cb8cd76c2ead941143ea

SHA256
ce857a7de02875a4351d4fc51f9434cc203e5e6d32e1429f2020e8f7b6d61cfb

SHA512
fdb5a1b9fa0f9ec3d33838508acd8386a520377226f19a469966cb71bf391228cfa174bd1b06bbe0c3e23023274d868f086fa0f325b7ba6d507a461d9abb4051

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
558B

MD5
c635f868628fa37b3c63f81cff93d0df

SHA1
5780ccd45ba003e49b8c3d139bf816fe80bf4b7d

SHA256
e854252b1e1836b4c3496a34dde908504245b688dc3190201c9e1759cbae8c01

SHA512
3c9508b42e39f99765acd163fdb38c72f3f2c0a8238027dfff49972637b4a9abd35dc1566a9eca81345a9b039c38ef729644907531dfbb875ef2a835e7540445

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
13KB

MD5
b3a1c782ddb5ab0c9bea0a22267db9eb

SHA1
73ad3d707151c6f590b3babd848cb309e557f82b

SHA256
f4b84e85689d804f71d2ec9e56d7c43afb4eac1ab124e49abbb7dda0a70a67b3

SHA512
00b3c98b637952bd417a604cb0098a6f14a0870a21bb195fea7fd49731c1be852f9ac03d3666caca029753ebed51fdc24c32f0fec1829a6fc2edbd15f0264b3f

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
12.8MB

MD5
0ef9e60d20540bd8870c0adea6306598

SHA1
2691b1de5c6ce251abc23aeb88a40fb8fceb3f2f

SHA256
aa04fed56ba3d3d683daa125a1de3c28fece1cccb7b751c777fc251c69294114

SHA512
698f42f9998cd2e4a395b8b1ad6899caef3abe801051e161ca17e5a08892697b7ad1e9de73ddd97394b50432037b2d2a369b11d1de5b92f0f24b3cd08dd7e631

Download Submit
\??\Volume{afcdac1a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{241f4abb-a475-4584-9fcb-70583e46896f}_OnDiskSnapshotProp

Filesize
6KB

MD5
4437f726bcf373184d5b5b1d00bf3984

SHA1
732b034e3b2d20353636491540323b3cdee75512

SHA256
3742526ad14b895752037a3224314df35eca45cf3d7430fd9af96ab600886190

SHA512
74579b58c98cb9ee7621fd338ca542516c3445c8ff11671ab3042980ca6c194cdbdd6556933f2e6ac2765c7642555208f474a5aa78f39023f464b26b38d84c13

Download Submit
memory/240-1410-0x0000000007CA0000-0x0000000008279000-memory.dmp

Filesize
5.8MB

Download
memory/240-1412-0x00000000082A0000-0x0000000008E51000-memory.dmp

Filesize
11.7MB

Download
memory/240-1414-0x000000000A220000-0x000000000A6DF000-memory.dmp

Filesize
4.7MB

Download
memory/1720-3177-0x0000000002580000-0x0000000002B8B000-memory.dmp

Filesize
6.0MB

Download
memory/1932-289-0x0000000008040000-0x0000000008BEE000-memory.dmp

Filesize
11.7MB

Download
memory/1932-294-0x0000000009F70000-0x000000000A38D000-memory.dmp

Filesize
4.1MB

Download
memory/2508-3179-0x0000000002730000-0x0000000002D3B000-memory.dmp

Filesize
6.0MB

Download