hxxp://tumblr[.]com/appsetupv

Analysis

max time kernel
136s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://tumblr.com/appsetupv

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4752	Applnstall.exe
4320	StrCmp.exe
5180	Applnstall.exe

Loads dropped DLL 4 IoCs

pid	Process
4752	Applnstall.exe
4752	Applnstall.exe
5180	Applnstall.exe
5180	Applnstall.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4752 set thread context of 5256	4752	Applnstall.exe	133
PID 5180 set thread context of 3316	5180	Applnstall.exe	136

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Applnstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StrCmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Applnstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\ = "BtDaemon.cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\Clsid\ = "{4F7FA487-8CC1-493E-AF0A-E7A294474F25}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\Forward	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ = "cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\VERSION\ = "2.1"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "_cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\TypeLib	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\HELPDIR	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\LocalServer32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\BgStream\\LPRZXMVODPHKTO"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\FLAGS	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\FLAGS\ = "0"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\ProgID	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "_cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "__cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\ = "BtDaemon.cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\ProgID\ = "BtDaemon.cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ = "cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\Forward\ = "{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\BgStream\\LPRZXMVODPHKTO\\StrCmp.exe"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\ = "{F477A542-C370-42A1-A166-F9CDAF2AF8C6}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "__cBluetoothDaemon"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BtDaemon.cBluetoothDaemon\Clsid	StrCmp.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\ = "BtDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A84C003-E3A6-4E71-8E33-5B929D40B81D}\ = "cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\Forward\ = "{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\Version = "2.1"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\Forward	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F477A542-C370-42A1-A166-F9CDAF2AF8C6}\2.1\0\win32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\Implemented Categories	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}\ProxyStubClsid	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ = "cBluetoothDaemon"	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\TypeLib\Version = "2.1"	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10E6A3D4-CABA-4E61-BD8B-83BA76283791}	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7FA487-8CC1-493E-AF0A-E7A294474F25}\VERSION	StrCmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5965C4C-9CC3-4EA3-8079-0B9AA9389A1F}\ProxyStubClsid	StrCmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65B9560F-CEC2-4DFC-A04D-BEA488DA4DCC}\TypeLib\Version = "2.1"	StrCmp.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\App-Setup+Instruction+installation_x64_x86.rd.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4752	Applnstall.exe
4752	Applnstall.exe
4752	Applnstall.exe
4752	Applnstall.exe
4752	Applnstall.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5180	Applnstall.exe
5180	Applnstall.exe
5180	Applnstall.exe
5180	Applnstall.exe
5180	Applnstall.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5256	more.com
5256	more.com
5256	more.com
5256	more.com
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
3316	more.com
3316	more.com
3316	more.com
3316	more.com
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1632	7zFM.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4752	Applnstall.exe
5180	Applnstall.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	firefox.exe
Token: SeDebugPrivilege	1080	firefox.exe
Token: SeDebugPrivilege	1080	firefox.exe
Token: SeRestorePrivilege	1632	7zFM.exe
Token: 35	1632	7zFM.exe
Token: SeSecurityPrivilege	1632	7zFM.exe
Token: SeSecurityPrivilege	1632	7zFM.exe
Token: SeDebugPrivilege	5848	taskmgr.exe
Token: SeSystemProfilePrivilege	5848	taskmgr.exe
Token: SeCreateGlobalPrivilege	5848	taskmgr.exe
Token: SeDebugPrivilege	1080	firefox.exe
Token: SeDebugPrivilege	1080	firefox.exe
Token: SeDebugPrivilege	1080	firefox.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1632	7zFM.exe
1632	7zFM.exe
1632	7zFM.exe
1632	7zFM.exe
1632	7zFM.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe
5848	taskmgr.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
1080	firefox.exe
4320	StrCmp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 1080	2688	firefox.exe	84
PID 2688 wrote to memory of 1080	2688	firefox.exe	84
PID 2688 wrote to memory of 1080	2688	firefox.exe	84
PID 2688 wrote to memory of 1080	2688	firefox.exe	84
PID 2688 wrote to memory of 1080	2688	firefox.exe	84
PID 2688 wrote to memory of 1080	2688	firefox.exe	84
PID 2688 wrote to memory of 1080	2688	firefox.exe	84
PID 2688 wrote to memory of 1080	2688	firefox.exe	84
PID 2688 wrote to memory of 1080	2688	firefox.exe	84
PID 2688 wrote to memory of 1080	2688	firefox.exe	84
PID 2688 wrote to memory of 1080	2688	firefox.exe	84
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 1936	1080	firefox.exe	85
PID 1080 wrote to memory of 4192	1080	firefox.exe	86
PID 1080 wrote to memory of 4192	1080	firefox.exe	86
PID 1080 wrote to memory of 4192	1080	firefox.exe	86
PID 1080 wrote to memory of 4192	1080	firefox.exe	86
PID 1080 wrote to memory of 4192	1080	firefox.exe	86
PID 1080 wrote to memory of 4192	1080	firefox.exe	86
PID 1080 wrote to memory of 4192	1080	firefox.exe	86
PID 1080 wrote to memory of 4192	1080	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://tumblr.com/appsetupv"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://tumblr.com/appsetupv
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2020 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c35dfbb-b090-4168-a44e-8b200b8bb9d2} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" gpu
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89b07159-83c5-4d78-a5bf-730c9a304c0b} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" socket
    3⤵
    PID:4192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3128 -childID 1 -isForBrowser -prefsHandle 3008 -prefMapHandle 3212 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56cf58ff-5c53-45e4-8bdb-af858214489f} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" tab
    3⤵
    PID:2304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3544 -childID 2 -isForBrowser -prefsHandle 3632 -prefMapHandle 2744 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cad1e6d-580d-447d-a288-4dcec5b84f22} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" tab
    3⤵
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4740 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4732 -prefMapHandle 4656 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cc8d824-51a0-4e09-ab0e-a3e3da9dfc7f} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" utility
    3⤵
    - Checks processor information in registry
    PID:1764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5304 -childID 3 -isForBrowser -prefsHandle 5296 -prefMapHandle 5280 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4146389f-fa74-4a3b-b4c0-a86f39c1fb41} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" tab
    3⤵
    PID:2648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 4 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {723a7178-f515-487a-9447-e2402e019070} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" tab
    3⤵
    PID:2192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 5 -isForBrowser -prefsHandle 5640 -prefMapHandle 5644 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {512b0334-f48d-45b4-827f-154a46535c9d} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" tab
    3⤵
    PID:1188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2660 -childID 6 -isForBrowser -prefsHandle 3532 -prefMapHandle 3528 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93ed0cf4-c6b7-4c2e-b9af-5ee16add628c} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" tab
    3⤵
    PID:3936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6228 -childID 7 -isForBrowser -prefsHandle 6276 -prefMapHandle 6280 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {970eec53-ed29-4f78-913f-09a0de4dd74f} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" tab
    3⤵
    PID:3592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6564 -childID 8 -isForBrowser -prefsHandle 6560 -prefMapHandle 6556 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb3a7e8f-929f-4441-a933-0ccad2c406e5} 1080 "\\.\pipe\gecko-crash-server-pipe.1080" tab
    3⤵
    PID:5376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5252

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1632

C:\Users\Admin\Desktop\Setup_Files.v4\Applnstall.exe
"C:\Users\Admin\Desktop\Setup_Files.v4\Applnstall.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4752
- C:\Users\Admin\AppData\Roaming\BgStream\LPRZXMVODPHKTO\StrCmp.exe
  C:\Users\Admin\AppData\Roaming\BgStream\LPRZXMVODPHKTO\StrCmp.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4320
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5256

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5848

C:\Users\Admin\Desktop\Setup_Files.v4\Applnstall.exe
"C:\Users\Admin\Desktop\Setup_Files.v4\Applnstall.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5180
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\activity-stream.discovery_stream.json

Filesize
32KB

MD5
53014d352e0b087784cf9b3818f65feb

SHA1
c9007c3ccd286e46724666c2af8495343376383b

SHA256
4cc0bcfb3361c5f942944e2d246756a4a02a476c53656e49b2c9d9fc3aa0ab8f

SHA512
6b881d6a7c5c20422b0a0fb23f924fd7184f6c5a2b063d14c02dfc3455acdca54ffe223d5e8c8dc8124c12af51a472babd73ffcf92f776ffc3aae9db11618507

Download Submit
C:\Users\Admin\AppData\Local\Temp\1c297ea0

Filesize
1.1MB

MD5
ac45055dad57fe62edad6188f07b8d8e

SHA1
7fbea2ed2d21b4ed3be432c0c22a5ba317f74600

SHA256
394d7b821388fd8236de38c63b0e05c8f97464a1c43b8c8e2c5bff78571edf16

SHA512
0d1ea6972ab247e6972ac186d60fad3811696c8a07b396c5b1f13e3ec1184c2e8972ee206ab95787dc51a2219ad2b24823026b4edd4461a9bd8bf493a9353bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5e08ecf

Filesize
1.1MB

MD5
7e2ea4fa92d3486782a6a3a0395d1986

SHA1
bdd2dea2a17dd4d3ac8dc36e7a26cabc9586d0ce

SHA256
ba0e6d8f8cfdd5677fc94d7bb8ef69466b00c728e9c3984181ac3023fc377b5b

SHA512
150ce1dc5c8bd09a8d764247e592957d24ed35e133e821bf2d8b1e41801c4e006723cce18c5a62135cdbe89489a06d3ca247fb657dffc29f2ac52b05313b0961

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\BgStream\LPRZXMVODPHKTO\StrCmp.exe

Filesize
47KB

MD5
916d7425a559aaa77f640710a65f9182

SHA1
23d25052aef9ba71ddeef7cfa86ee43d5ba1ea13

SHA256
118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35

SHA512
d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

Filesize
26KB

MD5
bf805e3b22c3cd98402ad9aa89c01294

SHA1
578df0cdbe83b349c20803c5f84657d86da78796

SHA256
24a8eb821556ee893fcf3c617d8ae33bc6ee4757f52298c17b87fe6e9131176a

SHA512
0da7453a168eac81457c430601c2291fc55930e39879af4222f54bf32328a0fcb1df5fbd93e975c11d8d5fdf10afe1b9f3d29485a94e79b60bd4a634680a2f28

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

Filesize
7KB

MD5
0b660f78bfec8f7029c4ce3cf7a245bc

SHA1
47963d252b750d440bfb54eb98e45dccc79c0708

SHA256
8ea8e991c204aad2dfa15d9c979215a6577cb769eba652adf987487cd0431591

SHA512
c421b9210c0f9c377651e0c3efaa5fa6ae91a78aef7e63554a1261404321e47e8248017764c67f2b228c91838ea0b5b8a2eac922243613b801af6f72a52b632d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
1593f8c131e2995f308c39a21012c596

SHA1
5312d23c0b6e6082a997ba5878488d14c375a151

SHA256
0a3a473bba6197b2631f815aff0ed79603619073b93fc764d58881a9d181cbd7

SHA512
d12daf623e7e8e0a2b41185eb5de4134852d1693816e3798bc35aa606356584fabdf3333a54e5651c0f172981ae8c099bb0d03084633a98ceafa316d0f26d636

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
6ba7e225ea6cde13feaaeed491776ea1

SHA1
fb1a075e98f45445d4c5b2019cc678ab7fb87ad8

SHA256
14e22959dbf76bd84fb849c99830236a7b166cb9284955530384a749b8eecb7a

SHA512
cdbcabecc279e2ab855c9f2772ed090fe64fab0c1c494eacd202088696ae86e43d712fd3b3ade17fd39d3271451447e049a8e38271af6f7153345d7bbad701ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

Filesize
45KB

MD5
54d5b86f9ea4533a70a2a37c39efec15

SHA1
7e1e6a5bef3aa8f9401e1214057bdf242ea17123

SHA256
76ac90dc310a95779d01dad3183f47eb5a34a3925696dba58461c2618ac57663

SHA512
182b4111f76ad7d003c14b34cbee57bb5875ee25856c7ecf9ff6c9c0d7f3790a0ca7b59a8ef4027c13a6ea1947b97162b59723cbf8f649cdccc1bad4e4a0c4fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
7d41e60c6eea7615f6010c431273cce8

SHA1
a7a7e1b5cf18dc2634da5122daae648be315876c

SHA256
428ca18c24f4e8467f4901cd44ce0d2c3550fc79987d9a1e7b79acc213f80ac9

SHA512
f2973ae8ce50696c8a1c32456e6566463ae7b766060eb1b94685f73937583f4f4945434b90b55fa6c89997bb77bf4fdbfc884f1044c436e757f68db5e92bd566

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\49047fe3-3bbc-48f0-9c9f-1c68cbc7a2b2

Filesize
982B

MD5
baf11d0fbdb5064146d52e0d9a8c3b43

SHA1
202198353af3d30e8af5b76c56b00d09b9ecee4d

SHA256
689cd094db38019b0e3753342bc48950a68f85528e0fe67bc7bc0c6c49116450

SHA512
f6bb797fa134284aab6e934ad260b37232eda299af17730e7f0a451871fe6eddfa08d55ad03305dc7966e12ec71b1b4bc359758ae21b55a8e0f93a8fa9683b11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\d555a98e-454a-4213-b936-25e61c25774a

Filesize
659B

MD5
6cf40a1783fbe4509489fa6a30d4a97f

SHA1
96ba13f14d87265f35d36ad9676b66efc39522a3

SHA256
e9e77aab86d469a9a9ba2090905c45b678350dfeac452a55e14daf0e341f9fe8

SHA512
ba5fb14796bfa14627f61be5264231b7a6c5eae5e6b58d208ce75b96cf5bc16f301ecf21c322be269a21f400019c2e38102daad1225830bb2c1a98a433999639

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs.js

Filesize
11KB

MD5
ab0e358c4917cea3acd8248acac4a525

SHA1
6944445042d7573c1cf276d3d9b094dd08204ba1

SHA256
ca03695484a27ba9c6816f543228f9a82e69695c2719c9f29de4b63163206058

SHA512
0f05a18f74091fd33e2d9d6c9c6974df57d2295be48d95e77786559e4688df21b490bd9684978748512a209082074b279f18de02973dede5aadd1231351447ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs.js

Filesize
11KB

MD5
f6bac294c43d286beafd6543325b9a0c

SHA1
7aa3e3d8b9e5794863f3a6596bf46b0f3031e76e

SHA256
6641b155c6cf136e18f46049b8d94457d09099beea930249e93a7d20e37ce5e8

SHA512
b4cf0ad1fc7e7b1f0e23707b777db5c5a1e6926e6417611374056874df4ea7a5d8778d9f2a9a640a5414aa2deeed6e9618e22a0adb07b3f8d48fa0938af1296b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs.js

Filesize
12KB

MD5
4addb9be772681cc09b48087ebe7182f

SHA1
d007ae5bb168fac664ef02c29701b394f238c309

SHA256
df55b755c6dcdbd04cb4abbfdf9a938442a84799909a1d6d6b04f7c38f0fece5

SHA512
4c45ee11f7bbc48a0fdd8ca67cf612578261c34bf7977ab7702203574ce185d823ff95e8b674c7130f95fc510c71e3ed6a243c7e6e3c3edfb1c8d37cd2cd44dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
327807d84ea9bb4ac1b3a83e159ba9fd

SHA1
4c8a03318a8d1c6af2e6ff6c90e3b6ffad10a1cc

SHA256
52df5784aeca3b0c2bf8762bd204bd14f7bde8bb55262468b876348b35798226

SHA512
f2c3f17e5d01b6a0130f46d30cc203ed51c350778741c294005b9f23e0bb893fdba907ae22a84d65986126e4608f56334d4026f512ba405818f3a2ac0c0606e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
fec9e9e7d5cc39b92522f5718dcc7ea1

SHA1
f362238211445ecbefb10a7689d85b1ab7dfa657

SHA256
54c68e562bd1c8e64afa87e10ef65c450b7b56be84dae2430db172125ceced55

SHA512
d4fa8f285e7ed4905151f8f129ccca04e7bbb35787b8a572fee6544abffca816f01cd28efe1012afb0c5af0d04e6dffc9940bf147ec0591fe09f5738da2ba31f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\storage\default\https+++www.tumblr.com\cache\morgue\215\{aef3c116-6c40-44bb-b1fb-d2cf1105f8d7}.final

Filesize
73KB

MD5
5693a65235d6e47f300251f91d274290

SHA1
5b2081d5f9a90a60ad167d435b9097ee49aae562

SHA256
f755e78007e575b439e33f1f7640d5e07edb9d7a202a28e65c1f197cb70f3a69

SHA512
32dfdf6a92418495731f3d62263f74c63b7c8c371014a1343a640e42022dc9d7f032b3ed3aaa809e15470259c498d5bfa68548847e06415b92e70e323e50e801

Download Submit
C:\Users\Admin\Desktop\Setup_Files.v4\Applnstall.exe

Filesize
1.9MB

MD5
0d93920a08c304bf7fd04561f924cfbb

SHA1
6948f5b140b12fbfdd540b43f2961c564e937f06

SHA256
452be2f9018f1ef2d74c935eac391ecdceff9a12cb950441f4f4e26b2b050fa1

SHA512
658f8cd388dfe8f6cf44f549d8ec7e5c8f9db8d5d5079333d5d4f6d47712273ebfde2a7e7ea9a19ddfaf0cbfeb96cc588d04e5f7ed3c620da56a3410ee70ce07

Download Submit
C:\Users\Admin\Desktop\Setup_Files.v4\ProductStatistics3.dll

Filesize
1.1MB

MD5
afecf597b7d072e81f2f3a8058860001

SHA1
93dc86da59f07bea3224d6252a2010b92a7e1301

SHA256
fddc3e47dde77d6c48e95da651783efacbcbea3ab75fda253b17bc50b3fbd663

SHA512
1af12cf66e42aa563796468dd2240737a76c7fa3b90d97258ba58ca0fc52ec1cf21397f1aaaddc3500a0791aecd46123056cb102934b5e3a3ffe97f839cb5627

Download Submit
C:\Users\Admin\Desktop\Setup_Files.v4\rrrgnbl

Filesize
38KB

MD5
2ac793671326ca2b39fef35cda777b1d

SHA1
442c4d9d45f8e507ea67ebbd9d757d5bb8543e42

SHA256
7485af0b757c66840faa8d4ddef5a507213f9cac8dfb173bb00f2d45fcd405e1

SHA512
238c409660fbd38315744dc8e575a71cd888e374a31324fba032dc9ebeda5b3940a67cc7685bc9e1c46ddd18be403ea9c0aa4934d91c79b905f7d6e0c08b4d1a

Download Submit
C:\Users\Admin\Desktop\Setup_Files.v4\xpcmh

Filesize
843KB

MD5
0ccaa87d8e48027f4dd1c45d5bb63ac4

SHA1
fece091f058b5010f35596a992de272b4ed8f8e9

SHA256
5b183cccf9d3b82b9d410bdefa7e20b885ff353786963144ef63fc134a9a200e

SHA512
baca8a59e75682222c5765fc2ae673a3d0801fdbf2c3cb0a53970ea92e2319e2df69682df8e17de30c8d69e7495d2b160ee345d3c2c1fc11b59d79350bc99513

Download Submit
C:\Users\Admin\Downloads\App-Setup+Instruction+installation_x64_x86.bdmeYzoq.rd.zip.part

Filesize
12.4MB

MD5
abee47e2c361e861f10f7935faaa7b5f

SHA1
da79d51f5182a70745616bc582e97551623e280e

SHA256
cff969da8de4eb09f57676cd59d22414450c924809d83f4694d145203f579258

SHA512
1446177812f860333fefbb2767cdaa301db1680711d5be0c878c3205bbbf1b70421c806d913e3a9ebe180230f7ffb833d624b92f744430fb752fe483a7e30e80

Download Submit
memory/3316-1557-0x00007FF8A8030000-0x00007FF8A8225000-memory.dmp

Filesize
2.0MB

Download
memory/4752-1496-0x00007FF8A8030000-0x00007FF8A8225000-memory.dmp

Filesize
2.0MB

Download
memory/4752-1546-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4752-1504-0x0000000074CF0000-0x0000000074E6B000-memory.dmp

Filesize
1.5MB

Download
memory/4752-1503-0x0000000074CF0000-0x0000000074E6B000-memory.dmp

Filesize
1.5MB

Download
memory/4752-1501-0x0000000074CF0000-0x0000000074E6B000-memory.dmp

Filesize
1.5MB

Download
memory/4752-1488-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/4752-1492-0x0000000003FB0000-0x00000000040CE000-memory.dmp

Filesize
1.1MB

Download
memory/4752-1495-0x0000000074CF0000-0x0000000074E6B000-memory.dmp

Filesize
1.5MB

Download
memory/4752-1500-0x0000000074D03000-0x0000000074D04000-memory.dmp

Filesize
4KB

Download
memory/4752-1547-0x0000000003FB0000-0x00000000040CE000-memory.dmp

Filesize
1.1MB

Download
memory/4752-1525-0x0000000074D03000-0x0000000074D04000-memory.dmp

Filesize
4KB

Download
memory/4752-1524-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/4752-1523-0x0000000074CF0000-0x0000000074E6B000-memory.dmp

Filesize
1.5MB

Download
memory/5180-1537-0x00007FF8A8030000-0x00007FF8A8225000-memory.dmp

Filesize
2.0MB

Download
memory/5180-1551-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/5180-1552-0x0000000003F00000-0x000000000401E000-memory.dmp

Filesize
1.1MB

Download
memory/5180-1549-0x0000000074CF0000-0x0000000074E6B000-memory.dmp

Filesize
1.5MB

Download
memory/5180-1535-0x0000000003F00000-0x000000000401E000-memory.dmp

Filesize
1.1MB

Download
memory/5180-1536-0x0000000074CF0000-0x0000000074E6B000-memory.dmp

Filesize
1.5MB

Download
memory/5256-1553-0x00007FF8A8030000-0x00007FF8A8225000-memory.dmp

Filesize
2.0MB

Download
memory/5848-1520-0x0000020D952D0000-0x0000020D952D1000-memory.dmp

Filesize
4KB

Download
memory/5848-1521-0x0000020D952D0000-0x0000020D952D1000-memory.dmp

Filesize
4KB

Download
memory/5848-1522-0x0000020D952D0000-0x0000020D952D1000-memory.dmp

Filesize
4KB

Download
memory/5848-1511-0x0000020D952D0000-0x0000020D952D1000-memory.dmp

Filesize
4KB

Download
memory/5848-1517-0x0000020D952D0000-0x0000020D952D1000-memory.dmp

Filesize
4KB

Download
memory/5848-1519-0x0000020D952D0000-0x0000020D952D1000-memory.dmp

Filesize
4KB

Download
memory/5848-1518-0x0000020D952D0000-0x0000020D952D1000-memory.dmp

Filesize
4KB

Download
memory/5848-1512-0x0000020D952D0000-0x0000020D952D1000-memory.dmp

Filesize
4KB

Download
memory/5848-1516-0x0000020D952D0000-0x0000020D952D1000-memory.dmp

Filesize
4KB

Download
memory/5848-1510-0x0000020D952D0000-0x0000020D952D1000-memory.dmp

Filesize
4KB

Download