b687de1924f7805b57a1b528ed804d6d2f5e2e3f8058ab904fe0983a9d6a2a36

Resubmissions

16/11/2024, 14:42

241116-r3d8daybme 8

16/11/2024, 14:36

241116-rywxmaskdm 10

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2024, 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Unlock_Tool_v2.6.4.rar
Size

49.9MB
MD5

b1a7540cd12701261738fd879efb2779
SHA1

1b3ad97b572045c61003de254d7833cab2391ee8
SHA256

69289808086eba703c638e42fa8f2adbe274b98ec0e3d005b62560e42a9200f0
SHA512

2a5ffac6840e56a2388f16cbbb737789482108fd77658467d55bcbcd49bcc3a13e942b073951cb3470f2cb42495e41b84404bedb2d4d8da33c9313e2fd944e44
SSDEEP

1572864:5HRk6MsvlqSOFhI63C6w1TMZmm+sIoE435lp4kJr2:BVnlxkr3URo+gN5Aks

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe

Executes dropped EXE 4 IoCs

pid	Process
548	librewolf-132.0.2-1-windows-x86_64-setup.exe
5184	vc_redist.x64.exe
5180	vc_redist.x64.exe
1068	VC_redist.x64.exe

Loads dropped DLL 4 IoCs

pid	Process
548	librewolf-132.0.2-1-windows-x86_64-setup.exe
548	librewolf-132.0.2-1-windows-x86_64-setup.exe
548	librewolf-132.0.2-1-windows-x86_64-setup.exe
5180	vc_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\librewolf-132.0.2-1-windows-x86_64-setup.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	librewolf-132.0.2-1-windows-x86_64-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\librewolf-132.0.2-1-windows-x86_64-setup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
548	librewolf-132.0.2-1-windows-x86_64-setup.exe
548	librewolf-132.0.2-1-windows-x86_64-setup.exe
548	librewolf-132.0.2-1-windows-x86_64-setup.exe
548	librewolf-132.0.2-1-windows-x86_64-setup.exe
548	librewolf-132.0.2-1-windows-x86_64-setup.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	3976	7zFM.exe
Token: 35	3976	7zFM.exe
Token: SeDebugPrivilege	4756	firefox.exe
Token: SeDebugPrivilege	4756	firefox.exe
Token: SeDebugPrivilege	4756	firefox.exe
Token: SeDebugPrivilege	4756	firefox.exe
Token: SeDebugPrivilege	4756	firefox.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3976	7zFM.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
4756	firefox.exe
548	librewolf-132.0.2-1-windows-x86_64-setup.exe
5184	vc_redist.x64.exe
5180	vc_redist.x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4756	940	firefox.exe	106
PID 940 wrote to memory of 4756	940	firefox.exe	106
PID 940 wrote to memory of 4756	940	firefox.exe	106
PID 940 wrote to memory of 4756	940	firefox.exe	106
PID 940 wrote to memory of 4756	940	firefox.exe	106
PID 940 wrote to memory of 4756	940	firefox.exe	106
PID 940 wrote to memory of 4756	940	firefox.exe	106
PID 940 wrote to memory of 4756	940	firefox.exe	106
PID 940 wrote to memory of 4756	940	firefox.exe	106
PID 940 wrote to memory of 4756	940	firefox.exe	106
PID 940 wrote to memory of 4756	940	firefox.exe	106
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 2616	4756	firefox.exe	107
PID 4756 wrote to memory of 4316	4756	firefox.exe	108
PID 4756 wrote to memory of 4316	4756	firefox.exe	108
PID 4756 wrote to memory of 4316	4756	firefox.exe	108
PID 4756 wrote to memory of 4316	4756	firefox.exe	108
PID 4756 wrote to memory of 4316	4756	firefox.exe	108
PID 4756 wrote to memory of 4316	4756	firefox.exe	108
PID 4756 wrote to memory of 4316	4756	firefox.exe	108
PID 4756 wrote to memory of 4316	4756	firefox.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.4.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1908 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bccc167-45bc-407e-a30e-a9daca14475b} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" gpu
    3⤵
    PID:2616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f70acf9f-8d31-4558-9384-fa3da507e8a3} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" socket
    3⤵
    PID:4316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2976 -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2964 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d4de724-9c8e-4194-ba8a-b9b68ba8de73} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" tab
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2752 -childID 2 -isForBrowser -prefsHandle 3740 -prefMapHandle 1252 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b1b0cff-f48e-4268-9cfe-ae4147cac0f2} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" tab
    3⤵
    PID:3040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4876 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4872 -prefMapHandle 4868 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46f3c515-8bba-4ea8-9d09-515b06103c53} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" utility
    3⤵
    - Checks processor information in registry
    PID:5356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 3 -isForBrowser -prefsHandle 5416 -prefMapHandle 5424 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7035414-a185-4113-9c52-73f5999fc12a} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" tab
    3⤵
    PID:5940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5520 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dacc4847-6523-4176-b745-1b644b640416} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" tab
    3⤵
    PID:5952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5852 -childID 5 -isForBrowser -prefsHandle 5756 -prefMapHandle 5844 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5af4c43-bceb-4a8b-baba-c2b6d232ba5e} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" tab
    3⤵
    PID:5972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6172 -childID 6 -isForBrowser -prefsHandle 6160 -prefMapHandle 6152 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a60a118-a301-4aee-ad0e-d30eb3cd5f5c} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" tab
    3⤵
    PID:1700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5968 -childID 7 -isForBrowser -prefsHandle 4832 -prefMapHandle 4592 -prefsLen 27919 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3682656-5c90-4a6a-a680-069a8cfc33df} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" tab
    3⤵
    PID:1000
- - C:\Users\Admin\Downloads\librewolf-132.0.2-1-windows-x86_64-setup.exe
    "C:\Users\Admin\Downloads\librewolf-132.0.2-1-windows-x86_64-setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:548
  - - C:\Users\Admin\AppData\Local\Temp\nsf8F66.tmp\vc_redist.x64.exe
      C:\Users\Admin\AppData\Local\Temp\nsf8F66.tmp\vc_redist.x64.exe /install /quiet /norestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5184
    - - C:\Windows\Temp\{789637F7-6919-4974-ADA7-26CC5F40FF04}\.cr\vc_redist.x64.exe
        
        "C:\Windows\Temp\{789637F7-6919-4974-ADA7-26CC5F40FF04}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsf8F66.tmp\vc_redist.x64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=680 /install /quiet /norestart
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5180
      - C:\Windows\Temp\{5292C9FB-836F-427E-A723-A306A11EABDE}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{5292C9FB-836F-427E-A723-A306A11EABDE}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{61F0408A-5817-4EF0-9DEB-F65C0AECE997} {76A9C6CA-4F01-4892-BEC2-0C3363F98F9B} 5180
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1068

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2992

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json.tmp

Filesize
19KB

MD5
6cc70104a0e66fa841f7a05ff5cb37df

SHA1
9a228ac8bf54d833e129a58afc99b62a64c2cf82

SHA256
33c737c1f4ec35a9463da5c4434058586e1f5e3042b08ea6fd776423c4deead2

SHA512
1de36f771af7d16d7d8c6aaadb957bfb7044179e86d67962337932992e90678c945372d2eac75ac51dc3e4394ad4237cb7a7f281642605ee96595c48ffbee7bf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\8FE29648FF5F63BAB33CDF49A7BE627C71FB6A7A

Filesize
61KB

MD5
ddd134652f37e7bd679ac406542739eb

SHA1
5e95bc565f631534b19e1647e0ce0df4fb1abcd8

SHA256
ad168d10274c3f88b231afc675629e8a357e46848f5681826248ee4168654479

SHA512
a69fe8a2046ff12e834fd8a9559bd69c1444c05aee98bc9a498867e29b436c4d0c19f0c43a550751945f35e43450b51e2bee6e6342de0b6990df6e1a54779972

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20241116144634_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
345f3da73914dcb5f691f830e526f663

SHA1
b9b8f118b5c16810d84e1cea67c9674348d01420

SHA256
942209c3a959fd7044aaa9c2590414f133b3ba7aced64ddff884b5b5a84e2b92

SHA512
b428f1dde00f85b933d607a484ebeb0256208a973380f5a7bd97c5ffd7b9bd6e86f7ad441d7722dcef58a9190d464f957b6f65970c0e6963eeefbcd9ed6491f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf8F66.tmp\System.dll

Filesize
22KB

MD5
b361682fa5e6a1906e754cfa08aa8d90

SHA1
c6701aee0c866565de1b7c1f81fd88da56b395d3

SHA256
b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

SHA512
2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf8F66.tmp\nsDialogs.dll

Filesize
19KB

MD5
2f2cd6e22e761b0d4e768b23bef637b2

SHA1
415ed80a3d4d2559bedfcb68d4d104b0d282618f

SHA256
55316f619c56fbb91ae0519e242ff4ae018d12ae03cba200d98533117a72ef3c

SHA512
18d7c0db90e551c1688ec2f53158929cfde43f8b8775e422ced39ddabd03dafca3e957305e7a2d3ad8e727591013c13273e1fd81f63a7b22590c4c72b02aceb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf8F66.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf8F66.tmp\vc_redist.x64.exe

Filesize
24.5MB

MD5
223a76cd5ab9e42a5c55731154b85627

SHA1
38b647d37b42378222856972a1e22fbd8cf4b404

SHA256
1821577409c35b2b9505ac833e246376cc68a8262972100444010b57226f0940

SHA512
20e2d7437367cb262ce45184eb4d809249fe654aa450d226e376d4057c00b58ecfd8834a8b5153eb148960ffc845bed1f0943d5ff9a6fc1355b1503138562d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

Filesize
6KB

MD5
62bd00e69f26208687a88925e008786c

SHA1
5cf0d2d7a8eb5bf5f284f0c8ef0092096b8ffa02

SHA256
cd9d0c947e3216dbea0c540c822ad39402fd85dd4ab481d3079080cedad17a8d

SHA512
e21e028792bd41f76aa0d4d7bb12ac3deca473d8e93a4cd6f3e19fbc6ea4a1a9bb29791750c5b28613b0131457bbffb002224caed1549a822394d3edd9089abd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

Filesize
6KB

MD5
7f8d802720e6b0b4dec409b8d6c73717

SHA1
218b85d498d20a134614a83d63b50251505a0576

SHA256
6940ac2885d6c154833a23aa25efde475b2acc6f63127ef73c3753bbcb1a74ea

SHA512
ed4a77b43579aeca33c6bafa656e3371a4c3bea4ada474617d9af89f10df00218484238920067c9bcf0c97f6efc99e718fccb81c6bf4150ca1f87e51a3167317

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

Filesize
12KB

MD5
ac6c46ea7c8433a6d292e8c43886fcb0

SHA1
7164c163b30b527a78d30baf684141c0463d9b4d

SHA256
9af4230565823ffdf74d7ed0a5427d49d3fe5de3f7c4bbdfb460f9eace83ae42

SHA512
aef382cba5eb43ac820f96f9ea78409832d0498e65f00934edfe3a0a2725bc62c9b4c3d0fdcc0127e82b1ccef9ecf1f3b1a5fb19f663fd094a827898ecff9060

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
8c1af5719a4cd93ea501de46fcdf8ceb

SHA1
523f5f7b228c8020894224900a3e8d7f2da72d40

SHA256
cb0d952f8db606e1392fdff3a10e9e8a1f7929c0364851aedd10980bcb570552

SHA512
745bb63c0307b572e27ae1365a91e9ff5afe428fd049ef21e83af959efa0a76d7202414ce8d19b5f3cc1b61f877e4a03ec0287f4db2ef1e0781aae681bdf2af8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ae4af07af127f172d020fca80801bef7

SHA1
6f12147976257347ac2f153623284b55c06293be

SHA256
d7e3d273eca6dd9cbdc8253e47d30172049b006dd4cb6d7d9ff518a37fa7b239

SHA512
1f952c4d30110cbb9998b5c01aebfe593aeea35a482b18cb5a0402c3e35dd14a9ff3d37d5a9415487314d27e93117879c9ecf87cae2c337a9cb439b686ba7cfb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\21d1f18b-9d2e-454a-93ce-34efcb5fa2e3

Filesize
982B

MD5
96c9dcb281a2409f6d94b670568122d5

SHA1
603442a4edbc5d79325409968fb6787efa300408

SHA256
73e67bd3571570270b52dbe94c4e0a3da3624c785264c846aab344d32cf64566

SHA512
b32c724616d8523e820c6573c34456a9f52eb36ee57f38374160ebeec6efdb9c19a36f4b8cc7b159e7f45f0b5d33a4f506641993d19a4071cb356b183d1f9ae3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\4ce85813-7cf7-4fb4-aef9-d6009649213c

Filesize
26KB

MD5
d71bfb64dee89869f5dfae2d0861abda

SHA1
540c1b3faa6e91f2cdbab92d7844f9b9473f82fb

SHA256
f7537f160dc32424390847d5282277123ba75b9e8586ff8a455ee0db251ffc44

SHA512
7f455383bf5cd5f922ef270d01b15bf24da495c21210063d8b04adc21eaf2e861fd8cb30076abf4de6c2cbc8e679d01e1fe589ae75753d6d98f8f20756ec1e71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\88df8313-37c1-4beb-b1b3-00d86ac19675

Filesize
671B

MD5
97951e72808fd92ac0f365b9de8d6962

SHA1
c62a5d7e2334fb61dfe7d0962c67f125244bbc5f

SHA256
c5defe41a7e70d8024a8c82432159f670a1c9b5268174e836333a2c8f33ce24d

SHA512
3db798fe0ba69739569a373093b5a1c6a535009e5afde86270f12c0264b70e91680c89ea8ab4b62d73ebac668dba08356417d439a6feedb9e7fecbb3da44dd87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

Filesize
11KB

MD5
357e37d3e022bc5168aa5609bb73778c

SHA1
d51c046e75659d1720c5bfe42d8bbc9fcffefbca

SHA256
89f318831170dc6eea86593e2e2254a4eb26e1cab493e244e84f5a86363a0c47

SHA512
83bc9764b801145d2c78d11e318087d35960104bfd1ae723b550bc669b56ce572c16db76c4688dbd679d6895af5e3d232a5a0979c7e8d63e6690d9fd5cca18d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

Filesize
11KB

MD5
9133247a98c6b2adc128873490e2aad7

SHA1
8efc280a447083fb781566b44a0cbfaba3cd32ed

SHA256
a8dc23e4d714cc3e118dd76f9a113250f5e58e9d0274f8bf08a6cc282188714d

SHA512
51c1db481b3b87061ee6416052fefc4c5d044c22060f0b116011ebff38e6b897e2fb83af40e9bcde4074a172169ded6f9b35ee5668dbdc4fc2f38fcd8da9719f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js

Filesize
10KB

MD5
b9bdcb2904868fe5bba536decd043fd6

SHA1
f494575a1504eab5811def3ba1946b3de27159fd

SHA256
5124f60916eb71b61dd5feea4e3fb3d649637e7a18ed63688245ba9ed0d5dc9c

SHA512
1c89f5d51da58d718dab6113dc3ee49c155321cfd778e84e34015c6b820bbc8edb594d5f4148f9a12911e329dcc3a5f4f723c18e86408b4c14c2673c95a302dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
316486dfc63c44302ba2b5d2ab532f70

SHA1
f8663ad4122236f2c413f12e61cdae4839b0f4f4

SHA256
0a4a6e8ac45bb3eac480479e1b8db4ac65535d95047c4bac7139b9235657d7ed

SHA512
d34948b137920d06835b94f54f38837cc9281f09f52ffeec1e2e50252c06514bbf0c20ad062578535ccf8dc0d2a5319de6c614446317519a8e6a27f1e8a9d38f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
8aeae5386716ddf9667c43e039f4983d

SHA1
97258476c05b875673a8af40b814de95bceaf5de

SHA256
12b7dd7ac74dcee7a63781df111bee691dc9b11d9a16196b77dd1e5e0d70b5e6

SHA512
6c8d319955ce75fe68450f557f75034c5be183d1696f25f2fca99ea161511cc5fe452a4167524f4bc53b8ef13ff67b16a127b151e55b76ab846600704c67e5a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
d5d522e2247ebfcfb669dcd238b7acf4

SHA1
b7469e7bc87d7710611c65f11052dfcc5c8ee072

SHA256
69131e2dc0f1ce5c382e3fef5f067bc537b514f66fd748a55a5e1ecf74dd784a

SHA512
7f6ca8568449ffca53fc07ba7e15b25adf21a87bcb3f75b0b62a29c71c745121ba96965850a2295e3d2b83438453b881d9c474096102fdccda599baddfa64501

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
299724a237db9108a6842a950fc614e5

SHA1
38662a31b4a06f37e012c3de10429217cdb4cc8b

SHA256
968bcbd4c64ab0a3992c0443393cc7be0cef961a81be121f570f83a1e59417bd

SHA512
de35b00efdde20b369a03eb580fc9bb9f2231515d4daf154fac3703d82f96ec2c99035db346d20fc16705313944b35da2f333d2a80b17ef6a13716e1ac994098

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
898d639dcc7ca10c43c1b1ede08b3355

SHA1
0b362fbbf04b48bbdd7db426a859a04995eaf3a0

SHA256
519692e9204ea576f2b5fce1fed909da69f2d828eb4f9b002ccefa39594e8649

SHA512
f46eb0e88d8ef7b4c59d816ead634df2214dec58be194605bfa121cba47b49b4e2c5351ef7d98f45d7df7ecd0c56f8be73a6c6915ff844b9879099140e6c6858

Download Submit
C:\Windows\Temp\{5292C9FB-836F-427E-A723-A306A11EABDE}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{5292C9FB-836F-427E-A723-A306A11EABDE}\.ba\wixstdba.dll

Filesize
215KB

MD5
f68f43f809840328f4e993a54b0d5e62

SHA1
01da48ce6c81df4835b4c2eca7e1d447be893d39

SHA256
e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

SHA512
a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

Download Submit
C:\Windows\Temp\{5292C9FB-836F-427E-A723-A306A11EABDE}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
5866203168b27f18c1b47abfa6823e02

SHA1
3b696be0a4cf750965d74263e43b8e302cb1b318

SHA256
7d48e0905ebea9b14a07cff687705dfdc50d795cd4c32e5ed87a0e344884b430

SHA512
037f793f60be84f1da005d47e21783e719a85b5c12c4d20050ad9d3254ac99ba8eb30b4b1378bac69379dbc659427dc1ae4a19062ecd337d47d480d047afb669

Download Submit
C:\Windows\Temp\{5292C9FB-836F-427E-A723-A306A11EABDE}\cab5046A8AB272BF37297BB7928664C9503

Filesize
969KB

MD5
8c302e40fbf614896ba36a75f3f8977e

SHA1
991af1495f7783173d0c5691be38ff8648f2df12

SHA256
b384b812dc59c2081cee080ea6bba748e02ecf3c0800d8dcaf9607a20a4f3290

SHA512
53b1d7d8ab495931f50b5d815afe04d52f9e0bbafa0a5f3e4f6605b6e4f2a85c583abf9014dec41481439827bb6bab23ac439d4fd7d0c3f191f21b2bf5afb11d

Download Submit
C:\Windows\Temp\{5292C9FB-836F-427E-A723-A306A11EABDE}\vcRuntimeAdditional_x64

Filesize
208KB

MD5
351d8e8c804f6c6aab4c718977b1817d

SHA1
1b680e5e2ed548e5636f9d656c49c87cf9a70da8

SHA256
cf584e5132ef3766a088f824bd038494713a7168cdddd44e3f8c4ad581e2206e

SHA512
d0613c6b1a72c73013c0519619c557811a1d20fcddc8361d391a31fc4aa9c70173b907957babb049067111427a81e48a82e5467a15dae8bebb55b048993c93a4

Download Submit
C:\Windows\Temp\{5292C9FB-836F-427E-A723-A306A11EABDE}\vcRuntimeMinimum_x64

Filesize
208KB

MD5
09042ba0af85f4873a68326ab0e704af

SHA1
f08c8f9cb63f89a88f5915e6a889b170ce98f515

SHA256
47cceb26dd7b78f0d3d09fddc419290907fe818979884b2192c834034180e83b

SHA512
1c9552a8bf478f9edde8ed67a8f40584a757c66aaf297609b4f577283469287992c1f84ebe15df4df05b0135e4d67c958a912738f4814440f6fd77804a2cfa7d

Download Submit
C:\Windows\Temp\{789637F7-6919-4974-ADA7-26CC5F40FF04}\.cr\vc_redist.x64.exe

Filesize
670KB

MD5
3f32f1a9bd60ae065b89c2223676592e

SHA1
9d386d394db87f1ee41252cac863c80f1c8d6b8b

SHA256
270fa05033b8b9455bd0d38924b1f1f3e4d3e32565da263209d1f9698effbc05

SHA512
bddfeab33a03b0f37cff9008815e2900cc96bddaf763007e5f7fdffd80e56719b81341029431bd9d25c8e74123c1d9cda0f2aefafdc4937095d595093db823df

Download Submit