951b282d2939d566ecb3e2bce4f5a4da8eeaca02644fb0f0455fb36a4bc5fd1b

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FireFoxUpdate.msi
Size 84.8MB
Sample260626-et1c2agy4s
SHA256 951b282d2939d566ecb3e2bce4f5a4da8eeaca02644fb0f0455fb36a4bc5fd1b
MD5 b76185d732da0a95180321aa4c045c1c
SHA1 b8be48b8dd8d50d090e1ee98dd54c72e7561aa36
SHA512 8658a278e67482d0bb483c3e4af1d0ae24b663679fabc68c3168d37d24473555a18ee1855da943e988d8330d9807ded70043909132ab9a26f8c7b86d1709aeb9
SSDEEP 1572864:rnM3tX0o7p8XHchC7SJgm6DNRvuFrV5uFTknl8k03u+lEbi2PzOKQ7Dt30y4vOKb:LCX0g8XMCOyNYhoql8kl+Wi2KKyWr7tV
TLSH
T1E4183302A94E8D7BCF13733FC52B1B1848EB2E4BD435E1973661B64855B083936AFDA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan upx

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
5040	MSIA3BE.tmp
6856	setup.exe
5432	maintenanceservice_installer.exe
6360	maintenanceservice_tmp.exe
2796	default-browser-agent.exe
7020	firefox.exe
6956	firefox.exe
3152	crashhelper.exe
3792	firefox.exe
4168	firefox.exe
6824	crashhelper.exe

Loads dropped DLL 64 IoCs

pid	Process
6856	setup.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
3696	regsvr32.exe
3696	regsvr32.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
5432	maintenanceservice_installer.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
6856	setup.exe
2796	default-browser-agent.exe
2796	default-browser-agent.exe
2796	default-browser-agent.exe
7020	firefox.exe
7020	firefox.exe
7020	firefox.exe
7020	firefox.exe
6956	firefox.exe
6956	firefox.exe
6956	firefox.exe
6956	firefox.exe
6956	firefox.exe
6956	firefox.exe
6956	firefox.exe
6956	firefox.exe
6956	firefox.exe
6956	firefox.exe
6956	firefox.exe
6956	firefox.exe
6956	firefox.exe
3152	crashhelper.exe
3152	crashhelper.exe
3152	crashhelper.exe
3152	crashhelper.exe
3792	firefox.exe
3792	firefox.exe
3792	firefox.exe
3792	firefox.exe
3792	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3888	msiexec.exe
3	3888	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_02F238D737DDE39558F0B4A5EF423834	setup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Crash Reports\crash_helper_server.log	crashhelper.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_02F238D737DDE39558F0B4A5EF423834	setup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Crash Reports\crash_helper_server.log	crashhelper.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	setup.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5040-31-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/5040-339-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\xul.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe.sig	setup.exe
File created	C:\Program Files\Mozilla Firefox\libGLESv2.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf	setup.exe
File created	C:\Program Files\Mozilla Firefox\Microsoft.UI.Input.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\mozinference.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\nss3.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\libGLESv2.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\uninstall.log	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\update-settings.ini	setup.exe
File created	C:\Program Files\Mozilla Firefox\installation_dir_layout\versioned\InstallationDirLayout.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini	setup.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\gkcodecs.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\osclientcerts.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\msvcp140.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\	setup.exe
File created	C:\Program Files\Mozilla Firefox\lgpllibs.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\Microsoft.UI.Windowing.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\removed-files	setup.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\notificationserver.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\	setup.exe
File created	C:\Program Files\Mozilla Firefox\Microsoft.UI.Windowing.Core.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140_atomic_wait.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\libEGL.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\	setup.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\lgpllibs.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png	setup.exe
File created	C:\Program Files\Mozilla Firefox\InstallationDirLayout.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\mozavutil.dll	setup.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nssckbi.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\mozavcodec.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	maintenanceservice_installer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\platform.ini	setup.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIA207.tmp	msiexec.exe
File created	C:\Windows\Installer\e589798.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1BE94E447A9481AE.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1294A4C5-9977-480F-9497-C0EA1E630130}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3BE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFB660E91EA883777.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD1E299EA8991CAA1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e589798.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8236B02FEBEAADB2.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3888	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIA3BE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenanceservice_installer.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000060e6f1f3fc64ed070000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380160e6f1f30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410160e6f1f3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e360e6f1f300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e660e6f1f300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	maintenanceservice_installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\PreXULSkeletonUISettings\C:\Program Files\Mozilla Firefox\firefox.exe\|Progress = "1"	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\DllPrefetchExperiment\C:\Program Files\Mozilla Firefox\firefox.exe = "0"	firefox.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec\	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Launcher\C:\Program Files\Mozilla Firefox\firefox.exe\|Browser = "54928038167"	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Colors	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Classes\FirefoxPDF-308046B0AF4A39CB\EditFlags = "2"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\command	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings	firefox.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Launcher\C:\Program Files\Mozilla Firefox\firefox.exe\|Blocklist = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\blocklist-AC3F455D0E724E7A"	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Colors	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Mozilla\Firefox\Launcher	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	firefox.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Launcher\C:\Program Files\Mozilla Firefox\firefox.exe\|Launcher = "54690646564"	firefox.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\FirefoxPDF-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,5"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\FirefoxPDF-308046B0AF4A39CB	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	maintenanceservice_installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\command	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "2"	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	maintenanceservice_installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Launcher\C:\Program Files\Mozilla Firefox\firefox.exe\|Image = "1782344377"	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\PreXULSkeletonUISettings\C:\Program Files\Mozilla Firefox\firefox.exe\|Progress = "1"	firefox.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Launcher\C:\Program Files\Mozilla Firefox\firefox.exe\|Telemetry = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Default Browser Agent\C:\Program Files\Mozilla Firefox\|Installed = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Installer\308046B0AF4A39CB\DidRegisterDefaultBrowserAgent = "1"	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\PreXULSkeletonUISettings\C:\Program Files\Mozilla Firefox\firefox.exe\|Progress = "0"	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Launcher\C:\Program Files\Mozilla Firefox\firefox.exe\|Telemetry = "1"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Mozilla\Firefox\Launcher	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Launcher	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Mozilla	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Installer\308046B0AF4A39CB	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Installer	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Mozilla\Firefox\Default Browser Agent	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Mozilla\Firefox\Launcher	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{30FFD3E5-7CF7-49E4-BFC4-DFA8F5AFED8A}\DllSurrogate	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\open\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec\	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{30FFD3E5-7CF7-49E4-BFC4-DFA8F5AFED8A}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\FriendlyTypeName = "Firefox HTML Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\ = "open"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\firefox.exe\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\FIREFOXPDF-308046B0AF4A39CB\SHELL\OPEN\DDEEXEC	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{30FFD3E5-7CF7-49E4-BFC4-DFA8F5AFED8A}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\FIREFOXURL-308046B0AF4A39CB\SHELL\OPEN\DDEEXEC	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ = "C:\\Program Files\\Mozilla Firefox\\AccessibleMarshal.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,5"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\ = "open"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "ISimpleDOMNode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\FirefoxToast-308046B0AF4A39CB\CustomActivator = "{30FFD3E5-7CF7-49E4-BFC4-DFA8F5AFED8A}"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\firefox.exe\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ = "ISimpleDOMText"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\FriendlyTypeName = "Firefox PDF Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\command	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppUserModelId\FirefoxToast-308046B0AF4A39CB	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\FIREFOXHTML-308046B0AF4A39CB\SHELL\OPEN\DDEEXEC	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\ddeexec\	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{30FFD3E5-7CF7-49E4-BFC4-DFA8F5AFED8A}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{30FFD3E5-7CF7-49E4-BFC4-DFA8F5AFED8A}\InProcServer32\ = "C:\\Program Files\\Mozilla Firefox\\notificationserver.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods\ = "9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods\ = "8"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\ = "Firefox HTML Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\ = "Firefox PDF Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\ = "open"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\URL Protocol	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods\ = "18"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\open\ddeexec\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\FirefoxToast-308046B0AF4A39CB\DisplayName = "Mozilla Firefox"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\FirefoxToast-308046B0AF4A39CB\IconUri = "C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_70.png"	setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5840	msiexec.exe
5840	msiexec.exe
6360	maintenanceservice_tmp.exe
6360	maintenanceservice_tmp.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3888	msiexec.exe
Token: SeSecurityPrivilege	5840	msiexec.exe
Token: SeCreateTokenPrivilege	3888	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3888	msiexec.exe
Token: SeLockMemoryPrivilege	3888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3888	msiexec.exe
Token: SeMachineAccountPrivilege	3888	msiexec.exe
Token: SeTcbPrivilege	3888	msiexec.exe
Token: SeSecurityPrivilege	3888	msiexec.exe
Token: SeTakeOwnershipPrivilege	3888	msiexec.exe
Token: SeLoadDriverPrivilege	3888	msiexec.exe
Token: SeSystemProfilePrivilege	3888	msiexec.exe
Token: SeSystemtimePrivilege	3888	msiexec.exe
Token: SeProfSingleProcessPrivilege	3888	msiexec.exe
Token: SeIncBasePriorityPrivilege	3888	msiexec.exe
Token: SeCreatePagefilePrivilege	3888	msiexec.exe
Token: SeCreatePermanentPrivilege	3888	msiexec.exe
Token: SeBackupPrivilege	3888	msiexec.exe
Token: SeRestorePrivilege	3888	msiexec.exe
Token: SeShutdownPrivilege	3888	msiexec.exe
Token: SeDebugPrivilege	3888	msiexec.exe
Token: SeAuditPrivilege	3888	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3888	msiexec.exe
Token: SeChangeNotifyPrivilege	3888	msiexec.exe
Token: SeRemoteShutdownPrivilege	3888	msiexec.exe
Token: SeUndockPrivilege	3888	msiexec.exe
Token: SeSyncAgentPrivilege	3888	msiexec.exe
Token: SeEnableDelegationPrivilege	3888	msiexec.exe
Token: SeManageVolumePrivilege	3888	msiexec.exe
Token: SeImpersonatePrivilege	3888	msiexec.exe
Token: SeCreateGlobalPrivilege	3888	msiexec.exe
Token: SeBackupPrivilege	5568	vssvc.exe
Token: SeRestorePrivilege	5568	vssvc.exe
Token: SeAuditPrivilege	5568	vssvc.exe
Token: SeBackupPrivilege	5840	msiexec.exe
Token: SeRestorePrivilege	5840	msiexec.exe
Token: SeRestorePrivilege	5840	msiexec.exe
Token: SeTakeOwnershipPrivilege	5840	msiexec.exe
Token: SeRestorePrivilege	5840	msiexec.exe
Token: SeTakeOwnershipPrivilege	5840	msiexec.exe
Token: SeRestorePrivilege	5840	msiexec.exe
Token: SeTakeOwnershipPrivilege	5840	msiexec.exe
Token: SeBackupPrivilege	4808	srtasks.exe
Token: SeRestorePrivilege	4808	srtasks.exe
Token: SeSecurityPrivilege	4808	srtasks.exe
Token: SeTakeOwnershipPrivilege	4808	srtasks.exe
Token: SeBackupPrivilege	4808	srtasks.exe
Token: SeRestorePrivilege	4808	srtasks.exe
Token: SeSecurityPrivilege	4808	srtasks.exe
Token: SeTakeOwnershipPrivilege	4808	srtasks.exe
Token: SeRestorePrivilege	5840	msiexec.exe
Token: SeTakeOwnershipPrivilege	5840	msiexec.exe
Token: SeRestorePrivilege	5840	msiexec.exe
Token: SeTakeOwnershipPrivilege	5840	msiexec.exe
Token: SeRestorePrivilege	5840	msiexec.exe
Token: SeTakeOwnershipPrivilege	5840	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3888	msiexec.exe
3888	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3888	msiexec.exe
5840	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 4808	5840	msiexec.exe	96
PID 5840 wrote to memory of 5040	5840	msiexec.exe	98
PID 5040 wrote to memory of 6856	5040	MSIA3BE.tmp	99
PID 6856 wrote to memory of 3696	6856	setup.exe	101
PID 6856 wrote to memory of 5432	6856	setup.exe	102
PID 5432 wrote to memory of 6360	5432	maintenanceservice_installer.exe	103
PID 6856 wrote to memory of 2796	6856	setup.exe	104
PID 2796 wrote to memory of 7020	2796	default-browser-agent.exe	105
PID 7020 wrote to memory of 6956	7020	firefox.exe	106
PID 7020 wrote to memory of 6956	7020	firefox.exe	106
PID 6956 wrote to memory of 3152	6956	firefox.exe	108
PID 6856 wrote to memory of 3792	6856	setup.exe	109
PID 3792 wrote to memory of 4168	3792	firefox.exe	110
PID 3792 wrote to memory of 4168	3792	firefox.exe	110
PID 4168 wrote to memory of 6824	4168	firefox.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FireFoxUpdate.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3888

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\Installer\MSIA3BE.tmp
  "C:\Windows\Installer\MSIA3BE.tmp" /S /TaskbarShortcut=true /DesktopShortcut=true /StartMenuShortcut=true /PrivateBrowsingShortcut=true /MaintenanceService=true /RemoveDistributionDir=true /PreventRebootRequired=false /OptionalExtensions=true /RegisterDefaultAgent=true /LaunchedFromMSI
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\setup.exe
    .\setup.exe /S /TaskbarShortcut=true /DesktopShortcut=true /StartMenuShortcut=true /PrivateBrowsingShortcut=true /MaintenanceService=true /RemoveDistributionDir=true /PreventRebootRequired=false /OptionalExtensions=true /RegisterDefaultAgent=true /LaunchedFromMSI
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:6856
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:3696
  - - C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
      "C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:5432
    - - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:6360
  - - C:\Program Files\Mozilla Firefox\default-browser-agent.exe
      "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:7020
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:6956
        
        C:\Program Files\Mozilla Firefox\crashhelper.exe
        
        "C:\Program Files\Mozilla Firefox\crashhelper.exe" "6956" "\\.\pipe\gecko-crash-server-pipe.6956" "C:\Users\Admin\AppData\Local\Temp\\" "784" "796" "832"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:3152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:3792
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4168
      - C:\Program Files\Mozilla Firefox\crashhelper.exe
        
        "C:\Program Files\Mozilla Firefox\crashhelper.exe" "4168" "\\.\pipe\gecko-crash-server-pipe.4168" "C:\Users\Admin\AppData\Local\Temp\\" "780" "792" "840"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e589799.rbs

Path C:\Config.Msi\e589799.rbs
Size 919B
SHA256 0d52b4d16e4224000fe4d685bc8c9240eb2689b1ec7eac1ab0a2a8196f31ba06
MD5 b15b1894722b6dea6c644a6b1567f2ca
SHA1 842e504d2104ed213c375eb8c4626601ea62f8b1
SHA512 c726994cd1a92d60df87a65f598f00e2530042617e7e20ab880f2622c07f265c0a1d0ddbde61c379af42a8235935e55c70392997a98ea1363f1e7483eb792b04
TLSH
T1D811E343BB1844D3FC81D67047034BE19FEF86B64A4943850C4D05682D113905FB91CC
MD5 SHA1 SHA512 TLSH

Submit Download

shortcuts_log.ini

Path C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini
Size 222B
SHA256 79d1631316cd79bc5127f745aa6707b4445f7d0432b685ef2c3ec3cf3a62ecba
MD5 4b8dc92a079f224935392f9b5a2dc051
SHA1 1027fc1b3e2e8ae78c60bfb25c5c9f87f9b3cae2
SHA512 ad0186cfc9df574e4a3c7c209b5dc3078fb86f6b1de0008bdede6768ec08d61b20f371d7b2d01dc50aa7d094b150db816358f03fa0d9135ce26d80d8886a1704
TLSH
T1D5D0C9320BF30208EE979691DDE8103EEB733559748ECA0CF087361E06F24408C97AA3
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
Size 970B
SHA256 5062f577bb09cd0197ec950720f6991f10717d2b1b107d714db4862d10349597
MD5 37b79a930c2bf401ed04c61b970df5ba
SHA1 bf2b596d9d257bc476b17254b3a2fccc435ee61d
SHA512 eed350626812612a58e74f17f6e2ebf7796547fdad2250e8a681e6e0deed0d823c71b8818def80638117d81890b11f1c555d5289c1ebebbf0fa9acb54b9e994c
TLSH
T131114E010FFB9A46F6F381323B311766A373FE01966A270AC58A66444D3B234969DF93
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
Size 1KB
SHA256 2eaf503a7c88b36f62a08b784e8951e0249e5593b933664d1bafd0d8d6d6d100
MD5 42c6cdd5c8f8eaf354233bb02df459d6
SHA1 718880f475cf06f124597a53bf3987e46c956eb5
SHA512 bc4eaf2ac0cdd5177044faddfcffa2c5a28821b49c438264571477156046e689de7ac69abc7ccdd06e77ca56da7632d4b855102d1e376936588b0d140b87fcda
TLSH
T1E911C0000FFB9A56F6F380323B7112636333FD01A269271AC04A67844D3B134969DF63
MD5 SHA1 SHA512 TLSH

Submit Download

~риватный просмотр Firefox.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\~риватный просмотр Firefox.tmp
Size 2KB
SHA256 a835f736ed2c2dfc0d9f5e1c9bd7139e91608a0920a61c118bdc05c94e08c9e1
MD5 c5d5030d17be7a188187ab42bc8d65d7
SHA1 a81c75a1ed00e719fa241afd56ec5456612ca203
SHA512 dbe6da8fe7a08a8e30f573c94456c36b42fb916e2837a46b632396e7dc9e831d42264073061d40dda6f3ea3a92098458a127006237f2d25c3e8005d05e8094d9
TLSH
T1C541DC111BFA5668F1F395326B3277635333FC42A629935E814D96844D3B030D6ADFA3
MD5 SHA1 SHA512 TLSH

Submit Download

Приватный просмотр Firefox.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Приватный просмотр Firefox.lnk
Size 1KB
SHA256 dbea8301ceca5ea5e68fa2441f6e40c6c0e37c7246803fd5797f3bf92986414f
MD5 bbc40e650cc087acfa2eaf18ee53478d
SHA1 92eaaa046e7084df688af3fde40745b443d61816
SHA512 0083e9ad8224830fc84e81c67ec4fefc444a259be4fbbe7304559f719c757d9d72ab374bfc06679fd42db8793345cf8fccbcb4340f599dd417f9c6074a4b0965
TLSH
T17241DD110BF64658F2F396326B3267629337FC01A729534E818D96854D37034D6ACF93
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_7AA1872B10F7F2428A1288E96F0B99FA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_7AA1872B10F7F2428A1288E96F0B99FA
Size 471B
SHA256 88dd113170a7e403b99e6c7819a3a3bec9acfc6bee61eded9d6970449782ebfc
MD5 27cc71362a1433f590ad635c2e79e5d0
SHA1 7fd6689c577b5ef35d82d4e44bc8e21b2c6799fe
SHA512 3930ca7ef192e38eaf0248351f09ba0b84b46c1f5b296c23ce0f03c22fead6f9d32b78c91026e12613f2d1faa2530fc2e6a38a5474147363d25e7fd9a147d62f
TLSH
T107F0DCB218B9E802F665604E51CB1D1970F5548D54C78B3D3C1A34D4E2E2FE9138F82A
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 43b230edeb0078e6f97dfeb593e9fd44daf6d13f94053c923050a8dcc7a3ea6f
MD5 59aebe45dfcd3309ac6f7e718247b423
SHA1 a7ea32b209731d07db552449d8fdf51be8e5678e
SHA512 bf41daf2df84a0bf16c8b0ac288b3bc4575c55123b3c0c6434fe0a26b74c2014fc271e785e466d323f967cc7ce3c75860f3e216f213e3c772d470724cd504497
TLSH
T10DF0DCA368FA20D2B41698FC49F9093820B05BCF08D60267383E46928DAB16C624E025
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_B6AE23E29F7147068BFE703694A1EF14

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B6AE23E29F7147068BFE703694A1EF14
Size 727B
SHA256 8ea9476ba70607acfeb32ae756d209050f1cf5bccadd25c80ac8fbca1fabb255
MD5 995eeef2cee69b035421db63ef0f17e1
SHA1 0f9b2f25611a061380b6fc4afaff8ded71f335ad
SHA512 5d022752e06b43e28bd5c90ecd905598581f34e75107a7566fc371e9bc7ebe4a69a2bf2bca5d5151d56c78a5db2020ec630490b557257f0fe998acf301c445f3
TLSH
T1BF011546E7A8A6004A020E1CEF689ED476D5551C398D5ECD6B3A7864D508F01AB99391
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 9896be4f1e4a2de16d0e12b194b2faf9dc4b2185ba74d32b44a7a876e70a78be
MD5 89cdfa636b0e37a914718dd397178ea9
SHA1 191bb3271a0369ec085534e11f8f549033035561
SHA512 43f28a4e36661609b67155aaa38441e2badec64266d6f3ca6faf0c488c3e9fa22f86ba08ca6fd43550eb1b6ff8cf538b17ca1fb64a100813162a0b90439bb93f
TLSH
T14801497356F85580FC316C42EBFE83E1BD5DA2582E9441B82525054650FCF509D52B55
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_7AA1872B10F7F2428A1288E96F0B99FA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_7AA1872B10F7F2428A1288E96F0B99FA
Size 400B
SHA256 9b78dd7bfbdf54fadd2417cf21dd2680b30364b1568aa61993529e651f15942c
MD5 e99ab71369c26a216d8a0479647f83ae
SHA1 86c66d907e75497a0084de74323fc3ef8a0bcc3a
SHA512 14a9cc414e26f37b2dcbc55198b705945653780d1ae3d2cecea8ae83ff51f0c0f5cfb6f857aaa743afd690a2396af2f3569ef16003e8a9fb42205f9f774cf27a
TLSH
T155E0201416FB521EF1749A7487D9D1575F36F0171D40976D1E91964E6D16D00CCB3830
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 e0b92fdfde5d3e823288d34208dd20d58b67122142f76eaf7b734a3a0477953e
MD5 7ace4e5d4845ff6d3a9ab7e0da329eb4
SHA1 504ff9f390a572c313c7b83595b02e1dcb383f15
SHA512 fe6c8b726df923d7363a8aa09cd6d021f08683aeae2b92871855a77ea85feb4446ec66dbeab69e3faed9688f0c8e2ad8133b53f20680e7ede4747a5e843a3749
TLSH
T1E5E0202017FE501EF2B05BB903D9D0956F39F1176D4996BE1EC1182D590AA004C52C31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_B6AE23E29F7147068BFE703694A1EF14

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B6AE23E29F7147068BFE703694A1EF14
Size 408B
SHA256 c4460687a2535aabaab5b77180c173dc8d7b3ab427c6cb137c44d86fb0164f3a
MD5 7fbf27b6ebf0b908ad83ef87b0fcfc8a
SHA1 18c9b0ce3f93297fa1856882ce278a4cdb3965bc
SHA512 579fbe9068e81f84744c05abb1102911bb4ce408fffe463e73fd65b18aebd512654fab3692b596810d2a186622add692c9ee86781f5a0f04ef5ff55ee2a8f80f
TLSH
T1C2E0203461F645ADF1F0D03443E999210F79F6060542D2B92584971DAF25B001CE7978
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 2509305da64aa43806a8fb0f0ff9bc6f7d0ba7d076cb952b412ba80141c994aa
MD5 198738e6681343ac77cf86620ba70ad8
SHA1 bc0c43f8b5e45c59bab07e2d340315b0baf278cb
SHA512 925e9318542132edd455d9e1465518bf809b000a65e0fd4e3178374c282b722179e84882bae469296013c63222719f668805eb134f1429cbdb5e7683357c6ee3
TLSH
T134E0682811AB701EF050983186E9A1711DD8E2111844C7781EC00318FB4AF405D10AB4
MD5 SHA1 SHA512 TLSH

Submit Download

AccessibleMarshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\AccessibleMarshal.dll
Size 31KB
SHA256 9b0da2fdeddbda2e7f265e3e7bc1ca283947f7c8d2b9a0cd2f1462ed913dad6e
MD5 136751c9d9c5b03911c7f87ccdc8f3b9
SHA1 dccad7384ea6d7d1618aa8bda632b2b6c53c4d17
SHA512 f12db805a6cc08bf64501456310be3326ad41ade799624805876df589191aeb952c64b94222d4b2536b869d29a2e9373386c789624a6115889eb7cd1c7646b17
SSDEEP 384:fu3xlr7aZFnvlf59dGeUMc25pYw2UtLIYiOkxPNyAmL4/y8RxIDFUCVe:IfaZtvbDGeq2Ew8YieLk54c
TLSH
T1B9E20942FA808815D81E8534989B8EA99B71FE055FD183D733A8732D0F723C17B756E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreMessagingXP.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\CoreMessagingXP.dll
Size 1018KB
SHA256 b3841c8a46b5a99e6ade2c55131aee51c11822ed5a25d0f8df3a4c9ea17e110b
MD5 e4b4016f5de5eaf518247c33ee006465
SHA1 cbdf1d346b4ee19462de1b6a93052fa3181ec80e
SHA512 49240c3177b0ba455d346c26e4e33d73bfea91394961c8a3281f8af06ece70db6b0683dd4f1dbf1e02e9a8a3192f3e427865e1f3602cdff2de8bcdd26eb2fad6
SSDEEP 12288:XK/YDbkEM085HReWuoG+nQlb8ssXEBwDEHWqgN97TLA:XwYD4EW5OoG+tslbE1L
TLSH
T1ED252B6B6FE88497D06AC27F85BB8A4AF2F1B852173147CF0451422D3F27BE49A79310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\InstallationDirLayout.dll
Size 21KB
SHA256 22c854b7a0f4ad85cd06ea8022ea28c63942f21d7117b85f4321834a7b342561
MD5 a72199330b5d819ef5e4cbc274af3c03
SHA1 947d29cd0fbdea4bb35ca44209901c3c62dc1a71
SHA512 2bc4f993c9f75e9c7e72731d56b7208989c7eb94d24ea49d3a0cd8b9c699bd68cb0996c1d080d0717cec7060179b0038596986353fe0975801ead6fb18522c98
SSDEEP 384:q9mbN3dCFn2deOkBSN2UtLIYiOkxPNyAmL4/y8RxIrhFxr8T:YWotHBSN8YieLk5iL8T
TLSH
T134A25D97CAA45C45EC174A70F8E04A26B672FA901FD0C2D72369C1544FA23C67BBD3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.InputStateManager.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\Microsoft.InputStateManager.dll
Size 438KB
SHA256 3b85e82f65486b9616450c092e71f568d073c12a9d220766f1f0f821f0d49f9e
MD5 7d39925d0782738de1968a51e6b33db5
SHA1 0a0d174410db49448b569788d609bb5cd76f15be
SHA512 e2d59f5d6c1b0885d7a0241725da0b549424f7bd76d461bc895d2fe3d7b24a307f235376e75b2cb4c1a88426618feefd34b00f771625976435fefbff95dc6405
SSDEEP 6144:N7ehrYmAQMd5vii7N+S5kExMnHqYnVHgXPcCiZm7kspEtknNRJ6Sao2/:chrYc8i2kEanzHgkCiZm7xpEeNmv
TLSH
T123943B3BEBA844E0D537913C85A78A47E6B1745907319ACB42A0922D1F3BFF49D3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Internal.FrameworkUdk.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\Microsoft.Internal.FrameworkUdk.dll
Size 997KB
SHA256 633ecf8d262b1d7626ff35844e4d29ba579549386eb609cc6779bbc4bb2d4752
MD5 a970df45e41987bdfac9ceea3c6d7221
SHA1 3c3e7b6a7bf59431f511432a32b7fd38d8b056a6
SHA512 00f361673b1f59579c6608936ed91e57bc06b8cd47c5dc91949d66a096824b11edeef49b8ec64ad2f40d6b7962517c514f48f9551ecc4b6848042c8c9a74a083
SSDEEP 12288:ntH9ImvHEvAGwCwxWtpi/9BtHwR/yZOCIgCyjxt:tH9ImvkvAGwrFHHIo
TLSH
T14325871FAE7951E0C4B9C038A596662FF8F130E6873457C3D9919A0F6B32BE4A53E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Composition.OSSupport.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\Microsoft.UI.Composition.OSSupport.dll
Size 66KB
SHA256 930114b5aa17a84f10cb76ef71e9a2a7d7d388dd7f21534402a5130fd237e3f5
MD5 63e6347634ea6cceee42687077d91214
SHA1 77f3e487cb2eb7c981d8980994c2cade074c48d7
SHA512 18fea97933e62a0367dc0f42fa9dc451d11ca1829e0a30abb2ba3f8cbb85d96120cf9527cb95237de67933425511d39a86a0f4abd03a3789bc8c86ce435475c1
SSDEEP 1536:jIDumBHbhIpkJau3shnIxWV4nkrFnDzTR9:EDuWhIpk9c2xXE3D
TLSH
T16F637B44A29830DAE876417CC166CF19E9B5F22253101AFF03A0D2BD1FD3BD9A53EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Input.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\Microsoft.UI.Input.dll
Size 1.6MB
SHA256 a1c1dd4bff8a52b6c791b9b726e29566f7fd65b42837daef8ed56cad2ba293db
MD5 bb5300e9751b2fcb9bfb494b403c614d
SHA1 b8bf9a2182fe5504d4d643f8b51a4310832dd607
SHA512 9f955b95daab7e600404198b0c1eb4a997c7b6193982630862caa07b611451ca0e210ccf2062ba94178141cbdd15c1830972434e14713490a3266d236807a18b
SSDEEP 12288:graZ6w2cxjd84cmRnINK8+3Dz85FGy0pm4YqNQh5tPTad4empehyek9i0C6jQG+n:UPcxU+3MmppmsKameH0CYQoqhIROR3V
TLSH
T149853B2B5EA885A6D236A23DC0A78F4AF6B074111F7156EB0171412E6F3FBE49D39730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\Microsoft.UI.Windowing.Core.dll
Size 530KB
SHA256 c4e2765c1c5219b704f14d7dda54469328fd311bdc2db1e09b75df61038df94a
MD5 ddcfbc6690a2ab044677b0ffaf74332c
SHA1 97350afd294aad845241c6562809578a83186090
SHA512 2fa1965c5670bc5e92ba52b801d5c796f5d8542614d5b85d357b8e80bd8542401f611af8e5a89179eabc7ba72522bdcf7e4d7dbbc517e247da38c7dac2bf8909
SSDEEP 6144:QYBt4KLmoxb3XxelxmrdoMvKnwxoD8onPJFA96RJitn96vs3iuM+6Y:TByKLdhsjIKnIoD8qA9yJib4s3iuyY
TLSH
T13EB44D6FA7E84496E22A913D85978B0AF6F174125732CBCB0121D13E6F27BE85D7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\Microsoft.UI.Windowing.dll
Size 538KB
SHA256 436e3b2665c459786b0d96f2a1f6c891625332e875913593131d94510da75bd0
MD5 55bd07aac4f8d2ca59e90dba717d4e47
SHA1 3282d01bc6737112dde8685914d34b7ad7fd4fbf
SHA512 c90725265aaeb0f27ff00b1a907c2f60fbda57b7818b11954dcf29d89571d06b0b6465799e6e6bded9e226ce2a54b1013ded4ef9f4e7cde43e58eefeac4547fe
SSDEEP 12288:7G1XLiw0POe488HeqoDHEeKuOG6DFbncIwO:GXLiw0POE8He36DFbncIF
TLSH
T1B3C43A6EBBB44696D12A913DC6A78F07F2F1B8115731DBCB0161823D9F27BE8593A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\application.ini
Size 899B
SHA256 bf38c0f64966d0ac338fc6a861b0ebc52e73f8645e1257fd61036e2014d6dc14
MD5 fc33ad47ebd27d733e63986a6d5db319
SHA1 03a71573b4ca1e1681345982b453a23305b58d48
SHA512 9578c1bf21ffb4c397604de9849e35413ed57c4b6d74a4375fb617821e1ea1028d8aa2285a0fa6c6875d6da345149e279bb38710d611bce73368101ddd029d7b
TLSH
T1C71140FB53103BFEC6C21DFF71250AA2125366781BD7341C9101B1090B49B6F266E7D8
MD5 SHA1 SHA512 TLSH

Submit Download

crashhelper.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\crashhelper.exe
Size 358KB
SHA256 7c5cf4d6c322a6d74c996defce0b8f68504959ea60e8c12ce8a51ebd3e5d575f
MD5 7b90185895f53286b8e9ee7231a48208
SHA1 eefd54899c92078a99e1989b8171b1a3db9111c2
SHA512 76dafbc4ff648302ed9f52ffb67b51b4193fea094d931997290e5ead1814775b0c34ad2b99ca1feff4759bfa420ad3067a9812fa8d756f222350f8638e27c511
SSDEEP 6144:/ohdE+aTiO6Mmu/qDqrbk9bZfrmuX6CXmp8LpF+WnzkmvK:/opV9N++zmuXGGPnz+
TLSH
T1D9745B27FA4540EED05ED074835A8532AA72BCC94B217AEF27D806752E69EE47F3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\crashreporter.exe
Size 3.7MB
SHA256 eb4ed8bbc5b5a5cfdf7d062b2625d46387a07731ef88085f962f1d712b3a9efe
MD5 ae2af1174691e28b4c278c78bb10f853
SHA1 4fc9da041a1c849bc29eb0a8cf1aa8a750b62bc1
SHA512 f3d16f62551619671c6daab45088139995355207a7b23f40c76a7b7c2ed9f6f03c9371905b572032ee193f64608a145b8df28fc9089a9e0ba2f2c1df2bb263cc
SSDEEP 49152:L0dpsE9LOc+quo5s+0yLKmGQEByhKfos6v8hbGvONP5zPbmuhmBKN:oR9vb+wubrKuhmBe
TLSH
T100062A12E72151E9C825C07483266323B7E2F9AD433077E74E905733AE64ED05EBAB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-browser-agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\default-browser-agent.exe
Size 33KB
SHA256 583c12684e3395943d9d9bde693ced718406f59c50004a6ad436597ed32a975a
MD5 0ac15eecb852809e8bda7df4018f58fd
SHA1 9edb916e92bb9f169851f30ab97e7e81e7978118
SHA512 3d68ba244a28c692db8fd983dc0a9fd35f9fb904861fff64214b87bebfdbbfd59c8619aca19f4b1f6d06b5bc6d4f49ca1e67e9e2e2647b598b8e66ccec47a4c9
SSDEEP 384:S9Xd2CY2PnAo4/z1mcgXo3wPLIOXLfKaWgvkzy2gMO2L2UtLIYiOkxPNyAmL4/yh:SzyOu1mct3sHzKJAO8YieLk5EP
TLSH
T1E7E26B53CED048C5EC56D53961A06236EA72FB521FA2D1C7B75682281F307C05F3A3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dependentlibs.list

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\dependentlibs.list
Size 55B
SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
MD5 a515bc619743c790d426780ed4810105
SHA1 355dab227f0291b2c7f1945478eec7a4248578a0
SHA512 48ecd83a5eb1557dfabfaf588057e86fb4b7610f6ece119d6d89a38369d1c9426027520ce5b6d1cc79a4783b9f39ac58afb360cc76e05bbe8bbbd5128c5d395b
TLSH
T1C6900252006F40226145A5A1684D890C80186146DC9101901567260E16259C008D456D
MD5 SHA1 SHA512 TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\dxcompiler.dll
Size 23.2MB
SHA256 fc184690ae855c7e165e0daa6d0b2eb25663b46e798cee74cd2904f427dc9de7
MD5 3c0a12101509a5516b5f693d181ce999
SHA1 9f8d70a4bb29d6e86a00e14d5a2328aaab3219a9
SHA512 79b86c450567264d0a1a54ab81a87d40225d3727087cc395f45508252d64e33e19686bb03ab2a7b276ce24a4b498213fcd5d5fecd3cda01f55cbcc605e536c31
SSDEEP 98304:zjEvDZV7UaUdIFK9chWK6SWFMFmmqeMXgqZ7uAwkP32Z8KBu8HkUw7W6rNzaUjea:zjE9OvIF1GbXgAkkuuKRu5JaDVdPgtX3
TLSH
T193373B133686946DC05AC8B4C3574A278A6870DB2F7679EFC1E482352F79EF81B39634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\firefox.VisualElementsManifest.xml
Size 557B
SHA256 3b25ae142729ed15f3a10ebce2621bfa07fda5e4d76850763987a064122f7ae6
MD5 0aa43576f0420593451b10ab3b7582ec
SHA1 b5f535932053591c7678faa1cd7cc3a7de680d0d
SHA512 6efb63c66f60e039cf99bfaf2e107c3c5ed4b6f319f3d5e4ef9316c1f26298b90d33c60b48b03699059d28b835fbc589417ac955fc45a2bc4c116a5200dfdc32
TLSH
T10FF0C0DCB058131017CA6A556523528FB10F11FB56D501DEB0DD80381B4AB4C442ABCC
MD5 SHA1 SHA512 TLSH

Submit Download

firefox.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\firefox.exe
Size 689KB
SHA256 4b4f48cac211d3a3060c77a6391050884542aa324b6a843fe475f3a41275e81f
MD5 ce32f8cdecfade154cd609a121f18a8f
SHA1 0a40957fe407b2f6806bbf5266ff53597d4537f4
SHA512 8376677c3c2a948cca73bac48e3f0bca1d632c0d05abbfb70601683ca169a5140060ba22d3eab9e8b3e5df5f4881b80802d4e626bf3ad597dbbe787f904c313d
SSDEEP 12288:7PzLBj8S+saI/L04Yb4yWP1ppx4aksuIlIGzwHJem7OzwHJe0IhflP:nFj8S+s1ub4yQz+aXuIlIcwpemIwpelJ
TLSH
T101E4AD03F34516B9E08AD5B49B43D633A9723C444B6161CB1BE5BF3A3E71AD12B79328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe.sig

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\firefox.exe.sig
Size 1KB
SHA256 c242db5f2ac7b0b5beb1a7d3ccf1cc938f85f84d2804df80f66de214a7ec4a16
MD5 cf1d5327aff3ec00618f0ec55ea888e9
SHA1 734b363ba94ab47a752fa6ce6be28ddea96e363d
SHA512 68d118fc5535b6ec354ab87c31fd17b5431c2f8ea3810f437b587a64b0e9a91b65ce1b9a786c316b89f9d7b723d5faf0ceeea0944cf6e300a228467fcd6b73e2
TLSH
T18931C6B51E34200037804F1B75F4DA190FB367D7E9368497506946A12DA2F709CA776D
MD5 SHA1 SHA512 TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\freebl3.dll
Size 1.2MB
SHA256 dc250081ed1a1cc83e80053499551cac013927617b455fbfc1e1ebfd520c15c7
MD5 79d1e56cf8124c16bf078505409c1871
SHA1 86baf1bc45d26246822ffdb5af1b5d6aff269d1c
SHA512 885392cd54037f3628efcb74a97bb6b75d6eb6b7ac2ad2d9f6ecc585915a26a733d15a2d3c0b03adf7c9780f118e44517ed09b91033465dd06213e4382274796
SSDEEP 24576:+wvkqBH/H599XqnnnBnnJHTTJfKyWfUUxvfhgrJ0qJfX65XP2iSq+hBy:+UkqBH/H599XqnnnBnnJHfJfKyQgrJnu
TLSH
T187456C0BE6B64794C0A7CC7C2356B623F9313C5D0A1576E35BD885213AA0FE4B329B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkcodecs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\gkcodecs.dll
Size 10.5MB
SHA256 0ba909c7b2ab2d065d3982d2fa6307175d11295e1a417dc05074ae3d9a8fba73
MD5 b6503b2d21c8a1731324ff896dab6001
SHA1 4996b136ff31bf00e3354ae2435d0af965e09585
SHA512 9ce7852923060aea5c3658061a9966549cac04e14d64af51b9ef222c592b613eb201cf24efc727e2fc88d2f6a0ca43bb607e02be0ef15ce6287e6cf7b9ec51e1
SSDEEP 196608:aUlUXUsQhMwdQ6beeJJLr+1ABwF07XwB5RTGX7:aUlUXUHMwd/JJLr+1ABwkwBTTGX7
TLSH
T1C3B66D4EF1A351A4D51BCCB4927DEB12BD18385EC31856E737DA19243AA3BC0AB39F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgpllibs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\lgpllibs.dll
Size 162KB
SHA256 a565d03b95572dfd09a1167dc29dc5005a871e1a72d058f0654b30b20bc504e3
MD5 8b787cab826a95780cc44f15a8867ff8
SHA1 77a7fb66acdee71f6ff0ac5456a2b1814eaf6498
SHA512 0ceda6de05f699f3c34d95d5ca60a12dc3ce99d7803137b5898dea1a5cea64f95d7bb3222b362b6ea99de1d98a1cbdb43cb7afb2457bb6467005319993f9cf39
SSDEEP 3072:JmeKaYND6G7I0WGDAfyGdraFrMlKFCag9d1eCCGjinr3S6q93EduDoxWxa+3Lj:Jv1uD6G7IEsfyzwa8eCCainr3S6q90d4
TLSH
T1A0F37C26D948882AD43E8C748DA28B169B7E7C8007551ECF57D45EA61F1BBC06BFB3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\libEGL.dll
Size 60KB
SHA256 b661b0850733343b759c86ae8781ce1710a01bb13973208ed830edfb5b0a33ef
MD5 28cb6352877bc935550c473a6ab1310b
SHA1 f14f99a0bc83525f5849012f4567b85891264189
SHA512 477908cccf57e9ddb578436ed7af8346b3855837ea410fc33c1b1ddba267aff4cfa9e4f304e6adf7054fd1ce3fac3ba0a75a9c197f15e5f321c292f1fcef390f
SSDEEP 768:AkK4xrrqsEI3pZMlMy3uFx5vERMvXQdO78YieLk56k:Al4xasEI3u3wx5cRMvAQg7l
TLSH
T19D530927C979A427DE0D8DB4C9630816EEA1BD8A8FF2B4CF27644DE10D94AC4A77D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\libGLESv2.dll
Size 4.9MB
SHA256 8a38f5c648739fa59ab66ca7e90388632c2880933cf729dac33f0458d1be9905
MD5 45f259e792fd4a8ee361e488a91196f5
SHA1 890b44e7570ea59ee7f2fea11efa3dacfdd28384
SHA512 6f014db8fb04360f0b8f8bac3106acdb17b4158ee99e4a558417a20fe754f306702d0b668ce21681147a7cda92e8e1d5ac4ff22b9146febfeecc39fd59214ec9
SSDEEP 49152:fB6JYw18OCR73O8fubE7bUNDASPH/RVpN6zw5LUPMvZ//Aoq8m9rrS5fZKz:fBDRCv/RV/tQt
TLSH
T110366C07F6A140A9C459D275975BD623F636B889036672CF229887323FA7BD02FBD314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\maintenanceservice.exe
Size 269KB
SHA256 2509a016164c6f8fddd59946c67553fc2fa24a18b2e3efa62cbb13913d7d06e1
MD5 3a866540b3ce9acdc954d8a62dbb0fe9
SHA1 32283920dadc5cb82c10793f498673cb04d1cbeb
SHA512 e66b48948bc347f56699c0714f7ec96d675f5ed7667d52d2f5164315b85b7f6d649f0deb0c88ccf86b7c29c909659a9220988295c291681baf394f6fceeb6d1c
SSDEEP 6144:9SEH2dyepIpc/3wkUYBX2FFBUxHzWJewjRGm:oEH20IIpI3GFFBU5znUsm
TLSH
T1B1447D2973A44CF9ED6BC23DCDB28516EA7278514360E7DB03A489251F237D05E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\maintenanceservice_installer.exe
Size 183KB
SHA256 b16555f23dd95c5c4f2be665b8e4ea3818c900560f8771aa3e00e296f57af024
MD5 102afab471e9dc5ed435146757ec2fb5
SHA1 600f49eaebddd30f245b9b8fb9dcff0a02dadda8
SHA512 0b686c7e7b399eac2595b82c7ee9216b6f90241fdd9a5e13a154cc29ede8a25385f3208932c36069b1f2c1bf5bbb5b238647d75ba511287830d5dc261ace9a5f
SSDEEP 3072:XNRCywDw1DiJkuKUNRD5bg+9pjem7y6tuU/RDObU7y4jem7y6t/rb:XT4DteUjD519B9oU5DOY7y4j9h
TLSH
T1E7046E02BBE0D991F9B20A303C76D7366F31FC666E90874B6350B35CDD72381A96935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

marshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\marshal.dll
Size 494KB
SHA256 83a71358dc172781f9bbb1b1a1e9da8dd98e9ca34ca3db440addeb9f96f078ff
MD5 67c47e43af1d00ac1f004fb7bf4a4301
SHA1 26e0878e684b9d695dfdfbf7632b0bca04feaffa
SHA512 ae5fe46c381d3619dfe940a277b670e8383609980033693966724fb09eeac1ce8b5a0ba06790ca12d0831925817ac776616359743b26e9066a629aa8799a9125
SSDEEP 12288:kJrGVEF3fk5Q+fAZmXRZnFh1LBztdyNSb/OwS:zc3fk5QMAZmXR7zLBzCw/Oh
TLSH
T17CB4084FE96408A7C466807D8567870AD779BAD503D686CF037082AADFDFBD42C3B618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavcodec.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\mozavcodec.dll
Size 3.8MB
SHA256 8f6b28cd41c658f3c78a722b58ca18ceadb0b85cdc7a04bea1fbf33883b47959
MD5 d44aa66aedd785beadaf7bcdf192c06a
SHA1 7848d3ad69b5d0661f4ca768902a665c38f46273
SHA512 2d9902f954577ae6f051d1b788191fc10ce141a7d1871089352e66ef8b2e25684e974910ca760bc778743e76dc5c19bf862616a8167a957f958011f7caef29ed
SSDEEP 49152:ZXgeikLBsiBejJA0SNa48Ri+WGFJGIwmmZRcflvLewMUHsoDybPR2Rgn/M:Z1BeOa48Ri+WQJGIwmm7cflUUZDytg
TLSH
T19C06AE4EF0A341D4C50B88B497BBE726F924345D971475F71B8786247AA2BC0AF3AF48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavutil.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\mozavutil.dll
Size 562KB
SHA256 4d135c72c4dd2c4c90ae1a01125500fcef0433b5b0ba51684d5836f09ae8152b
MD5 cd1e24b2e98276c679853411f06e69e9
SHA1 3aaf02d5e1797eeb2daf97b7e635c6864cfbf2a2
SHA512 13bd8d94b35a9891a07448f5a5fabef87c5cbb76cd18588c10b71c0fe3e9c83ef691c8fd27d2cc1cc23b6d309c326542c0ec870e43718f686f626fd6d5731910
SSDEEP 6144:uojSV4EVORBNDay+1Nz/I5a4zfomwKIj6H7sErFiIwt3fV9gCDluMGG23e6CQ+Jl:uojr5ChzsVzfdwKECFiIwxN9BDla+Jc6
TLSH
T1C9C45B16D6C2082BC4068574878B5554F2723483DB95BAEF37D205293F28BE27E7AF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\mozglue.dll
Size 692KB
SHA256 5ecca41dd114812a3f5cf0bd965927904d5256bfccd5aba5bf84a99a1e3cc384
MD5 bb5bdee4d48c11dc8a506a52e7a8e6f6
SHA1 1f4821cf5b2ce74e9872120fbe782356ca52148c
SHA512 b1386ebdb202ab11efba92e2652a43ea773bee3cb15787166a10ae244e0dc19f36891396bd46fbfa7e6aaabda011bf38d611ccaffd38e7b818e88484dce33aee
SSDEEP 12288:gpwSpJFiTxSQe+vY1/qhyeeLpLAzpVOKR1OZ9hFV:gpwS3FWSQrQIhyee5AzpVOKRc9hFV
TLSH
T175E49D13FB9640B9D048D579AB9BD122FAB278850720B5DF13804B263EA9FD0B77D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozinference.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\mozinference.dll
Size 2.2MB
SHA256 3a4f38af9085b7e6b4294e80a6ad0062af4ac73348535a265bc92c1d07e3f0fa
MD5 2bcaa1728c4a9d9317937db075d06796
SHA1 dcb54d2d7021082d8534668eb7c8db40fda188d5
SHA512 4c2d6c779590c1bc1618d0f265f1e86da9f97c903c01e1e45da8d28070d1652718b8e7208c59d31d1f7a1f222a56fa1c0c2b5ad653502a9190fa354e9deb6c26
SSDEEP 49152:V2i2AEAuz4AfqVgmJls1y3Dm9KU7ERfIyclUob:wkgQljyBGfOlDb
TLSH
T1B2B55A23FAA081A8C09AD1794B49D633B675B88C872539D72F544B513FB5FE02E7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozwer.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\mozwer.dll
Size 318KB
SHA256 f910f0dfd314d438040c8b91ac674de70f993306e39c7ba495c100c81b074f11
MD5 304ef98ccd7525075658bb5c26f27cdf
SHA1 8d60016ca407c3425edf8ba86754fabb3777b26c
SHA512 57a3a179f81dc8bf953678b66b0ccdb429e903a4fa674b216872106276e7486afbd6adcc313e0f0b9f790ed186a39c2ad93997b0887645bdb0f935ee69ff0474
SSDEEP 6144:BcqJMTOOt6CkOGtvd1sdWRtKJhWouvXYMG41M:Bb6BkOGt12dWRtKJ1VMGWM
TLSH
T1A5645C12F69408B8E05BC178436B8672A6737C850B21BAFF229442793F7AFE15B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\msvcp140_atomic_wait.dll
Size 47KB
SHA256 e7963645e0d1db08e300614d4c5fa7194bd8173e9ab7a5558859e6b232ed3241
MD5 23d24c039c2b4dc4ed855be0275e605c
SHA1 ec28606fc22642e8d0354459dc7b710f93306c40
SHA512 ceac73d3653bbbae3ab37729b136e67e3ef29a0625a251a22ed32a3fa9ffe999501b6ae1007cc9045ec39db438ec91308ac28c426d7c6b288e9c1161885b3c39
SSDEEP 768:7PMo5RIqKYwIgMhpLDQl4wFbRgU9VF9zUe4SoSS09zN:gOR+tMhNQl4wxR3dzl4SoSSczN
TLSH
T1CE238E89A7680082F9974A30C1A9E61BF979B7E247608ADF1362F54C0F937C5FA3471D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\nmhproxy.exe
Size 655KB
SHA256 121ddb8146fa6f9efd494545939c966c4d033b7e0cd0b40095f273237e45e2bf
MD5 c0507d5e5020bb98f6aaac2d1bc2a86a
SHA1 dcc5c99296605ac65b1e0fdcd80352c99f56e36b
SHA512 bbe315791cc52d21b28796c751b203b4c00c15fcc6130af2df44f304e950cd32ae2e7d8d3fd775abf01a7b83ff5eeb2cc35116eccb519e5673e5c9455a5bb401
SSDEEP 6144:0ELIWxSXeFQRO7Ek+C1j+Kv6dqV9GzhYWVnTdF0xHz5Yl7+zzpAQFZ1jq88+miv:pLIWxSuFAM+2JUeqFuTIqfF0iv
TLSH
T12CE44C53F64785DCDA5BC07D861642326632B48D47306AEB21856F3C3E6BED22E7E318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notificationserver.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\notificationserver.dll
Size 59KB
SHA256 80ab1ffcf2ffd89f0891be607d954c6551c08d6a504e9b1011d1b717fba88418
MD5 62185fa66ee9988f2db06ef53bdd1f54
SHA1 728e675acd769514cb3026f12d35f44e80252d27
SHA512 99f8b9e06b4fcf6a144ac128e638a0a2499331d95670c6ff7ff3f53ad0ed586fc798f6514423855f16c10d9216c0a212549a16bf8674f3a646eb5b97389eb042
SSDEEP 768:6tshnF43pxaJO4ewlgnWic7WVtfpksRQVbfgsrx6J8YieLk5B:GshF4ZGzlg67gdEbIkx6679
TLSH
T17B434A53A3950458E8E7D338E2A31D239677FD5D0B31A1CF0381D21A2FA1BD0AB797A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\nss3.dll
Size 2.8MB
SHA256 f95e7211c4440aa4826709e2a1198d3a32037663e9288399291279504d9c1fe4
MD5 282b063a5a7d146fa94209dac4cb35f2
SHA1 b7cc5e56fc7d0fa32a56d4dbebe84c965dbe04f0
SHA512 6c5d1427d947602cb0a093fb0984845084e0d455ae230c5aec6087cb6c107d484689c4018ebb56208278f03b3f6ce97bf590281949148d6ea9da1b568ec66f49
SSDEEP 49152:vvVUQ9VDfiEQAR14UjukGEJE5tP7nHCMb3eNRZDvOCg0txP2iVE/Q0qJ/mhVZiql:vvVUiDKEPRVjuk/EvHCMbOJ3g0tx+iVG
TLSH
T176D58C13F29510F8C429C1759B8B9323A9B2B4464B3976CF62944B153FE6FE02B3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omni.ja

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\omni.ja
Size 43.4MB
SHA256 689cb51c22df5ae1fcb1ce6a7d9f88940412812dd11afda4aab782870cc83b98
MD5 ef1712e1ee9d5f6e4b20e49f32ec6704
SHA1 c7907808db8f5c73f4cfcf6c1d53ad24d0747d5e
SHA512 c2e2630a66d2111f8eadd573493f29936afcaaf7ca0ce8b94797261e80a0d622c1dfe2ac55b6e42063b33ec7ce6b74d6e356ff28c69e9deaa99bf79d670fc88a
SSDEEP 196608:n+FJjYD4onUtaWPN25918z2soBryrcryy3fmo7kDtP2wshghHd0TTnDSoF5VMP1B:nNW1usnoZNTxkDtP2wshghIJF5VMP1B
TLSH
T19CA75C1937FA1172856360396F5F60C1B334901F2619EE587DCC83E82F9AA3886F6BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onnxruntime.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\onnxruntime.dll
Size 9.3MB
SHA256 e0c84439b631b63b8ac7f79a58c945942ed8a16a835e486349f7aa5e913abe23
MD5 0ba752ca797d0cae05e90b116da48323
SHA1 5d67ad6166eba787be220ca8e8d5619127fc9e5f
SHA512 a238a3078cbc13d52fd74e5bbd4795be51d7d9676f7e929c1ef4003211323a53636b7ea412dff4dd83dacd6bc7c9e6715be027f063a4e89b37dcc219b65cf809
SSDEEP 98304:ZnqhXTtRrgH/kylO0NItAgFOis1rIzCgBlccEVcBl9M3t04xyt:ZqhXTtRrgH8sNItA1iFzCgBFEVQ9qxm
TLSH
T14EA67E2A62A4029CD0BFC1BCCB579D13EBB1745A4339B5AB01E254912F67730EA7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\pingsender.exe
Size 80KB
SHA256 0d187db5f0ac2a209f403271f13787d7fe80d1d89150ac8997021aaf506f69e3
MD5 e48177348888bdbe8b47109e53af3964
SHA1 c32acb976541561e3c5203144f2f09451498c42b
SHA512 8eec605e080ead51d2e55a4804b57ac5f738b36b563194395dae692b274c0ace29f3dcf1dc0c9c48c57c256dfc0f83bcfa1cfff2024447cf8876fc6e9285f2fe
SSDEEP 1536:fLK1Yi+DXuzw91SsZjyNoBjdXRn6dhmcN79r:G1ZDzw91Flm6Xh2mcNZr
TLSH
T19E836DDA996050EAD452C2F0E2E61313EB7A768C2B5656CF939482223F077D01FBD7E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\platform.ini
Size 167B
SHA256 01aaeec1676361e44d8e9626a56d6c9c5b768f9187728d6e04b133248e2e1283
MD5 1f39bf488e4d9d98de39e18fc288a12f
SHA1 0121f90fd79e6469db9cc8f0b04a20425c0595b2
SHA512 1ba3cd94ed294ee83191c7d5fc38ebf50a2f5e26dccbe37dfba2c0fe42d3438df11c7c5dd53aa6c135f3953b625a8256e24cc36e477e16a4c667c339c4283af0
TLSH
T1B9C0127FA41003288244398350B41A51240796C047DB40187120E0090AE182E347B265
MD5 SHA1 SHA512 TLSH

Submit Download

plugin-container.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\plugin-container.exe
Size 141KB
SHA256 653a27b36c41fbb6ac9e7538b481e95b77ebc7eb4f83eb99b4838c81bff64dfa
MD5 6935302137f3152317eb6a3b4a74f8c5
SHA1 494e7a194ab5e7c6934c0154f6a2e48a001d199b
SHA512 b2c987911aba4f77df7844a6612034fd8516ab7671527c918be013179a61c28082a9ecac69625c66e5a7611535dc180f3792302ce75760d4a3d2610dce1da138
SSDEEP 3072:Xkxq4w6505dcKCB7xjLrWqQo6SY5bBL/zp2Z2x7tg:Xg9wzXCB7xjXWQ6SYhNLpy2lS
TLSH
T1FDE35A13FA5950FAD549C974DA824612DFB2B8860B30A7DF23944DA12FA5BE4BF3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe.sig

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\plugin-container.exe.sig
Size 1KB
SHA256 907da74f1d4a6a2d76e9b75a09170b52efe706853325fbfb5b17866be99e7247
MD5 5f079920033e2bb764bbf4e308057552
SHA1 97e2266c0742e7b4fc99aa891a230d7e737b3bc8
SHA512 6094b9746a700249d88bf513a1aca2ef695b1dce1afa9e20825ef96444aab5a151b577fd4de7ac767489d11091b2d4de951ee985f65de425d0dbf0b0235e8c0a
TLSH
T122311BFA2E1524003A810F47B1F4DF0B4FF213CBAD3248A7606897E83DA5F505CA226D
MD5 SHA1 SHA512 TLSH

Submit Download

precomplete

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\precomplete
Size 2KB
SHA256 2ead01f56c576721d50c00401a186c5f034cf9a99e0d9f7db4b90f23aeb1f342
MD5 5f15e4c2998ff04e909eec7b206228dc
SHA1 fd8b2927ec6ac1069a3f33842d31d15fec3b2146
SHA512 32aeb5750e8e0ff1f8cb93875a4568aadfb080ba2ef3c4375bea0503839ec1e94402face3d1590b5c569e9d3af0cd5b6fe816bdec1666575143c7e11a601f4d1
TLSH
T16541524CD01EEE6168D651C888D31D8F3D9B42A6DC4DE6781EC700047FA35EF010EA2A
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\private_browsing.VisualElementsManifest.xml
Size 559B
SHA256 9ea86a18d41112e25b17454044ac29b458f508d9814700a6f4c0f9370678f3ae
MD5 b499ede5c9228c742578086591193efe
SHA1 18e682ec73ed8fcea99893142fa8b08ee8a32b72
SHA512 b99ef0e9152da3bf6adac5fef67b44738ae7a2d1ef0041786a5700b8389acde7380f1bc9bf1402c7a356f1777aca7c2b05af5ee22b7297bc879fe2e6b9741f13
TLSH
T1C0F0C0ECB148220016DB7D756513D28BB20B10FB4AC811DEB1EF80341B4BB0C496EAC9
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\private_browsing.exe
Size 63KB
SHA256 1fbd1aa4feee79131b335fcda45d27137fd2f94bd050e2c05ad42b08f28c3fd3
MD5 47fd3a84bfa5976d6b2c90278fb9e2f6
SHA1 5c797eee3672d5bb99d917d1b4ad6246c4795d24
SHA512 371e2aa1888210a54d669c20649834b0306bc9d271077e0e07f7f3facc9459dda7ec767142b30a10008dd3d55bd4092b8807015bcbf719b6dc4b3ff5e196453d
SSDEEP 768:qj7SydrZ2U2GcEr5DWrXSHaJf8qffCPD2FliAut8UavHdA8YieLk52XIiW:qjuyrDAs5DWrC6JEqnCr2jEYF57CBW
TLSH
T15C537C42AAC01489E866B53490923E099D76BD155F6382C743F3773D0E7A3C37BB62B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

removed-files

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\removed-files
Size 16B
SHA256 52523da24287c4d459131c2e4818a713a732765e06e9bbba1cf353888ba34f9f
MD5 fefbfac37461bd30e05f5befaa1f7705
SHA1 74f9024662db06184e645cab76bfecb0e6897545
SHA512 874d6bdef28dea531c858443810d0b026a3a5667e0b9985bce84b7c5ab63d06a015487bd1da2a914d28af7b6568335b1927f9fb9656715947929cd6671ccc4b7
MD5 SHA1 SHA512

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\softokn3.dll
Size 345KB
SHA256 a7af12d40c8517f9518f61328024b26b8c5bb12f5ee5ba0020ded40d70db2505
MD5 77907c6bbb58ba3fff861e72fcd61ed0
SHA1 dbc88ebe606bea7f2b8d362dbc6ec48f560783b3
SHA512 039f6c89bda1d190085cbc2825040fe9379957747dedfd33dec9ebea80c355bf21285ad978072e6c75b21eaf9c36e336b182abae37a0f5a46f5163517fcba627
SSDEEP 6144:jFaOSERNM/RUZ0rcFrbU9cqqMtHyOSzHi/PdUEdE2uSC:MOS2ZVFsE3OiC/FUEdE2ur
TLSH
T1B6742813F7D5A1A9C814C17592579332A6B3B8580761ADCF43648F2B2FA4FD0BB39B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update-settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\update-settings.ini
Size 132B
SHA256 c18489344fdc21ae366b4d957a0b9f11be772483ca46f9ffab6ed0356f946513
MD5 1413131f8cfad1e19d299667bf759087
SHA1 a0435cbf1a2817ec960c56a896d455e78adc226d
SHA512 590b53aff46903b1883c5fb14492ca85db2c6e0e900d0fdf62c3e6da10f1d10c3aa51224dc6db50f4eb12d42de017892f77e91d79aa16fcaefba10b27748748d
TLSH
T16AC02B8505C0A80C4003C831F97C01230082C218044020111344C440B3E776082D9DAA
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\core\updater.exe
Size 989KB
SHA256 c2afd2408ebdbabda37aecc25c4da26fb5c7a2d9603af98a9611aa25c7b4c996
MD5 dffd40fec9905787e25d79c0f4c50966
SHA1 0d4639c0473f14e3e4140c7eea2e061f38ec5a65
SHA512 83b08687ff5b217e36928dd296037476d7362abc5b9ebd1654208b908055a7327a2ecf3f30f576df8568f210d4cf3feaf7839d626a85cd98964272f73bb2fe34
SSDEEP 24576:W7W/UyUOFHyKJu+KvN5J7MXth0lhSMXlEaLJ+Rw:Wq/UyvSca5J7MXEYw
TLSH
T1B325AD1BF79440F9E85AD574CAA64913EA72B88A4721A6DF03D48B152F73AF01F3E704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0B3166F8\setup.exe
Size 1023KB
SHA256 a4dd3ccc84d027743d80aa319ca6e49e0c4e130ff30d5aaf7199aadffffcd134
MD5 4957d4246e23032cd417978e9302e06f
SHA1 08dfcbd377d64f43b81bd61514e7f32f82bbe295
SHA512 19f1125f939549e7d7f431e779bcbe180a9f0dc9753651b0a4b251ef2187aa66454c8b6390de84c37375af509fbeff3fc3ad4bacff9f4fea0152f12ead48b3ba
SSDEEP 12288:ET1UjD5czai9euP+bnEPeqSjwSoFWKtsm45U:ETvvhmbEPeqSjfoF1tT45U
TLSH
T19A255A41B790E862D4AE493078F5D7572B39BDD1BF51C6B7332AB38C4E71B60962820B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\AccessControl.dll
Size 21KB
SHA256 ef4b548b27a6edab3bcb25cff0598918c645795850d62f232909dee851e04c6d
MD5 eb7a540d0d2e28f6bf524d2cdbe0f478
SHA1 76204991c60913cffeba5595033c4f79e1e89bd8
SHA512 947132d07f7875dc99fbe8a87757f6efee0a8c6271f8a3bac6747f9f4f60ed7e203e28a588db8c55ee898ba8f3dcf640f6562c49c45d6c6d8fdbe2d2309b9984
SSDEEP 384:8fX/qSSu13X9dGY+M47iw93L/pvDGFtart8E9VFK4imkGu6m328t1:8fXSz8X9MCqRDGFo+EA6D8z
TLSH
T1B9A25B968BF059F0F8B38E3531B45D1A4D7A7B5319F0C49F6226CA484B80746ADB83B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppAssocReg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\AppAssocReg.dll
Size 14KB
SHA256 eeed86addbf5989fe54e862e68e9a287eeaad11b209c26de67ab660b21445e15
MD5 012461cad43cc5a871bb2019a461a2e4
SHA1 75617dce95008117b5b1bd602bbbe58dfda4e6d8
SHA512 f1c42d0703e5c4fafae2fab90a7c23499e8b72f9e04ecc10602d1c48ca08781000cda36af86577b3e2380684ca442db54668f390822f3590b6dca6507e80fa2e
SSDEEP 192:zJfFQBTidO4veM7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRzt8oOT3ip0lL:lfF6iddHvDGFtart8E9VFK4ittEipoL
TLSH
T105623AF787906C10DD6B8E3231D89D267EB2F7826A90C1EB4329C50057917877AFC29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\ApplicationID.dll
Size 55KB
SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
MD5 fdc0338e6faeaf6f7c271982e103473b
SHA1 9a41f7932abe8be7e32c6371f085cf14de355d00
SHA512 a766eef11db4c94b1445d1cd70cf1d3b6141d6b3973562e9fa8d81c79195886b884dbc9b9f6952f8a6e8619534a6bf2d615d539d2cace9c8843dc19415051cc0
SSDEEP 768:oY+N1V9Ek9B/3I2IIk85ZLa342QpIK0+KE1zRBoSLDGFo+EAM:oY+LpI2IIk85Fs+LNRBo1oyM
TLSH
T167438C10BA80D473C556983970E8DA225E7E7D122BF090D37FBA83694F617D0B67E34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\CityHash.dll
Size 53KB
SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
MD5 2021acc65fa998daa98131e20c4605be
SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
TLSH
T1C8439D31759189B3D59AC97230E49F2F7E7E7A011BE488D35B7984001F60BE1B27E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServicesHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\ServicesHelper.dll
Size 14KB
SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
MD5 b9e8c2212ac8dae4b0eaf97c048529fa
SHA1 331d172323480b0518abdb0cc9e256dc7f46c357
SHA512 d93aa032e27c8268a4f6883711cf41f7ee2b5d33673a26d78db24456f2c548af39b7b98ed4b4737245c278d524fffb3e4bf708b6815dc866acd371427ff6be96
SSDEEP 192:UIHxGS7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHR5tHPk6NM:UR4vDGFtart8E9VFK4i/9kSM
TLSH
T148622BBB86A06C51DD668D3231988E2ABE7577456B90C0F7532AC1504BC1F8376FC2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellLink.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\ShellLink.dll
Size 14KB
SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
MD5 fa94d120efb029b43217c66bbc8c650c
SHA1 1fcf2d76adf69b403b7400681ac91d50ed20385f
SHA512 07ed0771d5bbb651ea7421a5f6b08fa234f9cc041315d9360a7135ba12180064fc99a27725385a8ecd3ceb25bed5c00de169f7dabb3ccf6e987f45254dff8158
SSDEEP 192:46J7JQCdiaR+7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRqt8kzN0eM2s:LJ7JQG2vDGFtart8E9VFK4ictvU2s
TLSH
T177623A6AC7A1EC90DC2BCD3730D4B9376A71AB8156A184EB576CC54047827873EFC0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\UAC.dll
Size 28KB
SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
MD5 d23b256e9c12fe37d984bae5017c5f8c
SHA1 fd698b58a563816b2260bbc50d7f864b33523121
SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
TLSH
T13CD28EA657D0467BE9731D3131E56A125F7AB9311E7184BF0A37C6842AA0B83BD7C30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\UserInfo.dll
Size 14KB
SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
MD5 610ad03dec634768cd91c7ed79672d67
SHA1 dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA512 18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
SSDEEP 192:PmTH+kPMC7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRGz6ot87n5/:PWH+SvDGFtart8E9VFK4iczNwn5
TLSH
T169622BBBC6606C12DC668E7670E49D2B7A71B7916F9080E7132AC15047C1783BAFD1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\components.ini
Size 44B
SHA256 775c85f3552754ad3794b88c0cb6d6fc43d412cd9a87a4b9e847386a5bd0a9c4
MD5 c9b5d86a9a0f014293b24a0922837564
SHA1 3cc73b4a30a1a0bfdc6812bbd17994f53eb5db2a
SHA512 790f365afbe4c5a37dbb56443d38f0c439eadca002e4001d373d6db8c1d80c4adacf3749e9d210cd0316381682fbbc46616a3fa36581c7ea6f5ce69119944b62
MD5 SHA1 SHA512

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\components.ini
Size 522B
SHA256 476b00b1352dd0e78c39b0777448b38c992e7fc4bddb06b56dea5b9da39c6fd2
MD5 f90de05c9e66b683601180e579280e38
SHA1 3db1bf4bb6298a54da291aeb7793a236d07df840
SHA512 6408015ea78fc2c26968f420c61b93f53bbbba5fb50dcd0c1e0e71478b13a7f255fd2212e26e4a974b88790ec345109e0125895a69778135c112a0e0aef0d6ee
TLSH
T133F0A00B69E54484A858F318EAB144B293797244261EC84E90EF1E1E55F92F1B13FBCB
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\extensions.ini
Size 402B
SHA256 4e3f2413784c7e3666c667eb2c35084154536edf9335d96f24d18a1d17590066
MD5 2ed482117f3148d08f92e22bed69f5ed
SHA1 2ac31eb3b05d73d23bd946d6b7c9a7a461d1bdf4
SHA512 3b84ec3c4aa29e70b428535d9f34577d69d6373772d96ebae71b27a73cbe6d7a82de1163c71280e7b0ca906f4fc3b995f3626988776b6116a2d81a5e82153d93
TLSH
T10EE046072AF94018A59AF608EBF480B1D7387009180EC80ED0E14E0F8CE9681422BFDF
MD5 SHA1 SHA512 TLSH

Submit Download

liteFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\liteFirewallW.dll
Size 92KB
SHA256 c0a12e651085aa2488796b474a5ca3bc70c22f1fd98ef854049b8d72987e478d
MD5 f5a3005a46e051b8d9eb5e2be7802f7e
SHA1 4fae43843bf6210d5d98683b50705824877a7d9a
SHA512 4993fcfe6669dd1e3621ca50e35aad750bc6c89838abf94da4303c5a31e958b3d3bc2cf70c268590c8cd5cdbc90f015ffa37cf98548c2b54ea8171b63a3bfa0c
SSDEEP 1536:tNiXc1jND/x0LI7W2kG3Crh520Hsy7xxz4J:79N7iPrh52ssyXe
TLSH
T1BE939E21B6E0C472C88BA9395464D7B25BBFB5316AE089877B68077D5F303C0977938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\nsExec.dll
Size 17KB
SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
MD5 0e584c7120bd474c616013c58d51dc6b
SHA1 0bc980892341b52985d92fb3d8fbb6be77951935
SHA512 aa3a471b3f33c3ffdbe1b1e3c1e5d04367bcab3c16049396a8dd12c5a8317e4b153761f74f39b756dd4fb1806aedc4f1bb38bfbc12f16480eed3fd3087a0d157
SSDEEP 384:qDrvAxnJGernNQZGdH7vDGFtart8E9VFK4ibEge:qDrkoernAGRLDGFo+EAxe
TLSH
T12C824CB685C02C55D85A8D353098AD1B6BB5B7462BA184F3533FC19057C1BC3FABC2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\nsJSON.dll
Size 33KB
SHA256 705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf
MD5 e832077eaee06f3b2ac9a8d2e7264567
SHA1 decbc329257c9c7fb67d3c449b4c5dfc1f87471f
SHA512 c1bada98c52ee2318d23c48fe202380eb42c5e1f18226cdc017f264c8c34f548bfe4d9b6eef13caae69ba321a71b199431b249fdec65f8bb1c386810932ccf6a
SSDEEP 768:QoZ1ZnhrTfldqk7Yyy94RxOcVQJrTuDGFo+EAe2:Vpi52vOcqlTvoyr
TLSH
T191F25D96977058F0F97B99B670B06E232E7EBA05295085EBC33785145A50B43BB3C337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\options.ini
Size 1KB
SHA256 5c7fd39223939936cdfa617a063c2b115ced7d1feb556f478b1ef0b537d34831
MD5 c4c65a0aae4d01bb0ca18ab8ea1b5bfb
SHA1 bc0bf9694bbbcdb845c7c2cb1445355c16af3c0d
SHA512 44f5771d35918cccaa59f07b6d5789925bef21560400cef513acbbcb9e4ce9efb0fff1ccc60492ab598522137ee6fe6e38007e1c28e59e02848dbc123ea58af1
TLSH
T1A321C24B79F84114A899F208EBB644F2A3387605151EC58FD5EF5E0E48E93B01227BCF
MD5 SHA1 SHA512 TLSH

Submit Download

shortcuts.ini

Path C:\Users\Admin\AppData\Local\Temp\nsvB756.tmp\shortcuts.ini
Size 664B
SHA256 ff47ec46e05846b6e27aa2d98ba3be3c5af55e8730fb4f23f8b95637e5496ff2
MD5 a96c16b7b75402b95674328d8bee8f40
SHA1 262f041b5682d7a76094c0fc6e673c1954c346a8
SHA512 96ae14847acf3f8dcfc1235a22d8a9a187103bc15beed1dcc8fe391e0a08f27eeb7085af2bcc9fd6bc40f0128db2548f6328346b0e218fed9305a64e64a8e52d
TLSH
T1DA01A9073DF94014E49AF00CEAF5807693793109150DC80EC0E70E0E48EA2900537BDF
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\3ks5jwiv.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 e089608d4fb80ff8a8e119e10c76da60d8489075e94eb6999f1d53e34a369021
MD5 811c3e84207a9837221bed047ed4b0dc
SHA1 1b9762923108665b5c1cfc369a827266dcac59f3
SHA512 80e9325f5801749982d752c09873edf8f4519c5a4422e9b68c0622af186b840f2679ddfe65a5a6f532f2212d5cf6b7f72f07b580a378c85897ed23336f1b74c0
TLSH
T11921C244FB64993AF149C33ECC4697214F316410E88FBF22306D601C9E5A6693BDE83C
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\3ks5jwiv.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 6f7a33e95374859d66215b57f6945d36cdd05875a44910334229a6ce78609142
MD5 e101ead81726ebf4e29b19635c3f5c73
SHA1 03cc50d43d2999d1b98ddf82b19c998627cc2735
SHA512 012d485e6c6d57b66b261a282699f87c174ed4614c7a8177f53067020adced4afac3e94a2e9aa6a1aa50ceceaefad9394fe431ea6e9121f032a73d767fd55753
TLSH
T1FA21E155FB28993AE009C33ECC864B255F30A415E88FBF21306D601C9E5B62937DE83D
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 958B
SHA256 73bbfa25f110707d218b89b85b88406cc956950bb2e54b60980a5805dfc616d1
MD5 89dd642a2ec1689635dbcff4fea160ed
SHA1 3d099aecf10408c5edca825ed359dc7e643354c6
SHA512 6190518d3de425f0c9fadadb51e140a8c96a54eae5b4f3d7dff89efbe6079d82d33d0b5355e3a562d79ac4c1e80b31aef6952681dae4d82cd7f0586159264e94
TLSH
T1E7114E114FFB5A46F5F381323B311766A373FE01465A260AC58A66444D3B234A69DF93
MD5 SHA1 SHA512 TLSH

Submit Download

~irefox.tmp

Path C:\Users\Public\Desktop\~irefox.tmp
Size 1KB
SHA256 232ac2a98e55c3625ffdc5479106be03d24e85e85d75c7920db931563b4da47f
MD5 bf6a9de1134a4be3fe10c3ab98067286
SHA1 554bf038b3f975b965381baf1a7a5e6c142e9ed2
SHA512 a148168b6d015182e1fe7ec3ec8c883f08bd02fc3003d3929230a4371f4683ef084eb1d9493454673ed4e212be0d787531bdb17588d4957e873c4677ab5ce2a9
TLSH
T1BF11CC004FFB9A56F5F380323B701263A332FE01521A261AC04A67848D3B134969DFA3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5040-339-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/5040-31-0x0000000000400000-0x0000000000446000-memory.dmp

Download