5d1eaa39b85337b3e6d5a6c2d0977dbd750cfb4aa5ed0d02ea47702c3042e7c5

Resubmissions

05/07/2024, 15:53

240705-tbt6ma1dlk 8

05/07/2024, 15:36

240705-s2d2na1cjl 8

Analysis

max time kernel
783s
max time network
875s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
05/07/2024, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Recording 2024-07-05 120024.mp4
Size

7.0MB
MD5

ca6bacbede222729f52a59a47245e51b
SHA1

dbdef42f1ddd48c08ed226cb31661649d398b984
SHA256

5d1eaa39b85337b3e6d5a6c2d0977dbd750cfb4aa5ed0d02ea47702c3042e7c5
SHA512

4fb1e078e268c7a7499f07892ad14bb1d8762ac79518850eb688a5e6fedbcbcf331a5a583f4f86eb9c4c83d443dfd2b1ce2f926caabd8a4bdb8634a448b6781e
SSDEEP

98304:Rx4A59rW9ci/dnenqSFBplIwazug9iNJS1IANZFXzHdy2btXiVbaFCe4:RxXy9ynt7lDacS1dNZiy5Ob7n

Score

8^/10

defense_evasion discovery exploit persistence privilege_escalation

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Downloads MZ/PE file

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
3960	takeown.exe
3948	icacls.exe
3536	takeown.exe
2500	icacls.exe
2872	takeown.exe
4792	icacls.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
212	setup.exe
4620	setup.tmp
368	_setup64.tmp
2932	shell.exe

Loads dropped DLL 1 IoCs

pid	Process
2892	explorer.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3948	icacls.exe
3536	takeown.exe
2500	icacls.exe
2872	takeown.exe
4792	icacls.exe
3960	takeown.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\b5-3tw.exe	explorer.exe
File opened for modification	C:\Windows\System32\Windows.Mirage.Internal.Capture.UX.dll	explorer.exe
File opened for modification	C:\Windows\System32\NapiNSP.dll	explorer.exe
File opened for modification	C:\Windows\System32\CaptureBrackets.hcp	explorer.exe
File opened for modification	C:\Windows\System32\icuin.dll	explorer.exe
File opened for modification	C:\Windows\System32\icuuc.dll	explorer.exe
File opened for modification	C:\Windows\System32\mdmpostprocessevaluator.dll	explorer.exe
File opened for modification	C:\Windows\System32\MixedRealityCapture.exe	explorer.exe
File opened for modification	C:\Windows\System32\config\BBI	explorer.exe
File opened for modification	C:\Windows\System32\restore\MachineGuid.txt	explorer.exe
File opened for modification	C:\Windows\System32\CaptureToast.hcp	explorer.exe
File opened for modification	C:\Windows\System32\MixedRealityCapture.Broker.dll	explorer.exe
File opened for modification	C:\Windows\System32\MixedRealityCapture.Pipeline.dll	explorer.exe
File opened for modification	C:\Windows\System32\Windows.Management.SecureAssessment.CfgProvider.dll	explorer.exe
File opened for modification	C:\Windows\System32\Windows.Mirage.Internal.Capture.Pipeline.ProxyStub.dll	explorer.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\basicdisplay.inf_amd64_85cec69e2fcef504\BasicDisplay.sys	explorer.exe
File opened for modification	C:\Windows\System32\CaptureCountdown.hcp	explorer.exe
File opened for modification	C:\Windows\System32\SecureAssessmentHandlers.dll	explorer.exe
File opened for modification	C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb	explorer.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files\Nilesoft Shell\imports\is-GT4TM.tmp	setup.tmp
File created	C:\Program Files\Nilesoft Shell\is-UOAL0.tmp	setup.tmp
File created	C:\Program Files\Nilesoft Shell\imports\is-799ES.tmp	setup.tmp
File created	C:\Program Files\Nilesoft Shell\is-H6VAR.tmp	setup.tmp
File created	C:\Program Files\Nilesoft Shell\imports\is-6MHD1.tmp	setup.tmp
File created	C:\Program Files\Nilesoft Shell\imports\is-HSKER.tmp	setup.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun	explorer.exe
File created	C:\Program Files\Nilesoft Shell\is-FKNUM.tmp	setup.tmp
File created	C:\Program Files\Nilesoft Shell\shell.log	shell.exe
File created	C:\Program Files\Nilesoft Shell\unins000.dat	setup.tmp
File created	C:\Program Files\Nilesoft Shell\imports\is-14H2Q.tmp	setup.tmp
File opened for modification	C:\Program Files\Nilesoft Shell\shell.log	shell.exe
File created	C:\Program Files\Nilesoft Shell\imports\is-VIHKA.tmp	setup.tmp
File opened for modification	C:\Program Files\Nilesoft Shell\unins000.dat	setup.tmp
File opened for modification	C:\Program Files\Internet Explorer\images	explorer.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	explorer.exe
File opened for modification	C:\Program Files\Nilesoft Shell\shell.dll	setup.tmp
File created	C:\Program Files\Nilesoft Shell\is-55JNU.tmp	setup.tmp
File created	C:\Program Files\Nilesoft Shell\is-QPKC6.tmp	setup.tmp
File created	C:\Program Files\Nilesoft Shell\imports\is-UF7NA.tmp	setup.tmp
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa	explorer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa	explorer.exe
File opened for modification	C:\Program Files\Nilesoft Shell\shell.exe	setup.tmp
File created	C:\Program Files\Nilesoft Shell\imports\is-BNSAR.tmp	setup.tmp
File opened for modification	C:\Program Files\DisableCheckpoint.exe	explorer.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\81479705\712695724.pri	explorer.exe
File created	C:\Windows\rescache\_merged\4082845976\4179106759.pri	explorer.exe
File created	C:\Windows\rescache\_merged\3623239459\11870838.pri	explorer.exe
File created	C:\Windows\rescache\_merged\1974107395\975126586.pri	explorer.exe
File created	C:\Windows\rescache\_merged\3418783148\2566861366.pri	explorer.exe
File opened for modification	C:\Windows\System32	explorer.exe
File created	C:\Windows\rescache\_merged\83250422\3565382066.pri	explorer.exe
File created	C:\Windows\rescache\_merged\3829149121\2365354878.pri	explorer.exe
File created	C:\Windows\rescache\_merged\3819496785\1816359024.pri	explorer.exe
File created	C:\Windows\rescache\_merged\423379043\145411833.pri	explorer.exe
File created	C:\Windows\rescache\_merged\4032412167\4002656488.pri	explorer.exe
File created	C:\Windows\rescache\_merged\2483382631\1954082820.pri	explorer.exe
File created	C:\Windows\rescache\_merged\4185669309\3653706970.pri	explorer.exe
File created	C:\Windows\rescache\_merged\1476457207\876982712.pri	explorer.exe
File created	C:\Windows\rescache\_merged\4272278488\2581520266.pri	explorer.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	explorer.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	explorer.exe
File created	C:\Windows\rescache\_merged\2878165772\3817587045.pri	explorer.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\689984732\3780030053.pri	explorer.exe
File created	C:\Windows\rescache\_merged\4250449246\2600995059.pri	explorer.exe
File created	C:\Windows\rescache\_merged\778832011\1888836112.pri	explorer.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	explorer.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	explorer.exe
File created	C:\Windows\rescache\_merged\662487990\2358785449.pri	explorer.exe
File created	C:\Windows\rescache\_merged\1301087654\4010849688.pri	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1\0 = 6600310000000000e558447f100046494c4552457e3100004e0009000400efbe724a2da8e558447f2e000000690f00000000010000000000000000000000000000007a53f600460069006c0065005200650070006f007300690074006f0072007900000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAE3934B-8A6A-4BFB-81BD-3FC599A1BAF2}\InprocServer32\ThreadingModel = "Apartment"	shell.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\6	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "3"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\NodeSlot = "7"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\6\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAE3934B-8A6A-4BFB-81BD-3FC599A1BAF3}	shell.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 = 5a00310000000000e558b77e100053797374656d33320000420009000400efbe724a0b5de558b77e2e0000002f0f00000000010000000000000000000000000000003cf08000530079007300740065006d0033003200000018000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).right = "873"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\4\NodeSlot = "12"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "359"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).top = "222"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).top = "155"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\3\0 = 5000310000000000845880631000372d5a6970003c0009000400efbe84588063845880632e00000040a10100000008000000000000000000000000000000d5c0720037002d005a0069007000000014000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).right = "1794"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAE3934B-8A6A-4BFB-81BD-3FC599A1BAF1}\InprocServer32\ = "C:\\Program Files\\Nilesoft Shell\\shell.dll"	shell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\3\NodeSlot = "16"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80707004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000916ac1eaf3ceda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80707004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c0000000000000000000000000bcea4eaf3ceda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000007fe99f2e8a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\3\MRUListEx = ffffffff	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\setup.exe:Zone.Identifier	firefox.exe

Runs regedit.exe 1 IoCs

pid	Process
3388	regedit.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4620	setup.tmp
4620	setup.tmp
2932	shell.exe
2932	shell.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	208	unregmp2.exe
Token: SeCreatePagefilePrivilege	208	unregmp2.exe
Token: SeDebugPrivilege	1824	firefox.exe
Token: SeDebugPrivilege	1824	firefox.exe
Token: SeDebugPrivilege	1596	firefox.exe
Token: SeDebugPrivilege	1596	firefox.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe
Token: SeShutdownPrivilege	2892	explorer.exe
Token: SeCreatePagefilePrivilege	2892	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
4620	setup.tmp
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1824	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
4260	SearchUI.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe
2892	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 4512	512	wmplayer.exe	73
PID 512 wrote to memory of 4512	512	wmplayer.exe	73
PID 512 wrote to memory of 4512	512	wmplayer.exe	73
PID 512 wrote to memory of 4728	512	wmplayer.exe	74
PID 512 wrote to memory of 4728	512	wmplayer.exe	74
PID 512 wrote to memory of 4728	512	wmplayer.exe	74
PID 4728 wrote to memory of 208	4728	unregmp2.exe	75
PID 4728 wrote to memory of 208	4728	unregmp2.exe	75
PID 3928 wrote to memory of 1824	3928	firefox.exe	79
PID 3928 wrote to memory of 1824	3928	firefox.exe	79
PID 3928 wrote to memory of 1824	3928	firefox.exe	79
PID 3928 wrote to memory of 1824	3928	firefox.exe	79
PID 3928 wrote to memory of 1824	3928	firefox.exe	79
PID 3928 wrote to memory of 1824	3928	firefox.exe	79
PID 3928 wrote to memory of 1824	3928	firefox.exe	79
PID 3928 wrote to memory of 1824	3928	firefox.exe	79
PID 3928 wrote to memory of 1824	3928	firefox.exe	79
PID 3928 wrote to memory of 1824	3928	firefox.exe	79
PID 3928 wrote to memory of 1824	3928	firefox.exe	79
PID 1824 wrote to memory of 668	1824	firefox.exe	80
PID 1824 wrote to memory of 668	1824	firefox.exe	80
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81
PID 1824 wrote to memory of 1288	1824	firefox.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Recording 2024-07-05 120024.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Recording 2024-07-05 120024.mp4"
  2⤵
  PID:4512
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\System32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:208

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.0.1307172988\250398998" -parentBuildID 20221007134813 -prefsHandle 1688 -prefMapHandle 1680 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {47bede44-bd1b-44fd-9c38-cebe72788a51} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 1764 281f2ce8158 gpu
    3⤵
    PID:668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.1.1066854904\1545997331" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf9089db-ab9d-4594-bffa-94a488b1337f} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 2120 281e7d72e58 socket
    3⤵
    - Checks processor information in registry
    PID:1288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.2.887165052\231519234" -childID 1 -isForBrowser -prefsHandle 2828 -prefMapHandle 2856 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {49e9bbe3-70ef-4d39-a58a-60e174947ec0} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 2956 281f6f9e858 tab
    3⤵
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.3.422798640\1471427884" -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 3512 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {42f8f9fc-d257-437c-8329-e90187ebd6cc} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 3528 281e7d2d858 tab
    3⤵
    PID:2852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.4.200679521\308095920" -childID 3 -isForBrowser -prefsHandle 4264 -prefMapHandle 4260 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c3647a9-90a8-4199-a22f-6ad2434d032b} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 4284 281f8cf8f58 tab
    3⤵
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.5.182296496\430505521" -childID 4 -isForBrowser -prefsHandle 4696 -prefMapHandle 4708 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {274c03c4-dc44-4f04-9523-229148fd5104} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 4688 281f558be58 tab
    3⤵
    PID:372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.6.1484306338\228581106" -childID 5 -isForBrowser -prefsHandle 4836 -prefMapHandle 4840 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b7b3350-29d8-42af-be63-26389a36e9e0} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 4920 281f939c258 tab
    3⤵
    PID:2052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.7.370961783\1177619697" -childID 6 -isForBrowser -prefsHandle 5028 -prefMapHandle 5032 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a77e8d7-4914-4cb8-ad23-c172c49612ef} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 5112 281f93d8258 tab
    3⤵
    PID:4364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:4752
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      Checks processor information in registry
      NTFS ADS
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1596
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.0.1495193328\679585962" -parentBuildID 20221007134813 -prefsHandle 1640 -prefMapHandle 1616 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4dc61ef-5d6c-4299-937a-377dce747eb4} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 1720 1f8406f1f58 gpu
        5⤵
        
        PID:2228
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.1.31162034\43870704" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1896 -prefsLen 17601 -prefMapSize 230321 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a10ac8a-6704-45f6-9b76-2b9991fe0c1b} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 1912 1f840538558 socket
        5⤵
        Checks processor information in registry
        
        PID:1156
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.2.69421697\82576586" -childID 1 -isForBrowser -prefsHandle 3556 -prefMapHandle 3564 -prefsLen 23735 -prefMapSize 230321 -jsInitHandle 1212 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0188d940-7eb8-4696-aab3-28d2311c22f4} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 3076 1f8459fa158 tab
        5⤵
        
        PID:2132
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.3.767837373\734960546" -childID 2 -isForBrowser -prefsHandle 2916 -prefMapHandle 3660 -prefsLen 23842 -prefMapSize 230321 -jsInitHandle 1212 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6aa171c8-e514-4c98-b228-95a35825ea17} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 2220 1f836863258 tab
        5⤵
        
        PID:4780
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.4.234630318\2131458740" -childID 3 -isForBrowser -prefsHandle 3008 -prefMapHandle 3928 -prefsLen 24924 -prefMapSize 230321 -jsInitHandle 1212 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {86664bf3-8aa3-476b-8dda-b9541a612fff} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 3824 1f846375f58 tab
        5⤵
        
        PID:2580
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.5.1253443391\880002174" -parentBuildID 20221007134813 -prefsHandle 4192 -prefMapHandle 4188 -prefsLen 25857 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f599d41-f92a-481c-8ac3-c2ef9ef50d2e} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 4180 1f846773b58 rdd
        5⤵
        
        PID:4684
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.6.1561833394\1663311321" -childID 4 -isForBrowser -prefsHandle 3676 -prefMapHandle 3680 -prefsLen 32019 -prefMapSize 230321 -jsInitHandle 1212 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {85a57ebe-38bc-4a9a-97a7-a44fffe98a83} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 2492 1f846770e58 tab
        5⤵
        
        PID:2364
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.7.957166350\1561527391" -childID 5 -isForBrowser -prefsHandle 4892 -prefMapHandle 4832 -prefsLen 32019 -prefMapSize 230321 -jsInitHandle 1212 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {68e4fc64-11c0-4a13-b7f2-46e7235e9058} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 4884 1f842e77d58 tab
        5⤵
        
        PID:2532
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.8.671926510\1865727692" -childID 6 -isForBrowser -prefsHandle 5048 -prefMapHandle 5036 -prefsLen 32019 -prefMapSize 230321 -jsInitHandle 1212 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f45c470c-5df6-436c-b30e-c5509a376482} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 5060 1f8459fa458 tab
        5⤵
        
        PID:3000
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.9.421714897\818596461" -childID 7 -isForBrowser -prefsHandle 5764 -prefMapHandle 5760 -prefsLen 32250 -prefMapSize 230321 -jsInitHandle 1212 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e14f23f-baa9-4996-b5f6-5d12d448f688} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 5772 1f846770558 tab
        5⤵
        
        PID:3064
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.10.51312689\1283699682" -childID 8 -isForBrowser -prefsHandle 4696 -prefMapHandle 4724 -prefsLen 32755 -prefMapSize 230321 -jsInitHandle 1212 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e2b40d7-bdd6-42d4-9774-74a14ab85f84} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 4708 1f848040158 tab
        5⤵
        
        PID:4188
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.11.899848615\599865774" -childID 9 -isForBrowser -prefsHandle 6028 -prefMapHandle 6052 -prefsLen 32755 -prefMapSize 230321 -jsInitHandle 1212 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abd1422f-73b4-4c9a-9513-96e9a901937a} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 3740 1f848040458 tab
        5⤵
        
        PID:3040
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.12.2022028849\1189233492" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5008 -prefMapHandle 5204 -prefsLen 32755 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e681ace-6cc6-44ed-bd15-a33c155aac30} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 5192 1f84c3e4c58 utility
        5⤵
        
        PID:1252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4612

C:\Users\Admin\Downloads\setup.exe
"C:\Users\Admin\Downloads\setup.exe"
1⤵
- Executes dropped EXE
PID:212
- C:\Users\Admin\AppData\Local\Temp\is-CBIK9.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CBIK9.tmp\setup.tmp" /SL5="$A01DA,2893195,815616,C:\Users\Admin\Downloads\setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4620
- - C:\Users\Admin\AppData\Local\Temp\is-54C92.tmp\_isetup\_setup64.tmp
    helper 105 0x380
    3⤵
    - Executes dropped EXE
    PID:368
- - C:\Program Files\Nilesoft Shell\shell.exe
    "C:\Program Files\Nilesoft Shell\shell.exe" -register -restart -silent
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2932

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2892
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /K takeown /f "C:\Windows\System32\DriverStore" /r /d y && icacls "C:\Windows\System32\DriverStore" /grant *S-1-5-32-544:F /t /c /l /q
  2⤵
  PID:2860
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Windows\System32\DriverStore" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3536
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\System32\DriverStore" /grant *S-1-5-32-544:F /t /c /l /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2500
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /K takeown /f "C:\Windows\System32\appidpolicyconverter.exe" && icacls "C:\Windows\System32\appidpolicyconverter.exe" /grant *S-1-5-32-544:F /c /l
  2⤵
  PID:3748
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Windows\System32\appidpolicyconverter.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2872
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\System32\appidpolicyconverter.exe" /grant *S-1-5-32-544:F /c /l
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4792
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /K takeown /f "C:\Windows\System32" /r /d y && icacls "C:\Windows\System32" /grant *S-1-5-32-544:F /t /c /l /q
  2⤵
  PID:4780
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3960
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32" /grant *S-1-5-32-544:F /t /c /l /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3948
- C:\Windows\write.exe
  "C:\Windows\write.exe"
  2⤵
  PID:3828
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1940
- C:\Windows\winhlp32.exe
  "C:\Windows\winhlp32.exe"
  2⤵
  PID:624
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:3388
- C:\Windows\splwow64.exe
  "C:\Windows\splwow64.exe"
  2⤵
  PID:3392

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4260

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1096

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:2296

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:904

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:3652

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Nilesoft Shell\imports\develop.nss

Filesize
1KB

MD5
64071e0ade07c9476afb2ecf8f2fb4d7

SHA1
6195d1aad0db188b10050bed8d8b0475f651f557

SHA256
ce2c52d60b517834453e7d9c0ae17c9af0fa52e05bc6dbbf22e699135dff3d58

SHA512
a643665c3b58c83d3deb54649063106d8675356ae99be51c697bcc2ebef7ececc273d5db1a518f6b98bb59bbcc028920dfb30764ffb731af3dbf6d7a00c141b9

Download Submit
C:\Program Files\Nilesoft Shell\imports\file-manage.nss

Filesize
3KB

MD5
472be00318dbec8007f144a443a04b09

SHA1
16ecf527d44bcce28d671d9638d7eb5d7a0d102c

SHA256
38c292b8bfe4d35e88ae36dae0cca1da91a9e69b3453c02deb14a5a8bb7f0e4d

SHA512
4668da2418ba346a53512941bcf761a1cd13cb42c3f012d38a1bdf59f59188cf253a0ba5c55ff1015a9498d56115e7c6e6d33331b28eed92408ac60e6026e2e5

Download Submit
C:\Program Files\Nilesoft Shell\imports\goto.nss

Filesize
3KB

MD5
dc489226cfcdb574b9fe6f5b9efc8704

SHA1
852abb753a0f4da5d8ece60192425d63efe799ca

SHA256
db3f4b59e677d1adf910d2639971fc798ea848fbc1f9fc1f9dfac5ac7f50a3c3

SHA512
328b3027174c3486724065b81361c4783b05e23d2c6ed7461f74a0b43fe9850d8524cb8c5787306dff36a4f1d666a4e1a9188fec4a84945ef02603352ae9acc7

Download Submit
C:\Program Files\Nilesoft Shell\imports\images.nss

Filesize
108KB

MD5
9a249216f4e42c8ce6473e40d7557f5d

SHA1
4082e349e734d4cea49e90aa90143abbbc8b59bf

SHA256
78e112a29afe26f2443e590699697a9863802389915a2ef9b3c4ad5d8f29793a

SHA512
99686fa1b46210fee3f678cae8fe639bd27413e4477d112fcd093b3a7296b33eabfe945bb63a6c3b2b598d6883784e5dbe7ef258f06158f97197956a0b0cec2a

Download Submit
C:\Program Files\Nilesoft Shell\imports\modify.nss

Filesize
1KB

MD5
75b9e6d652fecd135b70508bc2bf317f

SHA1
f77ad3807f52b0f28e7f04894ae318f671c851ce

SHA256
4eabac27d4a5323d4fcba5b8859fa497cf4635200012707f3228982cc6b461b8

SHA512
6c43f2abf928f81a5cb5c8660c98107d9730911efede40ec792b0cd38d310f74921c0806715cd3492ef9b3aa17a5870f8c754bbe5d8abe47b28baf78302a2340

Download Submit
C:\Program Files\Nilesoft Shell\imports\taskbar.nss

Filesize
1KB

MD5
260fb00c05e6b77642a36aa8c423f238

SHA1
af662db16cf9940ef6a1a5a35d6ed12cd3fdabb1

SHA256
915e178329803bf5805c6a7d8bcb7a223d27b7a2dc35fb75e93584bd38a38d74

SHA512
0d610416e09c20d44803fd80d1befae546dd5a7a8a6e86775382893452e28ae787c682fd0e8a2d6089d35d070f3290e9fd4676bab0274728e0f5fc29c89ad295

Download Submit
C:\Program Files\Nilesoft Shell\imports\terminal.nss

Filesize
763B

MD5
af27aa43dcb2000ab114e578f55ff5da

SHA1
3f4d748528706915cebfc24524e2dd8252364ee6

SHA256
ab90a6a006e3dfad789812a07b4af45d740df0ecbbb092f4c4285ed2f17b9914

SHA512
24866c7a832ae5bbacab9421396e93744aec710ae599a29e2c0f1a56e3a18b3489e77e44ccec4665cd5ec028b30c9bc90300f953c68425c33a394d36cf9f8049

Download Submit
C:\Program Files\Nilesoft Shell\imports\theme.nss

Filesize
165B

MD5
192cd4c02d5b586a75fe731df2ba9236

SHA1
845534bb6208542d4e8261c436e2b2a5f200f1e7

SHA256
a3bcd80af8cbe8d76a6b10953e3968145d8b8af73e0a66e60a6e07dc7e0327b1

SHA512
f96754b3002999a1d40d5629145c08e34bfb0ae5cbfac83c5f93d0047d216a084ecf0795c190a7f0bae50afa94c8db9853191a3b135f2fc3f893b139e74bcf4e

Download Submit
C:\Program Files\Nilesoft Shell\readme.txt

Filesize
1KB

MD5
df1ac2c455f3874d10470d5a49b12057

SHA1
80a6723c74679a4240a4046ba9d2f6b028f94c3d

SHA256
b7ba000e80f1f40991884ca63c9305e05d1ea5efabbdebc524d1e0779b84c2cf

SHA512
536418df838376b7f62ddb870c55b7b6cb05bcd26a5e4335bb9f88741d5ff8caff44ccf9c7fb74327e08bfac2e721b5aa8722ffd97f84a1ccd8cdcf66d4f21cc

Download Submit
C:\Program Files\Nilesoft Shell\shell.dll

Filesize
1.8MB

MD5
da93ac965678492d790d9dcf378b96fc

SHA1
33a7e38aea2a87fdaa2db1d6d4616390ba8e04e2

SHA256
d101213256583c6730f9f4fdfd7c9e43eb73c6a1317b5522e2178c79e0fe0a60

SHA512
2cae86da78d72d93c9e490d67944ec4d8e32372da89854e0d14a3a16688a3193ba1dc94f2c9872214e922476c81b64547df4bc1b65ac5e7ca2f5a6d2fc439b63

Download Submit
C:\Program Files\Nilesoft Shell\shell.exe

Filesize
280KB

MD5
fca624d8af2d9364398caa0942d8e8eb

SHA1
16b1b86f3c1927421c143ceefb26de607f214bb6

SHA256
ba90226f2fbdc36b96ace0bcb4c9a430d7f04cc99f543044d27f75c63b9214a5

SHA512
881af5b36797d5e789ede4ddea564b9f9e6509123770c463204762ddd7986b4132aac193cc3700187afa0df36bb679b600fd34e838e7c054c8357d3307b320d9

Download Submit
C:\Program Files\Nilesoft Shell\shell.log

Filesize
640B

MD5
3d384656321beafd1af6ba24a1e04770

SHA1
8b6403a7c453f84aa3151a73ee654b6c1d4fd0ac

SHA256
9edd0e098b6b67e8587875d9f7a2510e0a1ec2bffc7428ac7a30d764368fe383

SHA512
0ca3a78d63b23ba86ef82bb215618b073bd2578aa0215f316b0ac00115e98ea0e3351b90ea0b8daaee9baa9ed3dd4b6bebab0df70d8866edac3a97f8c9d08dcb

Download Submit
C:\Program Files\Nilesoft Shell\shell.nss

Filesize
575B

MD5
8b2acda30ddbc635d465506849d8442f

SHA1
2a2468f8c7a265fe13774dfc6ce3554cca3e73cd

SHA256
bd69f016815c96cd0a3981f9872a56ef5a4ead893ccb27942360bb181bf30102

SHA512
7d9a542462961bfed8961d787b552724a81ea12e8cc133a1ab8fd832a4b17638bb2d0c320fe997bf16f41c4629d258d6e812a2ad2c94aae0798d1bee5b5faa1f

Download Submit
C:\Program Files\Nilesoft Shell\unins000.dat

Filesize
11KB

MD5
b41891ca25e2b8fb2ab405d007ef9414

SHA1
35572b6c0f0e5cd529b785c192ace62b8c19d42d

SHA256
938f8dc978e2491bf9fc14a5ae58323e5b4d2aeac103715f0c43e735dfbaf572

SHA512
6855a83e5fadc7d7c3e30ad38ebe0cffe8e6b791956259db28a2c3da66bfeba20fca1036de9313af5be15691a5e1d001f20da40dcebd1e6b50e8dfb3e6dfca21

Download Submit
C:\Program Files\Nilesoft Shell\unins000.exe

Filesize
3.0MB

MD5
41cf42c9c010c315f32ab252a2f2c471

SHA1
a2109738e27af41785d9e2d5c60009fce34b7cf7

SHA256
fa6dc4295b9996c6fde83e45b4e33eb29cc7642adb843fa242ac4a21d3084e98

SHA512
fc95622db25740751f4c4d35e1d6e9adf5e2212ec307ee6746187ded204e15cd0a7b3c67b101432565325cc9abebcb9c3f47d21d551fe97e252a6b1b52945adf

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nilesoft Shell.lnk

Filesize
895B

MD5
e9bd079c2adb324ffb282f1011a39aa9

SHA1
d8175bc5b1003a765234c883e8e24923ac75e990

SHA256
b4af825730345c10265a000311e9d0cf127de7d0b1793b4040b095d173c887f6

SHA512
214d27d9d5b12b6477fff97ba4ce883c06b0e631f470e284bda83ff21f2c4735b24506a5ae884667c888220b43bb736b7a8b1fa9abaa447c912332d409a944af

Download Submit
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json

Filesize
102B

MD5
7d1d7e1db5d8d862de24415d9ec9aca4

SHA1
f4cdc5511c299005e775dc602e611b9c67a97c78

SHA256
ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda

SHA512
1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
0e807656bd86f2aef7ccf207f963973b

SHA1
27052af8d103d134369e356b793eb88ba873df55

SHA256
c509c498682bec50142782a51785655020bea27652f46e104e07a530c2ff5162

SHA512
e6c7d5e001e8322ccb1abd101d47e7f1401597518f45dd8da1d757728147262bcb3b1f96128f291e0e367c5b34026b401468e4219b27cf3c37a8d434180cd8f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
79ba67935dc85d787fd0915606be88a0

SHA1
faeae3bc11e794a2817fa23392a7e74b93869ad3

SHA256
9278bbb6b1a8f100cf0a3f633085ccc99908997e1a558221f3be85ec18932d27

SHA512
bcd4455245f1a077fd9d364b03926e742fcad711f89f59ba8c16d0a4d828f4843c79e8cb2627a22d33868806648e0af75cf7e457d494e7a157981e9c3a72a0f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
79a187e9dd71cb1f6f96e4f4a3fa1e0a

SHA1
7c70c257cca56ea606e2a0a9d0d0438c54d072ee

SHA256
3a135948d7677979195a19dc79c5e5e940e3c847dda0bc86bea88a1aa224b0a4

SHA512
2662c03ae4608a6fce52c2e91e69034b6825181e68dad03bb494fa90701ece7b63eb5323901b2d7928f81a7d1afcb438fbad23756bc3d67977afc1bba29d5100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
52e85c241c901fd35f18cb990761cf1a

SHA1
cc2366acc5b5ca3bbc3706ccbe81914c69fadcca

SHA256
5591d9c5fe2f3bc049a7783b9482d3eab0c899a12a155fdc2bea7cf04e45e434

SHA512
27c70059e13b0ad72594183e01207bbf95443419eb7644daaa6173c0257af6078b0693374ba6d6aa270b741dfb4e49806e9b55fc6482b25e104bc32ce672f3bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
14KB

MD5
a1a7908afa0411f223bed33763ed1806

SHA1
c635c4a2b4ee605795bc10f931ef49145407da8a

SHA256
ad0547eacb1ed423e017c16bda9556bd0cfec3fcbbd057d0a3422899639e9456

SHA512
83d116dca5fbd0e082d64ffb461185ee0ee77e0c2769bbaafb1928c9bf7a45f5c3d0952b43d2563122f65079359fb572f1edb989cfeb304e42f5a814aee59ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
14KB

MD5
66572f686f4d5749010862d138e2594b

SHA1
7e72e81d9342f7a5bcaa695987781c0a9da118dd

SHA256
d99969e28479b1e9cfc21c716ce15af612fe466953a0cdf91ea5ab2eac6a7639

SHA512
694c1205a0491ffa6fe3b54a14efe4be542bda6c6a57da98263e96b5bfc472b032f884a930f5bfcb73807d7b0fac9e61273502635dbf8bd13446d3529ce2b417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
14KB

MD5
1f16ce113118f6e988798b00def1f7a7

SHA1
beed607b2e71583d683e4027b49e75b3716ec071

SHA256
9cd0f627e300378e3d5f3b72c34d5a0cac42abc92ba1ff7127367a7bd92bc7b1

SHA512
5258e4f01499367ae3054a1152b6834f59d880c81c13a0ddcb17a914c34f2674958c668dd8ad6a2639fedfe5faa53fbea00cef6f59b6a4f8dfa221523208ebbb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
b9a6468d0df8b1f09b15f9a8c6d28d1e

SHA1
5561616c6ab874fd315c916a29874da556bca5fd

SHA256
43a5af652174b29f57f58b7fe441ff5d4ac1b98682c9da5b28ee0d98a76bdb9f

SHA512
ff920d7c354f926dc9964e3b48ccdac75bb35578e3ef8aa7b0b305ea0a90444fba23982d64d4a7ef391501394f5cdcc9d6b83b85d12db3336801669e2d1e6a86

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
11KB

MD5
78f2ee5f4b115834e67d2187cc21664c

SHA1
265c2005ea3519bcaccf017cd6cf82f6bc9b322a

SHA256
f5de8eed26a81042f34b06ecdfc04e55f1a1e41d35d61d29f6e948462a6df6df

SHA512
b7c68bcbb113997b331b2b3351607d6b413bffd82c8c1e4507ba8398e839436ee6971d2b9e096efd210819ef6164610dede4b7d566d45854659e3819c3262a7a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cache2\entries\C72D4296C2EBC6FD41A9F780CD0C8F30F0FF937C

Filesize
13KB

MD5
112b6b21a4aaf3b4c07b0c6798799f84

SHA1
449c5f01558795b7db138ffdc869d26db1483add

SHA256
64abd871270c2b27289e3cd3568191bac617422865b864c7e4f6e0068ec6cfe2

SHA512
128010554d77e32db993d3fc3b3eabe3f6223193b66d235f59989f3c6f942b86a0b7c94b78de8520712504d235694a8d9c2fe3f529b8bd7d8ed79fd5cec9941c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\startupCache\scriptCache-child.bin

Filesize
464KB

MD5
b1c0b3951a7abee30fb0ab72941beba3

SHA1
3d996cedee1d6eb87d144f8e220d41740978247e

SHA256
41edcec5320de0978c90cc2563ad07fd3e1e39b00be164ec27a299885b71299f

SHA512
dc2f9b4b5e4a81d9537d47372763b7570e8dee1b25e80131548ad816c8823424e9e2e298975932ea2d36e680922312cab5e65ee6c5715ba078a4c28d11b8829f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\startupCache\scriptCache.bin

Filesize
7.7MB

MD5
f0832224967733af8f5b9beb0daef776

SHA1
8efc7c92fb7bf2e0e33a718a8d6f2b34bc44f2ae

SHA256
ecd1224278eec0e3ae4faf1a03e01716c28891873057afdd840424ecee333677

SHA512
3460ccb889d72b7aac5f9904fe05f1616d482742ee3281eb6edf12af5f728a4c3b49ddea405bb5e845c5accd4b33980863380ed7db46d063057ad7dee0ff0108

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
1b56104a4f0a0b43d3d6ccedebccceab

SHA1
0fc13faca49bf572d627c91b17491e8e8ffb5a84

SHA256
0d8d296609b534ec0279ef25b87b15bedb2d8c2d65d31cdbf855911d1c89fc06

SHA512
7fa856800e87b9795983671670406553b92139069597a3092b2fe38372e7db911a71d2ff27517effabeb372157e47f36b9f8a5e6e49a85efed279ef13ce71218

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\activity-stream.discovery_stream.json.tmp

Filesize
24KB

MD5
64e1a491c85d6559cf0042aac74512c7

SHA1
3585de5fd431c737713f2099cdc4539a45afccd5

SHA256
3c61766648d19126e20f29611c2826aa35ec868e32f901fc354c8f01feb79047

SHA512
f737a0a9c6b783c94af2a5cc9f319cdcd72445d736b1ce5b6fa9a2e3507406168d66f43629370fbd882fc78efec31e355ddabb1241a68795b0c936c7ebcc3234

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\cache2\doomed\1941

Filesize
15KB

MD5
e69fa5d984bf6310da0a4856df4230a1

SHA1
3bde5babf905152467c898a9dd8c8ba504b798e0

SHA256
16a787ab4c3c176f429b9c39c5a5695548f73629de5df987fd2e10031ecac850

SHA512
ac812a4d394e15f155cabe835cdb5e8b0b4d03bdae132871b25c7d9c92aab16bed8097e88482fe6d4f2e7965ae777be4398454141f9f041c78c8309de9736956

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\cache2\entries\2803F2FBAAE4ABCB08334CAF353BF333FBB61A02

Filesize
59KB

MD5
340a5affd55f7c5dd90f5c15b22fc9cf

SHA1
9d94d8c79ad4c145cee617595db29390c3f2eace

SHA256
68a7faa65fe5e8f5dcb5a7ccb16304d047987ef225defbfd324298aa43430d15

SHA512
afb053189b6d25c52fe2035be2c23267ea49b01a0cd1a66e2248516daece44ab2d2788e1c205f5b8abc47a817bbb594d90dfaf5c33b683c2f93163668e192a8b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\cache2\entries\4DABAF7EFACD377F68614B900873860C74399618

Filesize
220KB

MD5
a6bfe2ad0aaffe54ca87791279df05ba

SHA1
8a0e0b624b388ae1160ca3b3dfc5fd33560e0ef1

SHA256
97bbe83c846296ed2229cd9c5e28f04a1704350959aee50453f4c9f40265be9d

SHA512
bcaf49c1f4ae47b9a792f6267515374df8c08f0121bfdd511d64693efce8403ee2a09449bcd330a638c0bfd8ec1f7a96a2ac9e9c8e38d606c57433d445e53a2a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\D1ASO0I0\microsoft.windows[1].xml

Filesize
714B

MD5
241e4aae4e91c59b35d27350efb9bce1

SHA1
434e832960f3287780dd43320013a18f90f76d03

SHA256
384f53df280debfb9e4bbdff018d3694bb34caa394e2e858485bc3700594b653

SHA512
7c4a0f65746e1c92cb1356e1d59ab5f91c84c4a4a28524c85cd709c5ac5b2093d813977a0da9a040c0f38ae384ab377ce251f40396869c66fea50245ce0e233c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\D1ASO0I0\microsoft.windows[1].xml

Filesize
97B

MD5
0eda8e59cca3e075793a0f3bcfe4057e

SHA1
e8157d1c3afb84b31c4476d561f223df2a1f7e48

SHA256
9cc66e0495e0b5b2b343e6cac656d6be24a83b93b275a2b32f20e2bb0a0d80bc

SHA512
65b46cc389e0c99238bab1fcd1e3e384ec58ce7421068fa01acf3f28f61dd46852a555fbb194a2b3470f6d13c6fabbc4e8f93af8eca0ae223a0f514b159c205c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-54C92.tmp\_isetup\_setup64.tmp

Filesize
6KB

MD5
e4211d6d009757c078a9fac7ff4f03d4

SHA1
019cd56ba687d39d12d4b13991c9a42ea6ba03da

SHA256
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

SHA512
17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CBIK9.tmp\setup.tmp

Filesize
3.0MB

MD5
e5e62f35d7de252d0970de6798b3288d

SHA1
8513920c1ee578718092481d2d9910a627eb8bb8

SHA256
09ba3ae548980417e18d01603f055ffe2ef769eaaca2beca1b33a73ad5d041a4

SHA512
a7e3b5611422ed948fd525ee069ea2e11c0a38dbc7a2bb8a1ac9657c6d768109b56d0404de8fe98a84fe95a25cb94f69c5a7581102498bd6e7cea8f0e3bddc72

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
3933e911230abd9d9a2d740e6e4f6e00

SHA1
e72e3c0652671ab193df7e4ae172b6dd59ef4761

SHA256
e233fb0a1f89ff463636e10369e9844ae1f637efd112b19aeb831f759b0f1213

SHA512
d054c9c62e0c0d28a043a3e2a34e56d94966e9b1b7d96b77b2db2840e71bf02cd4eecd63a744d44d7bcf491f6a4c7dd70046493a33c6e12eb0322cc1d0a7bd32

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
7KB

MD5
9a2ac7de6c7c93cfac275143c7346b38

SHA1
0b2269f304e490291d5d1fbd087646797a6a33d1

SHA256
cd56960197c1e6aa87159deb9cd547276ff209bf8623ff09cffa24de257dd90c

SHA512
d41913033a9ee94f5305c44e59a1e046ff8db2716efad63f5eab1343caa5cb3c57ead6b748bc0334fff54872b1bb879e91cecdbe8f42bf94a0dc918bee334fda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\AlternateServices.txt

Filesize
163B

MD5
7afff6ffde0f9bb7dc490399af86194c

SHA1
331519cebf4ed0dddd8e45477d65d55c35cd2061

SHA256
1f478b62fdba5dd2562a1b91d0440d4e687ada57bba7496a8a8690013e91c223

SHA512
8c69d5099bfce447c8e1a2af457ae0e204b309224a72925e371a862e227ff0ee9d1a43b76202eddf7e730ec3b035eb6ed5d6da2ec0299ea4d6c63570d5a5144f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\SiteSecurityServiceState.txt

Filesize
324B

MD5
90c673efe8f8c8b0028b0a774c44dbb2

SHA1
10e560e65ceb156aa7dceb1e8582844174057e9d

SHA256
aaa600ffda0290cf5a7e60064b41f0ef7e303effb09d4dd289fc8f85583b3aec

SHA512
9383203bb2c7b454ffbda4b3f67696051c6ca4d499564563f9e5eed5c8b72cb27c6461c02867ac50f075844c41b112f06e3af090e59c291cb044b77a7773a73d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cert9.db

Filesize
224KB

MD5
ac2384865274dfcfb424c21ffec04762

SHA1
48fa32f75492c988de30308afca1066d495d531a

SHA256
4fc2369473202fd793d1c88e89c480b5b43f01e963b4b610d5de0d5f4e3fec3c

SHA512
bf80b9ac6f81c265ce7cda6095ab6f837543adb5fdd3730284e33ecaa68a203f5f4197d4bd4817f1bf84a0b346c70820a44d0a8ead242c68411e0ac20c08b93e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\db\data.safe.bin

Filesize
4KB

MD5
aa8cd260c6a4ee49d269ac6971247464

SHA1
37a7a4be6d0c6b3c7ffe5e5740e58c76fd7cbcbd

SHA256
ef8611655738d296d1d83b77f1bfe6a25d49fc1bc4d87b2773c0a53b051c1571

SHA512
67a8ca3c48a6bebec97a10185a5977aea310af09f0afaf0991fea1c60f80097a429b9c043e299102e7707742501e8e3b546bd8b0effb5c90a71b22ffe20e9792

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
4bc1b9bcf128cbf9625a30eba09a4e9a

SHA1
0f1e1f50a8a825a1cf8e852e6aa708e6185a3893

SHA256
b42fd624e87e914ed4431cd0999cedea08710c66eea834738bdf53318414931b

SHA512
f607758a294ad6af8cd8d53ca43ecbd3bb0e774ab749f607c2431f90729e221da81ac50ba55357c39c1ebee9452fc822eeccaf4775dffe80626ad5938e0bf1f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\47278cd2-d97f-4c7c-9c60-a991848e16f6

Filesize
746B

MD5
06ce3159106e1a4391344d79bc8a0320

SHA1
5b6b47539c310c9dbd2747a7927b7f14a6393c7a

SHA256
8ea76c991e065380ad000f88ae0b442181e23ab15ef341b2941d504cf1fb4f08

SHA512
812e9858573e0349e1432c3923a3c62494588f0063a3bf63442c7d7f2f250c2ce1dccd9d5d7e744c1552f8cfb85c5a74a29bc5c7804e77e2074cd14140f03a7a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\77ff271e-af9f-4fe0-9489-92a6f7d52d6c

Filesize
10KB

MD5
9b2b59409c266036cfe086ab3294672d

SHA1
41cdb85692ca28016ef6062d82b6d52093405e8f

SHA256
a05fec80f65bda032d48c268d2a3da45a39e44f175284462ff0669d29318acee

SHA512
c51b46334a2d40d5a8ac621b9fa7591eb676b7d20d3cfbe7a65b6795082caea0ccffa79249364585722065deee2c7582e78613591cd4efb171091cf3ab904b7a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

Filesize
6KB

MD5
e39303067e3d7d5c3eda97d2b52d184f

SHA1
e892d0be03ae33b055c1681abf4a86f2d2c8b35a

SHA256
724f42c45065c26b1bd2fe4531ef28d67fb57eaa43413c66a692e3890a983d8b

SHA512
69cdd2acdd001a0580d1d6f3101681cb77704fc636eed575a1a03609a3c237d0329cf36195cb0f19c075849e8fafcd76cd007c3d1a1c602a5a0a46f36402d5c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs.js

Filesize
6KB

MD5
0cfd57eedda41941fe30cd100184395c

SHA1
1ba71cf1536c902a9bf15690745b93fce9ba3a15

SHA256
a5892d55dee1fbcb93df04ca38be7ccf1b1e60281106edfdf8358aefb873c5cf

SHA512
475156c0b3039e556888a3d863365474075527f2ee8ab31ba6bc4aa3e93e511752c198bccc42d66bebcde2564751fa2bb3e36ee19841b3a051c228b6d95fada2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs.js

Filesize
6KB

MD5
e59241597cda3f2f461e705014c3bba7

SHA1
51c94025fdbb0ef579004c1f445704cf67a3af56

SHA256
2c5795406c7ae01c49b8246844c52b1b170c186aaa2c9badffca3296790f7d05

SHA512
f2f4753bd8ad0b101a432c01f1f649c88c9ee6e6833de6aecf993d814a87946783e867d0420b9ed77920fa8f6778e87522ce416ef74a70a31d3cc02a04adeaca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\protections.sqlite

Filesize
64KB

MD5
deeced8825e857ead7ba3784966be7be

SHA1
e72a09807d97d0aeb8baedd537f2489306e25490

SHA256
b9f022442a1506e592bf51284091a8a7fe17580b165d07e70c06fd6827343a54

SHA512
01d303232d6481af322137b44fef6c2a584f0643c48bab2836f9fe3193207015da7f7514fe338500ae4469651e3d9618293858ae507e722198a249257677099e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore.jsonlz4

Filesize
1KB

MD5
b72c773f463090852012bed188dc79ec

SHA1
50946575de4d3fafd0f368e735bc072c13a8d9f0

SHA256
dc2ab966273b7cfd7e9497cebb9b46ef271d8e748632a95ced8bd06edb9a1e76

SHA512
0345af0a0fe03780a943a72ed7fa9943b7337a0ce9cf5bb7d69dad4ccb4012d869fa37d8e42926de8456caaa1a81c80160e4ab1c4f1c57d1b77f9bb056b2e140

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
19bd14bc2b49d024a4c784279dde9aed

SHA1
82d06e12958818bda4c3f639ce5487ada2d283df

SHA256
db72280744859a93c6017081c0fcd892ab126c9341af440b1f3561f041f7d3d6

SHA512
a637ec13e8c93ecde47fd91518e62b5cded088a7e2bd18ab7c49e43258142ccf889ffb44ccd32f6be86e4991776c94b69682d95cdb8a847d55632fab2924a2be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
3018d1aad8385b734068dbad441e344e

SHA1
2a3925bc92ec843db64b6db2cd6fe18ccf084a86

SHA256
f33415b0b1fc8c7e52356318d44aef1ae6bd9c64a89afa012d43a01a79954f88

SHA512
7ab1a1115a4f7ac61ba41bfe5875792cfa84d81f14f71239e43848de5940bfa07e2e34ea4be85a61c091d0b4b7742f3f55961fd26734b528cdb2c0b4d169c5e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\xulstore.json

Filesize
120B

MD5
05e1ddb4298be4c948c3ae839859c3e9

SHA1
ea9195602eeed8d06644026809e07b3ad29335e5

SHA256
1c2c5d5211674c3c8473e0589085499471399e53e9a85d7dd3b075fef6cbb6be

SHA512
3177b48cd0c877821419d7e5eb247a4c899bc37258994f22257ceaafefb316e6f5959faae02e380e432d7752f0218d45d56d6878c1e751d201d9fdb3ff98612e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\containers.json

Filesize
939B

MD5
94a3843fad8c45c48b0e07342df3dfdc

SHA1
d55b650208bda884d573afebd90830a3f4d7c201

SHA256
854ff2076f71097b030c302a1ea71d8e851d2920b9ff5fc8dc8f16c91ba95b72

SHA512
4d2a6b2a223ad81bb97195abb27685cf88453caf5769de154b373486d5245f02e0c0f664281d8e3bb33bfcdf1d6f7b3d9602303864d4e56481382adcb0b932db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\cookies.sqlite

Filesize
512KB

MD5
b8acf9fea7cbf1f52767748ad176a2e7

SHA1
318da1683a5d0ca3a356585d6627526db2ac96e2

SHA256
5707ec478ca82d0d06788406e71ab5c47f30b94749bc37916bbc3f0fd7f808f3

SHA512
21d25f8dd407e0709b6f840b81b6146fabe1ea59058ce08ea9a3a29ba96f935f799ada851dbe7910562961d376cace6b158186e8f55235ea402bb4ce0ecb44ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
965fa5f62c009d59325bdde84cf90566

SHA1
fbd0c67382c73fc7f8416735447fac1998bce5d4

SHA256
469a307c804f331cc90850114b2b6ed4d82250751eae8cba44976af28ef4156d

SHA512
e03863c82a49dcda40b76a7c5c4d5d607a581e9f747734cf3656d68d6f252c3b0cb15c0c5b9368a631eb670e3db65412b03a7931d322bccab6591ed67c2e9faf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\datareporting\glean\pending_pings\02728d1a-2b88-4560-ab35-c5b42f54d8af

Filesize
656B

MD5
f10202f15f2ab6e206180679e777a38e

SHA1
a68ea4947111282f864c07ca7eef7563c3b11e1c

SHA256
d60fa8727be35785a9d6a8ae3f98c667ed7fd553fb56d54eb40adf83ec3079b8

SHA512
9840acba4d3c976b9c9d7dd898547330cfc9b4824a2bec0c401cf6bc3f2f4b8a3c8747aca27dddfe05679b595813cf5c492f97bca270d11f4612106a62ae48cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\datareporting\glean\pending_pings\1b987080-7c4a-414f-b860-99386ee3a45c

Filesize
587B

MD5
0aa87499a922dd7aca06b75400ea72d5

SHA1
ff6cbef6bb2241311c42366cecde0a458415c3a2

SHA256
fe5b0c4197121a19f21adc36254d3905e5a531d0b58bf82a5dc5f5c6fe603a76

SHA512
82f751043f4172b51d37b7b914122df261d400dbcbf69f20bc4d6afd56662890469ea144cefde7044e517e59d7677a0d468a7988c18c112e982f26957f804228

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\extensions.json.tmp

Filesize
41KB

MD5
7828371e5a6514f5f69a7e02a61a212f

SHA1
9880e7672237aaaec115dd9bca3c7797568e5634

SHA256
c2a6ac0d2ca702bae5613d263e67f5999205c3a5e539af8dc250f12ab805492c

SHA512
fbf1112b868ea3f9baf389ed856f19d9b6e965781eafe11d206975e6fe014f2890747dfd306ffeae4045ca53dd8f10818dcc8c657145f23ba85c155449e37947

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\favicons.sqlite

Filesize
5.0MB

MD5
484a7e085e2a6d8d6345c7c24c4202c4

SHA1
9aaeb4443f246f0dd9b61e720a0d8c47917e6602

SHA256
c2f9cc575848d895c681cdef2a58450e43c1b7e69ddb5b3ce8b9fb5bb4af288d

SHA512
63698279dfe13b4a43430450a82171395b96f2ff3297a333ba1f11cf92c1585362e10112b677a8595dd3df6140d610785d60216a07285ba3946e08202964b9ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\handlers.json

Filesize
410B

MD5
e7a65c5ead519a7b802f991353c26d3d

SHA1
34cc3c1cf9bd4912dba5fa422010934e46419fa3

SHA256
0e5ce92485da953757f615bad034a43032b220da18f8165dd85347851b56b2d2

SHA512
2a6034449ba6f5da8a77870ae665064047cea2460aeb4c8c0b62b308a403fdd30648150209aecc31ab1e50b6d9d94a1f51d3d7d50bbf35ec1b742bff2dbe788d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\key4.db

Filesize
288KB

MD5
e518510546ca4529f5cd1cb668b43cf5

SHA1
24d18b6070211f1347a848b1558b6d9af943fcc8

SHA256
d8cf52de33499d50f757799408e39b7bdcf20b843871492050e87c037b36f7f6

SHA512
d0ff1b6c9e66fa753049d5b76d38b3096d9164cd332a40fcf5dbb20fcfb4659cbb1728991d2ca6f9d46b01205aef9a2b4809963ee7f3417a73ac54009dd45a3a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\places.sqlite

Filesize
5.0MB

MD5
00403f0d9acad799d2feb944b89e1b71

SHA1
4697273b8beed454fb48d461c3d7d993b4f5b7a3

SHA256
8e609da815e2d421a8e005edd0c9e0f197a5ec59f76c8d617755bf3fa1a28198

SHA512
c0c7883fe391fef60115fe534764cfa65961eeed2db2e92490a9b0158304c15741193fdaab5d66d704ede6427dfadf085acc968654df47c09bad5f8ce8a89169

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\prefs-1.js

Filesize
6KB

MD5
fd0753a961e44f6adfd78f0e1b5866ec

SHA1
ec16a024467ea43776987db77f5c06527c11a0c1

SHA256
6031b9b3b87b407634974a8a44e6d42bfc045139ccfce1f6dd8e5086abdc5f03

SHA512
9a92df78d71a30af6d2b05a9b95c4c6909bc6c35683b480e29b76649552b35850a74ac91d2b52166d4acd9f1b4745c389217aecc408f360e82d2b85f8eebf47e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\prefs-1.js

Filesize
6KB

MD5
d68e3934336a33808115f43583e08461

SHA1
ad6f4f8f663e9a8c5911f1afd5a9351e419b8832

SHA256
b243885fa131e049fd3f39b509f0a82222fe5a1c3759e83b372d61cd782afbdb

SHA512
9e66b1981415a88f95c509b897b724d3b2c7db90969f9af4ddd79598abae0f8c9742a8ef22ca10bd9c644ac1c61a9b5937299dfb3f1702d3095837e0b96fc75e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\prefs-1.js

Filesize
6KB

MD5
4149ffdde7064d135f0acceaee2fa37e

SHA1
c62aa10041f7828cdc90ac247fd646fc4df01e7a

SHA256
d8e1a3453205b73303661e27960e3e56f8072cdd60f4e2fb645e249c6056be79

SHA512
bb76ea34d3d0acea5fe7b59fe760b96926d542d83a19b1dd4fed003c08f93c8e885b08a4a7f3c4abaa058f5995c20dc848ac99d6430b4d29ffab88dffd4ba9dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\prefs-1.js

Filesize
6KB

MD5
def00c4fb49782cb15f0bedf3452b99f

SHA1
33580e838c29dccd02b2e47cbca78b5c6c011cdd

SHA256
3e70594b3265df1832a748af3e88a3fec3876bc9f8ec5f1177621274f92273a1

SHA512
6ee7df86cbb4be5e949e26ba727e6e6653035651c3c16470362b92656f08ed114fe36ba876d93944879abb5d4fd728fca8631f588cae6c98cd11e3f72a27d4d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\prefs.js

Filesize
721B

MD5
1b26e32b74bde53493e4a5fcd32ec3f1

SHA1
5d8039ac2748ebce4338f0b696b7e735597ef623

SHA256
11b14259bcb5714db6154978cada45d545221c4c878b119e2b780965b233af7d

SHA512
9a91ffd3e299c849b47de0e4d43597bc521a8a93b7299c190b4387427f163eda9a45c67e929e3908cef08af10a4779d1346e19472a2cc44391f11d29f6716089

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\prefs.js

Filesize
4KB

MD5
3a4051e7bf7647baac32b87fc1e4aad1

SHA1
3127e7d0cb038ad3931671cd578f9a489a530b71

SHA256
c8c2e033d7df2c85288993c50d305caba62bba42f88b1b127fed175e2ac5bb7c

SHA512
60cc02e5d4ce52178d22f0fb6ee966910e5db6cedf95d23b8fadc3059304b1f54e52043f6b1bc7e74ac725a81cdbafbfc9a693a6cc3e86cf3b02e365558f4f4c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\prefs.js

Filesize
6KB

MD5
73cb1d7273df313507d45ae3f2509a1c

SHA1
700376eec74b386193728b99893f9e173d88e6dc

SHA256
64860947598128838bdd8103734976bee8c1361d4dc0a2429083e591a3bc2087

SHA512
aa38c6157a61785ec13021e7b4c44d75315b5874625118f7fd5898a91b893653279b005a5c9e8743f678c594489d689604363e829cc0962d19f345bf34984e17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\prefs.js

Filesize
7KB

MD5
2094e160690d33609983833be4bbd508

SHA1
f0ffc20a878373a4a1a1e47decf272a9c9079622

SHA256
b7250e6cf77f7b6ff2f648a354ab8cffa286c594d9812c555c5740eb49331b2f

SHA512
24dcb3b5b2006c506c7f35502d516e45b22dff15877eb66aca42fbce866d19296b60659199e077065f1dc7af9104fd9a989a354f7d4396b0b2ab9a4c5e82dff9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\search.json.mozlz4

Filesize
280B

MD5
41d220d4783f67d2b57beec20c135229

SHA1
6e97765e77920b6010fac2cb4abf1e3cea106541

SHA256
5d1881e74d76b95bad59439bb5c7676258a4ae6b6d853074e93b5247cf1715dc

SHA512
dc30ddc4c8cfe598de5e24bc88cebbe4256fbb21a0b1db6c2ec15311053e7d8be6a93a0bcfcfd8a02543f8b9cf9b15a5840154b272a2df71d59d7dfd80984ac0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionCheckpoints.json

Filesize
288B

MD5
362985746d24dbb2b166089f30cd1bb7

SHA1
6520fc33381879a120165ede6a0f8aadf9013d3b

SHA256
b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

SHA512
0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionCheckpoints.json.tmp

Filesize
146B

MD5
65690c43c42921410ec8043e34f09079

SHA1
362add4dbd0c978ae222a354a4e8d35563da14b4

SHA256
7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d

SHA512
c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionCheckpoints.json.tmp

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
39e29b3ba05ebfe2230d5a1468c43b89

SHA1
f8d904d0eda11c951f9b4870096c91b9ea0c1d40

SHA256
297bd168227596282ab91e15915fe83302ed2e8323f4747f8618d4387fce4d19

SHA512
4b05d707c275509133b87bccd1e6f8c524494042381288d37afe720d55e7c542867f6632eb580ad860fe43314e6f1b4397828ce65aa9a11cccc9c347b1099f30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
dce1bcefaa9dbf6a782000281c767917

SHA1
8a90feb39b17a8ef92a58bef72070308f8d1b571

SHA256
4ec58140b1d052d86c33543fe3fb03a9e3299b7e48ac8508a2564720c1a29fd3

SHA512
76892bb4e9792cd5405c374c04ffb688da1df6bdf53a3eafd71be48aaad463be21e7c2ca4aa2b4ee20ff13bae389458b19cfe4012182f0c2618b63732d13ed57

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
aa9a28b9dda2fdc14f8aedd1566b48f4

SHA1
25c0b793682ad8a5b8ecbaa673ae0bb42d89c743

SHA256
238e2789b7a80cdc4b797134b7af392a2a40bfdaedc447c55d1cde8646289b33

SHA512
aa99f8f54870f63db18fe4663d21610be7c3e5e7c737a5fb461b01d15ff2851e92c0ed26f6177ac92f740cf6854785b497bd440ca65aa882d7ab6631e35f9356

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
61f0f96e96a598e50949236aa547d123

SHA1
d4f533835b200e56cd9a7a004e7d6635fb9af330

SHA256
0c1ef21cb9f47e04b876c3a742dea87b5e2781ae7d826f2af4a811d155cad625

SHA512
a5c5d51390f63182506972893023579bce5990b7ba25e941a7240846c173ca1d1ef49f36353aa3f282abe2f1b6e9845ef038b94225b209d787790f055394b8cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
d2277c61ff76e275d70faa1ed3bdf102

SHA1
655c1d1a7f5cd9f2841916cbdeed60e5f9ff6f99

SHA256
fd4f8a3622787493b7347e334b4998fc817ec4bb91d43f44042af7e39d81bcf5

SHA512
c75ff917e0e20f86a12a236c341dfba0185badf6e1553aef59f26557b28f20fc23529f4588e0bd934c98e6858df124d0f8d081d2b94babf56ba65fe020a2621c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
7cbb9fa3d99f21e285f3c9ee50d84512

SHA1
aa0b3068a9e72579bb3ab8e40d4573d7c94fbced

SHA256
072b3c02cbeb5a85e933ff49210621e225daad82561b3fc178ff2a3e87302c0c

SHA512
eb8b132dcacdbe804724e96f089aa3791e19c7e3ba835e170030733d8ab2e87982ea782fbd63eb6db410bf4f14429f34e7679787937547d6a3ba325ade7958cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
1707fbfb1e00581dedc6dc95b7555fb9

SHA1
179d9926a0aaff534ab8e479429d346366005347

SHA256
f0193b29330f368f6c0fe8926b4ad7fbe3d0e9a4629e497238bcb6dcad0e2e7c

SHA512
1793876385a3b628e030d46ccfb088cf444b0183b4bbf8c6d5eabdfd2e9bd9b2f4f2530d4cf064ae23c4f6cfa2632ce4ca371b9073870ca068516992fba1d714

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionstore.jsonlz4

Filesize
6KB

MD5
7d58c5caa2f559022ea4b47e4e9f5b90

SHA1
568d7fafa2762ce0719a996dd713bb4fe47b277b

SHA256
6a60ba9040ac3ac7baff85801e9f1631a473b4b2841d33ea2b4382425ed47e1d

SHA512
aecbbe8bb50de1560a7046b40a03ac999583fb91a86d6fa6ec0f4475167d79c5ac6ee0b856c7b315c973578a71eecc389e00cd262474c870fa92ec1b68ef1706

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\sessionstore.jsonlz4

Filesize
266B

MD5
4fdb7f9a51ba177262d07d38c0238915

SHA1
f12c5a74467bf624164ac77ab7af517ce46ace8d

SHA256
a641f5701e0ccb2fc22a9f4323c96d899db4397fc08c63fc5de852d9aadca9d7

SHA512
fd0e72672b280e9f362cd8ba4a81c795fd741163020cd2c62a104c3f8e006883ac592951db85f364f3fece2d9af386f635b93ced301e12b4418e1e0a7fdd9c09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kquc1a5g.default-release-1720194865015\shield-preference-experiments.json

Filesize
18B

MD5
285cdefb3f582c224291f7a2530f3c4e

SHA1
f816c3e87aa007b6e6d31eb6a4618695a7d83439

SHA256
704d28223a4320a853df4a19d48c7015cf79d56a5317cc3475b6305fa43dcc05

SHA512
8f1decf1e4b5755fce8f165daae115f45d6890985c9c4bbb33a6f724cbfd26db75f6da06f9ef675de20fe755da9b7f55e5ee37124296a12a520a393da159bd58

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\6lk2b5bo.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
dfe3b31a92da177310be5c8d5822144f

SHA1
916c9fb06d027d609e096cad65567b308c296f82

SHA256
bad4e384a93ef73912df809d8716d96cfa3780e367aec88cfd5da4b06ad19af9

SHA512
e8aa17dba155f0327d11a37e6c261b2e6a046b78f1f4b4820b7f7e6dc1c1dd99fc33a87b5b34709ee14060c4e0569a521d159961d3b6b7ef573523597a43ad0a

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\6lk2b5bo.default-release\compatibility.ini

Filesize
200B

MD5
170ce2c50c8496fe8d0d2febfa08c06e

SHA1
f4b26b8d9fec9a9a7514b8c66a427d021510a375

SHA256
75f315800fe5caa702c2fc68b93dde1749fca7fc4d68cf5b08ea4bcd8dbf8387

SHA512
2077c20a8d1840932f09d64233dae145288c30c7c3159fa5c1933928ce9a8710077c7027dfc78efd1062510a0e53f37a4342228f2d845410103642c4c45ec786

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\6lk2b5bo.default-release\content-prefs.sqlite

Filesize
224KB

MD5
ff964240e1b01a217afadc5f90379433

SHA1
33617b461f947b2ca87dfa779a15ad6125141d4c

SHA256
9f82ad8620da1e921fd7a9e742806e0d343fae2b14a968482b06e9add83af72f

SHA512
4fa14588832452bc80bb0dbfe54ff18180e4f0a76b66b4dc99b788ff72acd4713f86215142bdbfc43fd6e00a7168b1ebcae62afb277efc99064ae65422707829

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\6lk2b5bo.default-release\cookies.sqlite

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\6lk2b5bo.default-release\extension-preferences.json

Filesize
1KB

MD5
ae847cbf837f2442924326b0e1da512a

SHA1
c4b8800837aa542921d44de0f5188db78b153a69

SHA256
1d48a03b907ea8c2412ab0dea238abcd1c7ba686dc1cac155ec55a598f0533f3

SHA512
9f7437c3e3bdebdee427642c232ad23a83142ec1c8cd2a3288358a8afa496c4b9a4a98f29a7baa706e837eb84ffdc1a4794114aaa3b7ced3b77bb97486410673

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\6lk2b5bo.default-release\extensions.json

Filesize
36KB

MD5
9218ce78aa4413d0d437f2fbc82e7d17

SHA1
b4bd81f4152736bb9fd6c1443065bd720b22af4e

SHA256
8147fe0fd56a4c1f66129f2b8b2af71f0cccfd1be0cf27e840d2130c01632b1f

SHA512
e451b438980bc9342fe8c68b5198a23dade8a7a9ba161400ab435be1823a60b84a215521dab886eddd40923b5c8e2b430c2a972458c65f2d154a872674ed38dd

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\6lk2b5bo.default-release\favicons.sqlite

Filesize
5.0MB

MD5
c77d596c6abf8dc731be615aaab796f2

SHA1
e7f4c32e749cb9e0a381c83c55db6753f47f6e79

SHA256
0e3cc97c66dc9a14502059460ad557d32eb03c7737c591e2051bcf70c083597d

SHA512
50cce52533216371941dea412441587a237232bd7dae48cf6345b34df971fd07b9eb2c5ef1c4b286aca9a910a1bbae878c70518b16de54f926c7cb63dfc425a8

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\6lk2b5bo.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite

Filesize
48KB

MD5
e22d991a158104f8d22b351c504f8e8f

SHA1
6c39e37dd819b132bfb18602f8c110af8d0064be

SHA256
73232362d7b7ab9a57ac3de5ce2fc4e1c4c9d3cf98b1123a8f30b90b384337ec

SHA512
7dd3949079bfe260d7e21ac224688ecdf580765f85306c33a1cbfde6c4b671bcbbcecf34e23e0ec850c7ed5c1506914ac59be9c9327673ab64acd894e2cf4d09

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\6lk2b5bo.default-release\targeting.snapshot.json

Filesize
3KB

MD5
87812611f6c0dce0326d457f8a3a2303

SHA1
7b73f8fa936e6a51a05b5e15fe0394227ca56893

SHA256
81028647d50f167acdffd85e63ab0706fb706b64e517c56d4335ab100c3063fa

SHA512
94bb36ef022de6614230606ecedc21e50994dcccb9c10e64401c0149847d051daf9155b8dfd9c04f0ddc8b9fcd1e999493ac4472c7a0723f2900895e13643ab8

Download Submit
C:\Users\Admin\Downloads\setup.exe

Filesize
3.6MB

MD5
23abc43ba1cf8c1b721681a3314c3722

SHA1
4d5746d41e91aa39963e531c8ebd5d2c17dcd082

SHA256
46e5afb96a092307725eb4503480ed4c894168884474df01b5a679bdae7e3e5e

SHA512
08d76d20d17956f974693a1c98e789a502292beea4824e5cb18d657ab07a21e93fabc581ba1fec01e32d6f0729f5b7f4a509587f72478eac786aceebce4cc95b

Download Submit
memory/212-1205-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/212-1155-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/904-1445-0x0000021544160000-0x0000021544260000-memory.dmp

Filesize
1024KB

Download
memory/904-1475-0x0000021544C60000-0x0000021544C80000-memory.dmp

Filesize
128KB

Download
memory/2296-1412-0x000001E06B1A0000-0x000001E06B1C0000-memory.dmp

Filesize
128KB

Download
memory/2296-1386-0x000001E06A830000-0x000001E06A930000-memory.dmp

Filesize
1024KB

Download
memory/2296-1385-0x000001E06A830000-0x000001E06A930000-memory.dmp

Filesize
1024KB

Download
memory/2892-1201-0x00007FFE6F3D0000-0x00007FFE6F3E0000-memory.dmp

Filesize
64KB

Download
memory/2892-1257-0x0000000002D80000-0x0000000002D81000-memory.dmp

Filesize
4KB

Download
memory/4260-1259-0x0000019FBB160000-0x0000019FBB260000-memory.dmp

Filesize
1024KB

Download
memory/4260-1285-0x000001A7BE140000-0x000001A7BE160000-memory.dmp

Filesize
128KB

Download
memory/4260-1264-0x000001A7BDFC0000-0x000001A7BDFE0000-memory.dmp

Filesize
128KB

Download
memory/4620-1204-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download