hxxps://drive[.]google[.]com/file/d/1XWv9Dor2XPdnsGsi9pNWcL-M7vudnw7A/view

Analysis

max time kernel
1799s
max time network
355s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1XWv9Dor2XPdnsGsi9pNWcL-M7vudnw7A/view

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Executes dropped EXE 16 IoCs

pid	Process
4696	Przejścia.tmp
992	Film Impact Video Transitions V4.7.2 CE.tmp
1032	AdobeIPCBrokerCustomHook.exe
896	RuntimeCustomHook.exe
2168	AdobeIPCBrokerCustomhook.exe
1772	HDCoreCustomHook.exe
2584	TokenResolverx64.exe
1668	TokenResolverx64.exe
3768	Set-up.exe
1040	Set-up.exe
2316	Set-up.exe
4356	Set-up.exe
1536	Set-up.exe
5788	Set-up.exe
5364	Set-up.exe
4972	Set-up.exe

Loads dropped DLL 5 IoCs

pid	Process
4696	Przejścia.tmp
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4508	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
6	drive.google.com
7	drive.google.com
8	drive.google.com
11	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	Set-up.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\IPCBox.pimx	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\TokenResolverx64.exe	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\is-8J6RL.tmp	Przejścia.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP2\is-OC7MB.tmp	Przejścia.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Distortions\is-1GG0Q.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Lights And Blurs\is-PTJA3.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Transformers\is-55K1K.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\CRLogTransport.exe	Set-up.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\HDPIM.dll	Set-up.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\LCC\imshelper.dll	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\is-AKBAU.tmp	Przejścia.tmp
File created	C:\Program Files\Film Impact\unins000.dat	Film Impact Video Transitions V4.7.2 CE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc12\32bit\vcredist_x86.exe	Set-up.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Core\Core.pimx	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Distortions\is-HBMFM.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Transformers\is-K60VP.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Transformers\is-QGRSF.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc14\	Set-up.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\CRLogTransport.exe	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\cr_win_client_config.cfg	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Core\Core.pimx	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\Set-up.exe	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Distortions\is-JA328.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc14\64bit\vcredist_x64.exe	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\HDZIP.dll	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\cr_win_client_config.cfg	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Lights And Blurs\is-SKA6O.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc10\64bit\	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\customhook\AdobeIPCBrokerCustomHook.exe	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\is-DA4GU.tmp	Przejścia.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Animation\is-QSKF8.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Distortions\is-N06QN.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc10\64bit\vcredist_x64.exe	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\customhook\	Set-up.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\LCC\VulcanBridge.dll	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\is-K8DFV.tmp	Przejścia.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\is-J0UL3.tmp	Przejścia.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\is-36OM5.tmp	Przejścia.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Essentials\is-FCFSK.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Lights And Blurs\is-D58KE.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Transformers\is-6VF0P.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\HDZIP.dll	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Transformers\is-M8E8I.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc10\32bit\vcredist_x86.exe	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\Runtime.pimx	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Animation\is-2IE4V.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Distortions\is-JT4Q7.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Essentials\is-06TV6.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc14\32bit\vcredist_x86.exe	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\LCC\VulcanBridge.dll	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc12\32bit\	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Core\Core.dll	Set-up.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\HDUWP.dll	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\LCC\IMSLib.dll	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Animation\is-CSOE2.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe	Set-up.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe	Set-up.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\HDNative.dll	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Lights And Blurs\is-BJJ5U.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\CRClient.dll	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Film Impact\Transformers\is-4BI6A.tmp	Film Impact Video Transitions V4.7.2 CE.tmp
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\customhook\AdobeIPCBrokerCustomHook.exe	Set-up.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\Setup.exe	Set-up.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\is-A422J.tmp	Przejścia.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 26 IoCs

pid	pid_target	Process	procid_target
1584	4876	WerFault.exe	113
4640	4436	WerFault.exe	118
3212	3388	WerFault.exe	123
3172	1044	WerFault.exe	130
4904	2256	WerFault.exe	133
1084	4672	WerFault.exe	153
3316	4956	WerFault.exe	156
2636	4328	WerFault.exe	160
3092	3616	WerFault.exe	164
2320	4904	WerFault.exe	167
3872	1372	WerFault.exe	170
4704	524	WerFault.exe	181
4568	812	WerFault.exe	185
3068	3340	WerFault.exe	188
4136	4568	WerFault.exe	192
2412	1992	WerFault.exe	195
4036	2204	WerFault.exe	198
4036	4956	WerFault.exe	201
3764	3768	WerFault.exe	210
1668	1040	WerFault.exe	213
3820	2316	WerFault.exe	217
5396	4356	WerFault.exe	224
380	1536	WerFault.exe	234
5208	5788	WerFault.exe	237
4524	5364	WerFault.exe	240
5892	4972	WerFault.exe	255

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Film Impact Video Transitions V4.7.2 CE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Film Impact Video Transitions V4.7.2 CE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeCustomHook.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HDCoreCustomHook.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Przejścia.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeIPCBrokerCustomHook.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeIPCBrokerCustomhook.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Przejścia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe

Checks SCSI registry key(s) 3 TTPs 15 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Set-up.exe = "11001"	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\auphd\DefaultIcon\ = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\Adobe Desktop Common\\HDBox\\Adobe Update Helper.exe,1\""	HDCoreCustomHook.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "15"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\auphd\shell\open\command	HDCoreCustomHook.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\auphd	HDCoreCustomHook.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\auphd\ = "URL:Adobe Update Protocol"	HDCoreCustomHook.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\auphd\URL Protocol = "\"\""	HDCoreCustomHook.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\auphd\shell\open	HDCoreCustomHook.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000020000000300000001000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\auphd\DefaultIcon	HDCoreCustomHook.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\auphd\shell\open\command\ = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\Adobe Desktop Common\\HDBox\\Adobe Update Helper.exe\" \"%1\""	HDCoreCustomHook.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202020202	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\auphd\shell	HDCoreCustomHook.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Paczka Montażysty.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Paczka Montażysty(1).zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4696	Przejścia.tmp
4696	Przejścia.tmp
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe
4228	Set-up.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3212	taskmgr.exe
2276	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeRestorePrivilege	1356	7zG.exe
Token: 35	1356	7zG.exe
Token: SeSecurityPrivilege	1356	7zG.exe
Token: SeSecurityPrivilege	1356	7zG.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	3524	firefox.exe
Token: SeDebugPrivilege	4764	taskmgr.exe
Token: SeSystemProfilePrivilege	4764	taskmgr.exe
Token: SeCreateGlobalPrivilege	4764	taskmgr.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe
Token: SeDebugPrivilege	4228	Set-up.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
1356	7zG.exe
4696	Przejścia.tmp
992	Film Impact Video Transitions V4.7.2 CE.tmp
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe
4764	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
3524	firefox.exe
4876	Set-up.exe
4876	Set-up.exe
4436	Set-up.exe
4436	Set-up.exe
3388	Set-up.exe
3388	Set-up.exe
1044	Set-up.exe
1044	Set-up.exe
2256	Set-up.exe
2256	Set-up.exe
4672	Set-up.exe
4672	Set-up.exe
4956	Set-up.exe
4956	Set-up.exe
4328	Set-up.exe
4328	Set-up.exe
3616	Set-up.exe
3616	Set-up.exe
4904	Set-up.exe
4904	Set-up.exe
1372	Set-up.exe
1372	Set-up.exe
524	Set-up.exe
524	Set-up.exe
812	Set-up.exe
812	Set-up.exe
3340	Set-up.exe
3340	Set-up.exe
4568	Set-up.exe
4568	Set-up.exe
1992	Set-up.exe
1992	Set-up.exe
2204	Set-up.exe
2204	Set-up.exe
4956	Set-up.exe
4956	Set-up.exe
3768	Set-up.exe
3768	Set-up.exe
1040	Set-up.exe
1040	Set-up.exe
2316	Set-up.exe
2316	Set-up.exe
4356	Set-up.exe
4356	Set-up.exe
3524	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 3524	4856	firefox.exe	84
PID 4856 wrote to memory of 3524	4856	firefox.exe	84
PID 4856 wrote to memory of 3524	4856	firefox.exe	84
PID 4856 wrote to memory of 3524	4856	firefox.exe	84
PID 4856 wrote to memory of 3524	4856	firefox.exe	84
PID 4856 wrote to memory of 3524	4856	firefox.exe	84
PID 4856 wrote to memory of 3524	4856	firefox.exe	84
PID 4856 wrote to memory of 3524	4856	firefox.exe	84
PID 4856 wrote to memory of 3524	4856	firefox.exe	84
PID 4856 wrote to memory of 3524	4856	firefox.exe	84
PID 4856 wrote to memory of 3524	4856	firefox.exe	84
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2140	3524	firefox.exe	85
PID 3524 wrote to memory of 2540	3524	firefox.exe	86
PID 3524 wrote to memory of 2540	3524	firefox.exe	86
PID 3524 wrote to memory of 2540	3524	firefox.exe	86
PID 3524 wrote to memory of 2540	3524	firefox.exe	86
PID 3524 wrote to memory of 2540	3524	firefox.exe	86
PID 3524 wrote to memory of 2540	3524	firefox.exe	86
PID 3524 wrote to memory of 2540	3524	firefox.exe	86
PID 3524 wrote to memory of 2540	3524	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://drive.google.com/file/d/1XWv9Dor2XPdnsGsi9pNWcL-M7vudnw7A/view"
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://drive.google.com/file/d/1XWv9Dor2XPdnsGsi9pNWcL-M7vudnw7A/view
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d7b05ea-1708-4bae-8c62-646eaaef14cf} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" gpu
    3⤵
    PID:2140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59563b00-f847-4a69-bd17-588904791d7b} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" socket
    3⤵
    - Checks processor information in registry
    PID:2540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1564 -childID 1 -isForBrowser -prefsHandle 3180 -prefMapHandle 3076 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1288b36-f99c-4742-8023-7e739d23194f} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -childID 2 -isForBrowser -prefsHandle 4132 -prefMapHandle 4128 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {343456d6-5761-4306-a687-59874a1622a0} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:2852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4836 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4828 -prefMapHandle 4772 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08302337-e805-45f4-8665-dfaa7c9900b4} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" utility
    3⤵
    - Checks processor information in registry
    PID:3860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5244 -childID 3 -isForBrowser -prefsHandle 5280 -prefMapHandle 4992 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb80aa60-0ae2-4678-a38a-aba45ad8c280} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:4968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5404 -childID 4 -isForBrowser -prefsHandle 5412 -prefMapHandle 5416 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6f7939f-de7f-49c1-a215-f286d43949e9} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:1124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -childID 5 -isForBrowser -prefsHandle 5696 -prefMapHandle 5692 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71332514-cc4b-4674-bf77-30e8037bf537} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:3772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 6 -isForBrowser -prefsHandle 5876 -prefMapHandle 5864 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a5a10e8-0c16-49ad-9512-08f4b9d911df} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3304 -childID 7 -isForBrowser -prefsHandle 2956 -prefMapHandle 2812 -prefsLen 28398 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {947a573a-2ab2-49c1-91f8-550786325b89} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6056 -childID 8 -isForBrowser -prefsHandle 976 -prefMapHandle 1280 -prefsLen 28398 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c99e2296-d9e2-45df-9185-7a5c63d32502} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:2652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6936 -parentBuildID 20240401114208 -prefsHandle 6928 -prefMapHandle 6924 -prefsLen 31084 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {94a8d8ac-03f8-49da-a3ef-38c487ec1845} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" rdd
    3⤵
    PID:972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6900 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6948 -prefMapHandle 6944 -prefsLen 31084 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25375fb2-1d24-4f0a-8fd7-c03a70bef9bf} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" utility
    3⤵
    - Checks processor information in registry
    PID:540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3316 -childID 9 -isForBrowser -prefsHandle 3932 -prefMapHandle 5312 -prefsLen 31084 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4869d7d7-ea99-4d27-867a-82a5a99351f8} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=964 -childID 10 -isForBrowser -prefsHandle 3940 -prefMapHandle 4520 -prefsLen 28398 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fa686b0-11b6-41b8-a318-79c0d9874399} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:2348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7752 -childID 11 -isForBrowser -prefsHandle 7608 -prefMapHandle 7744 -prefsLen 28398 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ab706c6-2ed4-4e51-a948-8cc623b0f119} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:2092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8068 -childID 12 -isForBrowser -prefsHandle 8048 -prefMapHandle 8044 -prefsLen 28398 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {600e3868-98e0-4330-8957-22326309526b} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:3804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 13 -isForBrowser -prefsHandle 5556 -prefMapHandle 5564 -prefsLen 28398 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d2b0a67-79da-4b31-88eb-61a86405c3a6} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:5372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8748 -childID 14 -isForBrowser -prefsHandle 5360 -prefMapHandle 8764 -prefsLen 28398 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f11b8e1e-1e8a-45e1-bc3f-6618e8b15fcd} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:6068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7984 -childID 15 -isForBrowser -prefsHandle 8748 -prefMapHandle 8372 -prefsLen 28398 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90540e7f-a956-4aaf-bc77-c93270887edd} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:5648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8516 -childID 16 -isForBrowser -prefsHandle 8452 -prefMapHandle 8432 -prefsLen 28398 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82e013bb-4265-4a28-bc96-0dd6e2faf622} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" tab
    3⤵
    PID:6132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3608

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Paczka Montażysty\" -spe -an -ai#7zMap16736:96:7zEvent1834
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1356

C:\Users\Admin\Desktop\paczka montażysty — kopia\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\paczka montażysty — kopia\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 2468
  2⤵
  - Program crash
  PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4876 -ip 4876
1⤵
PID:1292

C:\Users\Admin\Desktop\paczka montażysty — kopia\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\paczka montażysty — kopia\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 2244
  2⤵
  - Program crash
  PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4436 -ip 4436
1⤵
PID:3380

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1680
  2⤵
  - Program crash
  PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3388 -ip 3388
1⤵
PID:1076

C:\Users\Admin\Desktop\paczka montażysty — kopia\Przejścia Premiere Pro Film Impact\Przejścia.exe
"C:\Users\Admin\Desktop\paczka montażysty — kopia\Przejścia Premiere Pro Film Impact\Przejścia.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3844
- C:\Users\Admin\AppData\Local\Temp\is-7MHQU.tmp\Przejścia.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7MHQU.tmp\Przejścia.tmp" /SL5="$D01C6,1210221,176640,C:\Users\Admin\Desktop\paczka montażysty — kopia\Przejścia Premiere Pro Film Impact\Przejścia.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4696

C:\Users\Admin\Desktop\paczka montażysty — kopia\Przejścia Premiere Pro Film Impact\Film Impact Video Transitions V4.7.2 CE.exe
"C:\Users\Admin\Desktop\paczka montażysty — kopia\Przejścia Premiere Pro Film Impact\Film Impact Video Transitions V4.7.2 CE.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4092
- C:\Users\Admin\AppData\Local\Temp\is-4C4F0.tmp\Film Impact Video Transitions V4.7.2 CE.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4C4F0.tmp\Film Impact Video Transitions V4.7.2 CE.tmp" /SL5="$90376,24449674,1071616,C:\Users\Admin\Desktop\paczka montażysty — kopia\Przejścia Premiere Pro Film Impact\Film Impact Video Transitions V4.7.2 CE.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:992

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 2236
  2⤵
  - Program crash
  PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1044 -ip 1044
1⤵
PID:4468

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 2220
  2⤵
  - Program crash
  PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2256 -ip 2256
1⤵
PID:4092

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4764

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:3300
- C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
  "C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe" --pipename={A4CD761A-2237-4B97-94A5-0BC36DAC45EF}
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4228
- - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\customhook\AdobeIPCBrokerCustomHook.exe
    "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\customhook\AdobeIPCBrokerCustomHook.exe" -uninstall
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1032
- - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe
    "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe" --VC10_win32=1 --VC10_win64=1 --VC11_win32=1 --VC11_win64=1 --VC12_win32=1 --VC12_win64=1 --VC14_win32=1 --VC14_win64=1 --VC14.1_win32=1 --VC14.1_win64=1
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:896
- - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\customhook\AdobeIPCBrokerCustomhook.exe
    "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\customhook\AdobeIPCBrokerCustomhook.exe" -install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2168
  - - C:\Windows\SysWOW64\icacls.exe
      C:\Windows\system32\icacls.exe "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" /setintegritylevel medium
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4508
- - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\customhook\HDCoreCustomHook.exe
    "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\customhook\HDCoreCustomHook.exe" --install=1
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1772
- - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\TokenResolverx64.exe
    "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\TokenResolverx64.exe" C:\Users\Admin\AppData\Local\Temp\Adobe_x64tokens.tmp
    3⤵
    - Executes dropped EXE
    PID:2584
- - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\TokenResolverx64.exe
    "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\TokenResolverx64.exe" C:\Users\Admin\AppData\Local\Temp\Adobe_x64tokens.tmp
    3⤵
    - Executes dropped EXE
    PID:1668

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 2244
  2⤵
  - Program crash
  PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4672 -ip 4672
1⤵
PID:3212

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 2256
  2⤵
  - Program crash
  PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4956 -ip 4956
1⤵
PID:820

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
PID:3864

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 2232
  2⤵
  - Program crash
  PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4328 -ip 4328
1⤵
PID:2492

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 2244
  2⤵
  - Program crash
  PID:3092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3616 -ip 3616
1⤵
PID:4536

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 2236
  2⤵
  - Program crash
  PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4904 -ip 4904
1⤵
PID:3648

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 2236
  2⤵
  - Program crash
  PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1372 -ip 1372
1⤵
PID:2632

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 2248
  2⤵
  - Program crash
  PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 524 -ip 524
1⤵
PID:2060

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
PID:4820

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 2220
  2⤵
  - Program crash
  PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 812 -ip 812
1⤵
PID:4240

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 2248
  2⤵
  - Program crash
  PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3340 -ip 3340
1⤵
PID:608

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 2228
  2⤵
  - Program crash
  PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4568 -ip 4568
1⤵
PID:3792

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 2244
  2⤵
  - Program crash
  PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1992 -ip 1992
1⤵
PID:424

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 2224
  2⤵
  - Program crash
  PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2204 -ip 2204
1⤵
PID:1584

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 2240
  2⤵
  - Program crash
  PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4956 -ip 4956
1⤵
PID:4972

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap27518:94:7zEvent9552 -ad -saa -- "C:\Users\Admin\Desktop\Adobe Premier Pro 2020"
1⤵
PID:3128

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 2244
  2⤵
  - Program crash
  PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3768 -ip 3768
1⤵
PID:1084

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 2228
  2⤵
  - Program crash
  PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1040 -ip 1040
1⤵
PID:3948

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
PID:4584

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 2232
  2⤵
  - Program crash
  PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2316 -ip 2316
1⤵
PID:1292

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 2208
  2⤵
  - Program crash
  PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4356 -ip 4356
1⤵
PID:5376

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c8 0x2f4
1⤵
PID:5872

C:\Users\Admin\Desktop\Set-up.exe
"C:\Users\Admin\Desktop\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 2272
  2⤵
  - Program crash
  PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1536 -ip 1536
1⤵
PID:3024

C:\Users\Admin\Desktop\Set-up.exe
"C:\Users\Admin\Desktop\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:5788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 2244
  2⤵
  - Program crash
  PID:5208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5788 -ip 5788
1⤵
PID:4904

C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
"C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:5364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 2232
  2⤵
  - Program crash
  PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5364 -ip 5364
1⤵
PID:4028

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:3212

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5736
- C:\Users\Admin\Desktop\Adobe Premier Pro 2020\Set-up.exe
  Set-up.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  PID:4972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 2244
    3⤵
    - Program crash
    PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4972 -ip 4972
1⤵
PID:1724

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
- Modifies registry class
PID:5436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:5664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:5416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:1124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:2620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:4476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:4068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:5264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:5480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:5456

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\Adobe Premier Pro 2020.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2276
- C:\Users\Admin\AppData\Local\Temp\7zO4E813003\Set-up.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO4E813003\Set-up.exe"
  2⤵
  PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\HDIM.dll

Filesize
379KB

MD5
058968a2932bd2b860ea265aaf115a10

SHA1
8834e9e2bee054cbc16350c6214c9aad16ed2889

SHA256
41c9f4f4035bcab439b935d4ef183ccfb4d1acd4d3b079e7a33dc88cd65500a9

SHA512
9ca1a7c1358cf1a06e82b99f5ce531915b3cb6db705231ecbe2efa8cc1d85340b77707f7553ae3362b3b596dfc7c62170070de8b40b029cde012df3e501a297d

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\HDPIM.dll

Filesize
2.8MB

MD5
c2751fbb427fcd8244f5936a2453ac70

SHA1
97aa82828bc43ecee6eb838eaa91ce5d6fedc939

SHA256
66c4aed3f4aea1f74d46a22fe72501d79f5d78c1f7a210991feb1e3c9516c7e0

SHA512
afc82f9e46102392a727a42a3786d1b694993cb613fb013378b5e246c7232f08a7ab5dd097032d88d318ce67243eb06ef81ead99286f2fd4b5c2a7228ab04c10

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\customhook\HDCoreCustomHook.exe

Filesize
1.1MB

MD5
86ca8834214195edd8e7c18ec4f566cd

SHA1
b3b79b438ae06bf0481cf38a1d9727914d768012

SHA256
9a1c114b8b9b8a7d5e02025d659d2eea1dac9475df86bdc34a2b61ce217f6ea9

SHA512
fabc38ca456a2151e42ef40d1b8adff1c6b1b6627687a6eb2270b0c77b2b226007506d70cc60980e2dfadbee463d812431c4c62267b922cfc2386c95c7d64c6f

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe

Filesize
1.0MB

MD5
df1be9fee60a63f53cfab084d820c4e0

SHA1
72732fe67539cd5111a6393e8e3061a94e9cdc2b

SHA256
3efca3f037960a5ff850216399afe8e35c4b168a0f459b9a289875e160e82c31

SHA512
d3d48ff519f1bd69d5ea15fbcd6c40c07370323fdf98019a7308e7be4db95f398d4e0ba891527f1b688f6d1160b35e1eaefc90239391a72dca744c6c2a1ec298

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\customhook\AdobeIPCBrokerCustomHook.exe

Filesize
219KB

MD5
1e6f1365903fd8f4c12b730b5e13e7df

SHA1
c707a51066b4ed807193460f3e34c8bc70701414

SHA256
65fda4a94155d447a67dc8a6aa62b6160736d4383b4e7c2cf26fe9a2df37cdc2

SHA512
1254de457519ffd167499de8de08a9a4004f6c05284e40af2ea00ca44a25a0864b2f71a208fb2b27e2a88ba8bd39857cd85e9b86f84143a785e11238db3a4d72

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\LCC\LCC.pimx

Filesize
12KB

MD5
a7c05e854712c1d94e7eaac2c3f32cd0

SHA1
38c09424d3d596d0047af111ff9f7be04229e01d

SHA256
29ab453ced5d4c5cb784354151f3e628a33d36bdaa2996082cd2fa452d918e9c

SHA512
b569c93c19b57ffc6e4fa14cb371792eeac9795be17227ffb05a04afd70e1fe97703f0aaad4ac343e469793fb527051eff4872fdaee68426e09b092eb30f4830

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe

Filesize
372KB

MD5
0698d7c17514cd8e79a9fba15f6e2b7d

SHA1
71892c49cfb997a814853e418cde2139629d7c3c

SHA256
4ab766658e49592c96d2e9324330eb0bf58bec16b2f9450df8057eec803fb344

SHA512
643f0dda2970c215227e7a883d874eec4f561a721267e3b83c3eb3652649e443de51c5324627808fc09834abea0f4902bef9ab7e27619a08577c330df3f04552

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Installers\Install.log

Filesize
588B

MD5
87107681fb0d2185146c49754856a5fe

SHA1
951fb3f77fe73649c5ac7f7e6d65df06a7379c35

SHA256
b43f3bcc2eab7730740969061b2f1a5927acf735db7f1de3e0ee5e493301ed2d

SHA512
c002520e28c1e5fda8005563414df2252a96a4df2ab19484ed596aa8ce77e72ea1703aa8300a0817346c790f903fff068128d6b9bcf6e7bb4f54236fbe624d15

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Installers\Install.log

Filesize
26KB

MD5
b430c31606ecaf811c0d91fcea333fef

SHA1
ebb08ef95518325e51fbc501a470c1a0667be17f

SHA256
e58a0c4b08b0c8f0e1781ba225e4d10b6446d06202cef84faa7f4e8b33849176

SHA512
5d2e689ee0200147a8d02cacd7ec856dc49e1d70818f4d58c2f97e51cce20defcb825ab1ed5b33e9d4df8a863d35bb47427d2ebc589803ec035153abdff61ba6

Download Submit
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\IPC.pimx

Filesize
57KB

MD5
92b46252406ffa6646cf4be809986623

SHA1
5543faedc35038cb6848f64c91e413b380505689

SHA256
0184e6b63dea884037cfa862107bd3e2d99a244334dfa641a4a1c312a5e59ce1

SHA512
39c21416428e9ce485c0fc4da6935783017e546297a1ab3d8b91402f27e4f11ee8b2744c15ccfe2ac5d873247b1b4b3537863e65b87a3e477999f58fca0366ca

Download Submit
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\customhook\AdobeIPCBrokerCustomHook.exe

Filesize
197KB

MD5
64100ce9dd9e670e28a487aabe7c1241

SHA1
4ac3eeb414d7d8d1c80b8644e445d2684991150f

SHA256
e97c8ed6d6c95556c11f73149a54b759548fd144e23f320ffa573709db9ccba7

SHA512
8527b9df907e98f0e810583cb1e64b7f8486e540daea5a7c0052e96d94516290eeb4f22163ed16b17006974d407132565e2c48d653ba385ab86857c0290d7cef

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\AE_Impact_Blur_Dissolve.prm

Filesize
287KB

MD5
af84bd690d58f0ad865b9c47be1466af

SHA1
a4373563da4545a97890ab90a01b79a322a25a18

SHA256
e47628d4f43a9baa02115f83cda6e5d0a2bf026a7ce81fb331c70cac462a8f09

SHA512
5491685d05546a81709c6797186a44d774724267a62da7ef7d1dcc2e1c81199f60ac1a4fb5b7c3bbd6147108108035e61ec60b59ab9536118ba453ee4dc5c68f

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\AE_Impact_Blur_To_Color.prm

Filesize
250KB

MD5
0d79ca4baf4045263f0f3c1b5c55e7bc

SHA1
4bda2147d8d4e66878df5b253741270ed721c85e

SHA256
52d818a1c857540e22c008a3ff8f31f01101aa3e86a33ca207b3d6b04e124f0a

SHA512
31218dc433487bdaf7ee8eea74bb69ffd973276932041b7dff01ca979a55146340c88fec92702e3198574ab57eeb2f092b75a81aa88bb5f70db5a52bfbf19dbc

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\AE_Impact_Burn_Alpha.prm

Filesize
289KB

MD5
4af9ec588271f2324c66d764d8e87fd4

SHA1
619281d622414e8294ae1711cbaad543c4ec55ac

SHA256
0a76be8438a67129830036c90a5242b9c3c7c535b5fc80e2c0e512b0b7a8b4cf

SHA512
43e0a583fa451e230108fde1a8f97efea53c4dff26e210ddb868c27c3687420d642f7d8ab28c0fef2017b6a7d1738d4ec9adf8eaeacfd691ac64ab4d383af05c

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\AE_Impact_Burn_White.prm

Filesize
291KB

MD5
5257e1e88288adaf2e33098ab937d804

SHA1
0d0132b70e340e3d53051943df58641f8fcbcebb

SHA256
6cf26a918792a27324d796596c577f3ba27bcb2d6181aa5a31a97ff0093ef9db

SHA512
7a1a4af1295dfaebb199c466141e81c79258e45b7191ea9216dfa8e84995a042f4cf0ff2a859387cb719f7983c37054a5ed6cc9b2f48ca43a188f32d619a345d

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\AE_Impact_Chaos.prm

Filesize
279KB

MD5
3d217c7a766f3986312746ccd1fff6a5

SHA1
73b8758559ba6141e14fa8bd3e99ab96e0a3fc5d

SHA256
45c50406da33f12264f59f12988b924f3b62007ed0f0cc348280ae2544891791

SHA512
fe5657504fcca8c3c1f54cc2ee05bdbbb6b07454ca0f503393018bf0432933705f356577c06d83e2cbb7ce760a134874be3dfc0befd21291b28507f138142eaa

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\AE_Impact_Copy_Machine.prm

Filesize
290KB

MD5
8d13b1eb9cde7a04ffab2e9649252066

SHA1
ceca9ef4e3e4b510ea7c939c550e37ef8e0bf79a

SHA256
d247d55908ef3ce05c0858d4997a08a3acef5a72f38a22544751e9e93a3c2574

SHA512
d524d4837961c6281a6d8150be17e9e85421a762a3ce8ab01d75db17b26481406ec45acd69f300729782bbd148b99072794eaccbecd1d574446fb796595ca887

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\AE_Impact_Flash.prm

Filesize
272KB

MD5
ff64d9adbd261ace848972e181437f91

SHA1
c075ef27c7808e7c9868feb120f7d42645d9cebe

SHA256
c6617cb78eddf827d58662db445c5ec42bf3e75b58d8d7df9c54bf6ddd295c47

SHA512
cefac1bfb9966f23c0ae14f0460340d0b41147732a9ef9e9df46472b252e533c7656a77733d417c4969e38c081f1025934aa7961471d07807e15eff05c4a4970

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\AE_Impact_Push.prm

Filesize
257KB

MD5
ae306d948c18074cd03d7095248604a3

SHA1
7e0ed9658afab83d3e07e30f4868f7d7e8890909

SHA256
28239500dd0420c7684ee8b989fbafd95455d176989adbf68d59b549e48e214a

SHA512
ba0b80e93d6591259861dc135e7e83ffec6def1c9d80dab48e7900fb1887a2dd947e351377db44a76083e5c4b0e4651be34e602ed966ee126cd2738e228b17d8

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\AE_Impact_Roll.prm

Filesize
258KB

MD5
3295c24815aa600d58edb5357c78cc5b

SHA1
8dbf26470751b98e794530bdbf4f9b1878b9ceeb

SHA256
abb309bb10d9c56d0f4ce996739fcd722eab03e135aaae7d04a9d3156ad0e3b7

SHA512
adf01a7521ba9ed87ed4bc308ecaa8721315068158e4526aba1ccb27c53c1c032feca6787ecde9ddc95aafcb570afd86b879753a751b06739c70e2c336afe4e5

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP1\AE_Impact_Stretch.prm

Filesize
290KB

MD5
361942dcda0a251fb19f693b756d9eee

SHA1
1e84061991d34e745f49ccdffe7a0856df9f116c

SHA256
36159326f44a6cdd733ad6d0f9cb0e6e384a000e78b94e661ceb794151fc994b

SHA512
2ea732d617f0f21d061846b06967501f9fbfed609fce5c115de708ff7c81a0612b196f3a3061bd16f1e5e797f40bed95057ee6d57d2f3b6a82dba00eb1d8bddc

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP2\AE_Impact_Chroma_Leaks.prm

Filesize
329KB

MD5
5681358725fb9fd12a55e1f1a6c8f305

SHA1
bcb59d41f490ce1751e1e18386eea7c72ad8de9a

SHA256
78fe29c601df031a92de6f3ccdd1c6546c0588d69ee2fc3b696478ac6cd62996

SHA512
89ef323d3f305d96bd560274d370ed9b91cc5044e4928024082c7fbbc01266868e2ce2cfe706aef223dd589e7fb5ede5008495d7f9787cf80a80a6725c187a73

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP2\AE_Impact_Directional_Blur.prm

Filesize
309KB

MD5
8807a9a279aa2f7b6dcecf03c8511d52

SHA1
0f3450b42e12b9ca3899475426284a47d8c11072

SHA256
7ed3efc69ec644af2b7c9b9e347dd4f79d479c3f286502610e51063223238917

SHA512
ecff9d06fe693a3f11b9ef5eec2d53092369a50d4834f06c45e7dde8d894ec44786ff3e3ccb049644032360042695373508f497c0c80c868329ec7921b3275f4

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP2\AE_Impact_Earthquake.prm

Filesize
308KB

MD5
408d6b0676cd015fc18088bc00e344b9

SHA1
a72c60ad224526b6b16f5734c95c5ea0506c71cf

SHA256
047132071bbadaf89c08ab2a6976295da5dcdb5a923de415bf785928bccb5e5a

SHA512
bb2b91b47aaf9a669ef5ef2af6dadaa312be37e555043021c80a4cc482d504b06d8327d73211a75da853c5ff207aa2aed7dc72ca226b60bf95f3f4ff10ae018d

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP2\AE_Impact_Glass.prm

Filesize
320KB

MD5
d4285b35ecfe84a4bdc4800ca0e4711b

SHA1
f3a00059e3a8b48fc14c734e9bf34b4637ae4091

SHA256
66aaabaabac330422d77642531e9d81a7cd755b6642c2d9fa1eb58b7a6af9159

SHA512
fb79a9475ff4df190792dda7a6f18e6f7e44b497896d8e639918f9e50d5b20ce9334602661573e982f63ec83deaa756557a731cce42002c92c684a44beffcedb

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP2\AE_Impact_Radial_Blur.prm

Filesize
309KB

MD5
a84c1f667f3e4a4137d392816e78ad1f

SHA1
5b9057f973c5cfa00cde3d5803a925eff37b3b4c

SHA256
59877b2ac669de888d4814331f9ec19e47f3331050dea0a0f6ac8c9d2d7f3e83

SHA512
426a1c0c4ac5bae306aa650ea2b41ed336c91413c1abd7d361ecdcf21f2a7ecf7b629c862469b681857c1e5470e537f1e101df2a3c580fc269d84898a4f34402

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP2\AE_Impact_Rays.prm

Filesize
314KB

MD5
e771caa985a3bccafc6ac018ca856cb7

SHA1
c2ed73fd624ad3b95eae9b9efc96ffb411bf4f4d

SHA256
adeb632ef4ff9940dedb07aaaedf828d9b93126796d47b84b0fd4d830b51f59d

SHA512
4c88be6a45a5fce4591f6d190e86937be01a9baec97d05e61ffa9b63cf6c3727e5f75dea615bd1d27624fc656c01d3c72213ff7b9af50802e2411d027196b362

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP2\AE_Impact_TV_Power.prm

Filesize
322KB

MD5
595dda2334d533eadff993713d4d1a53

SHA1
cfe98458294ea8dd4bbe13fe118f165fd9695b27

SHA256
4dcffe3a5b86310fab406116b5ee1fc54d269f213213b0c1b7985355d2789e37

SHA512
e069ef8cc4bbf743d1f6494b8a1787a1b6cf65c64f4935695aaa38e0e7f54f326a26f6580c7dfcdf7f47943241ddebd00569cfdb88b74eb69c8bcd077b55076a

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP2\AE_Impact_VHS_Damage.prm

Filesize
330KB

MD5
fc09d64bf93307991eeb0feaada6c09e

SHA1
e0f78a9fcd313f917451e0ec9bd693529775bdd7

SHA256
959d0abf4d07faa9ed7a3b5757ebe1985c9bfad83e1527e223edd422e5ae79d4

SHA512
9bb6cca759d582265709775f62d6ea8f43d2015ffaac41ac437a199eb0cdb120b6a10e687b98ad1b18bc1c537427c0728ae9824a260794c77c5860a491f5906b

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP2\AE_Impact_Wipe.prm

Filesize
323KB

MD5
1d73578c9c09dd5fcc20f9727298ec7e

SHA1
92a0f065845cb0cf8fddf2f4ebac9e183a0a0cdc

SHA256
6ed632ef55e88a36ae9ab735d0d9143b20fa863a01d87db28eee17d7a88e0713

SHA512
f173dbca3fb6a7bbb5ec47889cba540d785d53c208ffebd98c4596452907044004dcf95d47585f575875027c22949652276798a10003ff0c9bf53a829aa8b080

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP2\AE_Impact_Zoom_Blur.prm

Filesize
306KB

MD5
05ebcac1bdefcc32a9c493fb86cbdc26

SHA1
499cb0fc77b37e874353a9a87542dcb75b070c68

SHA256
55d715470a3ae8ce42bcaffd780c400d58f6e6264e44615a4e08c29c2d19ebc4

SHA512
dbf5471c9eb4482474bc5fa266954dc5e03dd24ca419f4e7d2b39ce031802d8cf9b9920437f7b7a13706b9204b02bc32df29d431864175fcc105e968dc5b97c6

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\AE_Impact_3D_Blinds.prm

Filesize
344KB

MD5
e894c6f7b71e1fed0d97671aeca5b8d3

SHA1
d1748086101c3971d4f187b7d2238f08f9e3768e

SHA256
9b352f5d33c57a791c8fb276207e2b773a2741fc1d5248d23f307d89e264a77e

SHA512
e12dd0615f01ba7b32e934ab56aca68417f156d6ada2362de85b85075c79a460f0b376beb6385cb06ac88802a38318157c60ee6d2bf5c24df9edb213de4f84c0

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\AE_Impact_3D_Roll.prm

Filesize
345KB

MD5
c8265e554b3146db4bb3f3d23efe866b

SHA1
1874781b67a74b31a3410d592f2c911e59dc29c9

SHA256
201314f9d84e7af18fdec2a4dae282b1afea78c406c9c6406d866dab6d6d31c3

SHA512
f7fce0583883641584bd917d8f1a3a2f48c73279ad6d56bf9fa0483f027607ad618dec31218a3551705858ba2a3e40abee5bad99b45d648eb82adf26aa9d15e8

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\AE_Impact_3D_Spin.prm

Filesize
337KB

MD5
95148c61525388ccb9baec23ec6b9e7b

SHA1
61f84b1e2204d8a50d909572ad9e5b3aee2bc7ec

SHA256
59175f5620a3120e91b1722fd6bc7fa7c07f594dd46ea87f4c4e3fa0225f415b

SHA512
f80fbc3bf1c113c00fdc77e54ef9bcca432febc1f90fa124d0f63074d85d62abd85efc04973969730a7a453919e6da152220f5f22620614a24274cabaf959def

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\AE_Impact_Flare.prm

Filesize
362KB

MD5
5b91010faca7f51c72323b223d059b3c

SHA1
eacdfea915793ed9c604eaf8c6988749a78acf90

SHA256
ce7e6b0799cc3093d8dbab485a9446bc1344cc48ca59f28485330105b517cc61

SHA512
23b308468250bb8ac692690a1d98c0109aef71024f4d61e3d745db4bd7820a6b9640f14cb20b6810be09c462c0bc5e38df65f7a21a1c69b05ffc6a87f90b254c

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\AE_Impact_Glitch.prm

Filesize
337KB

MD5
74c86f79993798c93cc965bbb00db225

SHA1
4d75300528b3c29ed5bee4ea2df8522856245ac6

SHA256
f4c4d97bd0ada5edd3fc621afd4913ee9c9b9304c2a49954f96bb1618a00acde

SHA512
db3fd449e8797dd02df70d1d858028b29c6815b7f6699f7312fd2ba807ddef85a666541edb023cae10e85024c745998605cafc0e49d482fc41fea43643e04cba

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\AE_Impact_Glow.prm

Filesize
332KB

MD5
4ec1ed35b047ea4fde6b4d5d8cf9f261

SHA1
6bc29764f3ea5a98f42068f57f79357d6481f95f

SHA256
df86ee0c5563afeee93c4ac50c926c045f85bbed6fff372366de4255e7f2f13c

SHA512
e2970adb70a440ec5565057726cd06ced16caaff194531164f4db953a9a954961659ec0dc61a7c9d0ebb75ac5e04f51b814623bd33d5d98ed9bc1d3378d7bfb7

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\AE_Impact_Light_Leaks.prm

Filesize
346KB

MD5
533e672db26268eb36f25f1ea9a5b82f

SHA1
a362b3a47b5ae0ef801030cc842c1500e27a564d

SHA256
e55aef3ff2b6e37950dc391199ffe602d97c7ab82085289fecf946e29230ab7a

SHA512
a42f547fe25f6544510c907aaac78375dd67f3ff76246aeefc4d0d2a5008e56f3c2f52bd5f32f6a33de5c3f7c621b5248b6e117a4fa70fe293515b22a849c528

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\AE_Impact_Solarize.prm

Filesize
335KB

MD5
8dea5921bce2cb051a50d2f63a5bd21a

SHA1
b3d75d9e06a6302ff7aac4909b341fbafae8b102

SHA256
2f7d8b86faeb93df97509234282977b7f25c229da4d70f36969af530a34d900f

SHA512
251ade088be3e1c8efeafb82118bd90c30f1ffc103be28c3905094a347b05852d4c21dc5269cdd71a8578dafe8402846bd10daf26cc07ded198afb420ec9302d

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\AE_Impact_Stripes.prm

Filesize
313KB

MD5
c9e63aab3a2397afe46c896320bbc97f

SHA1
68beeeb25ebbb08ace3193af52637e1147fb7485

SHA256
383de12d5b890974684f5f0a79dd2359a476de51e1aa88754f0f00ab5fe7bbe5

SHA512
99c574ac854ff9d0f4684eac92857ca759c27af63aa4f7e4821f76d04dc5c04becbab8c4ad1bf0a00db73d1f7947440b6885f131db6fb4373266801ccdf38fa6

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\FilmImpact\TP3\AE_Impact_Wave.prm

Filesize
330KB

MD5
8437e60e14e13967b76fb6f1dba42c5b

SHA1
fcc901497c1a1fcfd4555c8fb5befcfaddb410f9

SHA256
beb74abd016bfd21ee1f619604d6dd6d4e2c7ba98e45b8b7fcd213bab7c743be

SHA512
1d92598ccc662c07386d6b52bcff684e186aaa91f0188e3287d7f609438c3d4bbc82633d25b1f71aca9e60ac1cdd132eadfab5cedc79083998bce7e63131513c

Download Submit
C:\ProgramData\Adobe\Installer\Icons\PPRO_14.3_win64\config.xml

Filesize
534B

MD5
2bf9f831e68bc1c40aa7ad9456f0dd64

SHA1
5f0169ed2ce46b27eeadb985c57c7ae9f80bf90a

SHA256
7c4bb24e29837f106919240be87763ff102c66c48875164cbdf263093ca91fc5

SHA512
6a53b2bb18f85f248d58f6b76d09f4a6f73433fefba719c7afa8221c1d0769e98f8b9e37d61319d030f63ae7909e987313d495fdc67de35fbfb4270beb3e7aa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929

Filesize
471B

MD5
c27cd8a5bfefba44f895e2685432b7d5

SHA1
f9ec35744bbb129c6acc15b72ecd0cbfe74923d4

SHA256
bbc1287a0e35292c9b9e46731deef5e278b0c7032749e004f2160701997161da

SHA512
fd2993b36de089f7bfaa51985e23944fbacc59364890d1a33943ba36a5ed3b143201d2799f3b3b022371382db4cae6cdcbbfef4da87d109e767e42dd964f87bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929

Filesize
408B

MD5
b2ebe768920486aa64a4529663362a9b

SHA1
9232c0337450c8f6a56acf43ed15e9d97a1cfc1d

SHA256
c0fa2dade00c44208029cb6bc05d81d2b6aedd2c09864c0afa153cf35cc24876

SHA512
774d665d212169885a04a96e635d3e7826aba17e709c12f7fc158941d93590f92868572ab2cf94f450a7a3b662619f2d2e8669abf1aa70bef5a0474e60d392d6

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\6896730214f12fc6\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
a76b35f57a8fe2e2c38704b65ca45c97

SHA1
471847e8471b94cdaad905290e395b44ca995ec2

SHA256
8a04bf2c2c7ff348d5e6eebd45dc047e9b5030c95281485998bd684441cf3e5f

SHA512
28057d53a835d9b047724bf8cac4ef94c510c0350a73a0b83d6b1c75bb5bb3e88caed2f32f82ac38d19a5dc8bee05ab404a52c52a2540d83b0b8f7450731371a

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\6896730214f12fc6\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\6896730214f12fc6\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
992B

MD5
ddaf04bf3593a32e6f81d9b763b9fd28

SHA1
55e2c09d29aff2c2b725783211124afbccfbef01

SHA256
2055b7c22251aa1f40415a6924c88c9432d3771edc566cdaac5b6d355bd057e2

SHA512
a4ad08c66b747a73ee5bf72bc78afe14924c43430307e0feb15d95a4bdd690a62b115e21a55f55c047518c30b4ef41539dc64ca943775c37c5eca08af42ef8f9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h38twc8p.default-release\activity-stream.discovery_stream.json

Filesize
20KB

MD5
1264aecd504430f85e9624fe53433731

SHA1
be6f7f81bf9bdbd8202ceb5cd9cdca29e21ed0bf

SHA256
b3ef885363b49d31ee085ad3578a8a56218cc77845ab2da89ab43c60118c6dfe

SHA512
eb22d2d20c4199b5596ecf2b8ae259562b8ad21f64a6458173cc107ca2ce525d98d7d8b9b16b502e6cf0bda02510d5e9d28559ab75a481db82df17711ed3b590

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h38twc8p.default-release\activity-stream.discovery_stream.json.tmp

Filesize
19KB

MD5
dc5a3ffd7d8bb5cc3ccecdf11a994b5c

SHA1
8178c64c2667dde63d01ba6c81a4cb3b5b04e791

SHA256
e2e08b7337af8af1af5e010f158565a53de92393db509c0b7044029ac9bece56

SHA512
05d237b06a700c8f4e71d76e4ec541ef4b04dfc3e8cdf2cdcf3d242c70f1755218991354e34227e942b9f220ae2d67b9858192fc533ca8fcc8460c1da9a4e780

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h38twc8p.default-release\cache2\doomed\18088

Filesize
14KB

MD5
915f302f82c9e8e5cf8190ff70fdf23f

SHA1
5a0b9d4709e0d0b0e0518013ba16b4b8bfd93187

SHA256
42875479ea155bea327783ea8ff55ca6bdf8b674b5ae789e393edbbee6127cf6

SHA512
b4d50258060a3305d281427e6889c3a5ebc7b9c831df0ec4bc16f2075a074250badf577734db8a8cd6439f5bce504c4e20347b8ca4c049bd8d12f85c0b55f33a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h38twc8p.default-release\cache2\doomed\19317

Filesize
9KB

MD5
d145da36c7889ccd9c28bf10c4489b65

SHA1
5f55f1ce5161a5cc4b108624c99f6b0d0f2d8e60

SHA256
78bfac63e4beab42652209b768e2fd8fc3db4769fc9c3a645c65bfbda036662c

SHA512
2d52a77f570eaca3c7f4f430bf15c64e74df66830aa12eaebcb79bdf5121e55a2c9343755d914e07100c569ccc287223c2ca99542c1c0ea84a3920910319f9d3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h38twc8p.default-release\cache2\entries\5B23235D54208C34AFF88FC6F18585FD8A8F8FAD

Filesize
32KB

MD5
8d1123593308351bbbb7065c19d16abc

SHA1
11a22d612212647f8d7a81268787c647639723bb

SHA256
5fd35cb4c78f9cb29785ae15b912ea75a9720404b121be41e65b74a4207d9863

SHA512
98f286234f5dede458f34b5080ff24a5adf4db817f3b1de0bee78c2d739ba04b8b2f72820d0862b1f0abf6bb9acdf549a3145a0ebee5380ce3d2bb4cdc5bdeec

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h38twc8p.default-release\cache2\entries\68F56E80BFAC30F3F2C462654254C7AC14EFB886

Filesize
219KB

MD5
bad1f6ff2dc3f0b351a833106cd99b5a

SHA1
27ba1e7e890ba227a84b4468d6a4106673e4af8c

SHA256
f28a8d497b5705e99eb31a01ad3aab4df35e2bf267f27fdd7febe373c99d3509

SHA512
c7c55c2eb98afdd58ea168378d0be91f50b7ed089362656559b8168833a327cbf6d13417bbcefe8158fc4b88efae018bb35718df9ffd27b014784310d05587a0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h38twc8p.default-release\cache2\entries\D01EA48BC1126DD932F779FA129D878FBD7AE612

Filesize
22KB

MD5
194e965c779d333966cc6047c2b3a08d

SHA1
61566e554a00fafd93f7faf6519ac36f735ff96d

SHA256
b809215bcb625ec069f49c31029130ca66cefc79bcff33a9911c7ac321243baa

SHA512
b39ec887ae1479225645c4b771864393a44d3404a76f2836c4b58f41becce0ee89d07e17a141f524750467cb9a697165a9205e43c9dac09920153b22f80e5387

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\h38twc8p.default-release\cache2\entries\E186AAA3D85B9894619EC109500653D4D846296A

Filesize
51KB

MD5
bcd508da20505df1ff3c0351291cdf18

SHA1
d321c19dd11e4a6b8acb0cdcbe5ea78820ce90c8

SHA256
d697593bff90c1eb79b3029f65d85f1446862afbb07417e46e296686e38d79a4

SHA512
ad0c67a76c976bb962af7aa3db7b41437831504203e95c70d1f83b7f1558353b29d4f0d2feb4075084371f73a7a4cedff79f21e7ed2f3bf4bc2c05effc822286

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO4E813003\Set-up.exe

Filesize
5.2MB

MD5
389505fdd8b9293578079efa46691fd8

SHA1
6d4b9dba4e978643bde3e1ee54b82c37fccca01f

SHA256
396ce5f2f23a7c54409ee6fc7d4cf1b7a3a44f3210f0302e1f270cd0bbe258bb

SHA512
292d0a6614f32a0d6c908628339e738942b4f4c305caa8bde5a14371d7e49fbc6eccb4eec9bef8af6f7e807bfd32994a14b66a68f34c71cf8981879f699f96f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\ACC.log

Filesize
21KB

MD5
4edd6bbc176876effc292ee57b71fc8a

SHA1
2dd6483471faff5f9b95ecb8a5f3f8bd7bb7cc84

SHA256
b052d59418bbc52524ed12a907927e4b717f4a11337e96383356cac3e593b10d

SHA512
6678aef8dcade864dbc2c07dfb64135738155fd7e50b124c82ce52f80659e60d295ac44f866882f5e030a7a260ff8e99c3b1573577d834f4c5b4899c9a542149

Download Submit
C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log

Filesize
8KB

MD5
138c15ca95771959f5e2c8cdeb223ecf

SHA1
14ee2507d17f2f1d4db67c226b1432f9147b2c0b

SHA256
d23b646827ee53004c071177f408027909527049dba48235456ef78b59d8eb58

SHA512
dc812eb319e775074c73ead0039fd1474c5a5f69587aef1356013c1a133f27cca25bf51f6470394fd961726bb6116711f8346e1de865b6128a68024c748bb26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log

Filesize
12KB

MD5
7fbc49f115ad20a71c4f5b02917fd084

SHA1
9679df0ebffa580d1102c6725dc8279c18edcb6d

SHA256
29e6ce239b780fa8b8a26e5fcc6e7297273ae060e969ee1529d45fe8704a9045

SHA512
3fd0f04ed3b77b457c4c30b218bf8cf1de813bb405daffd3d66696f23115a684302cbf98aea149f19c5c5cf99bbece67464f9fe30c87756a305c5239477a8905

Download Submit
C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log

Filesize
16KB

MD5
219f2f5659486e459d3ee08f6206c9b6

SHA1
ebf52a50f61e0f9608ea2059bc67814e6417778c

SHA256
e00956240946d715ad4a300962752b62f61c9e2f49f25dd165bed4871915fbcd

SHA512
1ede508abe40f438c372f26bdad08c102bfdcde3084efea8d16e2c9dc87b372d903daedd9e820d32baa10992907ea045f1c8b17e60298082c8819fffd36d5b0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log

Filesize
28KB

MD5
77ea5e3dc9d39ccf108a4e7f8899d0a0

SHA1
c29688c45810508bf8606f15d520248b06cb243f

SHA256
0bff51d4b63756061d2090b67d83cd8c2160f8eea841616ca2234dbbe2609891

SHA512
9da40d21b013f1807cb26fa1cdb77695a42c845ce88163b4a355c3ad820c286dc1639271416471cf6072c4733b9b89809e0eddb24b1ecefed2aad752d37fbb15

Download Submit
C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log

Filesize
5KB

MD5
296ce312b0a0dd39de2caefbed7c363d

SHA1
5d1f5d508ebe53edffa8f5ede1f53b0e55c6785c

SHA256
0be7f8b889b6d4a665293a1eee01e1320f970a914c672577b426e655a0469702

SHA512
5c9129ba409dda7ce2c157042914f62a2d0586cd67ad5a646e875c282ad4e523a8eb58378757f1bc73a9f152a25e01ce9ea71664f19bb96bccc3caab19804d81

Download Submit
C:\Users\Admin\AppData\Local\Temp\datC1F5.tmp

Filesize
140KB

MD5
d070306a9062178afdfa98fcc06d2525

SHA1
ba299b83eb0a3499820fddcf305af0ddbda3e5d0

SHA256
8f5ccdfd3da9185d4ad262ec386ebb64b3eb6c0521ec5bd1662cec04e1e0f895

SHA512
7c69e576b01642ecd7dd5fe9531f90608fa9ade9d98a364bcc81ccd0da4daef55fd0babc6cb35bff2963274d09ef0cd2f9bce8839040776577b4e6a86eb5add5

Download Submit
C:\Users\Admin\AppData\Local\Temp\datC1F6.tmp

Filesize
140KB

MD5
e204643042591aeec2043c5eae255099

SHA1
ba5f2f94740400f540befc89f1c4d022a26faa84

SHA256
7f58f56a7a353f8fc78ec2757394a7c7f28165e6bbf2a37d6a6e48e845874f3e

SHA512
7196c5b8e88100a08eb296be7570df4d045268ad6bab1c45ebaa9063aa9b46b8896886e24a9f861e322b167dd95e18d5a18abb76f1bb01c8bc85c36bead855ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\datC207.tmp

Filesize
139KB

MD5
dfce51814cf6d2f42375f948602cd99d

SHA1
766e162ff305343010b67fbaa28b36af277c5b34

SHA256
7a8a945586a1d21d2922cb4aed9e28d872129f6c396ac69f47ef3e32ea972ba0

SHA512
2c9489c18719ad29928e86a9e631e080b024c882a77a582f40f4f86f625de9b08ad3c09710d5ee32b5cae5284fd960f412f05290bdb3b4709f097b269b99ce21

Download Submit
C:\Users\Admin\AppData\Local\Temp\datC218.tmp

Filesize
103KB

MD5
fa794ec12d353c26805ff53821331fc2

SHA1
cbc6658badeda2ad9b0d2e03a0a35ff7fbba542a

SHA256
cfdbd8a2aa463c11e483dc10c480acd274e9786632f5571a3970e8a20a2d8237

SHA512
1161afdbf6fc9b74421031fe6e139587f291ffaec03cae4aa76c1a86e10a69c7b1602ecbfbf60287ce8ed926377ad159992cde605ba98e75b212e971b7e14f18

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-38L5P.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4C4F0.tmp\Film Impact Video Transitions V4.7.2 CE.tmp

Filesize
3.2MB

MD5
a45f246b120cfe16908ae4cfb087bda1

SHA1
d325704a2c394c06933c3aa9a939232b52efe9cf

SHA256
0ea9d054468644a3813c90e38a5dd61fd8ce9bc9abe316dc5b8ef5c1447c6825

SHA512
067b061a917a04439f50bf89afcef6d9c158c5c1d718578811931d0a167e221c6b501f10021741593c6b55b37c2f68e3e3aefee1616c9d40c6816d3fa303b431

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7MHQU.tmp\Przejścia.tmp

Filesize
1.2MB

MD5
7bcb7a547280e3b6166347509e23c02f

SHA1
18dc09c984de6979d36b11330d4cadbc32d3c2a4

SHA256
ed58c0c2a01f42c0da277b65a7f7fc51a917cc026de9593ef930e18b3fa1f344

SHA512
ed30ec0863cae83dc843900f37c8b7a17b3938897616f7f94d4487a8dbfc72b697280abf2b6ecbbf6aed93f027ab075c7ed4364709059aa382dc366aabe80f50

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-2

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\content.css

Filesize
16KB

MD5
edacde36ff06bd26f1907ae092eac998

SHA1
c25e9052ee5b28ec28e2eceee40217302bf2caae

SHA256
257634b6fa84dce998b31d6497330f0a0661efbd270f58289fbe026ed95b6f2c

SHA512
7e8d48e71a51659ea52dccc2d7c542580c9ea1953ec9ca2ad77d3c0926c5bc77167f85121fab2dcb7fd4d6d2f04edbd90815b76979d3269994cf662fadc357e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\content.html

Filesize
6KB

MD5
60e80c05a9d6aa602626fec33cd99e3c

SHA1
7aeaac92d57fbabe5da2c923eb0ad1bb22e647ab

SHA256
5bd6a4bc514b2e697a0f0e8b7b8c0be0af34a9e1c25a628b286a5cdf8e1837d3

SHA512
838de7045b1ee4542d4145276b3fef5ba60dc10ed0066266bebb3e44c5485005d33dceaefb1cf3fd1fd1bc7364622bb85630957a243464c4c738a415b30adf7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\content.js

Filesize
36KB

MD5
d5e6dacf9aa3069e9241780cbc82d50d

SHA1
1b510f2e06b363b4b138afc409a811254f976dca

SHA256
4c3f64961a872731185c0db4d155c9db73f7885ec4596f15098857c5e1fe91f4

SHA512
a3485cd865098e0b6bad5b03936d8ca233eef42ae88f40d660e40a95cf8da1edc4788402c21cfce3eaf7084fadb35d121b1074e0e30adea4c01338aa1a327f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\adobelogo.svg

Filesize
749B

MD5
e7b1717b9eba236b9c12be7a980b5b40

SHA1
f1baa3f41ffa5dfff320b7e289964cec54f19a99

SHA256
2a48e8db0f3991de1088936f56c583fe615fae4b9e14f4ebe2b33d29138088f3

SHA512
9c8debe604372ac1fe3945579ee843f13df6f8d40f2c402590743009b39c5f80e859830fc422d7f8d447c4e30f1198584850de657facfaa2b84955d386563b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\alert.svg

Filesize
958B

MD5
332816d7725fc31725b678cff1cb6dcc

SHA1
876f938efb86c1bb1733b47ec279335de97576da

SHA256
8b5469642507c00b9130bf7ed17a1e4d221e2a93dfd4d2972163650c4e94d714

SHA512
5c4a678892b1a550a0c85e77f75c8b56febbfcd92c658dab198197ed17d7fad04d7b65f8adc17e095895366bf933421cae30e430e136870d3e02e9f89d115775

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\appIcon.png

Filesize
2KB

MD5
26e9b0fe7397d9c072da92fcf6951b11

SHA1
4ee24ef82e7ee4fcc980e3caeca90b6e0d99b59f

SHA256
e4c2314a50cf372465c97d955645455ccad1911eed45ff2c2de5a310316ab15e

SHA512
782b380a45eb82aeb69ae07938b9c0f211525fac4718c30b96c28d546a93be1cf000714df2375596cb6d237f3b3cc84f304fca73a732a7e044864ea329013425

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\cancelButton.png

Filesize
295B

MD5
7ae9fb845b9137ef10002fe9d0f5c643

SHA1
9f3fa2b29b1b40e1b6794e5d624524de297a8b59

SHA256
e9e5fc264337bf6845b2cf2720ddcde8936cb120328087917bf94c5911edd74a

SHA512
4420cdfbc47d2ac804f1c05840e4113b098ffc71e95e11ffe8f95342f5a75dc0f35fe8012984b0d645f1310b524f66069ae0c0fe053e0d601d39aded321c15cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\ccIcon.png

Filesize
550B

MD5
8d2c84506f3f48a810eb7232dc000d6f

SHA1
f4a238c1f7c02c7c907368b939efba7512c6be5a

SHA256
c4620bc8b293dd89db628d2002ef9fe02055e2d1cff1f07e18a3e2e4942ab7f1

SHA512
0fcca755a410c7ef4e6f056b7267aaf23d5063dd8230528fc3765ed1e3d12042c930f999a54498e754fcb3565df17636d7a5de2e95e142ae139d17a744ec93a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\ccIconDark.png

Filesize
654B

MD5
13b5f5e052334e0ad6d31845fc859e3d

SHA1
b71022382904d194a5d8f5cb3b1d0dd92e254b16

SHA256
87fd64c46642058fb6d7ae4ab2c71ba5df7ce12ffb8b9383edc7bb7a673f0306

SHA512
79e77ef0cc83c24d3d0f04a2340e248a8dd11469f43740b6453913648cf2c3c5592053dd4a5a34c81f3ffdfdd0fddc5953454ee0d44d3ac946b2ddbe17ada584

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\checkEmpty.png

Filesize
167B

MD5
d13cecc413374c4ddc22a9edacde8a11

SHA1
981295dd1f713584591716a6e753346b8a89215a

SHA256
b9c9ae215daf1bb5b6692f527375207aedc138891947e5f6c1c6b549c2ebf39a

SHA512
a717e64430a4680d09c555183c69705998fbec4cb8aa41ac6ad10df9fbd4f4e2243548689f12695760d5b191ed62a38a92558bc88a730004d7119dbe017c6241

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\checkFull.png

Filesize
317B

MD5
9f7974bbcc96f12769c1856045eb7bc7

SHA1
fa0b9b9d709718839ea525ab838260a4e124fb1d

SHA256
e7fcff2549114496e8141f46a7606f740bbadf22c9ad818c40d9ff9b9ea12198

SHA512
bc38c23791a8ad4e596e921bc5e391d39bea998434915d5c25b1b37015a089fe91ce9510774c48fbc91e52400c5843897a5780aa1c2cf5c8b73d3f89a2aa0856

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\dropdown.png

Filesize
224B

MD5
ee8599707751befddb2b94bc79525c15

SHA1
e118b48e25fe42d933377b03fb5a9a710e1c5caa

SHA256
c1f6844923f7c311d996d81eed6d8e769d52df6d95c898187d92997abbb2770b

SHA512
cdce6d59c807dd1d2b13af39e2fe078b0c0ad51b021dc30373e18bde2a807449051f3f9084afa15b2f6d943169c1bc246c7dbe6e965ddacacb961f67269fb548

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\dropdown.svg

Filesize
289B

MD5
4585f70294e7b625dcd1ea8c585067a5

SHA1
11c92ae523b0c588c5469814b0c3c7778cb3f133

SHA256
7e58a1cce147df03605a92ffda1b88ca26005c09d1eb9ae56f37accdebbfe348

SHA512
deb1ce83d9bdff93eff950ed267076e5e8a7bb43cd2dde28561c3d07f68094a9c99df594bf2fdcb38fddf9656cd51475108ad1b29f8c9d4bf197e6da5a093b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\errorIcon.png

Filesize
466B

MD5
7978536150734ceffaf0720837e8b302

SHA1
7c11361af6e41d00beffaf4ef9e677506b32164d

SHA256
5d10637927b7a623428560eaf18fb8eaf439cd8731199c3b4d251b9846841183

SHA512
da5bb4329783ba623e12d3dc50b2c080e8ac2aff4d4f25dc3e1d84561fd9b40b158570b98dd24618762562674fc1b7d10e081677f214ec859ecc5d0b477db0f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\folder-open.svg

Filesize
602B

MD5
3530c5040ac9af92cd0a7d347f764593

SHA1
b815ef3654ec2c677e8f8f68d8527b6d8142b4e9

SHA256
daf26ad61aee6152cf7c0e8f2d3936d0c220de2a3c329e6ce0fcc007cb64ca51

SHA512
0ce187a12445054e270337b6bdd6b035e8fadb3b0a4e8c822833c12431bb520340fa509ab3e1df564cbf67700b9ba78ee246689267878d386e88f709d10c1fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\productIcon.png

Filesize
2KB

MD5
c798f5f4b98fd335a77e600ce21e32dc

SHA1
3db71eb6d87c8a4fcc6fded25d420cf7ea79231d

SHA256
9b249680adc23b858b08a62ea83fd8373e3480ff6f9120195314897c6e5f2cea

SHA512
f74351c5a9535920a81ee42f8caf82bb0c97664b6928f921b4bc74cc446ee61884b1620bce5e57abd6e1a3311d6f70c1f66c459ee4531cbf0197093feadd29b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\spinner.gif

Filesize
18KB

MD5
7699a4c54b1f5515a64e93fe3f801321

SHA1
2e51f7e1a331d921eaf15bd7dc9721a742984d47

SHA256
9146e2390273ac868609dac1be7f1a0458b7d4f7ecdfe1eaec107b3211f33aa2

SHA512
4810abfecc92866145a22f73639264574958d6db1157da0b6ff0472c14d8171ffc633fc6ba04843fcfd617ce4f0c19633475d2501ace48f8ee34ec8fa6fded87

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3235C455-0A01-402A-994F-8487D678EF00}\images\transparent.gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BA1ACEA9-2E5C-4FEF-AB71-5B833FD21B4C}\Dictionary\en_US.json

Filesize
72KB

MD5
c693e1bd4feda683ae5c71f2bd6b9de8

SHA1
2f3c32dbb95623c52ebf3b608074afdfbcbf050a

SHA256
5dffe13d4c72f59dbc6f8efb439350518acd4e8e07efa124973cfd1a625f60d4

SHA512
a48c520b1432f208f7494759d316cf2411163373ef7ba5bb2b2121b4520beb2932d4ea612e9d2dc8997b6221fa2d44c9312928c79394a5d8c577fa39aa5007d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BA1ACEA9-2E5C-4FEF-AB71-5B833FD21B4C}\clean.css

Filesize
702KB

MD5
4f3364af3e396f92a8826532bfb1a7e5

SHA1
7f7b613435ece78a358f2066287c2f2c3c6aa168

SHA256
45b9b77499356527e9047256db96a542a720bf075d67e9f6ba55d51fd562339e

SHA512
c022a28656483106095967ec4d57eb743d04f029406c2c553c9d19c103520e274c0eea19f411bdb7ae16f388211c456a413df5a0a6097036deb0010573d49c72

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BA1ACEA9-2E5C-4FEF-AB71-5B833FD21B4C}\common.css

Filesize
2KB

MD5
1265d497504870d225452b3309b0e06b

SHA1
29a3b783e6f2f2cd3f6d08833b83c7848f8e3450

SHA256
4273a5d4ef990dead6cabe760c27b25f7fcf8a51177f1b31813ad8866a565330

SHA512
9aa8b24e800a619651699c193a7747b8673a3cd4f8a5d3b16ee35f5ef6161f953a904631b97d118339332a3d2c7292c910802f6e1518db18d48fab5e9eb91681

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BA1ACEA9-2E5C-4FEF-AB71-5B833FD21B4C}\main.css

Filesize
16KB

MD5
ee23e36c90c9fccd530504285d371ac3

SHA1
7a4e24d18ec723d38cd922e3845ff290f0299e15

SHA256
32616e0764c80efb4607a0dccfec7cf7862886c4ae80e6405dc3cc5c62cd0f82

SHA512
542937075a96f6afb8170c6f41915efeec5e067803606c2a26d29e6c990d93a255ad8cea18600cd0825a0c91ff935d057870a1724062543a8e2bc09c4041b375

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C0434468-E918-420D-B151-FF81A14B76AC}\common.js

Filesize
2KB

MD5
d98f70ffd105672292755a37f173c2ec

SHA1
c0154add295ac052f234a0282a62b704cdd01998

SHA256
257a42f797f140667c81930001e73943bfc243d50bcc775f75d0334a2d2cf2c3

SHA512
1909cc7e4da0949a469852240be2205209968b18b99f7d967bc0231de33d03c7cbaa9578972e30e95e6d7017aebf9cd70a55ba22cdc9d5774d2a237d3eb0971b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C0434468-E918-420D-B151-FF81A14B76AC}\images\appIcon.png

Filesize
1KB

MD5
0888f293d15c51354ded410dee3ad535

SHA1
9652c87a2a9a62f013020ff09096d7e23031feaa

SHA256
b842284dd918c07938bb4f84cf790ee99097625d9eb89e5eaf221602f167cede

SHA512
3caf7d503f39a5ffc0fd9e984d1543dff5ca26b875df6f48bfc450a7895316f967945eb1be93618d87531355627b42b861f8fca8897ae3d4c61d212d1098e40d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C0434468-E918-420D-B151-FF81A14B76AC}\images\appIcon2x.png

Filesize
2KB

MD5
a99a41b9525d820733e39d7cd051aa44

SHA1
0b22982dded3feaa4502e078747722550ffe2519

SHA256
fe4e106a0af4455633299e3bcd09073603241d9577d3e6240d57eba93a6238dc

SHA512
bdf8426496a7be728f4ff41048457c75c04f1449f1f01c6b028e290f82d983018e373cb9b11bc1ed906c22825eee8bbbdc2445651474a5e1b53256d04524c2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C0434468-E918-420D-B151-FF81A14B76AC}\lib\jquery.custom-scrollbar.min.js

Filesize
14KB

MD5
ab3adf4aff09a1c562a29db05795c8ab

SHA1
f6c3f470aea0678945cb889f518a0e9a5ce44342

SHA256
d05e193674c6fc31de0503cbc0b152600f22689ad7ad72adb35fcc7c25d4b01b

SHA512
44dfc748d0bd84f123f9d3f62d5ea137d9128d5bdbe45da9a8666d09039eb179acf0dbb3030e09896fd61e7aa5ae6dfaffe9258d80949a64d0a7e45037791fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C0434468-E918-420D-B151-FF81A14B76AC}\lib\jquery.min.js

Filesize
91KB

MD5
e1288116312e4728f98923c79b034b67

SHA1
8b6babff47b8a9793f37036fd1b1a3ad41d38423

SHA256
ba6eda7945ab8d7e57b34cc5a3dd292fa2e4c60a5ced79236ecf1a9e0f0c2d32

SHA512
bf28a9a446e50639a9592d7651f89511fc4e583e213f20a0dff3a44e1a7d73ceefdb6597db121c7742bde92410a27d83d92e2e86466858a19803e72a168e5656

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C0434468-E918-420D-B151-FF81A14B76AC}\lib\jquery.placeholder.min.js

Filesize
3KB

MD5
e13f16e89fff39422bbb2cb08a015d30

SHA1
e7cacaf84f53997dd096afd1c5f350fd3e7c6ce9

SHA256
24320add10244d1834052c7e75b853aa2d164601c9d09220a9f9ac1f0ae44afe

SHA512
aad811f03f59f799da4b8fc4f859b51c39f132b7ddbffadabe4ec2373bd340617d6fe98761d1fb86d77606791663b387d98a60fba9cee5d99c34f683bcb8d1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C0434468-E918-420D-B151-FF81A14B76AC}\main.html

Filesize
8KB

MD5
f4b7942d6563727bd614f10da0f38445

SHA1
84f22240f7a5ed1c23b09e8677ac2ac3cd4e26f9

SHA256
e4bedde22ed405d291c746440a824d5f8527fb232e7a6be2ed9a76465d82f8dc

SHA512
f79b24ac78863a4ed87d41f37b2a5bc27017ebc5317f0a305d676090a16aee8a61384b476e7e9a68a024aa8da4784c1bd4f118766caf4450ec97af430e7074af

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C0434468-E918-420D-B151-FF81A14B76AC}\main.js

Filesize
58KB

MD5
a8f9eb478c7512c98ca1ad46dbcc298a

SHA1
454226dc42b911caafc9a1e56d8ad0000bbb7643

SHA256
1df6cbdc80c1df47d93d6e7516a2d7017362413a6b9d93634e143856695c3645

SHA512
ae3198cc6ae739f3009359988f5c090664e5fe8422ad1cf739fe316e66f344c10385d1f841c7b0e3ca9f7997c79d95fa0559386b6dec10641ceb8c290b14f5b3

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Premiere Pro\FilmImpact.net Plugin Data\is-21BDH.tmp

Filesize
236B

MD5
bda48bb11a28b8422ff25ae7f72b9093

SHA1
38d57f97e3bbc0d5891fc7cd47885df9fcbeb4b7

SHA256
d5857f421e2ec13ca2f0d4495be28917db77bf3cddf4b3c171246521a0796e2d

SHA512
6abf7a1709c99a487e8884242f3740be864f3ae5d2c47e8ec8487c6b988a99c2833795ddd97486c621a920a8002afe6f7f124e9f5ddc528ec7fab9aac40d852f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
9b23574a1f0a2a62c7f69dce72719187

SHA1
0e4b1aa328599cad40dbf9fb0313a8c8888c17d6

SHA256
1741a96b587f22c7ee762ea63359862717a83712f123ad0865e8c27c63ef0de9

SHA512
6ea2f9020c00e0d13ed2b2d18af7a929e98b2451a8cb4d4f324ffe3c6f43937b75bdb485057c3e5c57b8dd9fc7c63bba3295af25e4feaca5cd2a81114ae12aa3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
11KB

MD5
3f491b9638ef314b1dc44382e7ae6755

SHA1
53954c08afb19ffc75d31910660bee6fd0cffd64

SHA256
a13bda24cd0395780438f1f33a4f4e9dda72ecb3be64311432889cdb389c69a2

SHA512
d71013982d5699f4c7673fdac44c0b82c81e0a0bc064a5dfffb7e6088f111ebcfef8ff0b567d2ebfd333f74980dfc4256e6036d21bb434ce78d0f78cd3d7f2aa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
11KB

MD5
20693453bfe2c8c6cdf94db283290497

SHA1
e62f32eb0e0b1ba3b177c1ff31018b235ca2a84a

SHA256
504a62b60110223317c1dea1cafc86781c7ef1db374bcd17a5a9eaa6ff298184

SHA512
408db3d657c05be0ace7384d27b49b7c51eac18ebbdb237a2d8ad675e781bec58f4a39d047d126c7bf4b15acd7a5597d23ff4fc2d94d77a0273d092016d281da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
11KB

MD5
c61939be46a243e435bd5333859de50d

SHA1
a629caf99b55ac23e2adbd24fc23fd1f94290990

SHA256
9f06ab9b845b518081454a681a877b3113b91d3140d1385c27b21d99548f61e5

SHA512
127eb3f43e360b8e9a9c178ad36538025b95967f0e733cc55321a9d84978010508baa301ce5c5f9b4c5dac84d8fcf4e4c19be80133051681d9ac63c41c446ca9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
a3daf641bd3b73947f7a264c1328cfff

SHA1
f936f6c81b5c61a4ced93b70a4aadc067c9b38bc

SHA256
5a70aa7c296169ff5c3a499028dc243592230f8a02efeb643bd836286452cce4

SHA512
451b5941cdaaa06f47927be3b54ac0c50dc53b4bfdb98a005e9d1a4e3e293d8a41db1f8e6b2f596bc0ff8260da7c0941ed83bb84eb0bfd8661f6cbd3ec03db65

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
17KB

MD5
89d504b0e394b635baf440ea29f9c3f9

SHA1
a3d96099395bba6dec6fdd0b05a0a2d6f985641d

SHA256
4ef2b4851cc7b79da084e22c810195e2dc38bb885ea8ba88f9615139a9f8f877

SHA512
c96612c3a9c09ee2cd1865899687d1668a3d0ec4e0877cf732dec4ee3ddedd23f3b3e6b65b4c0aeacd0ecaf2f71c59400ccbcb0598f9ad188cd1660d174fabc6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\L237H6SIBWQ8W5EQSX40.temp

Filesize
11KB

MD5
b1f22fdce7b441813b4b23dc8d5317e7

SHA1
5055d342757d957f0ee6703e27282c2ea709e4dc

SHA256
0ba32615af6aa72f5c0689160dfac4c2ad95660d7811869f662346840eb2526a

SHA512
06db4917000ce31280f6762952bc0a36e97b7c093e6fd527d12eb595ee1a9f389c7fee5760b65803ac3794b37cf441bd2bd492f18b949e6d8644ba4b69c828ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\AlternateServices.bin

Filesize
8KB

MD5
81379864794595f375899583e644d8a5

SHA1
9f3e1b32c87f9c1b4889980429a1144ac21bddaf

SHA256
8c69d45dc97ba0de1a920638c35bbf546ad6c6e4ba1b7c8350eed6e43022ece4

SHA512
ae75c8973541b8d1a7575699df1bf0831fa60aca94709c820878646b40f8e1bf05ec45f51e28c94e958989c70a2dcd7a3fe79a1c5a25905950cadb5cb1354b3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\AlternateServices.bin

Filesize
27KB

MD5
96161ac8f3637aaef023903d8630189b

SHA1
230417e0c306653bd423d0ddbe3cece60c8e6cf6

SHA256
d1dd151c04b868e3bb2891f663dbd8eb10b80ada53130ee30a6805598df97ae3

SHA512
07c7cf5199ea336183bd4664eb0b93c82986280e4632a65e9e1a08dc68ef0013bab7fd026cec34517c9f695e623ff9166e78351642f81d928c3db7e6c8e260fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\AlternateServices.bin

Filesize
12KB

MD5
9e1ef4f54a24496d8f544fa215b22142

SHA1
092fef1d9ef1f052b0316cd42c5fe8f2951ae05d

SHA256
c8cba1c148ec9402ba8e3ba7658110b0dca9c49f61209d8ed8e176f70788b398

SHA512
7b9b8765b010f7a6edf62cf16b95e4faa066d7d645fcedb752bbdd79753e40ddbdccc58d5d9e36a2e7fac85fe3ca64d16ae8d2e6c457d4d857f84dc83523361b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\AlternateServices.bin

Filesize
26KB

MD5
e69f60cd2cb1d5c7eb9d510a8061e9e0

SHA1
e8eac267d717d11989108e2aeb5f7e5078319de0

SHA256
ee03bed42d2164583550ce6621ce82c8610be797782777d4c2350edb766d5688

SHA512
91e602744e1d3ce6ceb87ea5193ed95a73eaf8df56c81a44c31ab62e5c2966516490454e18ea0512f388801a647d4eb1008ecd903f5be029d40b615b8b9d5a16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\db\data.safe.tmp

Filesize
41KB

MD5
a74bd24af8b403b8ab34e61f47ee190e

SHA1
7e6511211190464973d7996541b976ce2c61a1f0

SHA256
2ef1cb847efd750bac596e60e87f677c2f65b9ba69488bcd8a0c6c58d824775f

SHA512
cbbdf56ca040019c52e1fd21453e682da054e90616678df5846b51c5a3245ab5023566e637c494055af3913fff4d2a7d3bf541ada9fe775a986fc7217d23269e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
9ef8a9a47af347105595e25040e105a9

SHA1
b97195ff453178588c0a3539783f8f2594bf1711

SHA256
ade17dd3238028d4bb0b39e80bafc91ed8c76fec3afd3a5fc0ec1421b0f1b062

SHA512
9e79cdc71b17e367b945ddc61f4ab8f1ec60f5353979540e0ed9f0087247bc873c9ce24991a9da241e675aab00879e4540617e91602a369123719a0bf0c79d74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\db\data.safe.tmp

Filesize
17KB

MD5
cfeee5b5e677dd972a90457fb568bb6a

SHA1
9b43a2ff55a8a5cab32d57673557f28f9605010d

SHA256
cfecfb6939918e730beab4994b149eddc6958b2c4c67d7d8f1813eb6ad892db8

SHA512
4f6fd098dd4e1ec8b433c9eb36d3455910996181b72f859cd10c9fb073236a0145d98a882b4ca9105316c2dced32a739e9ba8befa66b506994f01fa509ee9270

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
4ebcd828f48feeba50cf52df508d47d0

SHA1
ac0396a5603d828662dc2bd8596c6ab943c2813c

SHA256
6b22786606af9b3b20f201a3733fc338c799d36dd66b842f3a098db65b2696bb

SHA512
097d8a778407bb0e09fae00742a4d53b07785b86b70b6383f8350b29a289863a92d04d6d489a7d09813e08399e145f5d143cb99a465da856e637b70b663fa805

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\pending_pings\3f27cba4-1dc8-4301-a5f9-07db641d94b6

Filesize
982B

MD5
f9da8963ee5dec4ea2c96c958d964c03

SHA1
3850bb1cdc1b4df71cec611e021513451caeb43d

SHA256
883ecf550f35b261f3016e24a6e1da850ca8094a0279e01f7487595a843b70f6

SHA512
035dba17c9f94b13682a28e8363941281b0d58c65fd64f82d8f3969dbdedcdb5cb6ee56a8670e06e264ed5634123c855ab945a2ec6831ac8236ca82f4193d9cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\pending_pings\83f25b0f-0b80-48f8-ac30-ca59bc7746aa

Filesize
27KB

MD5
e232783fd546f63ae80569849197f6e8

SHA1
24c02680a1f9f0deafb1546bb7c25f6314704d60

SHA256
d0d87d1f705136d1c53a01ec86e884f28d5046fd71b82ef0b0a0a678f0ce5f8e

SHA512
6c8d666feff8f3717b1b4312cbc7d5f3ecc46c35ce65d59eae172ea9d2ed42d18ba0e1fb5299db9fca9dbee220a3f105fe42475ecc9dec1509eb57e4a0b1cf0a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\datareporting\glean\pending_pings\ad099b10-43c4-44a4-b31a-2a2d3436f9b8

Filesize
671B

MD5
bac124ad22108cddcb29c63fd4fc4b29

SHA1
3b90cc1fdd85f3f8e622c5bc6dc9d93a2f669f74

SHA256
317a73501e2681301cf1c3dcfdbd1660e6e02cbad9c414389f5eb0e4e87a4f08

SHA512
10a202022d2d8d1278e5b357fd6f18ac76104b8a5b4bb3ecbc7cbb36389469ae303883ccca624c7fabc7f35a072955a780cc2fe9fe0ae6c4519b4b24c3f3f10f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp

Filesize
1KB

MD5
36e5ee071a6f2f03c5d3889de80b0f0d

SHA1
cf6e8ddb87660ef1ef84ae36f97548a2351ac604

SHA256
6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

SHA512
99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\prefs-1.js

Filesize
11KB

MD5
fb1adc6879dc3469bac5d91953208d9b

SHA1
984c9176891f9b3d1b6fb2ed31afc695d1ca4ff2

SHA256
c215439014836199c3425164b80245db949f82805e91cf73d6b6c69399e1ed19

SHA512
044b5d62f6fc8c12b016eaf676fe1d0342168122350e866140319944b46f218c92163f20c3d490f8c559d8d659bb5e3c6f2ebbd448d663f36a7552dea59c5aed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\prefs-1.js

Filesize
12KB

MD5
dcddbf51fcb90e6e82b92a3807319ce5

SHA1
2ea099164ccaeee7365e7201ed8545ab1cd19c97

SHA256
8be285cfc73ce79298390d727f1a6b3964d981f77a2eff4089976f27da5b6ce5

SHA512
d25079fdbf7b10e488f902e9d8891b8f7fd63bddf3a346a9f3cb7bea17117ea297741fdf720d86c338d2e90b82b17e97efc672c8619591fe685d2ce0fcfdfde5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\prefs-1.js

Filesize
12KB

MD5
3ea13669a48c5bef1ff2375f23d9449c

SHA1
b06228cf74132aca6fa8a4d2ed7b4b61b2872947

SHA256
a4959a5afa6d594bcc50607562c2c2d7e25e6a444e1b6894e1d685fdbe6473e2

SHA512
b2779804517fadfb0870410ff016929ddee03999694899bf03ad5b5c15a8c304ea693c20a05e30295af84c06b1b59bf875156c901a29de0514dafe47e2942f85

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\prefs.js

Filesize
10KB

MD5
42b5344d58ae215aa37d5a8426bca530

SHA1
3e2d0d678d44ec2b7f6112bc25cf2bbdff9e2914

SHA256
12b0c7acc7f1748510d43e2517976c1cb921e0929018bcfe33efbbdf9cc2c3dc

SHA512
bf8976927ab84a245ab1b8beeb71c999e97641f4ff29966e3041a579c379e863907121f6e2e7d47e10f1ad60a9bdff19aba0d524a6aab598e9a3ef100d8b6f48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\prefs.js

Filesize
10KB

MD5
2122e4d0b1d7c783890dccdbe5d7c90c

SHA1
073487c80baefd7213085783b2947788a6ef0b6e

SHA256
d8871e27ac0d77a89e3a090c49417b7c711e74e75f7eb67b5230e3372284b011

SHA512
6ba3fd6149a755afa3234a65b8543d670c9776b77c1f39690b3319c5074d3f8290f4083e3aaa7b83b553ae7050bf3ea01def25d8330a83abc6639808490f7d78

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
910f3331aa73246ceaa9e1c7fd064654

SHA1
6d8c663beff7ede9b6b85cf25582264078910e13

SHA256
8483cb8ad1e406195deaf61c4f8270053514aa365d44865637ce927909daade7

SHA512
94e3f0e82c8c1f0d075a07445814b6b95d0d916fe397b7d059920f818e818fd75f309a60636b3b4345e22b3bf2446b35574a055cef8b5d681c33febb0549add4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
7fac43583e13f13f9c706304f3f64760

SHA1
e85ac7e1c1676749514fd2d4a3d38c79577c11a3

SHA256
3c2390e8036eb9df50fde1973851c7e3f6072061d692265bff5407c204bb0bf8

SHA512
3bf876d9ad0e4ff7a748b9ed9411efa70219016e7169620a23836af56232b0e7acda2503b7c9c846cc7da5b1287bd13e9e9f5519296352cda00d21543dbfacda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
156d0aefb2318a80e9c7c6afc6468819

SHA1
883a9231253eba744f976ae4f411c943332b8f4b

SHA256
e2ef76fa2008ec2889b9b78c81bd7a4ad3f50ee609c6ae81d3bced77eff25f93

SHA512
a967522e2fcc93dd266418a4951385f8a11452c7024b20c36e06355658e21ae9a68eda921b4ec818384fda35e1d5e59b2d27f9c193aaab4f75367683a4c40f2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
6f555f19c15112cd7bf26f2e8da5b810

SHA1
4349e7737ac33c35581536538d59dad83f70cdcf

SHA256
b0074b3bea4d5183925afc433d4164bedb212055a17478cbf2ef8c104815ff39

SHA512
1b34ee771b0f2042f87c92d08d92c1317a388b910c1dcd9b393888d0fbccde20a5318b8b63cbba809040db19cb4867e0e83e5fe1a3c994ae62273372a2848f90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
ff97fe8f826759ed3153c5b5ce7586ff

SHA1
8dea61bc980eec60726b68c97c59e1de82c6a95d

SHA256
b6f81f211500dc1be2f12fabba64845c144cdff019a9c12f090b61bac08f909c

SHA512
3848dfaaeb31a7757fdd2179272530ee63955c99e8f038c76a91e3d69fcf72014e3877fee3953179f57d77e65d77d6cb44d1541604bd8925a1ddb2b71c679f54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
c211ad8ee6d792f28eb18b5146d91e81

SHA1
a9331a9b95188407218f9bf6748007fd20eb67bb

SHA256
96e19f6dd8cbbf42ed5ea31175ded27936caf405f2596fa0207ee93cda033ab2

SHA512
681ef50f19007ce2c929845ed399a4b8598a76bd22becbca596e7ef38e13cd50b9862f6a28f28c1404c497a1d214d12e33a3409908da35d4b92c2ae16f728e80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
66d188957ff843434a9db96f75e23cc6

SHA1
95eeeadae2b3bcc4bc40ecb514519d64ddd721c9

SHA256
b41b8be4e9729400781f78d5fdfe934f14c5f08110ae240005d6532d081a8622

SHA512
1c69095ca7b1285042d3dbbcfb5b9c162e4fa35fe92cfe50276fda4e40c580ba372ed01a6f275545a60db310d3ba642cd9a3136e82a75549a550450126ebba28

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
340e45c04c219b5aa2662f1573cbfd15

SHA1
bc1de619f18762ef33e78376449176d553a9b662

SHA256
34f3a7a3c88b5e01da067f0e3c38c2c79c87172a648b8698dbc567c0357614d4

SHA512
a63af9284990e63af047c5d90ceea5d80ead8dee48d6c91a99804c5243a226f1559cbfed663a1d04b5a0c11e9cb4ec42eac386501fdc6334b672df02224bb9f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
217d8f9b5e95388e6bc2a6397303287b

SHA1
ab6803aa1752b8eb351509042b1f9f712dfb9efa

SHA256
5e03d777c5651ac24d6412ff00b7885bd58e771f77b9e6f09ac49f7ff9dc00d9

SHA512
36cc75ede0a02c9a0965232d961a4384e39f791a247ebaf63092bf5cb29406442353f18ab65e16f63a69d33b5af1e31211f3a8426733c1b6e2932a21db1489ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
b36e69e60142e0e69672a6e827f3150a

SHA1
1a7e339afc24847de681241534340873d5be8bbc

SHA256
898a49dde2a72240fef4c53df8998bd2f81fdc6eb7f4515b297171e5a6131911

SHA512
da41820b63b9688a39e4820a384950d81c5c4025c067c0522e2ef2e4b79f43ffa349b6c0608e6f1f6c137f525e4a372568f56f7cc47027e95373c22afc554678

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
bdfc831b64d6b6d02f31f1b4c9393459

SHA1
8adcb8f18b08cab0aefe7b8c58221b0368bbabc4

SHA256
11228aa7ac26f61fe6eb2695ed755946806872a01e6c7391fd7478af2f706900

SHA512
60a3308ca79442587b85eb36733ba2d62bfc224141faeb669a409263eea0548cf5f107befb74b6fff661006cc9cd93b33cbf0698d41c53e67ec66c90550bf20a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
3ec058b73f82230dbd6066396bf09698

SHA1
be405fbc4c9a52d9420f8f9bc7efef8646cd69af

SHA256
d014309f176c61bdae0b962b323fd9c648662aad5bed534cad932eb149813b60

SHA512
962c462354f5d56535b58cac2bfb88fed2882d14c59e87e52f8c499b3ed9f4f80ba1f5e7279acb9afdb6c5fa852823648303f84905d1ebb0b98ed9f4d4aa1bc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
8b053464a8ee531e86e2f56d0e57cd83

SHA1
cff51a828a30f25f87bf4fc91c4c0d7b48a33d6c

SHA256
c308bde58ac720444bbe8971755a81e6021e9a9dd6cb0afc543629d887520c72

SHA512
67766b88c1ebc37ef07d11f58fd36fb2feea78bd6328b9b12a601ac4ada758726821fa1c135ec76b7631bdc467fbfb6be0b574b405b62cad96815f1e325ac084

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
a08ad222287365461f9f07d7c406bd66

SHA1
5e1a39211322c5d85b656f161d4cb7c7a4a35377

SHA256
ebf6355c6e1d45da51e8fe3212077984ee371fff02e1e43d3308b836b000f284

SHA512
5750d8d5ccd0a675e4c0a584e827072dbc0b539d4b92559f6b229ed94e3df0e05a854d416c460f0efe51cb5f49af8da9ee659d6521e01193fde4ec23e53df153

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
12KB

MD5
55cfd221958ac1648bc64b9743ee06c2

SHA1
dfd22cbafef9221630b158a4863a7e324e893da2

SHA256
216ee04547399c4b061b62ab252ffb99b859ea76009ff3900355f5a77dc47804

SHA512
c5c2abad558a00c69a74a4086059466c26a1e27381e2b613cb5007253d8935dc7576691c05455089cc1cfdfac48e59435702d90d71e12756f70ef0b11244dd28

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
15KB

MD5
809adb0df082e30b668d93ef7bb8c0cb

SHA1
bf6ee6a16a7301dde18171c5af0d911556f5cbaf

SHA256
2594c596b2e1e160f7bd0cc1344caa122b6f403f3b34f08b063339a3f1ae0240

SHA512
d74998ef56c13bbbe6ac9b847d10669d6d899b10e70e95ed982c176011c164f10e3f5e896aab9ecba41e29e81dfedaafdccf2a31ea333425500b6a0292585615

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
38a014bd9e8e63a0b5663333bccbbcce

SHA1
0627f5bfbcb8787023e84c2c72d6dece3e068216

SHA256
ffbc700e276a3fd9080ff3374e2bbd12d3abc85616fd066c926ad51bfc077cac

SHA512
8600462edcab0e4d05e22003d097f1886042e7db9080f36f899b767166466a1ddfa164bb0130527c3bc46693949d44cdcf3d4bc94b351bfa4659123800af9dcc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\storage\default\https+++mega.nz\cache\morgue\31\{a7ec4fbc-a1a9-48ea-b76b-871f3069991f}.final

Filesize
1KB

MD5
3efa9abd92666265dd81c4f4311a96f9

SHA1
41b6b716d67b93555e444cd453f3c6e3f8c9522c

SHA256
5066b1841e8877db31312ef3af86f9bc9234c95071119e025764f45241a4e2e7

SHA512
5961950f077501608a0f2975e7f69c483eeacc4eec4ac77fd650cc1131609501f87819f93ed23aa508a90426156abf038a859fac4112d2d4435bbb634027cd6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\idb\1214953363LCo7g%sCD7a%tcaebfafs.sqlite

Filesize
48KB

MD5
cbbde110e2b158301600674a87781765

SHA1
b3212d0358bcd2ef676f46fac300de6ffdcd96d6

SHA256
fb0a88095d3f8fbb17784db5772fabc5a71d2437213b8d31e25df7f8e0eca7a4

SHA512
1aa8ae398c1eeeb68f52c9b70387c2f39e52fc7016db5d59b3b17fa2859469dc47753752e2bbbba3de9436f08e69857c5bde6189d73a56e2d3e0cc502eee2661

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h38twc8p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
584KB

MD5
8af79e36e76926c0b1d2c48d5537dacc

SHA1
d077a8a361605f27d54f2e3860ac78aec1b38581

SHA256
323ac6207fba4ac47942cecceba4cd994a224adda8d32e0eb0cced4f55a746e3

SHA512
9ed395b3cd05d2065a6c265bce33befa703f51d81be148f8aedf831e18c24d3962dca5aae45011cd20a220a8e184e2aace4057bcde8c49f630ad3e89569830fb

Download Submit
C:\Users\Admin\Downloads\Paczka Montażysty.x5eOv0pg.zip.part

Filesize
1KB

MD5
1080b956ccac4d9780d8f01c1234a5b7

SHA1
7e611ed023c61b626fd4d74c28cf2b547c08eaf8

SHA256
ee20871753f45e43154792aa3639df6d10d0231f6b058073d3abe352c252fad5

SHA512
6e861d8cd5d7fc8bb892079bdbd693bd1a575017f8d9a7086067200dab2c7cc8693dffb6d8f780da2d5a2346aaed4ececc364a282d32e80d323c985f3fc8dee8

Download Submit
memory/992-1378-0x0000000000400000-0x000000000074C000-memory.dmp

Filesize
3.3MB

Download
memory/3844-1219-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3844-1133-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4092-1221-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/4092-1379-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/4228-1786-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/4228-1792-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/4228-1784-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/4228-1785-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/4228-1790-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/4228-1795-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/4228-1794-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/4228-1791-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/4228-1793-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/4696-1218-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/4764-1564-0x000001D9AC040000-0x000001D9AC041000-memory.dmp

Filesize
4KB

Download
memory/4764-1562-0x000001D9AC040000-0x000001D9AC041000-memory.dmp

Filesize
4KB

Download
memory/4764-1563-0x000001D9AC040000-0x000001D9AC041000-memory.dmp

Filesize
4KB

Download
memory/4764-1568-0x000001D9AC040000-0x000001D9AC041000-memory.dmp

Filesize
4KB

Download
memory/4764-1574-0x000001D9AC040000-0x000001D9AC041000-memory.dmp

Filesize
4KB

Download
memory/4764-1569-0x000001D9AC040000-0x000001D9AC041000-memory.dmp

Filesize
4KB

Download
memory/4764-1570-0x000001D9AC040000-0x000001D9AC041000-memory.dmp

Filesize
4KB

Download
memory/4764-1571-0x000001D9AC040000-0x000001D9AC041000-memory.dmp

Filesize
4KB

Download
memory/4764-1572-0x000001D9AC040000-0x000001D9AC041000-memory.dmp

Filesize
4KB

Download
memory/4764-1573-0x000001D9AC040000-0x000001D9AC041000-memory.dmp

Filesize
4KB

Download