c7d4c33c935a875fba56bf595060d8292ce5dedb0013cd5992e54e7dffbda843

Analysis

max time kernel
334s
max time network
391s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
17-11-2024 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AtlasTools.zip
Size

380KB
MD5

96aed7199e04727e40439c592406c908
SHA1

2d81d956ffd7d94d12a08f5c228ffe21b8895530
SHA256

c7d4c33c935a875fba56bf595060d8292ce5dedb0013cd5992e54e7dffbda843
SHA512

9adedebbbf31c152d811f1966558511f5159df66553cb1692900451bea9f5ef6b3ebd62840502622757fca94ff28fcf031c478b633ebe3f0e4e2404799965a67
SSDEEP

6144:+Azvy9VyHhCkVEqX6M1IEpPVdQ3pZVVImMRabJz09qw9Smp9CHv8EYPoGWZAFycO:bjy3yBCWEqXT1B7mpbVImOa949XSmfCv

Score

8^/10

microsoft defense_evasion discovery persistence phishing

Malware Config

Signatures

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 7 IoCs

pid	Process
2100	AtlasTools.exe
4544	AtlasTools.exe
4864	windowsdesktop-runtime-6.0.36-win-x64.exe
476	windowsdesktop-runtime-6.0.36-win-x64.exe
4536	windowsdesktop-runtime-6.0.36-win-x64.exe
680	AtlasTools.exe
1320	AtlasTools.exe

Loads dropped DLL 18 IoCs

pid	Process
476	windowsdesktop-runtime-6.0.36-win-x64.exe
3700	MsiExec.exe
3700	MsiExec.exe
4296	MsiExec.exe
4296	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
4112	windowsdesktop-runtime-6.0.27-win-x64.exe
1940	MsiExec.exe
1940	MsiExec.exe
1748	MsiExec.exe
1748	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0532b8f2-12d7-43de-95fc-7b87006758a8} = "\"C:\\ProgramData\\Package Cache\\{0532b8f2-12d7-43de-95fc-7b87006758a8}\\windowsdesktop-runtime-6.0.36-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.36-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Security.Cryptography.Cng.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\System.DirectoryServices.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-timezone-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework-SystemXmlLinq.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Runtime.Serialization.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\UIAutomationProvider.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\hostpolicy.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationCore.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-synch-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Xaml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework.Royale.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\PresentationFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Private.DataContractSerialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Text.RegularExpressions.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-locale-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\de\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework-SystemCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Windows.Presentation.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-utility-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Runtime.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\cs\System.Windows.Forms.Design.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{A9E32B25-994B-4856-A12B-0EBED3050410}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB4C71023A75A89AC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\79D2396D1F638B04C9CDAC38562B0100\48.144.23141\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\E39B69A3F3677E14587CF1C3CC73FE72\CacheSize.txt	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6A7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9E2321CFD60425F1.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{61D4736B-3325-4D4A-BD41-8BD206C6A86E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI147E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE7E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE883.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA88.tmp	msiexec.exe
File created	C:\Windows\Installer\e5bcc1b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE33C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9F6A2C807D3D740D.TMP	msiexec.exe
File created	C:\Windows\Installer\e5bcc20.msi	msiexec.exe
File created	C:\Windows\Installer\e5bcc25.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12E6.tmp	msiexec.exe
File created	C:\Windows\Installer\e5bcc1f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE768.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E39B69A3F3677E14587CF1C3CC73FE72\CacheSize.txt	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3F2541FB7473A544.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI120.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB6E8F896EA776E7B.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\79D2396D1F638B04C9CDAC38562B0100\48.144.23141\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF13148E5AD7751B60.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9392F6BAAA449297.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1393.tmp	msiexec.exe
File created	C:\Windows\Installer\e5bcc1a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\79D2396D1F638B04C9CDAC38562B0100	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5B179B9A30DF673A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAABFE8223733137D.TMP	msiexec.exe
File created	C:\Windows\Installer\e5bcc16.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2A8892A34E1955CF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF9154AE01E11E97D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2F5D54F7B5857BF4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC9C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAC56933AB217A253.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE719.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5C8D91BE6893E481.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF79A95A3635AED1DE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF24EAEEFDA1F1730E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID463.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA3712BCF1FA23B6E.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C912E33F-956A-4921-9F55-CC11AE8F09AF}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3E9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0546B4B4011A7413.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC0E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI17FB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bcc16.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE552.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF781E3A82AC82134F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF282E2C679E83DC23.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5E94F7072E2F1983.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8346B2797BDC2FE6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDFDF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bcc1b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE0AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D6932D97-36F1-40B8-9CDC-CA8365B21000}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCB6CA4613E4EF6BC.TMP	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.36-win-x64.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.36-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.27-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.27-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.27-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.36-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.36-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F33E219CA6591294F955CC11EAF890FA\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\52B23E9AB49965841AB2E0EB3D504001\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.144.23141_x64\Dependents	windowsdesktop-runtime-6.0.36-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.144.23186_x64	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\497A7447E2AFEB24ABA9F5BC5DC4D53F\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.108.8828_x64\Dependents	windowsdesktop-runtime-6.0.27-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE340971DE772245A5E405C95D4127F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\613F436E6BEB3BF46A217F01F2751656	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F33E219CA6591294F955CC11EAF890FA\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B23E9AB49965841AB2E0EB3D504001\Version = "814766693"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B23E9AB49965841AB2E0EB3D504001\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B23E9AB49965841AB2E0EB3D504001\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\094F9C7997352096B7082D27C35AD959\79D2396D1F638B04C9CDAC38562B0100	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79D2396D1F638B04C9CDAC38562B0100\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6374D165233A4D4DB14B82D606C8AE6\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B23E9AB49965841AB2E0EB3D504001	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79D2396D1F638B04C9CDAC38562B0100\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\34E9844CA4C526252F3E0750AD7D17A7	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{d87ae0f4-64a6-4b94-859a-530b9c313c27}	windowsdesktop-runtime-6.0.27-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F33E219CA6591294F955CC11EAF890FA\PackageCode = "577AC2DDD07ED8F4DAB1B20CB6D27084"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F33E219CA6591294F955CC11EAF890FA\Version = "814766693"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F33E219CA6591294F955CC11EAF890FA\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A84090FB8635C505D4A4CC7DD0A0BB05	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.144.23141_x64\Dependents\{0532b8f2-12d7-43de-95fc-7b87006758a8}	windowsdesktop-runtime-6.0.36-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6374D165233A4D4DB14B82D606C8AE6\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\497A7447E2AFEB24ABA9F5BC5DC4D53F\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B23E9AB49965841AB2E0EB3D504001\ProductName = "Microsoft .NET Host FX Resolver - 6.0.36 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B23E9AB49965841AB2E0EB3D504001\SourceList\PackageName = "dotnet-hostfxr-6.0.36-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\79D2396D1F638B04C9CDAC38562B0100\MainFeature	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\DOTNET_CLI_SHAREDHOST_48.3.31210_X64\DEPENDENTS\{D87AE0F4-64A6-4B94-859A-530B9C313C27}	windowsdesktop-runtime-6.0.27-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0DE340971DE772245A5E405C95D4127F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2DDBF7219475B995939F6795C8ACCD62	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B23E9AB49965841AB2E0EB3D504001\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79D2396D1F638B04C9CDAC38562B0100\Version = "814766693"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\094F9C7997352096B7082D27C35AD959	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F33E219CA6591294F955CC11EAF890FA\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B23E9AB49965841AB2E0EB3D504001\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.144.23141_x64\Dependents\{0532b8f2-12d7-43de-95fc-7b87006758a8}	windowsdesktop-runtime-6.0.36-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79D2396D1F638B04C9CDAC38562B0100\ProductName = "Microsoft .NET Host - 6.0.36 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B23E9AB49965841AB2E0EB3D504001\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79D2396D1F638B04C9CDAC38562B0100\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6374D165233A4D4DB14B82D606C8AE6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{61D4736B-3325-4D4A-BD41-8BD206C6A86E}v48.144.23186\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\613F436E6BEB3BF46A217F01F2751656\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.108.8828_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0532b8f2-12d7-43de-95fc-7b87006758a8}\Dependents\{0532b8f2-12d7-43de-95fc-7b87006758a8}	windowsdesktop-runtime-6.0.36-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.144.23141_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79D2396D1F638B04C9CDAC38562B0100\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79D2396D1F638B04C9CDAC38562B0100\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6374D165233A4D4DB14B82D606C8AE6\ProductName = "Microsoft Windows Desktop Runtime - 6.0.36 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0532b8f2-12d7-43de-95fc-7b87006758a8}\Dependents	windowsdesktop-runtime-6.0.36-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F33E219CA6591294F955CC11EAF890FA\Provider	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\DOTNET_CLI_HOSTFXR_48.108.8828_X64\DEPENDENTS\{D87AE0F4-64A6-4B94-859A-530B9C313C27}	windowsdesktop-runtime-6.0.27-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6374D165233A4D4DB14B82D606C8AE6\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F33E219CA6591294F955CC11EAF890FA\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F33E219CA6591294F955CC11EAF890FA\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C912E33F-956A-4921-9F55-CC11AE8F09AF}v48.144.23141\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\52B23E9AB49965841AB2E0EB3D504001\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\79D2396D1F638B04C9CDAC38562B0100	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\79D2396D1F638B04C9CDAC38562B0100\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.144.23186_x64\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.36 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6374D165233A4D4DB14B82D606C8AE6\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.144.23186_x64\Dependents\{0532b8f2-12d7-43de-95fc-7b87006758a8}	windowsdesktop-runtime-6.0.36-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\497A7447E2AFEB24ABA9F5BC5DC4D53F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE340971DE772245A5E405C95D4127F\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{0532b8f2-12d7-43de-95fc-7b87006758a8}	windowsdesktop-runtime-6.0.36-win-x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.36-win-x64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe
2964	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3612	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3612	7zFM.exe
Token: 35	3612	7zFM.exe
Token: SeSecurityPrivilege	3612	7zFM.exe
Token: SeSecurityPrivilege	3612	7zFM.exe
Token: SeDebugPrivilege	3512	firefox.exe
Token: SeDebugPrivilege	3512	firefox.exe
Token: SeDebugPrivilege	3512	firefox.exe
Token: SeDebugPrivilege	3512	firefox.exe
Token: SeDebugPrivilege	3512	firefox.exe
Token: SeShutdownPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeSecurityPrivilege	2964	msiexec.exe
Token: SeCreateTokenPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeLockMemoryPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeMachineAccountPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeTcbPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeSecurityPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeTakeOwnershipPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeLoadDriverPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeSystemProfilePrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeSystemtimePrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeProfSingleProcessPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeIncBasePriorityPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeCreatePagefilePrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeCreatePermanentPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeBackupPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeRestorePrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeShutdownPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeDebugPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeAuditPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeChangeNotifyPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeRemoteShutdownPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeUndockPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeSyncAgentPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeEnableDelegationPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeManageVolumePrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeImpersonatePrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeCreateGlobalPrivilege	4536	windowsdesktop-runtime-6.0.36-win-x64.exe
Token: SeRestorePrivilege	2964	msiexec.exe
Token: SeTakeOwnershipPrivilege	2964	msiexec.exe
Token: SeRestorePrivilege	2964	msiexec.exe
Token: SeTakeOwnershipPrivilege	2964	msiexec.exe
Token: SeRestorePrivilege	2964	msiexec.exe
Token: SeTakeOwnershipPrivilege	2964	msiexec.exe
Token: SeRestorePrivilege	2964	msiexec.exe
Token: SeTakeOwnershipPrivilege	2964	msiexec.exe
Token: SeRestorePrivilege	2964	msiexec.exe
Token: SeTakeOwnershipPrivilege	2964	msiexec.exe
Token: SeRestorePrivilege	2964	msiexec.exe
Token: SeTakeOwnershipPrivilege	2964	msiexec.exe
Token: SeRestorePrivilege	2964	msiexec.exe
Token: SeTakeOwnershipPrivilege	2964	msiexec.exe
Token: SeRestorePrivilege	2964	msiexec.exe
Token: SeTakeOwnershipPrivilege	2964	msiexec.exe
Token: SeRestorePrivilege	2964	msiexec.exe
Token: SeTakeOwnershipPrivilege	2964	msiexec.exe
Token: SeRestorePrivilege	2964	msiexec.exe
Token: SeTakeOwnershipPrivilege	2964	msiexec.exe
Token: SeRestorePrivilege	2964	msiexec.exe
Token: SeTakeOwnershipPrivilege	2964	msiexec.exe
Token: SeRestorePrivilege	2964	msiexec.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
3612	7zFM.exe
3612	7zFM.exe
3612	7zFM.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
476	windowsdesktop-runtime-6.0.36-win-x64.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 3512	5044	firefox.exe	86
PID 5044 wrote to memory of 3512	5044	firefox.exe	86
PID 5044 wrote to memory of 3512	5044	firefox.exe	86
PID 5044 wrote to memory of 3512	5044	firefox.exe	86
PID 5044 wrote to memory of 3512	5044	firefox.exe	86
PID 5044 wrote to memory of 3512	5044	firefox.exe	86
PID 5044 wrote to memory of 3512	5044	firefox.exe	86
PID 5044 wrote to memory of 3512	5044	firefox.exe	86
PID 5044 wrote to memory of 3512	5044	firefox.exe	86
PID 5044 wrote to memory of 3512	5044	firefox.exe	86
PID 5044 wrote to memory of 3512	5044	firefox.exe	86
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 3164	3512	firefox.exe	87
PID 3512 wrote to memory of 2024	3512	firefox.exe	88
PID 3512 wrote to memory of 2024	3512	firefox.exe	88
PID 3512 wrote to memory of 2024	3512	firefox.exe	88
PID 3512 wrote to memory of 2024	3512	firefox.exe	88
PID 3512 wrote to memory of 2024	3512	firefox.exe	88
PID 3512 wrote to memory of 2024	3512	firefox.exe	88
PID 3512 wrote to memory of 2024	3512	firefox.exe	88
PID 3512 wrote to memory of 2024	3512	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\AtlasTools.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4192

C:\Users\Admin\Desktop\AtlasTools.exe
"C:\Users\Admin\Desktop\AtlasTools.exe"
1⤵
- Executes dropped EXE
PID:2100

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1400 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {126ad178-ffe0-42ab-a3bf-9a2555b9dade} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" gpu
    3⤵
    PID:3164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55781fdc-fcf8-4e9f-ac39-41041db75ad6} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" socket
    3⤵
    - Checks processor information in registry
    PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3116 -childID 1 -isForBrowser -prefsHandle 3232 -prefMapHandle 2956 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16eac134-2241-45c9-8c3f-bcab572a88f7} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" tab
    3⤵
    PID:2636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3200 -childID 2 -isForBrowser -prefsHandle 3612 -prefMapHandle 3608 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55fdaf1a-2ad0-4b93-82db-f1fc2c2cf8b1} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" tab
    3⤵
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4560 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4552 -prefMapHandle 4540 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d3a0d04-7663-41b7-98fe-65984734e5e4} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" utility
    3⤵
    - Checks processor information in registry
    PID:8
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 3 -isForBrowser -prefsHandle 5476 -prefMapHandle 5536 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01228ebc-d802-403c-bc38-01074435fc80} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" tab
    3⤵
    PID:580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 4 -isForBrowser -prefsHandle 5668 -prefMapHandle 5672 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {320bfc1c-7bf0-4ab3-96da-1a31451aa270} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" tab
    3⤵
    PID:1468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 5 -isForBrowser -prefsHandle 5860 -prefMapHandle 5864 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2885093e-46f1-4898-bac9-773c6d9ba350} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" tab
    3⤵
    PID:2760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6148 -childID 6 -isForBrowser -prefsHandle 5940 -prefMapHandle 6140 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f2350f3-d241-4b33-841a-3a28a2951de1} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" tab
    3⤵
    PID:3460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 7 -isForBrowser -prefsHandle 5624 -prefMapHandle 5600 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59bd8b04-9c09-4490-9934-71525fec2108} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" tab
    3⤵
    PID:4968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6776 -childID 8 -isForBrowser -prefsHandle 6824 -prefMapHandle 6820 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8de24c7e-761a-4719-9bd3-20ef1edf4083} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" tab
    3⤵
    PID:2492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7068 -childID 9 -isForBrowser -prefsHandle 7088 -prefMapHandle 7084 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c15a0b9-c3f8-4da2-a012-b5935f54f800} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" tab
    3⤵
    PID:4172
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.36-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.36-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4864
  - - C:\Windows\Temp\{75A7A354-082F-4FC4-8452-F404D255A312}\.cr\windowsdesktop-runtime-6.0.36-win-x64.exe
      "C:\Windows\Temp\{75A7A354-082F-4FC4-8452-F404D255A312}\.cr\windowsdesktop-runtime-6.0.36-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.36-win-x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:476
    - - C:\Windows\Temp\{C245826F-E645-433B-B7C2-3D56D151B443}\.be\windowsdesktop-runtime-6.0.36-win-x64.exe
        
        "C:\Windows\Temp\{C245826F-E645-433B-B7C2-3D56D151B443}\.be\windowsdesktop-runtime-6.0.36-win-x64.exe" -q -burn.elevated BurnPipe.{4EF00465-F138-495F-9652-E0782E2AEE5E} {39AF1B7B-CAE6-4C59-9E5D-17D1F321AD8E} 476
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4536
      - C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
        
        "C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0532b8f2-12d7-43de-95fc-7b87006758a8} -burn.filehandle.self=996 -burn.embedded BurnPipe.{FE7B460D-D439-48C3-93C0-00DEAE4D6E0D} {386404E1-7F76-48DF-9C1D-DA700D28E70F} 4536
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
        
        C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
        
        "C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0532b8f2-12d7-43de-95fc-7b87006758a8} -burn.filehandle.self=996 -burn.embedded BurnPipe.{FE7B460D-D439-48C3-93C0-00DEAE4D6E0D} {386404E1-7F76-48DF-9C1D-DA700D28E70F} 4536
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
        
        "C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -q -burn.elevated BurnPipe.{DCB48969-0746-4A8B-A44A-3EFBE6488B92} {5294F0DD-486C-436B-BD8D-4BCDF6F5BBA1} 4112
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1116

C:\Users\Admin\Desktop\AtlasTools.exe
"C:\Users\Admin\Desktop\AtlasTools.exe"
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 824321342A5F9E1E9A9FE491035F1251
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3700
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C5D25062E3921EF6BFAD7FFDAD1A989E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4296
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 264E75AAD0F6888D1690860DEA8B95F7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AB054E36E3B3557D3DDB594594AAD941
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2756
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3A74B6B3051A55CA4DAD65281B9669E3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EBDDC9F27FAE61FB4C57B40CAF35EAFE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1748
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 41550A9A4446391A3226333E247F2D62
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3956

C:\Users\Admin\Desktop\AtlasTools.exe
"C:\Users\Admin\Desktop\AtlasTools.exe"
1⤵
- Executes dropped EXE
PID:680

C:\Users\Admin\Desktop\AtlasTools.exe
"C:\Users\Admin\Desktop\AtlasTools.exe"
1⤵
- Executes dropped EXE
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5bcc19.rbs

Filesize
56KB

MD5
8a0440c4d06b8a42737408a773f587a4

SHA1
c157edbda1b5e8dadd83e60af37c876ab6e8a334

SHA256
4f9dc182d879c7b24860c5d4d7c705140eeb1703ce4242333dd65712c8d429eb

SHA512
eafabba89fb3c190e6d79989d810ab33be95da0fc8aa0fc7f59fb8ae7e9bbf8a9581d77df30528b86afb296b674c8d5f52e507a51ac398a1259a337b35b7876c

Download Submit
C:\Config.Msi\e5bcc1e.rbs

Filesize
9KB

MD5
e3841aae17aada0ef67f48f5505d2cca

SHA1
2e89db359c4ff47c0e379926a1ce7d3f18ddd3be

SHA256
e5d59e4a11dfde63b46e11c6c8f88c5f1841bbe3d27bd3c60360cc645969c00d

SHA512
2436261cd7fbbcadf36d0ea65fa0dc48a146efda730e1740e6d76605ee68457a9841895f247e01aa77bfbe608f1427066bbfbe82b1a0ad6f2f629be14b2e1fa5

Download Submit
C:\Config.Msi\e5bcc23.rbs

Filesize
11KB

MD5
78c19ab432353ce275d300907b531c47

SHA1
05ccbd13de6b37181867c8cb9a6066910934cbbb

SHA256
8c8627179682eb82b568557905af303fa4d2925b38331d0c0fcdfb512fa0236e

SHA512
509a75f46359927d474b244167b7bbdef5e6680dff1fa0756880844d7e6641cf2b737da5cfa7ef135a2c5348a5c098be83c119069960a6d87c39e5bfa679af36

Download Submit
C:\Config.Msi\e5bcc28.rbs

Filesize
8KB

MD5
ce04bae4b08630150411da05680c5870

SHA1
5271a01b8e3d8abc445ecf1e775c8e0f3e3a0380

SHA256
2a8a46aecca12d279e08b48db4df174e295e7694ba4e1d6a8ea60ec8a014a31a

SHA512
ac59a50eebe7eb859d0600c1e7aa9c7c79ab273889a9bffd312f176eca90e54de7e5096c1f536eb32751188a39ec25a26f22f08f487703db1179c8faf2564ea3

Download Submit
C:\Config.Msi\e5bcc2a.rbf

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Config.Msi\e5bcc2e.rbs

Filesize
87KB

MD5
5943a5796dc9985b86062786e7c77894

SHA1
12a460f078b693d863fa1a41c012789e0e051af9

SHA256
09f9074ddb045f311c694c4570c1113322aa3d9076fa3eb7031ffd63a98df1a8

SHA512
f250803b67c78df4cebf2224d05d346838689bc68fac269555a99030e608596e9ac66946beb907be170c5dd0994f6dde5afff620c4cfd7d2d177caa121ae5ffb

Download Submit
C:\Config.Msi\e5bcc32.rbs

Filesize
132KB

MD5
c4707928fb37ce49b31b37f9bc64eb67

SHA1
8e9746cab961f8e4a4801260d52676f3377ee32f

SHA256
29b1d39752383ff03fbe36b336ffa82a51ef96c36ebad003892837fa1eedd9b0

SHA512
1c15819e6345083689a08cf723d4dcc6304bfcf1b95ff9bf9c32b57df0fcf8893f901f2bf4ddaed356f1a98a4afe93e3f0ee27ee8f627facc822f207ad20f868

Download Submit
C:\Config.Msi\e5bcd4f.rbs

Filesize
8KB

MD5
39b63a4017b342444a09abf2bf1085ea

SHA1
10239ee67a1ce968893e045216b1675a89e9cb6d

SHA256
2b7507abcda631e6366ec3cfe336b59b40e7730749901f694524dfd198030bb2

SHA512
1a2b877c31bae766836cb8da2417cca561f490ea66be7feda127cf41d4b05a3e12be2fa62dcd096b4183e9ae97f8adb4ba72f8c1be2d8082fdaca2eab1f83870

Download Submit
C:\Config.Msi\e5bcd53.rbs

Filesize
102KB

MD5
09ba231f86e162605977ef320cbd003a

SHA1
85745a0ba4dfc04a9e06caad6de5b8c4f37a8332

SHA256
86b393e416bd63a05ea27c8af8453122448323c68de908eeb7fb65e7b0302f94

SHA512
c360856c9b7e4f4ef6c1fd692429b94f44a27c5d1921e607b6e0f7b437d6dcda5ea0ea2ca7802f03e83634f0736fc9cd35633a9e2538df0dedc05eb2cf9096d2

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
0dfaf65802d5d87f9e12860cf046d66c

SHA1
5fc12779b444e76bbdfa860dd7d52d03a5ff4ea0

SHA256
178d805b6fb46365890860c8c5b0af83d152a8c802c26b7bbc8c5af662c5e714

SHA512
287c6f3cac02f68ad06adf5ebd3d5d613fc2b0d833e54a83dffea66d234a197a7ffbccafd07c9ef2d984e93c49ccb87cb90f56f0bd033efda0b85a5b8ff76d60

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\cache2\entries\8FE29648FF5F63BAB33CDF49A7BE627C71FB6A7A

Filesize
61KB

MD5
c77c029c50f1966de50daa982bc72230

SHA1
fcd2ed05df1f18a362221de3b1a36bfb90539936

SHA256
3496e4c6b96b7caccac45d099c832ae43e13c410aa5017729912d94be9c4f818

SHA512
70ee3fac2476db117f204f367a7b60515fe393eb6079dd67d25a9e7c97882f0addc092e0db72e1e7f3635fc3332103666e64db7f70544f944d698ff0985fa582

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241117114913_000_windowsdesktop_runtime_6.0.27_win_x64.msi.log

Filesize
1KB

MD5
c1f8da77ae843dff39209a8d2586f7f8

SHA1
8b39acaac7cbb0a858b2a1a7edcf3bd9ae307da7

SHA256
7bad2e8996a9918a8a344c8901b9821c5426c462252552f6e5c928a4fe1e0a81

SHA512
89290ffb3de3986a7312ffbb039a26134e4a1c59aacfdca8079511030716a5e6361daf12bb64796e262a89a3915fe558d1ac7e84fad61b1ebe32b29b97635221

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241117114913_001_dotnet_hostfxr_6.0.27_win_x64.msi.log

Filesize
1KB

MD5
35c0160221d731be9c4186c242d02451

SHA1
75791124c3dcf49669cc777ebe3fac6041be8669

SHA256
6fed38e34485885895268dea807b07c8f2ae6fa3882d0d379c5d7498979cbb1e

SHA512
45a8643057d0c314c2df2103d1f3448f25dba3416dff42e199110f385e136c4fa0a21b38b22ed6253ded0b6325e09f6d2efc918a4c8e24e29d0dada3f8ef93b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241117114913_002_dotnet_runtime_6.0.27_win_x64.msi.log

Filesize
1KB

MD5
8ed391e40deab357abcd5430960e99ab

SHA1
16836c4f888ece769a5f442901898630f7bd9685

SHA256
ff59f7522c55b9085ed331a27d039a68fb82b8dc4508adca5315b540b3eb1b08

SHA512
8c30d44a7e08b6cc56136bc4bc1f717e88d4c903e33ec00449b1b2197587f06685c5aec84f3592a0f1463ac7fff7a96c0e0988c5dbb1c6da4d1330b95176acc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x64)_20241117114852_000_dotnet_runtime_6.0.36_win_x64.msi.log

Filesize
3KB

MD5
c4aaaa1b260fb5faa50dca13c0d0174e

SHA1
368cce425aeeb0d33df0d2a2b3c3697b4e7f07e6

SHA256
d1b3fca7f211f741c4e3426607b6520c132f8b4df84f7dfcee40ee7d6bbe555a

SHA512
3720899b57c2178258c8da435b3305a6e101b91c91ef4e147dab22665449759c5e107b0b181ec11208ad104f8b099c0a5a2cabf4b7d180a3ee82303b069abb16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x64)_20241117114852_001_dotnet_hostfxr_6.0.36_win_x64.msi.log

Filesize
2KB

MD5
ec84204d3e5dcac12896cece0d6ba2d5

SHA1
f1785e082c0f83cc429067b900a2ca8d706be94e

SHA256
6603bdd8ca9bb7f5c120729bbe662844bbcf1c5373fc9865c544e6f2d602d257

SHA512
799920be0f34a0979ac611d8f23543b72cf735fff796c890ddbda1f4e447fb087d44eb0aab2f92082662d7fd196fd7a92d319a3210d471913dfc5b0373c5e6b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x64)_20241117114852_002_dotnet_host_6.0.36_win_x64.msi.log

Filesize
2KB

MD5
0d99eb0600377948e6762965402d91a5

SHA1
0eb5c330ac74778197db2571d774e8efb7f8dad4

SHA256
8e071ee937883de9ef22d4ea04e2bf8d12db96540dd806f22e566bc840fd5dd2

SHA512
57cff1c9f95dfdc21e9997177adcebe2219c4f0307b6d35b85979d074a9af40087e7cf2c2e6fa996281e12615d2cd4d01265d40eed805d6d5d76118808cf1d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x64)_20241117114852_003_windowsdesktop_runtime_6.0.36_win_x64.msi.log

Filesize
2KB

MD5
c591d768a78946118af3f2137615951b

SHA1
bd92a2bfb158b8b0e98d880f22e6015ecb19b8fa

SHA256
9a665834181818f0b31a38d775ee79c5739554bab15b80687a793e3936ad58b1

SHA512
d508c5135f278847d63c80cf48bec78f0aa30362c86c8a8a11ca378add1dc77b2eeb0a647df14c9323aef2e5a33e62151be9ac369cb5f032fa1f97578d59606a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\AlternateServices.bin

Filesize
7KB

MD5
03b24622c31e867b9aa3624377461796

SHA1
633c0968ca492d38666b4e7ac50407b01c87239d

SHA256
27427f483051188ca82c47e179771d16b68ea7fd1c229512dd4b7816d627cc7e

SHA512
a8bc321dde0029d7442a6139413b20436803a2a513b0bef42a9ee9ad16c2c752998dfee54f52af048e29528251b32295b53814431c05961a623950d81b566ece

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\AlternateServices.bin

Filesize
12KB

MD5
b6242f934219a936f94ff9d2f2a9e300

SHA1
defdd84ed8477b6494a52844dc8c8ebff940a19a

SHA256
c8f57029ba97105b6c71e74456b7982d269e5dc9caeca0b8bea2865222cb325f

SHA512
70d9736a6c6a39f8f6e5a9adf6c91cdbc6edf16b1dbf9f7326679a05d44b487afc10beb18aa7deef71cb5ff32c6feb54ab49040cb7a5eb6035750ee57ec15976

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
8050d757613913a2c5f60f06f14992f2

SHA1
27cf9742429381fc2d573deecdaa5ceac8a57748

SHA256
a6b76f2b204be6ab54c357226a4388047d6f222aa9573c24b0908e1582ec3e88

SHA512
c469633620e436aaa673a481f93cc0303ba06deec3ab2472b32fad3343b9fade5f071c494904ccff96b2b3caab854881a5a263bbc3ecb7e94ac3b16156db7407

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp

Filesize
47KB

MD5
de034e10feea074ed0f929b5674d9fc6

SHA1
1e3421020fb7b49943cde76a8a29850192d20b22

SHA256
4b041a01b8d5398cbdb83138f30753c9f2064f2b90e0a76afa9b088bba2cd7f3

SHA512
999c18b81af4076c6194b66a7a24e587fae3f5690857c5550545053946a7e782535117d627e5a02578f65fcacd564f5f4cbb9bf8973e26bbd1da410af64f2038

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp

Filesize
47KB

MD5
e22783dc90587452bd4d11fe00875dae

SHA1
12e8f9dc713fe853198e52449cfec786fa264da0

SHA256
8716b8cb144825681021915a8cb995368fd43eb2057f0012c9171932b01f60f0

SHA512
0e3fa7c926545cdc4ab31317c755c31c23860fff51ba0a3b5f9362831223018241c1a104112f6ba28b47ef463c520e6327f96313c5bc1aa676e40dabf9aa651e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp

Filesize
48KB

MD5
8e778b53a14b32a7c1182aa1c269a13e

SHA1
53a4c2952894e8a2e99a04f994bd258022a20a49

SHA256
4fc37acaaeac0e244ff2381a3a5f2e610e03555d699551ee571ffe3d3ad17130

SHA512
a13a14eac251892e17adeac570c4ec909d44a1297c17ee56028fe837c77f53a65bc9126f20b044822d93c78318c0c82a2e45d12b61ff6135dd53f0a266c4ba2c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\032fb35e-144a-4de8-9404-e73ba7580c23

Filesize
25KB

MD5
da0dbd7fbaa8f45621c07057be8c5c54

SHA1
2a410444296f54d9747a7ddee1b6d901218669a7

SHA256
3cd33b78d5cd82e8a979e9aea4d0af1ab82098c72a260b467fea73485d9a1eb6

SHA512
fcf69e38ba819f4ae5b1777522cebec056e988e90f9ae0b89a68c0779786379d54391a33d8ba853f26e7bbc74b3f1283cf29e2a3c47505e9fb96b3ad219d38fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\3e2796db-5acb-4965-9eda-5206fbb66297

Filesize
3KB

MD5
f7b769cd9966ab3b90499dbafbfc1e5e

SHA1
ba8c559342dcda902908a81ad8ef74dc9919194d

SHA256
7a051ed05bd8dcfcb6800b59711e8372a8124b08b7f7ffee71e60453f7c13119

SHA512
73f746465b25ac2e071fec4517263225d9980b15a2925fd26dc38de7751482d81cb6a2f6444352097f346a9e85c5a869edc3df36dbe4c3fe06a9d9e23a9ab944

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\5edde10e-976d-4a19-918e-17ff5705244d

Filesize
671B

MD5
106f56c808a0565682eee72fabd01947

SHA1
78190460ec30056e27228347850bea17e411f2ce

SHA256
a3eb6929f46b8ef48ea3955e5b77922b64bea66419d5195c5f9256d95e0aa2a2

SHA512
c851c7beda0e2a1c200e600fbd5c52c1a766ea9db4484b7628d225599876cb9d859acfbc90552359ec4d92f59f3219b2e0cca43ffd4c722d9361fd23dd7336a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\689d6b1f-1960-48b0-9f80-7bf52929374b

Filesize
847B

MD5
ec5b366f20f98b87fc39981cafe64d51

SHA1
76973ee9d9130622afaa18c2f090023a2c711bde

SHA256
7c7c912478db54668e99c2b08d697636badc9ddd38b506dad810263fc269ef57

SHA512
7a742f41d02c4295a089cfdcfa9ceb44270807eb0c0217eb76e0f321bfef8f03a87fb00647fe7e4efe1c15362bb7b9a8730d9e0e46e4bc8ee2a1e2c3bdb8b14d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\ab88711f-adb3-472b-9596-cf351f3960db

Filesize
982B

MD5
e395387355607563da04889daa8b9f3d

SHA1
efca07c19c18a1b38c0a100073e53cb5b84770b2

SHA256
1f7160393e6b33111de20056d074d4b96176287ac1d4ef91146fa60793c83f3a

SHA512
7c707398490cdaf5b46f798e51aebbffe2e95c860ef278976511fc431ac50812aa286f59145ca077ddebe933c4a2accb8fd13e7fe620b58d1aa6fe5433ffe438

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs-1.js

Filesize
12KB

MD5
3d45591a2a428c705768f4ef8e8b5c7e

SHA1
f4e13ac0bb22024e17ff64725fd83b5c48d649b1

SHA256
5406334504f88861fa46fe2bd769de7909476e5cda783dc43875b7d616df3e39

SHA512
50ab01b8b4473177768be3d42d098ae131eb7da20b7482a0fc06c73a5d183829d26abb2e7cf24aabcdc39602ece03a92b061d430c6d9cf732145b205db69d08a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs-1.js

Filesize
11KB

MD5
90af5bc1a0db9de252e0bc4ab8d705b2

SHA1
37c5683568b30bfa87634f000b137b61787f3350

SHA256
2048bd2668ff638221837f83a48542380ee0e81d57105e84357e65ca6662c843

SHA512
9ef2afbf512b024d89be276d2ac4496e6e9e0e1583a26924bac69e9e10e5dcd167092a34a0f7065b3b69fc0b5e36b3794c85cf311641c9e0e3670332a74c397b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs-1.js

Filesize
11KB

MD5
9de4f4cf81edd0a648a0962b2c05cdb7

SHA1
b86f76b381ceac33310a54947fa13cc59a2da592

SHA256
4adccc648e030a3d32092873063e4d52d1c02f34e985e928923260913ebd2f3f

SHA512
e79082c98bb87a7348f72e9fbceb641f38deb969660db823d35159e15da412e89517114d13849296b3d99cc28184c4f0e2a371d37ff593e453740e8f5d566639

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs.js

Filesize
10KB

MD5
629e1e972ff834642782d3f9bd080f62

SHA1
78c4d4b3871e8c9bf839a206cd841852391edf37

SHA256
3b0b34af909b7e1a9229da7df8403ec95896eeb59fb45614a3797ae8b96e45ed

SHA512
b21deb7370bff8fa656673859e84d5f8dc9d18aeab49d63c2672e26f61bb380f7b6e069a061fa5fe9e65366d0c3367f505b68f5a905d0a3d9869a69ae0f7d435

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionCheckpoints.json

Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
1c90ecba032cbd719a008bb7a5b78d92

SHA1
1d91818e1e34f091a91fc7c436ebc9927375bc80

SHA256
26c1e4e59e863d36bf6ac959346bfd27038c05d937aa6846946d2989ed0d7037

SHA512
38653391a5ab101b49f2cf4a21941dda487a82d0fcfa2568e38aba90ed85ab2804c3042f2a1a305114ab2168a0f08f1c842a4bc4cfb572e0d92f501e14ea48ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
f5dae83b0512630b0dcc34ef70b1789c

SHA1
0fb7f7cecb2982779634891ceb2b8b23861b3709

SHA256
85267ba8a6fdf579921b8dd0db996084ed92038af91b724fba52edfa0f6a8a91

SHA512
2146594271146239476b223f40c161d02f703141c7abb1f6df14592f58c0401f17700bbc5bdfa24d76d839e76e6cf22b4393bc0ae9c3fb7e520be7fa6545cb9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
23KB

MD5
06e814aceb1357bdc2361be16d593578

SHA1
3954b3ad2b16de53e925b5f5d90d9093269e159f

SHA256
2bbf331822b8ea0b4656a2762c3624359b060935a37100fe1e12e8ec1d7ad0fd

SHA512
6b2891d615774fafb26fab13f771b73394ad3850367a34aa165b8868ed51af4a2e63e65c2a1bb06fef4674ac529f7ddcc570ed9249d0d583a02311e46380b0df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
20cf542df78987f5db5d42e602cbce5b

SHA1
8de578d462b9e50b94fd1124e3286c53e8105e38

SHA256
2d073a62903f8f41e6371139a531e0ec7b4449d52f9d7edf11c13395dca694b6

SHA512
f7d2cda46f839beaedff1088357aebbc6146f93963309021dbc2f1979663a14e174ecd94a8e8d2f7ab6bafb7d65efc010f46ddeecda8ec530cb681d0b398c006

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
6cb6f414a093cd8c12b39859df9aaab0

SHA1
7aa7d8a820d6467a89897587705b3eea9475cbb0

SHA256
a205d43deb69563bfa7331601558cea8849d8fa7863ee4f61b81b1a2c641978e

SHA512
a2a42712b75bd0ed949cb067806d7c0389b58b5426ac845cd349d98d846b126bbaf00fd2ff47545163025b81ddacb1fd57bf95578a2b22e760b3004c0b7ce9b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
52610ac1af5cffd225f97f17d5506116

SHA1
cd34bdabe7690dfb2e7e9dae7cab53dcab482d3e

SHA256
6bbd926d7dca8386a27140037c841cb7a86e928b5fe1c4955c5e866a92eeeabb

SHA512
c35afd62fd94073703706acf335d634b4afbaef6dec8cb7463be726e410f0b70a704840dc1941be581df88d880feb0f1d237bbcddb99058d87145e456424d8cf

Download Submit
C:\Users\Admin\Desktop\AtlasTools.deps.json

Filesize
422B

MD5
851d882e1f208226b455dc51d3714535

SHA1
5534735d98be5d140a2e88633ff198c942b16627

SHA256
2dc1aacf59d2de710c18b1360cca9f94e320f9c17a51627f970b2e5ef86f0e7b

SHA512
57493458561d2c53ccaf8262588eae1212edfb24d7616da6b0a492d16a4efd2d0805317727f4f30c0e813361538404e8399ff812471f046f3d2d08631d40ec7f

Download Submit
C:\Users\Admin\Desktop\AtlasTools.exe

Filesize
295KB

MD5
445de3681a25420096f1fe1550893a9d

SHA1
3f79e719863588d46763e8bcb072f42e18a9a931

SHA256
2308698e3126db10b5235d8bcf94ef89bf9886c06186e8d821a8f8ced9fa49f6

SHA512
380cee86243f492d752c1653e0c005ff15b59585187cb95b2ad7a8142988f5876d8ace383712ac1560c1e422be83cd1b51eb995f6a7a37eb1ae37af29c82aa63

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.36-win-x64.exe:Zone.Identifier

Filesize
246B

MD5
e71bea87ffbec45de33382d0a03ed7de

SHA1
699e870da520d29e49d7f0b1dd80dc2557f016ed

SHA256
20093fe38a7f1289b712419b1aaf8adeda638ebdf6c3486666ff1db0415d2862

SHA512
97ad190cafb3c1bd48ee57406124364f0d88609ffa43d9aff6df63bfa97cf49c16e3966ef49f7080866ed47ab4413d2040aa34ba1cce467b182a799a055532f1

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.hVDGTJP9.0.36-win-x64.exe.part

Filesize
27.3MB

MD5
ae83d41a1c9abe65a68e3a89d57409dc

SHA1
dda97001356fb54f86814d1f2befd951d9f0ca6b

SHA256
0278ef7fd07c57f69b6910b2ac234c1d17920bdadc43cad15ed84bbf0eb16985

SHA512
b9790a132bcabf34b3bf149cb2df845bd518fc5da76a138a8736ff0d3e771063dc1b7eac8c8f361f228cf10bd4c9e422bb566db0b374dad0260bd25e45794dce

Download Submit
C:\Windows\Installer\MSID463.tmp

Filesize
219KB

MD5
928f4b0fc68501395f93ad524a36148c

SHA1
084590b18957ca45b4a0d4576d1cc72966c3ea10

SHA256
2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae

SHA512
7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372

Download Submit
C:\Windows\Installer\MSIE719.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{75A7A354-082F-4FC4-8452-F404D255A312}\.cr\windowsdesktop-runtime-6.0.36-win-x64.exe

Filesize
608KB

MD5
d73468bae3dee29164dd9f7fb0ed49cd

SHA1
a1eb8fbe9916008d3948ec64b407600b40cc958c

SHA256
9b8b7390579a87b3f6a1370a31c92ebdcbbf0d43a4007ee6f66f3c1887681b15

SHA512
05c74c09489ac104b9c8e35e339561a0c09687f1b57caceea23c4dc4d199f9bc2e3941e9530a0b8ce0d9ed131892d86a48dbefce6841748d110f2745ac3341c7

Download Submit
C:\Windows\Temp\{8C74C953-DABA-4AE6-987C-CCD32B8E067B}\.ba\1033\thm.wxl

Filesize
5KB

MD5
d5070cb3387a0a22b7046ae5ab53f371

SHA1
bc9da146a42bbf9496de059ac576869004702a97

SHA256
81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a

SHA512
8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3

Download Submit
C:\Windows\Temp\{8C74C953-DABA-4AE6-987C-CCD32B8E067B}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{C245826F-E645-433B-B7C2-3D56D151B443}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{C245826F-E645-433B-B7C2-3D56D151B443}\.ba\wixstdba.dll

Filesize
190KB

MD5
f1919c6bd85d7a78a70c228a5b227fbe

SHA1
71647ebf4e7bed3bc1663d520419ac550fe630ff

SHA256
dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640

SHA512
c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb

Download Submit
C:\Windows\Temp\{C245826F-E645-433B-B7C2-3D56D151B443}\dotnet_host_6.0.36_win_x64.msi

Filesize
716KB

MD5
155dae1ed3b7773cd86b6a68d45eaa35

SHA1
8b8934ba8ac23496a7a554c60e460491da3a54ed

SHA256
f73830d5f64e7a920aef8ae2c101b3dea69a5feb47c10d1d6b2141235c4156ae

SHA512
c1839de901084757da563b4b3c091b0851430102355e655e58bcc7a3324e78de908a30ad3aa5814a52f5ab46cf6f4c1ebe610d84b642554c2661bdc3d72b06bc

Download Submit
C:\Windows\Temp\{C245826F-E645-433B-B7C2-3D56D151B443}\dotnet_hostfxr_6.0.36_win_x64.msi

Filesize
780KB

MD5
9e06a7a66690f89aa724369b851904ec

SHA1
e5e2441fd0a95fc6fa80ec2e2d4bcb451a9eacb6

SHA256
ccb99abeb554c877236697168ad75bf6fb905c986ddbdb463a8e16cf430a1c0d

SHA512
a9d9c7f4146ce5940b237462ef574c58edfc4ca8d4da6079df7cfe7738c869c48ec6619ba45d5275ad45d204be58e40976dbd28a4759058424d14711442e6f1b

Download Submit
C:\Windows\Temp\{C245826F-E645-433B-B7C2-3D56D151B443}\dotnet_runtime_6.0.36_win_x64.msi

Filesize
25.9MB

MD5
ce601053890199872aee8f17e6149527

SHA1
04a99a97045d95f7814608e66ea735f19dda4420

SHA256
db92e057f649d4804d3a758aedade71a3b63991ca318077d4340e47c4bdba8e7

SHA512
6d352a77eeac9bb01d19a115951f9c11ab2285f18739c3861c941353bb63b9f4c418e590eed81762de39c5f1d634dbad274a778fd53df90e29ea919d5fa5bef9

Download Submit
C:\Windows\Temp\{C245826F-E645-433B-B7C2-3D56D151B443}\windowsdesktop_runtime_6.0.36_win_x64.msi

Filesize
28.4MB

MD5
344ffd985baf47c368a9c9b56f9625fd

SHA1
1855382370544728829c5a87e690dc3a674b1df7

SHA256
c463d23e60c2169da0e10d1cfb097d2ae27f25102ac55d4589069bbe2c4a2276

SHA512
c086fedc2bffb94a3cc68ec70bcda8a2ba528c19f394f002ef7b2a49529407915c0e405a70527b63671b89dfe74ba53e8129739d74009d66143da8bda75e852a

Download Submit
memory/1116-1937-0x0000000000300000-0x0000000000376000-memory.dmp

Filesize
472KB

Download
memory/4112-1962-0x0000000000300000-0x0000000000376000-memory.dmp

Filesize
472KB

Download
memory/4504-1963-0x0000000000300000-0x0000000000376000-memory.dmp

Filesize
472KB

Download