Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2023, 00:37
Static task
static1
Behavioral task
behavioral1
Sample
Vega X_94306.exe
Resource
win10v2004-20230621-en
General
-
Target
Vega X_94306.exe
-
Size
8.7MB
-
MD5
d95304d22479d196942a8e188113884c
-
SHA1
f9f88c60a21b7348dd4732134862b80eb324be60
-
SHA256
cc8884209d49144b756c86a3a65385307c06415776863eeec0746438ff8d3e36
-
SHA512
67ad51defe3912434e6c1e9002027517e30c1ff7ddf6592bef10bb14c232b96a234520d92b6666bb9f6cae74a6caa2bb02b7c6c708925dbdc17782a04eeb472a
-
SSDEEP
196608:yIIQxYuxFeQFrqNYaG59Fa9FVDNWXVkHo/EZb:rI0PFLrqNYv529PDNs2Ho/EZb
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV GenericSetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version GenericSetup.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Control Panel\International\Geo\Nation Vega X_94306.exe Key value queried \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Control Panel\International\Geo\Nation GenericSetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Executes dropped EXE 5 IoCs
pid Process 4996 setup94306.exe 4356 GenericSetup.exe 3524 setup94306.exe 3888 GenericSetup.exe 1380 OfferInstaller.exe -
Loads dropped DLL 37 IoCs
pid Process 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 3888 GenericSetup.exe 3888 GenericSetup.exe 3888 GenericSetup.exe 3888 GenericSetup.exe 3888 GenericSetup.exe 3888 GenericSetup.exe 3888 GenericSetup.exe 3888 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe 1380 OfferInstaller.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000_Classes\Local Settings Vega X_94306.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0400000001000000100000004be2c99196650cf40e5a9392a00afeb20f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d4190000000100000010000000fa46ce7cbb85cfb4310075313a09ee052000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 OfferInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 5c000000010000000400000000080000190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd940400000001000000100000004be2c99196650cf40e5a9392a00afeb22000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 OfferInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 GenericSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e GenericSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e GenericSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 GenericSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e GenericSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 OfferInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e GenericSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 GenericSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef4240f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 GenericSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 GenericSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 GenericSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 GenericSetup.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\Vega X.zip:Zone.Identifier firefox.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3476 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4356 GenericSetup.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4356 GenericSetup.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4600 Vega X_94306.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4356 GenericSetup.exe Token: SeDebugPrivilege 1380 OfferInstaller.exe Token: SeDebugPrivilege 1112 firefox.exe Token: SeDebugPrivilege 1112 firefox.exe Token: SeDebugPrivilege 1112 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1112 firefox.exe 1112 firefox.exe 1112 firefox.exe 1112 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1112 firefox.exe 1112 firefox.exe 1112 firefox.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4600 Vega X_94306.exe 4600 Vega X_94306.exe 4356 GenericSetup.exe 1112 firefox.exe 1112 firefox.exe 1112 firefox.exe 1112 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4600 wrote to memory of 4996 4600 Vega X_94306.exe 87 PID 4600 wrote to memory of 4996 4600 Vega X_94306.exe 87 PID 4600 wrote to memory of 4996 4600 Vega X_94306.exe 87 PID 4996 wrote to memory of 4356 4996 setup94306.exe 88 PID 4996 wrote to memory of 4356 4996 setup94306.exe 88 PID 4996 wrote to memory of 4356 4996 setup94306.exe 88 PID 4600 wrote to memory of 3524 4600 Vega X_94306.exe 92 PID 4600 wrote to memory of 3524 4600 Vega X_94306.exe 92 PID 4600 wrote to memory of 3524 4600 Vega X_94306.exe 92 PID 3524 wrote to memory of 3888 3524 setup94306.exe 93 PID 3524 wrote to memory of 3888 3524 setup94306.exe 93 PID 3524 wrote to memory of 3888 3524 setup94306.exe 93 PID 4356 wrote to memory of 1380 4356 GenericSetup.exe 99 PID 4356 wrote to memory of 1380 4356 GenericSetup.exe 99 PID 4356 wrote to memory of 1380 4356 GenericSetup.exe 99 PID 4600 wrote to memory of 3476 4600 Vega X_94306.exe 100 PID 4600 wrote to memory of 3476 4600 Vega X_94306.exe 100 PID 4600 wrote to memory of 3476 4600 Vega X_94306.exe 100 PID 1436 wrote to memory of 1112 1436 firefox.exe 103 PID 1436 wrote to memory of 1112 1436 firefox.exe 103 PID 1436 wrote to memory of 1112 1436 firefox.exe 103 PID 1436 wrote to memory of 1112 1436 firefox.exe 103 PID 1436 wrote to memory of 1112 1436 firefox.exe 103 PID 1436 wrote to memory of 1112 1436 firefox.exe 103 PID 1436 wrote to memory of 1112 1436 firefox.exe 103 PID 1436 wrote to memory of 1112 1436 firefox.exe 103 PID 1436 wrote to memory of 1112 1436 firefox.exe 103 PID 1436 wrote to memory of 1112 1436 firefox.exe 103 PID 1436 wrote to memory of 1112 1436 firefox.exe 103 PID 1112 wrote to memory of 1768 1112 firefox.exe 104 PID 1112 wrote to memory of 1768 1112 firefox.exe 104 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 PID 1112 wrote to memory of 3128 1112 firefox.exe 105 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vega X_94306.exe"C:\Users\Admin\AppData\Local\Temp\Vega X_94306.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\setup94306.exeC:\Users\Admin\AppData\Local\setup94306.exe hhwnd=524368 hreturntoinstaller hextras=id:3edef7f19b9beb4-US-qVYDg2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\7zS483B0C07\GenericSetup.exe.\GenericSetup.exe hhwnd=524368 hreturntoinstaller hextras=id:3edef7f19b9beb4-US-qVYDg3⤵
- Checks for any installed AV software in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\7zS483B0C07\OfferInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS483B0C07\OfferInstaller.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
-
-
-
C:\Users\Admin\AppData\Local\setup94306.exeC:\Users\Admin\AppData\Local\setup94306.exe hready2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\7zS4CDACE47\GenericSetup.exe.\GenericSetup.exe hready3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3888
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt2⤵
- Opens file in notepad (likely ransom note)
PID:3476
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1112.0.795977066\231056150" -parentBuildID 20221007134813 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e014fe20-fc13-41d2-9dbe-67f58c3c64cd} 1112 "\\.\pipe\gecko-crash-server-pipe.1112" 1928 18ca051a858 gpu3⤵PID:1768
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1112.1.1540877155\1970442310" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {efc4da31-7722-4321-9e1e-e6a1e0010409} 1112 "\\.\pipe\gecko-crash-server-pipe.1112" 2316 18c92572e58 socket3⤵PID:3128
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1112.2.1428291011\1717864887" -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 3032 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8911066-1168-4497-a8aa-af25bf4f1607} 1112 "\\.\pipe\gecko-crash-server-pipe.1112" 3048 18ca31f0e58 tab3⤵PID:4876
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1112.3.1500409984\1849128655" -childID 2 -isForBrowser -prefsHandle 3524 -prefMapHandle 3536 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abc69c8a-b479-4616-9ce9-7c6089a1593c} 1112 "\\.\pipe\gecko-crash-server-pipe.1112" 3520 18ca1ba0058 tab3⤵PID:3328
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1112.4.2115300471\2006211619" -childID 3 -isForBrowser -prefsHandle 3812 -prefMapHandle 3808 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da1aa50d-b062-43c4-9b52-55339b88abe6} 1112 "\\.\pipe\gecko-crash-server-pipe.1112" 3824 18ca4129158 tab3⤵PID:4264
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1112.5.1030823940\153684693" -childID 4 -isForBrowser -prefsHandle 5064 -prefMapHandle 5056 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0339362f-2cb0-4ae7-8c9a-382ae7e5331b} 1112 "\\.\pipe\gecko-crash-server-pipe.1112" 5028 18ca5772b58 tab3⤵PID:2372
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1112.6.978908955\947139521" -childID 5 -isForBrowser -prefsHandle 5136 -prefMapHandle 5044 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e55a3c1-308a-4ac7-a518-3e8b2cc6434d} 1112 "\\.\pipe\gecko-crash-server-pipe.1112" 5124 18ca59ad558 tab3⤵PID:2308
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1112.7.455660689\814471676" -childID 6 -isForBrowser -prefsHandle 5328 -prefMapHandle 5332 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4189c2b7-16b8-485c-8873-65e033e75f69} 1112 "\\.\pipe\gecko-crash-server-pipe.1112" 5320 18ca59ad858 tab3⤵PID:1924
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4800
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Vega X.zip\Vega X\READ.txt1⤵PID:5008
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_5F5F520ABA6509FB550A7DDEB645B50F
Filesize1KB
MD52dff2883a80ad9602a175a97287974fb
SHA1c2366a60b63c0cd1bcbd571912fef2ae9fddb9b3
SHA25673635432b7db8d3d96190a5181e726f3beeb048e01f8f154bcfe77f5d6734b48
SHA512d1272f2478200f914e743a25ba192d84ec78872fa5c03489fb93a0b70db3e21b479a65ecc51de30d1249c8f102c2cc73f90570f481b2a641241707ef0af369a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_5F5F520ABA6509FB550A7DDEB645B50F
Filesize520B
MD55b962ea598325bac03590084537c5095
SHA1e9d27e5bcba082ae74cfffb4cc2b4d4ad41f1e7d
SHA2565596ed72fbcfe46f3d78a8c0cc595e67b2b369af99be7f75a308d933fc32d937
SHA51280fd31405e6fc71f28ebd4954843a00bc88f7e7c9f9f0d451dfd2fc2f3c108f1c976626b0751cde716621f42231fc2f9beffdb3ee2dc96e8b9676a403f6df8fa
-
Filesize
621B
MD5ad1a8f8d9ea2fe08bd64dd13d6ad450e
SHA146a4f5c0e86bedd8f94bdfa0e75005809fc3299b
SHA256a70ec63df01049ca33e9e9ba171b339b71dc26d88dfbfdf31c15d22cb7bec5e4
SHA5123bfa4bfedc2ca9922ecc85d7793c5cb47d285f0c4f98e555136f678498c86cf8c6664b3da099e1dd5a01c8151bf643c6a957268e281768b567dc4f5295c5d62c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ld41mu0o.default-release\activity-stream.discovery_stream.json.tmp
Filesize162KB
MD50698f6d54c44a6bd55c92db4245bb817
SHA193eeb518d32f9dfed2947953cca5d0a6e9164727
SHA25654fffb0f9ceaba763b3adf029a4df2b216b58d6d23fb0d70314b74805799fd97
SHA51268815999782458d1a1edcd8fb167b0169abd5a384841f07420044c1755a4364c8aeb1ac3457bbb7753d8559ef1acd8fbd41a3209f82cedd1998c8789edb86c79
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ld41mu0o.default-release\cache2\entries\118BB2BA245AAA64B01692DF29396B97E11FC1A0
Filesize14KB
MD545983d9ae5a41d6a578caa9279758d80
SHA139c09ed18b8bf157d9b7f9be4391ae7bc0a33ae0
SHA25657777dd729fb023b7a894ac464dec71c6ecc8665bf2ea0ec1147f6468eee1387
SHA51279729cb41b2d78f4d0994e0f63ce66cc00ced800968f80d05a7220cedb2290bab457fb560c4023708df41240db6dba84c076c8ff1aa2d0c04120b47cc99a6c33
-
Filesize
25KB
MD5c7151d4057d2b91da27bfab58415dd81
SHA1bb945c91cdfb0960e785fb5a40b27d25fad448e5
SHA2564263a69119ae27e65b3bf25e1552c89e1ff2dbf0fbd6865cbd69a95cf851d81b
SHA512c1f0cb4dee96274fc700d65665690fe5f0075a4fcf9b0b0d12700908225c002efb8311bd8137984cdaffe978936d32a111c5153da8c1784a7f1b7d6204a28f88
-
Filesize
25KB
MD5c7151d4057d2b91da27bfab58415dd81
SHA1bb945c91cdfb0960e785fb5a40b27d25fad448e5
SHA2564263a69119ae27e65b3bf25e1552c89e1ff2dbf0fbd6865cbd69a95cf851d81b
SHA512c1f0cb4dee96274fc700d65665690fe5f0075a4fcf9b0b0d12700908225c002efb8311bd8137984cdaffe978936d32a111c5153da8c1784a7f1b7d6204a28f88
-
Filesize
25KB
MD5c7151d4057d2b91da27bfab58415dd81
SHA1bb945c91cdfb0960e785fb5a40b27d25fad448e5
SHA2564263a69119ae27e65b3bf25e1552c89e1ff2dbf0fbd6865cbd69a95cf851d81b
SHA512c1f0cb4dee96274fc700d65665690fe5f0075a4fcf9b0b0d12700908225c002efb8311bd8137984cdaffe978936d32a111c5153da8c1784a7f1b7d6204a28f88
-
Filesize
31KB
MD53319432d3a694a481f5672fa9eb743d0
SHA199bff8f4941eb3cee3e0a7cb86b89eda1df07bf9
SHA256768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693
SHA5127f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f
-
Filesize
31KB
MD53319432d3a694a481f5672fa9eb743d0
SHA199bff8f4941eb3cee3e0a7cb86b89eda1df07bf9
SHA256768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693
SHA5127f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f
-
Filesize
31KB
MD53319432d3a694a481f5672fa9eb743d0
SHA199bff8f4941eb3cee3e0a7cb86b89eda1df07bf9
SHA256768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693
SHA5127f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f
-
Filesize
31KB
MD53319432d3a694a481f5672fa9eb743d0
SHA199bff8f4941eb3cee3e0a7cb86b89eda1df07bf9
SHA256768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693
SHA5127f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f
-
Filesize
31KB
MD53319432d3a694a481f5672fa9eb743d0
SHA199bff8f4941eb3cee3e0a7cb86b89eda1df07bf9
SHA256768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693
SHA5127f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f
-
Filesize
6.8MB
MD54d65e6eb25db2ce61f4a7a48d9f6082a
SHA1130abbae19f227b0ef4f278e90398b3b3c7c2eff
SHA2561e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a
SHA512b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb
-
Filesize
6.8MB
MD54d65e6eb25db2ce61f4a7a48d9f6082a
SHA1130abbae19f227b0ef4f278e90398b3b3c7c2eff
SHA2561e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a
SHA512b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb
-
Filesize
6.8MB
MD54d65e6eb25db2ce61f4a7a48d9f6082a
SHA1130abbae19f227b0ef4f278e90398b3b3c7c2eff
SHA2561e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a
SHA512b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb
-
Filesize
6.8MB
MD54d65e6eb25db2ce61f4a7a48d9f6082a
SHA1130abbae19f227b0ef4f278e90398b3b3c7c2eff
SHA2561e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a
SHA512b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb
-
Filesize
6.8MB
MD54d65e6eb25db2ce61f4a7a48d9f6082a
SHA1130abbae19f227b0ef4f278e90398b3b3c7c2eff
SHA2561e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a
SHA512b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb
-
Filesize
25KB
MD585b0a721491803f8f0208a1856241562
SHA190beb8d419b83bd76924826725a14c03b3e6533f
SHA25618be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345
SHA5128ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71
-
Filesize
25KB
MD585b0a721491803f8f0208a1856241562
SHA190beb8d419b83bd76924826725a14c03b3e6533f
SHA25618be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345
SHA5128ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71
-
Filesize
814B
MD5fd63ee3928edd99afc5bdf17e4f1e7b6
SHA11b40433b064215ea6c001332c2ffa093b1177875
SHA2562a2ddbdc4600e829ad756fd5e84a79c0401fa846ad4f2f2fb235b410e82434a9
SHA5121925cde90ee84db1e5c15fa774ee5f10fa368948df7643259b03599ad58cfce9d409fd2cd752ff4cbca60b4bbe92b184ff92a0c6e8b78849c4497d38266bd3b4
-
Filesize
149KB
MD57874850410e21b5f48bfe34174fb318c
SHA119522b1b9d932aa89df580c73ef629007ec32b6f
SHA256c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1
SHA512dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa
-
Filesize
149KB
MD57874850410e21b5f48bfe34174fb318c
SHA119522b1b9d932aa89df580c73ef629007ec32b6f
SHA256c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1
SHA512dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa
-
Filesize
149KB
MD57874850410e21b5f48bfe34174fb318c
SHA119522b1b9d932aa89df580c73ef629007ec32b6f
SHA256c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1
SHA512dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa
-
Filesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
Filesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
Filesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
Filesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
Filesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
Filesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
Filesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
Filesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
Filesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
Filesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
Filesize
476KB
MD53c4d2f6fd240dc804e10bbb5f16c6182
SHA130d66e6a1ead9541133bad2c715c1971ae943196
SHA2561f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e
SHA5120657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d
-
Filesize
476KB
MD53c4d2f6fd240dc804e10bbb5f16c6182
SHA130d66e6a1ead9541133bad2c715c1971ae943196
SHA2561f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e
SHA5120657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d
-
Filesize
476KB
MD53c4d2f6fd240dc804e10bbb5f16c6182
SHA130d66e6a1ead9541133bad2c715c1971ae943196
SHA2561f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e
SHA5120657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d
-
Filesize
476KB
MD53c4d2f6fd240dc804e10bbb5f16c6182
SHA130d66e6a1ead9541133bad2c715c1971ae943196
SHA2561f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e
SHA5120657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d
-
Filesize
476KB
MD53c4d2f6fd240dc804e10bbb5f16c6182
SHA130d66e6a1ead9541133bad2c715c1971ae943196
SHA2561f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e
SHA5120657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d
-
Filesize
133KB
MD5ce80365e2602b7cff0222e0db395428c
SHA150c9625eda1d156c9d7a672839e9faaea1dffdbd
SHA2563475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5
SHA5125ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3
-
Filesize
133KB
MD5ce80365e2602b7cff0222e0db395428c
SHA150c9625eda1d156c9d7a672839e9faaea1dffdbd
SHA2563475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5
SHA5125ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3
-
Filesize
133KB
MD5ce80365e2602b7cff0222e0db395428c
SHA150c9625eda1d156c9d7a672839e9faaea1dffdbd
SHA2563475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5
SHA5125ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3
-
Filesize
133KB
MD5ce80365e2602b7cff0222e0db395428c
SHA150c9625eda1d156c9d7a672839e9faaea1dffdbd
SHA2563475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5
SHA5125ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3
-
Filesize
133KB
MD5ce80365e2602b7cff0222e0db395428c
SHA150c9625eda1d156c9d7a672839e9faaea1dffdbd
SHA2563475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5
SHA5125ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3
-
Filesize
27KB
MD52537635bcf851b0faaafc2b0c8eab06a
SHA11124433a701fb5e30b73c0fe901d78fd475a5460
SHA25641f443757912fbadaff9d07c9dfc46a0078d20a512fb10e0a6fec454eea62f5b
SHA5129f4a2c580be3dfc25a4ceb9aebc759fbabd6c218cc0777d9f07980edc30808bd03f3487bf9dd636513b5ad34f8547c762f6a0749de1019c5d0b94ef76b15e68c
-
Filesize
27KB
MD52537635bcf851b0faaafc2b0c8eab06a
SHA11124433a701fb5e30b73c0fe901d78fd475a5460
SHA25641f443757912fbadaff9d07c9dfc46a0078d20a512fb10e0a6fec454eea62f5b
SHA5129f4a2c580be3dfc25a4ceb9aebc759fbabd6c218cc0777d9f07980edc30808bd03f3487bf9dd636513b5ad34f8547c762f6a0749de1019c5d0b94ef76b15e68c
-
Filesize
313B
MD567ed4edc1d47444b046ad77f68cb2801
SHA115d183fc00e868e96e2b5f671bdf5b75678d7474
SHA256c9dd581b481e198c4e83db6be03bec4bac64c02c6c6f9e3051c23c3df6f1301e
SHA512f0beef571b8753c7f32a3e7b3716cdf782026268102510b4a6b0631036b8653d2087ab7b7489931c2cb35c1995bcf6eb7530a049d1f89f372282ceb46d402b76
-
Filesize
25KB
MD5c7151d4057d2b91da27bfab58415dd81
SHA1bb945c91cdfb0960e785fb5a40b27d25fad448e5
SHA2564263a69119ae27e65b3bf25e1552c89e1ff2dbf0fbd6865cbd69a95cf851d81b
SHA512c1f0cb4dee96274fc700d65665690fe5f0075a4fcf9b0b0d12700908225c002efb8311bd8137984cdaffe978936d32a111c5153da8c1784a7f1b7d6204a28f88
-
Filesize
31KB
MD53319432d3a694a481f5672fa9eb743d0
SHA199bff8f4941eb3cee3e0a7cb86b89eda1df07bf9
SHA256768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693
SHA5127f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f
-
Filesize
31KB
MD53319432d3a694a481f5672fa9eb743d0
SHA199bff8f4941eb3cee3e0a7cb86b89eda1df07bf9
SHA256768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693
SHA5127f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f
-
Filesize
31KB
MD53319432d3a694a481f5672fa9eb743d0
SHA199bff8f4941eb3cee3e0a7cb86b89eda1df07bf9
SHA256768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693
SHA5127f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f
-
Filesize
6.8MB
MD54d65e6eb25db2ce61f4a7a48d9f6082a
SHA1130abbae19f227b0ef4f278e90398b3b3c7c2eff
SHA2561e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a
SHA512b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb
-
Filesize
6.8MB
MD54d65e6eb25db2ce61f4a7a48d9f6082a
SHA1130abbae19f227b0ef4f278e90398b3b3c7c2eff
SHA2561e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a
SHA512b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb
-
Filesize
6.8MB
MD54d65e6eb25db2ce61f4a7a48d9f6082a
SHA1130abbae19f227b0ef4f278e90398b3b3c7c2eff
SHA2561e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a
SHA512b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb
-
Filesize
25KB
MD585b0a721491803f8f0208a1856241562
SHA190beb8d419b83bd76924826725a14c03b3e6533f
SHA25618be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345
SHA5128ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71
-
Filesize
25KB
MD585b0a721491803f8f0208a1856241562
SHA190beb8d419b83bd76924826725a14c03b3e6533f
SHA25618be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345
SHA5128ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71
-
Filesize
25KB
MD585b0a721491803f8f0208a1856241562
SHA190beb8d419b83bd76924826725a14c03b3e6533f
SHA25618be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345
SHA5128ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71
-
Filesize
814B
MD5fd63ee3928edd99afc5bdf17e4f1e7b6
SHA11b40433b064215ea6c001332c2ffa093b1177875
SHA2562a2ddbdc4600e829ad756fd5e84a79c0401fa846ad4f2f2fb235b410e82434a9
SHA5121925cde90ee84db1e5c15fa774ee5f10fa368948df7643259b03599ad58cfce9d409fd2cd752ff4cbca60b4bbe92b184ff92a0c6e8b78849c4497d38266bd3b4
-
Filesize
149KB
MD57874850410e21b5f48bfe34174fb318c
SHA119522b1b9d932aa89df580c73ef629007ec32b6f
SHA256c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1
SHA512dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa
-
Filesize
149KB
MD57874850410e21b5f48bfe34174fb318c
SHA119522b1b9d932aa89df580c73ef629007ec32b6f
SHA256c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1
SHA512dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa
-
Filesize
149KB
MD57874850410e21b5f48bfe34174fb318c
SHA119522b1b9d932aa89df580c73ef629007ec32b6f
SHA256c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1
SHA512dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa
-
Filesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
Filesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
Filesize
476KB
MD53c4d2f6fd240dc804e10bbb5f16c6182
SHA130d66e6a1ead9541133bad2c715c1971ae943196
SHA2561f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e
SHA5120657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d
-
Filesize
133KB
MD5ce80365e2602b7cff0222e0db395428c
SHA150c9625eda1d156c9d7a672839e9faaea1dffdbd
SHA2563475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5
SHA5125ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3
-
Filesize
133KB
MD5ce80365e2602b7cff0222e0db395428c
SHA150c9625eda1d156c9d7a672839e9faaea1dffdbd
SHA2563475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5
SHA5125ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3
-
Filesize
133KB
MD5ce80365e2602b7cff0222e0db395428c
SHA150c9625eda1d156c9d7a672839e9faaea1dffdbd
SHA2563475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5
SHA5125ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3
-
Filesize
27KB
MD52537635bcf851b0faaafc2b0c8eab06a
SHA11124433a701fb5e30b73c0fe901d78fd475a5460
SHA25641f443757912fbadaff9d07c9dfc46a0078d20a512fb10e0a6fec454eea62f5b
SHA5129f4a2c580be3dfc25a4ceb9aebc759fbabd6c218cc0777d9f07980edc30808bd03f3487bf9dd636513b5ad34f8547c762f6a0749de1019c5d0b94ef76b15e68c
-
Filesize
313B
MD567ed4edc1d47444b046ad77f68cb2801
SHA115d183fc00e868e96e2b5f671bdf5b75678d7474
SHA256c9dd581b481e198c4e83db6be03bec4bac64c02c6c6f9e3051c23c3df6f1301e
SHA512f0beef571b8753c7f32a3e7b3716cdf782026268102510b4a6b0631036b8653d2087ab7b7489931c2cb35c1995bcf6eb7530a049d1f89f372282ceb46d402b76
-
Filesize
17KB
MD5b597e0a66eac08849cb8ca80f9f2e8b4
SHA1a0405075964c52945c69c8e9d321ce74b39d63d3
SHA256b0c5246b10d5dfaf55b2112910c1ca11815f066c2854eecd326c657a7e46ad57
SHA5124e983f9d781abfc9d40360767e856bbbe5f7673e35a7176e6c85a92f63c7bb3b17445b274672808e78cb13c8055caf3ca9154f19ca7be8cec8b4434124a423da
-
Filesize
16KB
MD5be272836941982a1a22473e27976766e
SHA1f1ff4d69c805497bb9254df081b4c316844071ee
SHA256971ae92220940ac6fbbd2ae155138c348de9ce2e6927fc83d48e27bbd988f3cd
SHA512523d602b44417838c00448061562576ad87eb9e355fa1137c38fb4b9a860081e5b0e5a69c6899717e10854af2f63f56b1d82faf753fc299b525e0dbe34ebd247
-
Filesize
17KB
MD52cf788bac39113080f6ec4d54fb77720
SHA13c6e5dedd0b319ac940b49bb407f9ccaae6f6d7e
SHA256403c4f149bede7ac73a2ff40a3e30e57c9e98ea24cff6121cda04e9ac38f13d8
SHA512e7d2cbb430ad7c8a8d7f0526255f6bb35d6ff0214ebfaa663c9ca8d21914d029ddb7105ae1ed992bc3bc6615ef0b43c57195f3eba7004121a7aa3e0abe0ed3bc
-
Filesize
16KB
MD5cedcf18bbabc93400beeb3f26022ac15
SHA1975be24d7d9d788d23a578a6cf3f0de30224124b
SHA2567b8ea36bf4afbe6d62623ba85239a6a57dbb710e067786bc0b67b6bdcb245c9b
SHA512de38d30f313007b11535e1e4054dd132f889e88da1083ec51b1a94597da60030a04a3285f5d80e2a3637c81c5b22cedb7fc58207695ee5afe142c2695f0405dd
-
Filesize
16KB
MD5b537a58b5ee8605d890fc46d0b6918c5
SHA106f38521367a13529df8e67bad88754fa517a137
SHA256e529c65d0b4ff015109016d2567a511f56d04da4c8cf917c0490272220913ca2
SHA512ff54a2ad53791780cb8a2797f3dd7e009d0c263e516ed4dd3d415ab124f4f90255af63a2e9cb8ee3a5d8b0afb7065e3a3ec12ab48c23d3435332aadab5e12f17
-
Filesize
18KB
MD57ea51496582b5b25fd9e6db9de6d1b8d
SHA150654a76676458916bc08e7121d7a161e852366e
SHA256ad97150baedb7406086e2bed93e121a0cbf40459643c3ad3a0669b659d5ff2c2
SHA5125a4099f7e7e576691b6cde4783702fdc52154388ab3c1361fa3567a9a900c08f2e9e6569c53d9df7469e26c78511a63ff682a0e464d9098844fcba036f814a55
-
Filesize
1KB
MD55f29b47126c45d119442ad3b896f74eb
SHA1801a4e5b7d01f81c9c398b4d8d9a5f49e5269eef
SHA2564e85074502c0267e04b324cdbb46df644e040513e94dd13c6625fb2e039c9a3f
SHA51281ddcda6399365ad83689b14d22488137b88a80988eeed40ff1678fc387cb098227f520514a3d1a2a213efb4a8f435d87f40647bbe35a273c8d277d2c639c18e
-
Filesize
291B
MD5bf5328e51e8ab1211c509b5a65ab9972
SHA1480dfb920e926d81bce67113576781815fbd1ea4
SHA25698f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b
SHA51292bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928
-
Filesize
766B
MD54003efa6e7d44e2cbd3d7486e2e0451a
SHA1a2a9ab4a88cd4732647faa37bbdf726fd885ea1e
SHA256effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508
SHA51286e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198
-
Filesize
5.6MB
MD5b431083586e39d018e19880ad1a5ce8f
SHA13bbf957ab534d845d485a8698accc0a40b63cedd
SHA256b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b
SHA5127805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
Filesize
3.1MB
MD5369acf60d8b5ed6168c74955ee04654f
SHA11753fff63efa6ed5ad30ede6b959261ac67dd13e
SHA2563ff8ec8f9f27a27f414a90bfed5b7f5a3c118b33cf0f80aeb7026e0a53e26632
SHA5122582b3b4525321fece978710403e4bd4dd6e9f0869de1fec784e4e79ac98e8c6498a601c9db45d5af4f1b99e3a2cc07b9e3ec18144e18ce82b41eb64ce4eb643
-
Filesize
3.1MB
MD5369acf60d8b5ed6168c74955ee04654f
SHA11753fff63efa6ed5ad30ede6b959261ac67dd13e
SHA2563ff8ec8f9f27a27f414a90bfed5b7f5a3c118b33cf0f80aeb7026e0a53e26632
SHA5122582b3b4525321fece978710403e4bd4dd6e9f0869de1fec784e4e79ac98e8c6498a601c9db45d5af4f1b99e3a2cc07b9e3ec18144e18ce82b41eb64ce4eb643
-
Filesize
3.1MB
MD5369acf60d8b5ed6168c74955ee04654f
SHA11753fff63efa6ed5ad30ede6b959261ac67dd13e
SHA2563ff8ec8f9f27a27f414a90bfed5b7f5a3c118b33cf0f80aeb7026e0a53e26632
SHA5122582b3b4525321fece978710403e4bd4dd6e9f0869de1fec784e4e79ac98e8c6498a601c9db45d5af4f1b99e3a2cc07b9e3ec18144e18ce82b41eb64ce4eb643
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld41mu0o.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld41mu0o.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld41mu0o.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld41mu0o.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld41mu0o.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld41mu0o.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld41mu0o.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
9KB
MD59927cf897c29677151a69b393428a0b1
SHA1a7c83d94b92f6d4a2e4d8c7da7ae4e132074dd84
SHA256c04089313d47fa5be13ab8173b07c73111f1fe71e1ea4b4fb3a0dfc15b64cfbe
SHA5128414ab3aded2db3f9ce65ebe597efd738d3ec4637597973191e7e6ed78f0376bc0686b92d024df3a2bc80ada01abd9ae164684d6b7986b53d4f5cb8b94207294
-
Filesize
7KB
MD5454c10c56cc6600583665f44f3d415ff
SHA1fd7b900fcbc2a8cc5f027ee12e58f9147eed8560
SHA256fffeec6a32210fc1ae81c291bfd81ef533a07b708cdd2a60455a1c31228ebb7b
SHA5127e709892c15f119aa20d4d2bb5bf6288ace6d2be241b552c621963a14a81e93d7f83541133bdcf39f635ba0490c48530fd36fbe3173d7a067091e3635ad7bc9a
-
Filesize
10KB
MD5d4976b530dba5b6ed571a1c4c02151f7
SHA14fb42e294addbc4aecb0bdcdcebff53a68957748
SHA25638f6768560006eb22e66f6e4465b774f50806f0e031815aa4f430a80d5f11b65
SHA51237ccc4e5d7f49d1cda04bd2d4d4aeaea17670315dfd4b55df382233a7933aac0bb8c887e15176123e98d082de72020f4a78801b81b3262f7111668c1f8161815
-
Filesize
6KB
MD534ff773a49fff928be4ffcaadbde23f5
SHA179127e3f05c782f8763d24d8f0d0179272e142fe
SHA2569499a6d95b69a0a5f75c40849afd47691ef324b8516e2a7ef2bc409baab96981
SHA512775ae04128a60e5e8a1d6af882408c81dd91ed16412a2ef0a2ae9f3eac127eeeb2f236cfd71f0ed61400c714efa277e0ceb082ed233067730c70bc185432c62f
-
Filesize
6KB
MD599020570eaf26f7011d286e5f158aaa9
SHA11e63dc952e48bb62b7eb1e41702d991aeb69391c
SHA2560ae327f939f39d2a5ea593509aa8e0ae4aa0641675dbf5762d0df395f13f9fea
SHA51256140301473273d7e017d48464c44cad3305325f542b3398a39da566b5cb2d67fad0929749730bd10b3bfe507026b41426390f0e6c89f107f7b64f6e66942d8b
-
Filesize
6KB
MD581e6994d18cd7072b75d789d4592976a
SHA12b0dc9b2e49517d3dbcbdd2c6ac664bceea3d56a
SHA2560c1ed1a48bcdf0d36907b2030a74d8353152590315b10f7356e1884308a49d40
SHA5125848bb92cb9f3a209c1ba100c9a391e603252233028d939c556840990e9c6bb3147ff6469f75694a69d71f37ccb66f39a28461a0e601969bdf77f8a270b3e833
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld41mu0o.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5ec5c57316039b455b91b4dec533a29b6
SHA1d26f41f6eb83c827f8fad3db331a391b0790cecc
SHA256701bcf15e6c670ccad78041df2c54a2b4a1208839c8a1d590109e43d60a81212
SHA5124d949541f2c610f7f4efc9eac5e377c1471ba0ead012b7d92bcc11844b3799e34be65629a7d3393a5644d32ec20bb6bfacf23e6ea12a9f2c5a52936d15d7a791
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld41mu0o.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5965c0d57bb2b08bdc751357f54033eff
SHA16d1babfc58994e9932bb1d62ae9d5ee97b3324b2
SHA25648a82eb3a163cc36351d4f3fa21e5977d92f3eb776334ca33abb8d5a9d736f16
SHA51233cd132922c00a6eccd0e974496b0db65843db793c9836d4347ecdd7c8f8a0a6d9d28f9b6982e104fa6a2c8a33658dd0c1b1b52d53f0c9c2feeb1663306eb578
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld41mu0o.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize424KB
MD5e1a75a2da36dfff9b03962da210c9f3f
SHA1391d65e60ae0cd3122ee7d44c1d7315e70023aae
SHA2562b557ab63e3048f2c38798a066e800c9c7a7e2b2891ffa6bf9a2b979c255d68e
SHA512cece7b222a4dd2936fb75dcbbbcf0a997ce744b3ddedf04887cf4f2930746988f3c3386ca488a18d7cddd62dd55c64ea799ca27ba99da5d0911b6df126a8a2d7
-
Filesize
668KB
MD55fcfd9d7a98ffffc32a27896604c5a02
SHA1d765480c5ea422ce32ab377b55c89b969fe421ac
SHA256f612b857c373ff169ba51c9d2a87884b4fceba6be275bb66db8fe864cf34cd5a
SHA5127733d8bb2a9e652c593c7dbc58611d22a05bd62f82a149937baded735b792f0eea3584b631059f75ec91e802d5dd7f1a94cbbf68808759009d8d9c39cc5a4dc2