Analysis
-
max time kernel
331s -
max time network
335s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 17:35
Static task
static1
Behavioral task
behavioral1
Sample
B̷u̷c̷k̷s̷h̷o̷t̷ R̷o̷u̷l̷e̷t̷t̷e̷.rar
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
Buckshot Roulette.exe
Resource
win10v2004-20231215-en
Errors
General
-
Target
B̷u̷c̷k̷s̷h̷o̷t̷ R̷o̷u̷l̷e̷t̷t̷e̷.rar
-
Size
146.3MB
-
MD5
496bd1858c3e2a3a44a5f16da029e9d7
-
SHA1
8df2a8c4020dde5ab5448826080547bbd3e2c58f
-
SHA256
bb231edffd746ffcab7c11330e73036d096a6f80ad032da2f641e67acc7de662
-
SHA512
0016f462508a21a7e888c498d7494f0e8d3359fe060c12e3e6641c1808a881e1be75ba81975e9809893b486ae52fbdae1a8dd9c9efb7ee5b60e88f4dcd7c1d6e
-
SSDEEP
3145728:gjzCUwaZtEXxA+EoeOS9MrNMeeAy7mLJExRDXHUxod7hqqp9Z6:ICUzEMoen9YpeAqLfX0xoxd94
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe" NoEscape.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" NoEscape.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 7 IoCs
pid Process 1624 Buckshot Roulette.exe 6768 [email protected] 6860 NETFramework.exe 1952 Setup.exe 6584 [email protected] 4648 [email protected] 6148 NoEscape.exe -
Loads dropped DLL 5 IoCs
pid Process 1952 Setup.exe 1952 Setup.exe 1952 Setup.exe 1952 Setup.exe 1952 Setup.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini NoEscape.exe File opened for modification C:\Users\Public\Desktop\desktop.ini NoEscape.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
flow ioc 191 camo.githubusercontent.com 192 camo.githubusercontent.com 193 camo.githubusercontent.com 214 raw.githubusercontent.com 215 raw.githubusercontent.com 239 raw.githubusercontent.com 194 camo.githubusercontent.com 216 raw.githubusercontent.com 217 raw.githubusercontent.com -
Modifies WinLogon 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "0" NoEscape.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1" NoEscape.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" NoEscape.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png" NoEscape.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\File Cache\IFEO.exe [email protected] File created C:\Windows\File Cache\Driver.sys [email protected] File opened for modification C:\Windows\File Cache\DLL.dll [email protected] File opened for modification C:\Windows\File Cache\IFEO.exe [email protected] File opened for modification C:\Windows\File Cache\Driver.sys [email protected] File created C:\Windows\winnt32.exe NoEscape.exe File opened for modification C:\Windows\winnt32.exe NoEscape.exe File created C:\Windows\File Cache\DLL.dll [email protected] -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 5604 6584 WerFault.exe 144 3532 4648 WerFault.exe 148 -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Modifies Control Panel 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop\AutoColorization = "1" NoEscape.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Mouse NoEscape.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Mouse\SwapMouseButtons = "1" NoEscape.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop NoEscape.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "162" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings firefox.exe -
NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\Downloads\Spark.zip:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\NoEscape.zip:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1276 msedge.exe 1276 msedge.exe 6768 [email protected] 6768 [email protected] 1952 Setup.exe 1952 Setup.exe 1952 Setup.exe 1952 Setup.exe 1952 Setup.exe 1952 Setup.exe 1952 Setup.exe 1952 Setup.exe 6584 [email protected] 6584 [email protected] 4648 [email protected] 4648 [email protected] -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3168 7zFM.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeRestorePrivilege 3168 7zFM.exe Token: 35 3168 7zFM.exe Token: SeRestorePrivilege 2404 7zG.exe Token: 35 2404 7zG.exe Token: SeSecurityPrivilege 2404 7zG.exe Token: SeSecurityPrivilege 2404 7zG.exe Token: SeDebugPrivilege 4580 firefox.exe Token: SeDebugPrivilege 4580 firefox.exe Token: SeDebugPrivilege 4580 firefox.exe Token: SeDebugPrivilege 4580 firefox.exe Token: SeDebugPrivilege 4580 firefox.exe Token: SeDebugPrivilege 4580 firefox.exe Token: SeRestorePrivilege 6544 7zG.exe Token: 35 6544 7zG.exe Token: SeSecurityPrivilege 6544 7zG.exe Token: SeSecurityPrivilege 6544 7zG.exe Token: SeRestorePrivilege 6668 7zG.exe Token: 35 6668 7zG.exe Token: SeSecurityPrivilege 6668 7zG.exe Token: SeSecurityPrivilege 6668 7zG.exe Token: SeDebugPrivilege 6768 [email protected] Token: SeDebugPrivilege 6584 [email protected] Token: SeDebugPrivilege 4648 [email protected] Token: SeDebugPrivilege 4580 firefox.exe Token: SeRestorePrivilege 3956 7zG.exe Token: 35 3956 7zG.exe Token: SeSecurityPrivilege 3956 7zG.exe Token: SeSecurityPrivilege 3956 7zG.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
pid Process 3168 7zFM.exe 2404 7zG.exe 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe 6544 7zG.exe 6668 7zG.exe 4580 firefox.exe 4580 firefox.exe 3956 7zG.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1624 Buckshot Roulette.exe 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe 6860 NETFramework.exe 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe 6856 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 3168 1968 cmd.exe 87 PID 1968 wrote to memory of 3168 1968 cmd.exe 87 PID 1312 wrote to memory of 4580 1312 firefox.exe 105 PID 1312 wrote to memory of 4580 1312 firefox.exe 105 PID 1312 wrote to memory of 4580 1312 firefox.exe 105 PID 1312 wrote to memory of 4580 1312 firefox.exe 105 PID 1312 wrote to memory of 4580 1312 firefox.exe 105 PID 1312 wrote to memory of 4580 1312 firefox.exe 105 PID 1312 wrote to memory of 4580 1312 firefox.exe 105 PID 1312 wrote to memory of 4580 1312 firefox.exe 105 PID 1312 wrote to memory of 4580 1312 firefox.exe 105 PID 1312 wrote to memory of 4580 1312 firefox.exe 105 PID 1312 wrote to memory of 4580 1312 firefox.exe 105 PID 4580 wrote to memory of 1760 4580 firefox.exe 106 PID 4580 wrote to memory of 1760 4580 firefox.exe 106 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 3292 4580 firefox.exe 107 PID 4580 wrote to memory of 2852 4580 firefox.exe 108 -
System policy modification 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1" NoEscape.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System NoEscape.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" NoEscape.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NoEscape.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\B̷u̷c̷k̷s̷h̷o̷t̷ R̷o̷u̷l̷e̷t̷t̷e̷.rar"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\B̷u̷c̷k̷s̷h̷o̷t̷ R̷o̷u̷l̷e̷t̷t̷e̷.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3168
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3676
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\" -an -ai#7zMap21398:146:7zEvent242121⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2404
-
C:\Users\Admin\AppData\Local\Temp\Buckshot Roulette.exe"C:\Users\Admin\AppData\Local\Temp\Buckshot Roulette.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1624
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.0.1543783905\2005083674" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b76927d8-bd6b-46f4-9d7a-085d1af9f091} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 1976 281654db958 gpu3⤵PID:1760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.1.613999135\248139236" -parentBuildID 20221007134813 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7069f9d5-9b33-42dd-9092-8b3699180840} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 2360 28158c72558 socket3⤵
- Checks processor information in registry
PID:3292
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.2.2032850741\737563245" -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 3076 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aab88681-9fc8-4e1d-98ad-adf9cb4ac54e} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 3048 281695a4858 tab3⤵PID:2852
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.3.1723479070\87670577" -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3596 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d013d476-8b92-4a7e-9c93-535cc4f33449} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 3608 28158c60758 tab3⤵PID:3712
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.4.1721023644\775894870" -childID 3 -isForBrowser -prefsHandle 3596 -prefMapHandle 3636 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c694961e-29c1-4ffe-a57a-9bc1051b2df0} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 3856 2816a7efb58 tab3⤵PID:5048
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.7.101301878\1530480274" -childID 6 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f7de4c4-8f6f-4642-a90b-0f366f61d1fb} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 5528 2816b88aa58 tab3⤵PID:3480
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.6.1285485748\421083873" -childID 5 -isForBrowser -prefsHandle 5256 -prefMapHandle 5260 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6443473-0281-48f2-a2ce-eaa060e986b6} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 5248 2816b889858 tab3⤵PID:2368
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.5.892173551\1407529032" -childID 4 -isForBrowser -prefsHandle 5108 -prefMapHandle 5104 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {232346dc-3148-48f4-a324-8a5860d8095a} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 5116 28166fa7858 tab3⤵PID:3796
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.9.1855148443\1012920652" -childID 8 -isForBrowser -prefsHandle 5428 -prefMapHandle 5424 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0323d21a-bbbc-4d3d-abbc-70e6634e72d3} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 6028 2816abe4058 tab3⤵PID:5656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.8.539895389\987602992" -childID 7 -isForBrowser -prefsHandle 4008 -prefMapHandle 3992 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {703a6dc7-0c57-4289-a9b7-c5ffee5c09ce} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 5708 28166fa4b58 tab3⤵PID:5648
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.10.765336250\559835816" -parentBuildID 20221007134813 -prefsHandle 4008 -prefMapHandle 3992 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3e47e8a-d131-4cd8-82ee-03950da06b90} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 6116 28168261858 rdd3⤵PID:5972
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.11.363658469\1931699534" -childID 9 -isForBrowser -prefsHandle 10224 -prefMapHandle 2860 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2364d3d5-bcd8-44d5-aa9c-7af87f3b5322} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 5728 28166fa4858 tab3⤵PID:5780
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault3342a3f1hc175h4fabhb104h8f607801e1191⤵PID:2820
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xc0,0x12c,0x7ffe0a8b46f8,0x7ffe0a8b4708,0x7ffe0a8b47182⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12752937719679788300,1515001492655354723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12752937719679788300,1515001492655354723,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:5640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12752937719679788300,1515001492655354723,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:3880
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6180
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6248
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Spark\" -spe -an -ai#7zMap13082:72:7zEvent275091⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6544
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap25055:72:7zEvent92861⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6668
-
C:\Users\Admin\Downloads\[email protected]"C:\Users\Admin\Downloads\[email protected]"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6768
-
C:\Users\Admin\Downloads\NETFramework.exe"C:\Users\Admin\Downloads\NETFramework.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6860 -
C:\73b9832479271a48a0c4dab6\Setup.exeC:\73b9832479271a48a0c4dab6\\Setup.exe /x86 /x64 /web2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1952
-
-
C:\Users\Admin\Downloads\[email protected]"C:\Users\Admin\Downloads\[email protected]"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6584 -s 10842⤵
- Program crash
PID:5604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6584 -ip 65841⤵PID:5468
-
C:\Users\Admin\Downloads\[email protected]"C:\Users\Admin\Downloads\[email protected]"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 11282⤵
- Program crash
PID:3532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4648 -ip 46481⤵PID:4320
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\NoEscape\" -spe -an -ai#7zMap28831:78:7zEvent275101⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3956
-
C:\Users\Admin\Downloads\NoEscape\NoEscape.exe"C:\Users\Admin\Downloads\NoEscape\NoEscape.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- System policy modification
PID:6148
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa395d855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6856
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:1280
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD502ab15e715c7d1ae4ece7690cdf5a294
SHA16c998ab25338f369c474ac9e2ac47c5c8538db60
SHA256954c175f9adb86be3a0f8e9ac3ff8518fa7b6ca18d08aa5ef69b8bccdf90197d
SHA512bc7bee61267c65c1ba3ddaddf241e4e44201bfbb8f568dcb1f8e69eff338309cdd0dc4f7099da6f2300eb82487ae420701d5819955c5327da1be87d48a926cd0
-
Filesize
66KB
MD576f7b1cef1a49c82b47b90d04cb039d7
SHA14ac2ae25878c6a598b9cb355a59c060ab9f61497
SHA25605327b7a1c41170fe226ff9079752e26a3a91b5c98e66317e1d90b216df100fc
SHA512434059db641a566e791868f67248cad551f1d3151b82493fd5beaee05005ae79374b851860b4cb69aeda12a9d6b1daccf9b6f294e5cf3353af1aa044a871f1d3
-
Filesize
82KB
MD5f3920542a960c87163a56c543cefd324
SHA17d3d3fd793a7d6d9b51c3186f248e85ee2bba926
SHA256bc268ae7c59a667831d4146e075c31dad36ec7a37d2f4cb786e738c79771252d
SHA5123dee2ba996a325ab1f42e21de3300307c600d8c1032af0c7282de352805fdde2e07fd2f2336fe2a23ea3ac91cf45a7914f1cb97cf3f5d7e47c879f7c0054ac3e
-
Filesize
80KB
MD58d00b037478dd7d49f71762737240958
SHA1832772a63671209fba379caa17b2786e5a45e41b
SHA2563afc5c85a625d9526c13e7a5c088f44ba0ae8155b93f006c7f65cf1cf807dff6
SHA512024e8430ada12f0e7960fa9f33ab2b6b4f2241afb4b40a883f2344fc04aa0916d3000429fda2059331cf7bd78983c3397a700b1c14dc26af3b1c67c0182e3560
-
Filesize
84KB
MD56dbdfcd42c445771a1be1d6a979e5749
SHA1d4f9ca38ada2959eb9f1170c7f8186f1146d4cb1
SHA2561160e3c01d50c4c2a9975e33eb79fd567a6b82f0e68270d705f8abc1f30c2e23
SHA5125fe927ef6e13ee1386d131f20c265026c9f8977a20c97144d8110c33b7757d626d190c9fb7768cef58666197e2d4a7228eda6eb776e8cade456067ea78479b67
-
Filesize
86KB
MD557650e70903871e960b49e65dce6e9f9
SHA14574188dfa8d28bfadcf58572e800f1171f89fde
SHA2561014aedc8e8af3094df5ee650264b5e3a0405e7ff15f9cc2e93c20c2eeb0e48a
SHA5128158e041b731b53c42d77022b3551049cb8998ff7be7471d874b8b246718392e1a222215dbe44a5f23cb8cec1c86d3abda38d266ed37c2b853e0e65ba8c04e19
-
Filesize
80KB
MD52640d0f6737cb3d2a6bdb85bd7cec3d4
SHA14948ab621477ae6609d2c87e49f7a6c421b91acf
SHA25647a78abb0463514e38f58dc852033b3d6a860b6ff78e9eb840252b811ca07b43
SHA51294fd8a425253861fed41ce4c48b04a298fa9b40ba2b99e16bc5cb52c02d84c405586c805279bc66111ba8fa076dbaf8e3d4c309d9601708206fc632d1c0c8136
-
Filesize
28KB
MD5b64b497b9a0c6f73664d94fc3939b217
SHA1eebf353932eb05afe67b4b93ea2f72eef90ef7ae
SHA2561f178f943699bc5ee7185be95e33598a7174d5e8aea39f9415f0a48f91ab5fe4
SHA51272041e8d12ef6559b3bd6eb62c4d88909b37b611bdb4c1ee7fcd8fb19977b332054e1867ccd99b7b653bb5afcc1268b0c10c2a697c38580f813a4db7d414d17e
-
Filesize
80KB
MD56db3905aa9cdbb5218945b2f039bd918
SHA18b083a073476c33619f1a7e59143e834a0aaeba8
SHA2563b2ae103414d88df359138e6300a42b4b81a4a9ec029647cd92a91507f6790e4
SHA5120758f118d25177a5b25ea3a28ff1980047006f3635da8f606c2da444e43978d3caf9576a0d40da5fdd06d4b3c93d19b6f3a6ea0ff7a2a4dcf84b12ba5a3d0285
-
Filesize
84KB
MD5c4e7d53b6230a96a51a9229a38649f6b
SHA1e8803c413e849c2284ecb4e6413a9c806aff4356
SHA2565063961620f393ec42aca367543bbac7ab060ce755bb21893961c7ed3e0b8181
SHA5126c55d234cb9016526690c83bc37280bf35bb3e0dd931bc8a8c2042f6544c1411795d1d4c5b4cda8699151c6de50350bb14ea8262ee47a6b630c808650bbc66bc
-
Filesize
75KB
MD556329f193fdd4cb90668342ba38b8bbe
SHA19471a902509ad3229a8dff03cee2fa092af2e8b8
SHA256f40ecf915e020f5e80da0f4507563e6e986d0082e32388e419bb2cb9ab278ba0
SHA512017d9b2ff58cc3236c4eca34cc502930b69bdb9f77b89ea5075305492437740819375247017d9000932d898f05b526679c879415a243e3da7abb1b39815b33b2
-
Filesize
83KB
MD54e4a8d918f7d6f9c7f703d32e02b0616
SHA154aa1acaa00e2fed592d9fca89019d5e20953490
SHA256e7d59bd7f25e498c1beaff4410c99915cf9196a64bcaed65ee78c2050e775265
SHA5124b5b6db2de1380a11c31f3f70d44740594557c2b36c5aefd8a9b7fcf045821605afb5adc36c5884501af070fd74efeac7e5e6d87e54758574617fd6153fe1f6f
-
Filesize
82KB
MD508d44237c079905a1790ce4f248766d1
SHA18b7731a0d2353bc196f4baf882963dcd63208f7f
SHA2564496e4f201007336d7074e69f489512ed972f22bb7824d6912cf5393ab84aa5a
SHA512bbc145ef2e9af63c32e43102b6164eda0e6389ab60671ff4cc23606afa743fb07c762711d58fa35d94bd2c1f3354eace6f7642dcd969ec2c56f49f73b8a4b0bf
-
Filesize
72KB
MD5cd14395e8e607de625a274651eb5a52b
SHA1402dc99037a2cc2c8da53f52dc9559782bcc1851
SHA2564c5ead9dbe4444405f9d9cfe1d400996f336251d75c264f31521d634cb0095ca
SHA51232accc7cfd5b3a2973db995d4c846844e72d5d6ff7adddb89b7a4fb274e4acb18478e7e357e5151bfd99fafe43e1e55ca0518d79d9b8ffdff06484a5c6c627df
-
Filesize
70KB
MD5bd35a3f092019cdda9aed34580aad75b
SHA12716acf6f85be4b98e8b113f053e072a437b9aea
SHA25608bd53d0c3500faf56aca1aaa3066887415581977d3b1dc87c82d7243a0fc74c
SHA512fd2110ead353f46bda1c055deaaebdd3fd6c72df274ec1826e1e1429d8ed87dfbe24c2e0aa09d32271161d136515cf31ddca334041c71d355aafb995d2fd6a98
-
Filesize
82KB
MD57ed59b3f7090880fdca53615aaf0b1b8
SHA1ed741c332e76e42dc84e44872fb320679b39d528
SHA25615896789b0db777822afeab092f5875f1ec34427c149d9a76a73c7d4c305c8a7
SHA51274b5ad365e208f25d1023b9db5cb450ae8c1a3cc52ae8e850a537010cfea6d47940ddc725638c90413ba4b4e81859cb5f924a894f90e568da76345a26cd09f67
-
Filesize
81KB
MD50aec9e12bdc036632554bfa7acf02364
SHA152fc4760f0b177e02162dbd2e8f864f09dd40b46
SHA256ca7402592b3d15c1a0cc489e8c6e3bedbe686e6c25491f1d3dfdb8991ca2aeea
SHA512ed97c2a059dc54cf4952060ec6415b3a3b437c7e4255bcb326789f5977532660bbb9d05a59c9e567742d225e875a88aa5fabb545166460ad8eb108304b666b9b
-
Filesize
84KB
MD541e0beb3b84b4c515914361d4d0faca2
SHA1abd800e9b47ea64a1d59ece318e346d17c0a36d9
SHA2563dc70b6cc40369c955fc93e452d890372375758bd74fae2093c19f79c65c0add
SHA51239057093b3e698d3a6abd25a25a04a3cd0813ee7803ae818f5c26d150b76cc0474a22521d468bfd1012c99d85a410b16668db4b460894b5d255a0028dc9c0bf5
-
Filesize
81KB
MD511776bf8799541b1fe275f316800f736
SHA167b2b1893ce2d4ea3a7db5bbc9276d1a5b19ac01
SHA2569139f6acae8399628c522e8bd1d714e92be225bc33e696c1bfbeccd6d0e233de
SHA512b7bdb2c9f4f81d21281ccd553f7882e4475c2e01c9c37a2045e5caa48974a7dd796806ae1a76286360e9d314d4da18f4a4cac77e73ca84c9eb3705097c881879
-
Filesize
83KB
MD51bc37bac6c635d56bd68e785950955d1
SHA14e16ed5dde6f2d37449137f2e414761718e4e6f5
SHA2565c6eeb4c977a4c371dbc787d0cf1ad503fbe5d13c10d9b69664954974e15a899
SHA5129a7ae5e495a9863ca0c44107b253d387b8a4c442081974acb030593e98895cdcd80f93b16397a244e45b80d99d2b22edca8b7bdfff5715cb633bf040e7a35192
-
Filesize
80KB
MD5a6c1f2a9c0c3367bb484a0322392ecf3
SHA126887a144de9e1961be84cec5aab58225967dd77
SHA2568abcf315769b6fae1751133bb2dbcba6bf0b0ef4c37304dc466824c77db22ba9
SHA512cb39a1435c0721bac2c44b8ca8873218a1dfda849d478de0e5e75f8fd6762b556a869de3646c5a3394e5367914a87170d5743bcb5c2f91773561d8a526eaa487
-
Filesize
80KB
MD59b47a98c389ced8315fe4b477c9ad06d
SHA1a52933f5e3e40fa5bb871a3ce33e41342d751ecd
SHA256979d4402c8ba85a265cdabda3de7e0f5ab0715fb83faa63c8484095e866ed4ef
SHA51232e2c5bed2c18122bbd434f983dffb4ee318aa28200e4a2e1343591387c81acd4af063874787e4eb9ff110bc456ea888420f59f5afbfe7e0a5fac62213deb597
-
Filesize
66KB
MD5ef091f3efb7b9270502f2eb939c970cf
SHA162f0a992fe9f032bc8197b89daf0a37a34e34a40
SHA2566063d64a1d09d1a33ea3c4fe0a9446bafd5ca69786351f3bdbbd9a9ddc283676
SHA5121713da86ea18be10984314139d3fa78d55de47c04e51c2e869875fec313a5ac8d9da9850a0c1295dc95b62b43351aa735fe407446ed3c8a5a590e64a98378e30
-
Filesize
83KB
MD54c00a85cd7bf97400b70d1de3859e061
SHA1fd5e38e0c92da14373e28600a8396a17102b15fe
SHA25693039cf880eaca54ccc48f159848a17f2c30fa70d334cf2b9eedbcc5aefb27fb
SHA5127005b3c8c6b775a31bce1cea6924bcb929217d288e6bce390a5e591098a39ac0de321474591b56333b6d84167862bcfa12cbb65b9fa0b767961248ae3eae0f64
-
Filesize
82KB
MD59dd24f4d210e2139badbb7e0ea897c87
SHA14aace4240fcc09d433bd82684064136e2145ac4f
SHA256509cfa220321582a56ec21959dfd8a7c55bb3070ad5bb738b074a14188e80593
SHA51297af7279463e4dd69344745dbe7a29b7bd536e795524ce0c24b5672e4c7a4203d3ae0cf6c46f69d491edfcb3efe3a57ddc27ea9f6e213fbc0f4a537cf93d2949
-
Filesize
15KB
MD5cd131d41791a543cc6f6ed1ea5bd257c
SHA1f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA256e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
SHA512a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
-
Filesize
2.7MB
MD536837cdb9209e5924ff65a69e9be7534
SHA1a31dedd58d65755cfd3b8edbecf49ee0bc7e2edc
SHA2561d395b3d453d14f95c80dbd69a66f5b82caee182d3ac5c2cccedf0fe2ab4ee12
SHA51244c6a4a7131bc30c97e07698b3be7d418880b8940b77e635b503a104bab6916a3a254c48f9e9d58999204995cc278e4a3efdf45f06b0927fd304b68d95e5d1a4
-
Filesize
86KB
MD58367720a1164111028db6d5f396cda97
SHA17cfd8f59bbf4653edc0dcbd1603dacde5a7690f1
SHA256e241471f86108bbb6c1c5e4323d1c5598bc3d3f214db2d35103c55aaae62d66c
SHA5122313cce886580ad2dd4feb9e64e671c5e422cb46d2652d0ef6e148f42864adff58e3426f0df2500506441aff019b84e3577fa4b415cff6ac0e3266f11589df3c
-
Filesize
868KB
MD5ee43a1104d88368e5c0c4ab7eace4731
SHA1a3ff9f8ab508c3131db5eba8cee0b205ccacf7e4
SHA256920605232c94d163753f21cf46957ec5af0e0b6ca606b46b4ac4bb1ebab67ff1
SHA512f4b95386fa5f8d0ade3317c97dd623e59f2f9ae9a5ff49f58cfb6da804585cc2bed773340f068ff89b70a4bb9ee4009e6a1daccce49981fe273f23d268f99f0b
-
Filesize
312KB
MD541905594045c8c1321d19d2323afa5f1
SHA1bf2425dc7198e18a5941febbe046257b0630fcea
SHA256d789a1e0cfcd134eabc3d7a9ec3efbc04fa6bf589189871884c542bb302ec648
SHA512b1e1bfe94633c1bde81cf851a0ff726d1044690bc4a71701d5c3847c386576c2357eba57161a647edfc0db063cd4f949adb72bddde32fee5d5f0785008da6101
-
Filesize
31KB
MD5a9f6a028e93f3f6822eb900ec3fda7ad
SHA18ff2e8f36d690a687233dbd2e72d98e16e7ef249
SHA256aaf8cb1a9af89d250cbc0893a172e2c406043b1f81a211cb93604f165b051848
SHA5121c51392c334aea17a25b20390cd4e7e99aa6373e2c2b97e7304cf7ec1a16679051a41e124c7bc890b02b890d4044b576b666ef50d06671f7636e4701970e8ddc
-
Filesize
117KB
MD5bc32088bfaa1c76ba4b56639a2dec592
SHA184b47aa37bda0f4cd196bd5f4bd6926a594c5f82
SHA256b05141dbc71669a7872a8e735e5e43a7f9713d4363b7a97543e1e05dcd7470a7
SHA5124708015aa57f1225d928bfac08ed835d31fd7bdf2c0420979fd7d0311779d78c392412e8353a401c1aa1885568174f6b9a1e02b863095fa491b81780d99d0830
-
Filesize
13KB
MD58a28b474f4849bee7354ba4c74087cea
SHA1c17514dfc33dd14f57ff8660eb7b75af9b2b37b0
SHA2562a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b
SHA512a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369
-
Filesize
68KB
MD5cb78d0ca2b26ab8ed781819e722567a2
SHA165b909a6420aae40193ef591565873c6e73a868c
SHA2567e6d551037d889ee3eb5fab8b84f23cc9ce459c6150104a5d7f5c78ecf81c6d0
SHA512c6c9ea01dc90e7099a5baa543c1784e18a703cb2a733db92abd7e4be0e19453a765bc0da85054eab1c5452b1f58ae4892cd9e0820fd8b71d4a03cf0b25315ab3
-
Filesize
123KB
MD5d39bad9dda7b91613cb29b6bd55f0901
SHA16d079df41e31fbc836922c19c5be1a7fc38ac54e
SHA256d80ffeb020927f047c11fc4d9f34f985e0c7e5dfea9fb23f2bc134874070e4e6
SHA512fad8cb2b9007a7240421fbc5d621c3092d742417c60e8bb248e2baa698dcade7ca54b24452936c99232436d92876e9184eaf79d748c96aa1fe8b29b0e384eb82
-
Filesize
123KB
MD5c66bbe8f84496ef85f7af6bed5212cec
SHA11e4eab9cc728916a8b1c508f5ac8ae38bb4e7bf1
SHA2561372c7f132595ddad210c617e44fedff7a990a9e8974cc534ca80d897dd15abd
SHA5125dabf65ec026d8884e1d80dcdacb848c1043ef62c9ebd919136794b23be0deb3f7f1acdff5a4b25a53424772b32bd6f91ba1bd8c5cf686c41477dd65cb478187
-
Filesize
123KB
MD56125f32aa97772afdff2649bd403419b
SHA1d84da82373b599aed496e0d18901e3affb6cfaca
SHA256a0c7b4b17a69775e1d94123dfceec824744901d55b463ba9dca9301088f12ea5
SHA512c4bdcd72fa4f2571c505fdb0adc69f7911012b6bdeb422dca64f79f7cc1286142e51b8d03b410735cd2bd7bc7c044c231a3a31775c8e971270beb4763247850f
-
Filesize
194KB
MD5c8824ea3ce0a54ff1e89f8a296b4e64b
SHA1333feb78e9bb088650ce90dea0f0ccc57d54a803
SHA2564bb9ea033f4e93dbf42fc74e6faf94fe8b777a34836f7d537436cbe409fd743f
SHA512c40e40e0cb2aaa7cf7cccbe29ca4530ff0e0a4de9a7328996305db6dfd6994cbe085fab7b8f666bbd3d1efd95406ea26b1376aa81908ace60dc131a4e9c32d40
-
Filesize
221KB
MD56404765deb80c2d8986f60dce505915b
SHA1e40e18837c7d3e5f379c4faef19733d81367e98f
SHA256b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120
SHA512a5ff302f38020b31525111206d2f5db2d6a9828c70ef0b485f660f122a30ce7028b5a160dd5f5fbcccb5b59698c8df7f2e15fdf19619c82f4dec8d901b7548ba
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\[email protected]
Filesize410B
MD53bbb825ef1319deb378787046587112b
SHA167da95f0031be525b4cf10645632ca34d66b913b
SHA256d9c6d00fad02f7a9ef0fcddc298ffd58b17020fb12b1336d5733237cbfadb1e0
SHA5127771ae543e188d544e1bb6c65e0453a6777c1c39790a355f4cce652a815bfaf94dd426de3db910a67bd06e463ac0143d9e2ca44d2b12af7f0d84c27b4a09cc54
-
Filesize
152B
MD54d6e17218d9a99976d1a14c6f6944c96
SHA19e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA25632e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
SHA5123fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD54aff9469d9abc13774b10fadc40f1453
SHA164141000b817d808c23ff75ba50ab8e9ed4bb220
SHA2569573cef51b1e50d8ffd0a097f85b345d8b638a3e703a89f8603b7baf1b817396
SHA512953b758fdc0a51eaa8bc51a3d1056437d6eeaf6547e3f9c183427eb5722bb3a6d6e6a4bbd120aa21cdc91ad1d3fb6e0214b8bad8a953dda638df77644d6e5414
-
Filesize
3KB
MD5d46e87d947dda105658dd8cb0c70d4fe
SHA16c0e152a9c41df21baee2cfbcfdecd4bde9fce6c
SHA256cf607b333f16f77df70d4dc819231ea3da42b9d7b7b391b1f5f10c6b37c88c5f
SHA512dfc41ef8a282b8138bfcdcfc206d9b6e37c0944505b073e58f44e0bb2e7f464f83a2dd457d602ef05574f6dae7c0298ec55a0dafaf9794acf7a16138e7c2d6ae
-
Filesize
51.4MB
MD5b07e952896a4bc05fb948e11e38d35a9
SHA19d5f09e017f3f98083f3600c68e40fd1f4708c56
SHA256323f89835f75b978890f419208c21adfb2625ee25aa7dd82ddf804c7d7a423bd
SHA512a65bd05cb139655bd0c9a7d76a4c001deae56e93053977b186613e58da5efda88a95ea534481df4dc7f2ce1e3c8744f6658b42eecc18a9a1ae49bfedbc4cd83c
-
Filesize
34.2MB
MD5d9b8bf106c39d1b8a47975cae257ea42
SHA1be52451b12f85de60ae20e2a8c243caa8b4da2fa
SHA2565615d35480b115e2eaec53f04798e5f39985d9cffc89adc231445f34f8563f7f
SHA5120c8315254eb225e9989e18016cab940eb89c25e62ac59a6bd949f794c8fe4ec0a3a362c0cd433bdff2352f1cb938c0641b0e92099801b3bbc7d5dff9aefc641c
-
Filesize
17KB
MD5d4586c86488cb50d4c5573b3f37609e3
SHA11650636653685cac3da4464e86fc99346bda23bb
SHA2568da51e836b9850f9c957a86aae140c4637e530dba93aa6657afc808baf8da9d8
SHA51252625825c35c7d59fd22f2f3bca4f33de383c31417d0c430acb2d9b18d3270e0441bd1c3d4c6d512e33f3d3ba5901beccff48be891bf3cc7c101f91ca0384e56
-
Filesize
1.6MB
MD5860168a14356be3e65650b8a3cf6c3a0
SHA1ea99e29e119d88caf9d38fb6aac04a97e9c5ac63
SHA2561ae2a53c8adc94b1566ea6b3aa63ce7fe2a2b2fcbe4cec3112f9ebe76e2e9bf9
SHA5120637e4838beded9c829612f0961d981ee6c049f4390c3115fed9c4e919561ad3d0aa7110e32c1d62468a7e4cdc85d2f2e39a741939efd1aafae551de705aab61
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5c2cff8ba8b66b028124234c2c71cfe2b
SHA131f186e8017dbabaaca63ae34891f8299b150c77
SHA256ae1c750ece1a0ad787d76ee30111874366ffc2e3df490a12524e8d0b4c1a3a07
SHA5129393239997f39479cfd78723b9d1203e22a19d0ac7676877b9b3f82ef4531952308aad93f2e5a6fc05a3fe3a53d1140c6784f9d204334126cbf3f4f77c785076
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\53c72321-04cc-470d-a753-47bc33a6a421
Filesize746B
MD5d21f477c578cfe36427e846ae24edba9
SHA1c67196b5d3d20b65af6ae66b41b7990b7266d27f
SHA256590001258b715a111a7f9a3c08231b66073d026a29f82efb6e3b825334bd5128
SHA5127679526f7f01206a90c0e46e9ca05b9da756ca09c2ade5e8b567f1e16f1c18ac05ad10fa626628655252ecc3e2424da8a5e6ac91bd4c911d5bd51c7ef5181ce3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\d83791c8-9d03-48c4-aed0-85ee0a6dff5e
Filesize11KB
MD550957d015124be05994e13f8a7a147cc
SHA1fa31e3e1885bd4f4eed5dbfeb25c82dc35661ae5
SHA2568a4726a2de8ec7f01d6928bd86c07a742a125481c0ea928f33981fa426a68b33
SHA512fa6817f0ce30deb944eb6300dc214d2a9cab00553e6aa1b55766a6052896bdbbbd1a6957b127e20fbf0b9e48367af227427585a50a68f45bd102549889e46360
-
Filesize
6KB
MD5960a557ff381a5e80f8402744708ead0
SHA13778673c1e94b7d472ddf2bd55f68cba70b3167b
SHA256b97649410c23bea7eb4257a12bb55aecd5bfd1716b5a75f7fe65d5c24a18c7a0
SHA5122859cd5da5968ecb3901fa7344dfeb850ce5e1861fc7cb808e14d29084dbe699f63dbac8645910db0a8a6b0c4bd087382ca0a2a3bf125eb2c5391b21046ea420
-
Filesize
6KB
MD508e2d79076cb83ef9a97e2ace042c671
SHA17a5b1a1ea99775c50eaca0cec49257b4fb74502c
SHA256654c3686542f238fddfb32053a718174e8db52200a7ef23564d0a1374b3ec07b
SHA512a5bc6c0e66f1945d60f017ae9a2b1d3f4df3c3f73105fd7334a01604a86affb0890c9d7c5bc173e322544ac6a39fef0b04ee2c6b1deecfb8104939c902aa36f8
-
Filesize
6KB
MD59787e303064ed3b75f90aadf3260fb06
SHA12ab3ca0b9fc72e10d84dfc12e8f8947078eff9cb
SHA256dd3bb7e45672a5ed262c88741d6a45e213b75d35f1d64614c50c5af18d6fb0cf
SHA5122dc0a0f8c4047c3be4e9465fcfbb96ac3d501fa4aebeddcfc1a4bdc1b8d4e08cb421178001af5ac01ec6c50e82c034dd3574e2d6659c0c857b958cd730612a0c
-
Filesize
6KB
MD5af6bb14945a4f12f4cb40ea382850c39
SHA12499ef77f530d8c17dd1284b23645e94ab07af4f
SHA2568768b4861f1ee557e882500dd9c459be3af41b463688f68e911270253f164bdf
SHA51202000072478512fc96c416cf81442786cc3fbdb87de388b964ef322c8effa8ffdcd3fa80e14ced1767945e4056e78b7f2d2d3421b4798064e538b96e9a365d89
-
Filesize
6KB
MD51480c2f63980d213faf5f322b64b6418
SHA183c08e11eff536e60c0343b2de54e78dfedefe9b
SHA256b8502e9dcc4741e590a9d142de423c334f9c5a73af7947bbfacdbd3a13ab81c3
SHA51210329b9b726d9e540e4f382aae6de5bea95bb4c7439bccce70326a31c7fb2c0c24785ba86cac91a068c3d95fed58ba5a4d19ee9cb127083f8ed68f9ddc849bc4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4
Filesize7KB
MD508094a549b5eeb70fb764479b8d4de25
SHA157889ff32165ab60a70e21380f0c91bf5f29af17
SHA25679a3456de6973c2926508ccb448b356e31643c0786551ff4dc4523dfd4f5bf0e
SHA512565459229361951d161edf8819c05d5371fc9a0b999c1102b46b134d326a601857fca92fd3ac336980005dacf234ab17b3e8addae718e65cbbe4b355ed2d052f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4
Filesize7KB
MD5b0b27b8bab6848b835b81151365663a0
SHA1f3da9f1f23c72f1bf75b09764e8d0a4c47621d79
SHA2565099373a204ecf84bfec09221200005eb062a8d2dec0f8b5ab2fe81565b789d5
SHA5126ae55cfb5de4f8ea55c7d781cff3b5dce3f783ab7a83a059d3db1bdf8285a76ab8e10b0e257770736762e2be87ae8a8aa3d2a718cc269b1afdae4213c353c7f2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD5890ab1fc4d9ab01ec6522223fffb5f8c
SHA1b6650a6a64467e62180bebd0be5332e7335a7188
SHA256924c95e3e93384f23418d6ec934bbb454124d44d54ef51bc32de3544cecf819c
SHA51222b890cb4ec763a008ccf2a3a9f48eb2ff6c4d7ca8a980baec73696b55bb4e15c12aa8caa7feb0036ec46c30013edebcdecd732f7c4605d3d9a62a5308a2682d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4
Filesize7KB
MD5b77c095021e56481c1c25931eaff1dd8
SHA16493ce5d72eb61cd6f4adea3b87c454d8287d6a3
SHA256a096797d11964248991b71991b5618e4f1ef7102dd7cf5c25d7e44481d9d9bce
SHA512448c11e4924892412186b83b4efdb366332b477c89df059c0616990fa4041babdcdf1252fba3090ab6adebd7b1e7a3893b9a09e64aa43452be3f595bd0f57e80
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4
Filesize103KB
MD5eecd926dce0be24d28984b71d9b94f0c
SHA1d39184ca3c896afcc581d4e2c26382d7d1e770c0
SHA256576de92e5b48972c2be35f98cb9c396c76783f6d72b12d25a42d017df4e26318
SHA51215d839c3e394d34964bc10bd0b21e505e5350a79b059f1bbd160f21a18ac30563862d9ab1dbc9025a1128e8d8ac21a5ab8d3550e6e3912b7ceb620f8f52e40e3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore.jsonlz4
Filesize7KB
MD5d9903d87a98274231f66c03ac902df26
SHA11cce0bf77ac8fee0979bebc20f869a6f2f42593c
SHA2568b6068f9c87173540cbd3cb5b44cd5d9a2fd94eb113afa5e365758162f27f42c
SHA51216d268d317033f45882548cae7199181e06ecfa6bb84a18bc5f27eee1171e67fefa6c32da76a834c9b1299ffbceb55a1e496e9314cd45aa26dbe83695855ff66
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD5feacfeaa6370d0dd460a0609e1e1435e
SHA11463da69f34d0efa56e61d9dd55ac1f435237b5b
SHA256d57b87db93a487d521c52be8e0d599fcfb17e8012f6066c303f4e48e92c3f439
SHA51261097d4419f67e7b364a5f0f3a248d801e0bbff2283ffce8cb89a5d43309145288c20ce1a6620217c81256db7da81de7d184a0c7eb769ea237902a5abbe5782b
-
C:\Users\Admin\Downloads\[email protected]
Filesize495KB
MD5181ee63003e5c3ec8c378030286ed7a2
SHA16707f3a0906ab6d201edc5b6389f9e66e345f174
SHA25655bfcb784904477ef62ef7e4994dee42f03d69bfec3591989513cccbba3fc8fe
SHA512e9820f60b496d6631e054204c6fc5b525527d40a578faac1d5cdb116abcb4a35aacf4f4354ff092a2b455c5d9c2e0f29a761d737d9c9ad3d59d70b51d0583d92
-
Filesize
1.4MB
MD54fb795478a8f346c337a1f84baccc85b
SHA1c0919415622d86c3d6ab19f0f92ea938788db847
SHA25665a7cb8fd1c7c529c40345b4746818f8947be736aa105007dfcc57b05897ed62
SHA5129ca9e00bb6502a6ab481849b11c11526a12e5a1f436f929381d038e370c991e89a7bbcddc62da436accaeaa1d292b6453fdea964d645d08299a64aa603f8bc69
-
Filesize
616KB
MD5ef4fdf65fc90bfda8d1d2ae6d20aff60
SHA19431227836440c78f12bfb2cb3247d59f4d4640b
SHA25647f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8
SHA5126f560fa6dc34bfe508f03dabbc395d46a7b5ba9d398e03d27dbacce7451a3494fbf48ccb1234d40746ac7fe960a265776cb6474cf513adb8ccef36206a20cbe9
-
Filesize
666B
MD5e49f0a8effa6380b4518a8064f6d240b
SHA1ba62ffe370e186b7f980922067ac68613521bd51
SHA2568dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
SHA512de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4
-
Filesize
116KB
MD5a61c26b360471c8258c7571037c4bca0
SHA15db105e0384f25b1ab165c10a9445e6b943cd0ff
SHA256e77316a1fd682e1af8af3ccd03c170f886b9ec8edf7013e1be6a6207cb5a6f16
SHA5123ef680d50ccfa4311d3d1bec1648c48cf8e8633353dea5e06f52339047ede36fd1655ce728541e769d9fcaa6ab8c2a66981aef708a9f4d05ae46ad26f9d6aef4
-
Filesize
9KB
MD58cc9cc6a8168b750954dc8d63a8da6e6
SHA11118772f1cac728ce51df36ed7058ba4380a7ac2
SHA2568fbdb68eab9fd43be4861de04f7a9d4455cf23604c2afb8a42578368f37d1aba
SHA512e3930ae1529d6e9b27279475f9500a85cd5a3af5a4fc55fe075d014a15d9a8a59a2fcf4dc4960073c121d79451c0e970402dd46b960d6d479e158375913520a0
-
Filesize
4KB
MD54a741ee0a43e437b2f12d3cf355a0234
SHA1f0282ade55c154168cf036b72f1b6b329fe36011
SHA2569e919b9d333e5084427c4aaf4c00d058d9e2955f0428962dcb87fd48e163e65d
SHA51287ad3828d1152cc25bed0a2c0cfa728341d6780b6c2d4872481a884ed72a08dcd1d315321c1e629d005480d8184a4bc7d7a7f88ddefe546a5959c3836dafb14c