cobaltstrike | cde8eaf68d611447fcc50d5d9c2a0367523138a470a41cda344ee73ebceca87d

Analysis

max time kernel
767s
max time network
918s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshot 2024-05-06 1.41.32 PM.png
Size

2KB
MD5

2bb68f4f284ecb1bdeb44dc50247841a
SHA1

e82ef84597658be1d9c5581bab3f1a3e99e58ce5
SHA256

cde8eaf68d611447fcc50d5d9c2a0367523138a470a41cda344ee73ebceca87d
SHA512

f8ff7937811ae918e087653ae113e684da9a7c330479f66241c777b9dd8a0024016dddcc673234c1558507a00cab590be05eea54c963c84458047eded4ea8919

Score

10^/10

cobaltstrike zgrat backdoor bootkit discovery evasion execution exploit persistence rat spyware stealer trojan upx

Malware Config

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0009000000023c84-10587.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Detect ZGRat V1 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024255-9300.dat	family_zgrat_v1
behavioral1/files/0x000700000002426a-9296.dat	family_zgrat_v1
behavioral1/memory/9076-10079-0x000002B88DA50000-0x000002B88DAA4000-memory.dmp	family_zgrat_v1
behavioral1/memory/9076-10147-0x000002B8A8970000-0x000002B8A8B92000-memory.dmp	family_zgrat_v1

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 9740 created 8316	9740	WerFaultSecure.exe	341

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe:Zone.Identifier:$DATA	Gnil.exe
File opened for modification	C:\Windows\system32\drivers\rsElam.sys	RAVEndPointProtection-installer.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe:Zone.Identifier:$DATA	Gnil.exe
File created	C:\Windows\system32\drivers\rsCamFilter020502.sys	RAVEndPointProtection-installer.exe
File created	C:\Windows\system32\drivers\rsKernelEngine.sys	RAVEndPointProtection-installer.exe
File created	C:\Windows\system32\drivers\rsElam.sys	RAVEndPointProtection-installer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004\FuncName = "WVTAsn1SpcPeImageDataEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLREMOVESIGNEDDATAMSG\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2010\FuncName = "WVTAsn1IntentToSealAttributeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCertPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\FuncName = "CryptSIPVerifyIndirectData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2\FuncName = "WVTAsn1CatMemberInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.3\DefaultId = "{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPPutSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.1\FuncName = "WVTAsn1CatNameValueDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2\FuncName = "WVTAsn1IntentToSealAttributeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLCREATEINDIRECTDATA\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.25\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222\FuncName = "WVTAsn1CatMemberInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12\FuncName = "WVTAsn1SpcSpOpusInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4\Dll = "WINTRUST.DLL"	regsvr32.exe

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Localized Name = "AVG Secure Browser"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\ = "AVG Secure Browser"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\StubPath = "\"C:\\Program Files\\AVG\\Browser\\Application\\123.0.24828.123\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
6980	icacls.exe
6396	takeown.exe
10672	takeown.exe
5736	icacls.exe
7076	takeown.exe
1104	icacls.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe\DisableExceptionChainValidation = "0"	AVGBrowserUpdate.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000023547-852.dat	acprotect

Checks computer location settings 2 TTPs 35 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	avg_secure_browser_setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	LDPlayer9_ens_com.roblox.client_25567197_ld.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	AVGBrowserUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	rsStubActivator.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	aj1C6C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	rsAppUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe

Executes dropped EXE 64 IoCs

pid	Process
1488	WinNuke.98.exe
5024	WinNuke.98(1).exe
3680	Mabezat.exe
4556	xpajB.exe
2568	xpaj.exe
3588	xpaj.exe
4800	Gnil.exe
4908	spoclsv.exe
1620	Gnil.exe
4664	spoclsv.exe
3604	Floxif.exe
1276	firefox.exe
3204	firefox.exe
3300	firefox.exe
1624	firefox.exe
4344	firefox.exe
1060	firefox.exe
1752	firefox.exe
5628	firefox.exe
5956	firefox.exe
5964	firefox.exe
6140	firefox.exe
4200	firefox.exe
6132	firefox.exe
4776	firefox.exe
5452	firefox.exe
5684	firefox.exe
6472	firefox.exe
7064	firefox.exe
7080	firefox.exe
7152	firefox.exe
6980	avg_secure_browser_setup.exe
2768	aj1C6C.exe
5460	AVGBrowserUpdateSetup.exe
6148	AVGBrowserUpdate.exe
2364	AVGBrowserUpdate.exe
1644	AVGBrowserUpdate.exe
7032	AVGBrowserUpdateComRegisterShell64.exe
5436	AVGBrowserUpdateComRegisterShell64.exe
6972	AVGBrowserUpdateComRegisterShell64.exe
6280	AVGBrowserUpdate.exe
5656	AVGBrowserUpdate.exe
6292	AVGBrowserUpdate.exe
1980	AVGBrowserInstaller.exe
5900	setup.exe
2668	setup.exe
7476	firefox.exe
7484	firefox.exe
7492	firefox.exe
7872	firefox.exe
8048	firefox.exe
8100	firefox.exe
8180	firefox.exe
7600	firefox.exe
9052	firefox.exe
9044	firefox.exe
9060	firefox.exe
6380	firefox.exe
6432	firefox.exe
2452	firefox.exe
5532	AVGBrowserCrashHandler.exe
4644	AVGBrowserCrashHandler64.exe
5920	setup.exe
5024	setup.exe

Loads dropped DLL 64 IoCs

pid	Process
3604	Floxif.exe
408	firefox.exe
408	firefox.exe
1276	firefox.exe
1276	firefox.exe
1276	firefox.exe
1276	firefox.exe
1276	firefox.exe
1276	firefox.exe
3204	firefox.exe
3204	firefox.exe
3204	firefox.exe
3204	firefox.exe
3204	firefox.exe
3204	firefox.exe
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
2748	firefox.exe
2748	firefox.exe
1624	firefox.exe
1624	firefox.exe
4344	firefox.exe
1060	firefox.exe
4344	firefox.exe
1060	firefox.exe
4344	firefox.exe
4344	firefox.exe
1060	firefox.exe
1060	firefox.exe
1752	firefox.exe
1752	firefox.exe
1752	firefox.exe
1752	firefox.exe
1752	firefox.exe
1752	firefox.exe
1060	firefox.exe
1060	firefox.exe
4344	firefox.exe
4344	firefox.exe
5628	firefox.exe
5628	firefox.exe
5628	firefox.exe
5628	firefox.exe
5628	firefox.exe
5628	firefox.exe
5964	firefox.exe
5964	firefox.exe
5964	firefox.exe
5964	firefox.exe
5956	firefox.exe
5956	firefox.exe
5956	firefox.exe
5956	firefox.exe
6140	firefox.exe
6140	firefox.exe
6140	firefox.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
10672	takeown.exe
5736	icacls.exe
7076	takeown.exe
1104	icacls.exe
6980	icacls.exe
6396	takeown.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32\ = "\"C:\\Program Files\\AVG\\Browser\\Application\\123.0.24828.123\\notification_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32\ServerExecutable = "C:\\Program Files\\AVG\\Browser\\Application\\123.0.24828.123\\notification_helper.exe"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\InprocServer32\ = "C:\\Program Files\\ldplayer9box\\VBoxC.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\InprocServer32	Ld9BoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32	AVGBrowserUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\DownloadScan.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\InprocServer32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\WSSDep.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InProcServer32\ = "C:\\Program Files\\ldplayer9box\\VBoxProxyStub.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32\ = "\"C:\\Program Files\\ldplayer9box\\Ld9BoxSVC.exe\""	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\InprocServer32\ = "C:\\Program Files\\ldplayer9box\\VBoxC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000023547-852.dat	upx
behavioral1/memory/3604-855-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3604-859-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x00090000000244d0-11588.dat	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGBrowserAutoLaunch_2539D9FFF1F40C0A976762D6C815D3E3 = "\"C:\\Program Files\\AVG\\Browser\\Application\\AVGBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\""	AVGBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Checks for any installed AV software in registry 1 TTPs 7 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	avg_secure_browser_setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\AVAST Software\Avast	avg_secure_browser_setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	aj1C6C.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\AVAST Software\Avast	aj1C6C.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	AVGBrowser.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	AVGBrowser.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	AVGBrowser.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	aj1C6C.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	rsEngineSvc.exe
File opened (read-only)	\??\m:	xpajB.exe
File opened (read-only)	\??\o:	xpajB.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\u:	xpajB.exe
File opened (read-only)	\??\w:	xpajB.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\g:	xpajB.exe
File opened (read-only)	\??\h:	xpajB.exe
File opened (read-only)	\??\q:	xpajB.exe
File opened (read-only)	\??\F:	takeown.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\i:	xpajB.exe
File opened (read-only)	\??\l:	xpajB.exe
File opened (read-only)	\??\t:	xpajB.exe
File opened (read-only)	\??\y:	xpajB.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\e:	xpajB.exe
File opened (read-only)	\??\k:	xpajB.exe
File opened (read-only)	\??\r:	xpajB.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\j:	xpajB.exe
File opened (read-only)	\??\n:	xpajB.exe
File opened (read-only)	\??\p:	xpajB.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	takeown.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\F:	takeown.exe
File opened (read-only)	\??\F:	rsEngineSvc.exe
File opened (read-only)	\??\s:	xpajB.exe
File opened (read-only)	\??\v:	xpajB.exe
File opened (read-only)	\??\x:	xpajB.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
106	raw.githubusercontent.com
107	raw.githubusercontent.com
108	raw.githubusercontent.com
3198	raw.githubusercontent.com
105	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 7 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	xpaj.exe
File opened for modification	\??\PhysicalDrive0	aj1C6C.exe
File opened for modification	\??\PhysicalDrive0	AVGBrowserUpdate.exe
File opened for modification	\??\PhysicalDrive0	AVGBrowserUpdate.exe
File opened for modification	\??\PhysicalDrive0	AVGBrowserUpdate.exe
File opened for modification	\??\PhysicalDrive0	AVGBrowser.exe
File opened for modification	\??\PHYSICALDRIVE0	xpaj.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0009000000023c84-10587.dat	autoit_exe
behavioral1/files/0x00070000000244d0-11528.dat	autoit_exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	AVGBrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	AVGBrowser.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_4B7EBDACFF7CEC3D08B5D86C9ECA8639	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	rsEngineSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_4B7EBDACFF7CEC3D08B5D86C9ECA8639	rsEngineSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_43.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ClientConfiguration.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.ServiceModel.Duplex.dll	xpajB.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-utils.js	installer.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\osfimm.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jjs.exe	xpajB.exe
File created	C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Quarantine.dll	RAVEndPointProtection-installer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\mozavcodec.dll	xpajB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	xpajB.exe
File created	C:\Program Files\McAfee\Temp3533232325\jslang\wa-res-shared-fr-CA.js	installer.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	Floxif.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Media Player\wmpshare.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\C2R64.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\Microsoft.AnalysisServices.SPClient.Interfaces.DLL	xpajB.exe
File created	C:\Program Files\McAfee\Temp3533232325\jslang\eula-da-DK.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-zh-TW.js	installer.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_hu.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	xpajB.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxDDR0.r0	dnrepairer.exe
File opened for modification	\??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso98win32client.dll	xpajB.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll	xpajB.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\lcms.dll	xpajB.exe
File opened for modification	C:\Program Files\McAfee\Temp3533232325\wa_install_error.png	installer.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll	xpajB.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\events.json	ServiceHost.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\psuser_arm64.dll	xpajB.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Net.Requests.dll	RAVEndPointProtection-installer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_en-GB.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\clrcompression.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll	xpajB.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\psmachine_arm64.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe	xpajB.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File created	C:\Windows\Installer\e60cce9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e60cce9.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDA5.tmp	msiexec.exe
File created	C:\Windows\Installer\e60cced.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
10512	sc.exe
7224	sc.exe
10448	sc.exe
10700	sc.exe
9796	sc.exe
10384	sc.exe
8616	sc.exe
6644	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	3604	WerFault.exe	106

Checks SCSI registry key(s) 3 TTPs 17 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AVGBrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AVGBrowser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aj1C6C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AVGBrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aj1C6C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dnplayer.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dnplayer.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AVGBrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	AVGBrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	AVGBrowser.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
7712	taskkill.exe
4664	taskkill.exe
5920	taskkill.exe
232	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001"	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dnplayer.exe = "11001"	dnplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppName = "AVGBrowserUpdateWebPlugin.exe"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppName = "AVGBrowserUpdateBroker.exe"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	dnplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6"	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\Policy = "3"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\Policy = "3"	AVGBrowserUpdate.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rsEngineSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\hostprefix	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rsEngineSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 0c1f000036e11a3c59a1da01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rsWSC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rsEngineSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rsWSC.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update	AVGBrowserUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4A75-437E-B0BB-7E7C90D0DF2A}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4BA3-7903-2AA4-43988BA11554}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.Session.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-808E-11E9-B773-133D9330F849}\ = "IGuestMonitorInfoChangedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-F1F8-4590-941A-CDB66075C5BF}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3COMClassService	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-319C-4E7E-8150-C5837BD265F6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FF5A-4795-B57A-ECD5FFFA18A4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4430-499F-92C8-8BED814A567A}\ = "IGuestProcessStateChangedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-9849-4F47-813E-24A75DC85615}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4A9E-43F4-B7A7-54BD285E22F4}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A708F91-06A3-409E-83BC-4A5CF10C8025}\NumMethods	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-B7DB-4616-AAC6-CFB94D89BA78}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CD54-400C-B858-797BCB82570E}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4453-4F3E-C9B8-5686939C80B6}\ = "IGuestProcess"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0C65-11EA-AD23-0FF257C71A7F}\ = "ICloudNetworkGatewayInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-394D-44D3-9EDB-AF2C4472C40A}\ = "ICloudNetworkEnvironmentInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-EABD-4FA6-960A-F1756C99EA1C}\ = "IGuestSessionRegisteredEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-73A5-46CC-8227-93FE57D006A6}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3E87-11E9-8AF2-576E84223953}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5A1D-43F1-6F27-6A0DB298A9A8}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23AE0B95-20F3-4632-A2AE-C3D706E1D5D9}\ProgID	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C7E81D6-0463-485E-8DF5-2ADAD81FAF40}\ProxyStubClsid32	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.webp\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8CE7-469F-A4C2-6476F581FF72}\NumMethods\ = "14"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CC87-4F6E-A0E9-47BB7F2D4BE5}\ = "IInternalProgressControl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ldmnq.apk\Shell\Open	LDPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-AC97-4C16-B3E2-81BD8A57CC27}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3700FAF-2DC2-4322-99B1-D6A51203AF77}\ProxyStubClsid32	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0D96-40ED-AE46-A564D484325E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0126-43E0-B05D-326E74ABB356}\NumMethods\ = "28"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-604D-11E9-92D3-53CB473DB9FB}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-04D0-4DB6-8D66-DC2F033120E1}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-47C7-4A3F-AAE1-1B516817DB41}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5637-472A-9736-72019EABD7DE}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9B2D-4377-BFE6-9702E881516B}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{633D953B-278A-4DAC-8E4B-D15296A1C845}\ = "GoogleUpdate Update3Web"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3FF2-4F2E-8F09-07382EE25088}\NumMethods\ = "14"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1bcf-4218-9807-04e036cc70f1}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EEA7BDE239E6384EA053D0B7B67C65B\SourceList\PackageName = "AVGBrowserUpdateHelper.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7071-4894-93D6-DCBEC010FA91}\ = "INetworkAdapter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4C1B-EDF7-FDF3-C1BE6827DC28}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7556-4CBC-8C04-043096B02D82}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-B45C-48AE-8B36-D35E83D207AA}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7071-4894-93D6-DCBEC010FA91}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FF5A-4795-B57A-ECD5FFFA18A4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-D545-44AA-8013-181B8C288554}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-BF98-47FB-AB2F-B5177533F493}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4A06-81FC-A916-78B2DA1FA0E5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C71F-4A36-8E5F-A77D01D76090}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6972DB5C-E9D6-4A81-B352-B415A3A61CA6}\ = "IAppBundleWeb"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-C71F-4A36-8E5F-A77D01D76090}\ = "IGuestMonitorChangedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-26F1-4EDB-8DD2-6BDDD0912368}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4C1B-EDF7-FDF3-C1BE6827DC28}\ = "IGuestDnDSource"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3CF5-4C0A-BC90-9B8D4CC94D89}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0547-448E-BC7C-94E9E173BF57}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3700FAF-2DC2-4322-99B1-D6A51203AF77}\ = "IMiscUtils"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BA03866-1403-40EA-81A9-23FCD97810E2}\ = "ICoCreateAsyncStatus"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C50E3A4-12A8-41FB-9941-E8EEB222E07E}\ProxyStubClsid32	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1EC0-4C0F-857F-FBE2A737A256}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C9D6-4742-957C-A6FD52E8C4AE}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3WebSvc.1.0\ = "GoogleUpdate Update3Web"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-93AF-42A7-7F13-79AD6EF1A18D}	regsvr32.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	aj1C6C.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	aj1C6C.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f1030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	rsEngineSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf50f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	rsEngineSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	aj1C6C.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	rsEngineSvc.exe

NTFS ADS 12 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Mabezat.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\xpajB.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\xpaj.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\avg_secure_browser_setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\LDPlayer9_ens_com.roblox.client_25567197_ld.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ArcticBomb(1).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WinNuke.98(1).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Gnil.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Floxif.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ArcticBomb.exe:Zone.Identifier	firefox.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
4800	Gnil.exe
4800	Gnil.exe
4800	Gnil.exe
4800	Gnil.exe
4800	Gnil.exe
4800	Gnil.exe
4908	spoclsv.exe
4908	spoclsv.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
1620	Gnil.exe
1620	Gnil.exe
1620	Gnil.exe
1620	Gnil.exe
1620	Gnil.exe
1620	Gnil.exe
4664	spoclsv.exe
4664	spoclsv.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4556	xpajB.exe
2988	taskmgr.exe
8928	dnplayer.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
10988	AVGBrowser.exe
10988	AVGBrowser.exe
10988	AVGBrowser.exe
10988	AVGBrowser.exe
10988	AVGBrowser.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	firefox.exe
Token: SeDebugPrivilege	2540	firefox.exe
Token: SeDebugPrivilege	2540	firefox.exe
Token: SeDebugPrivilege	2540	firefox.exe
Token: SeDebugPrivilege	2540	firefox.exe
Token: SeDebugPrivilege	5036	taskmgr.exe
Token: SeSystemProfilePrivilege	5036	taskmgr.exe
Token: SeCreateGlobalPrivilege	5036	taskmgr.exe
Token: 33	5036	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5036	taskmgr.exe
Token: SeDebugPrivilege	2988	taskmgr.exe
Token: SeSystemProfilePrivilege	2988	taskmgr.exe
Token: SeCreateGlobalPrivilege	2988	taskmgr.exe
Token: SeDebugPrivilege	3604	Floxif.exe
Token: SeDebugPrivilege	2540	firefox.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	6148	AVGBrowserUpdate.exe
Token: SeDebugPrivilege	6148	AVGBrowserUpdate.exe
Token: SeDebugPrivilege	6148	AVGBrowserUpdate.exe
Token: 33	1980	AVGBrowserInstaller.exe
Token: SeIncBasePriorityPrivilege	1980	AVGBrowserInstaller.exe
Token: SeDebugPrivilege	5900	setup.exe
Token: SeDebugPrivilege	5900	setup.exe
Token: SeDebugPrivilege	5900	setup.exe
Token: SeDebugPrivilege	6148	AVGBrowserUpdate.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	2768	aj1C6C.exe
Token: SeIncreaseQuotaPrivilege	2768	aj1C6C.exe
Token: SeIncreaseQuotaPrivilege	2768	aj1C6C.exe
Token: SeDebugPrivilege	5920	setup.exe
Token: SeDebugPrivilege	5920	setup.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
5036	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2568	xpaj.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
3588	xpaj.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
6980	avg_secure_browser_setup.exe
2768	aj1C6C.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
8152	LDPlayer9_ens_com.roblox.client_25567197_ld.exe
5996	LDPlayer.exe
8200	dnrepairer.exe
10128	Ld9BoxSVC.exe
4300	driverconfig.exe
8928	dnplayer.exe
8292	Ld9BoxSVC.exe
8944	vbox-img.exe
3276	vbox-img.exe
6020	vbox-img.exe
10904	Ld9BoxHeadless.exe
5884	Ld9BoxHeadless.exe
7896	Ld9BoxHeadless.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2540	4732	firefox.exe	81
PID 4732 wrote to memory of 2540	4732	firefox.exe	81
PID 4732 wrote to memory of 2540	4732	firefox.exe	81
PID 4732 wrote to memory of 2540	4732	firefox.exe	81
PID 4732 wrote to memory of 2540	4732	firefox.exe	81
PID 4732 wrote to memory of 2540	4732	firefox.exe	81
PID 4732 wrote to memory of 2540	4732	firefox.exe	81
PID 4732 wrote to memory of 2540	4732	firefox.exe	81
PID 4732 wrote to memory of 2540	4732	firefox.exe	81
PID 4732 wrote to memory of 2540	4732	firefox.exe	81
PID 4732 wrote to memory of 2540	4732	firefox.exe	81
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 2748	2540	firefox.exe	82
PID 2540 wrote to memory of 4024	2540	firefox.exe	83
PID 2540 wrote to memory of 4024	2540	firefox.exe	83
PID 2540 wrote to memory of 4024	2540	firefox.exe	83
PID 2540 wrote to memory of 4024	2540	firefox.exe	83
PID 2540 wrote to memory of 4024	2540	firefox.exe	83
PID 2540 wrote to memory of 4024	2540	firefox.exe	83
PID 2540 wrote to memory of 4024	2540	firefox.exe	83
PID 2540 wrote to memory of 4024	2540	firefox.exe	83
PID 2540 wrote to memory of 4024	2540	firefox.exe	83
PID 2540 wrote to memory of 4024	2540	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-05-06 1.41.32 PM.png"
1⤵
PID:3032

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.0.176131302\930191458" -parentBuildID 20230214051806 -prefsHandle 1772 -prefMapHandle 1764 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0db21fbc-5556-4e91-81fe-616299752e85} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 1852 23dd7a0e658 gpu
    3⤵
    - Loads dropped DLL
    PID:2748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.1.1597502922\2139849143" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b56cc252-1e0b-462e-8fef-340e47b559ef} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 2420 23dc368a258 socket
    3⤵
    PID:4024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.2.1354993527\2050169337" -childID 1 -isForBrowser -prefsHandle 2608 -prefMapHandle 2792 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a89a467-f25b-48c5-9077-3aec3636b086} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 2768 23dd6997b58 tab
    3⤵
    - Loads dropped DLL
    PID:408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.3.345283313\1028925963" -childID 2 -isForBrowser -prefsHandle 3976 -prefMapHandle 3964 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41596e10-831d-4d6c-b06c-1b684183e0f2} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 3988 23dc367ae58 tab
    3⤵
    PID:3532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.4.1371609556\1459103875" -childID 3 -isForBrowser -prefsHandle 4984 -prefMapHandle 4980 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43e5f72d-679f-4d71-aeee-310dd9633333} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 4988 23dded1be58 tab
    3⤵
    PID:1060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.5.1875931292\756703644" -childID 4 -isForBrowser -prefsHandle 5128 -prefMapHandle 5132 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23755e2c-31b6-4657-a382-91a53df2ee71} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 5008 23dded55258 tab
    3⤵
    PID:884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.6.491211021\1523179197" -childID 5 -isForBrowser -prefsHandle 5328 -prefMapHandle 5332 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cb1b529-a623-4d1e-8c41-335d24220283} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 5316 23dded55b58 tab
    3⤵
    PID:4804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.7.2050817506\2124957357" -childID 6 -isForBrowser -prefsHandle 4464 -prefMapHandle 4444 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04de0f1e-a2f1-42a3-8c25-3d46855de833} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 4472 23dd6920258 tab
    3⤵
    PID:692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.8.1279964439\1666266308" -childID 7 -isForBrowser -prefsHandle 5316 -prefMapHandle 4980 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b5c9541-d2e4-4ce7-8fd8-2e7dd66edcf8} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 5156 23dda1d6658 tab
    3⤵
    PID:1968
- - C:\Users\Admin\Downloads\WinNuke.98.exe
    "C:\Users\Admin\Downloads\WinNuke.98.exe"
    3⤵
    - Executes dropped EXE
    PID:1488
- - C:\Users\Admin\Downloads\WinNuke.98(1).exe
    "C:\Users\Admin\Downloads\WinNuke.98(1).exe"
    3⤵
    - Executes dropped EXE
    PID:5024
- - C:\Users\Admin\Downloads\Mabezat.exe
    "C:\Users\Admin\Downloads\Mabezat.exe"
    3⤵
    - Executes dropped EXE
    PID:3680
- - C:\Users\Admin\Downloads\xpajB.exe
    "C:\Users\Admin\Downloads\xpajB.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4556
- - C:\Users\Admin\Downloads\xpaj.exe
    "C:\Users\Admin\Downloads\xpaj.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetWindowsHookEx
    PID:2568
- - C:\Users\Admin\Downloads\xpaj.exe
    "C:\Users\Admin\Downloads\xpaj.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetWindowsHookEx
    PID:3588
- - C:\Users\Admin\Downloads\Gnil.exe
    "C:\Users\Admin\Downloads\Gnil.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4800
  - - C:\Windows\SysWOW64\drivers\spoclsv.exe
      C:\Windows\system32\drivers\spoclsv.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4908
- - C:\Users\Admin\Downloads\Gnil.exe
    "C:\Users\Admin\Downloads\Gnil.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1620
  - - C:\Windows\SysWOW64\drivers\spoclsv.exe
      C:\Windows\system32\drivers\spoclsv.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4664
- - C:\Users\Admin\Downloads\Floxif.exe
    "C:\Users\Admin\Downloads\Floxif.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 432
      4⤵
      Program crash
      PID:2800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.9.782814394\256766813" -childID 8 -isForBrowser -prefsHandle 408 -prefMapHandle 6696 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1208b28a-6513-4f55-8aff-658f940b2a66} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 6692 23dde38de58 tab
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.10.1307481051\274231252" -childID 9 -isForBrowser -prefsHandle 5576 -prefMapHandle 4976 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84259e14-f823-4aa7-9464-0cfc4ccde3f1} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 5524 23de0d68558 tab
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.11.1263641389\1774787311" -childID 10 -isForBrowser -prefsHandle 7232 -prefMapHandle 7208 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24690973-b091-4d46-8c00-a85a0aafbd71} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 7240 23de1479858 tab
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.12.399373937\2041626321" -childID 11 -isForBrowser -prefsHandle 11268 -prefMapHandle 11160 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {220eb252-fa1c-4c6c-a71f-0ec2de15e294} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 6688 23de227e558 tab
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.13.1496877090\450032951" -childID 12 -isForBrowser -prefsHandle 10900 -prefMapHandle 10896 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9cb68b2-46da-47b4-b56c-7332e5d60c56} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10884 23de2df3158 tab
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.14.1347916101\72654517" -childID 13 -isForBrowser -prefsHandle 10728 -prefMapHandle 10720 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ea7092d-5f14-4953-a867-0d1a7f13d24f} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10736 23de2df3458 tab
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.15.944462501\1187166580" -childID 14 -isForBrowser -prefsHandle 10540 -prefMapHandle 10536 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0eb8d283-d764-47a8-a45f-1b4065c26665} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10552 23de2df4658 tab
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.16.1427400803\21960833" -childID 15 -isForBrowser -prefsHandle 10116 -prefMapHandle 10120 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {614ac576-bfe6-4ab2-88db-1b97cdac00c6} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10100 23de42aae58 tab
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.17.794242506\94671961" -childID 16 -isForBrowser -prefsHandle 9936 -prefMapHandle 10144 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ae55e3c-e187-447a-8a9d-f4e1fcd48347} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9928 23de4610058 tab
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.18.210821394\1207800117" -childID 17 -isForBrowser -prefsHandle 10720 -prefMapHandle 10736 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbceccc3-56f4-4243-814b-a8c1e2773bc6} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9920 23de43faa58 tab
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.19.740557093\715264796" -childID 18 -isForBrowser -prefsHandle 10700 -prefMapHandle 9780 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84e0f3e0-765a-41d2-bb66-f31f51964eea} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9788 23de49cb558 tab
    3⤵
    - Executes dropped EXE
    PID:6132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.20.787644800\1420524210" -childID 19 -isForBrowser -prefsHandle 10676 -prefMapHandle 10680 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77634a5f-e972-4cf2-9f0e-02db35495c7e} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9608 23de49c8558 tab
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.21.96395193\1546842767" -childID 20 -isForBrowser -prefsHandle 9352 -prefMapHandle 9356 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02dff265-6762-4b8c-bb3a-ca46ef78ebff} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9340 23de4a5ce58 tab
    3⤵
    - Executes dropped EXE
    PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.22.350833139\1847420663" -childID 21 -isForBrowser -prefsHandle 9592 -prefMapHandle 9352 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d93b884a-721a-4b38-9b82-110639607ac5} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9340 23de18e4b58 tab
    3⤵
    - Executes dropped EXE
    PID:4776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.23.165739734\1274412125" -childID 22 -isForBrowser -prefsHandle 8972 -prefMapHandle 8964 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {777f1310-91b6-4032-b78b-5ab014f7d61c} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8980 23de18e3058 tab
    3⤵
    - Executes dropped EXE
    PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.24.575430372\2083137852" -childID 23 -isForBrowser -prefsHandle 8788 -prefMapHandle 8784 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3dd42494-788d-4132-a108-23d62c70bfde} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8800 23de18e3f58 tab
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.25.2006268589\327823554" -childID 24 -isForBrowser -prefsHandle 11296 -prefMapHandle 8728 -prefsLen 28201 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53d0baf1-909d-46d1-9ec4-58fc1af47cf9} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 5060 23de213d958 tab
    3⤵
    - Executes dropped EXE
    PID:6472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.26.1487559532\552704381" -childID 25 -isForBrowser -prefsHandle 9952 -prefMapHandle 5312 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {292f64ea-1ba7-49de-8151-0b7189546e2d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8460 23ddf192358 tab
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:7064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.27.1399393798\444917795" -childID 26 -isForBrowser -prefsHandle 8904 -prefMapHandle 8968 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1e11474-8351-4162-84b3-8e1db51f9c5d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8916 23ddf192c58 tab
    3⤵
    - Executes dropped EXE
    PID:7080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.28.1500257593\1377768785" -childID 27 -isForBrowser -prefsHandle 8156 -prefMapHandle 8160 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06204a7e-1e56-48cf-9342-4dcc3ecee0a0} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8420 23de0632558 tab
    3⤵
    - Executes dropped EXE
    PID:7152
- - C:\Users\Admin\Downloads\avg_secure_browser_setup.exe
    "C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Suspicious use of SetWindowsHookEx
    PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\aj1C6C.exe
      "C:\Users\Admin\AppData\Local\Temp\aj1C6C.exe" /relaunch=8 /was_elevated=1 /tagdata
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Checks for any installed AV software in registry
      Checks whether UAC is enabled
      Writes to the Master Boot Record (MBR)
      Checks SCSI registry key(s)
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\nss1D84.tmp\AVGBrowserUpdateSetup.exe
        
        AVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dfirefox --import-cookies --auto-launch-chrome"
        5⤵
        Executes dropped EXE
        
        PID:5460
      - C:\Program Files (x86)\GUM37D1.tmp\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\GUM37D1.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dfirefox --import-cookies --auto-launch-chrome"
        6⤵
        Sets file execution options in registry
        Checks computer location settings
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:6148
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2364
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1644
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:7032
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:5436
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:6972
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezY5MDUyQjFBLUU5N0ItNDQ4NS05MTMzLUY3ODdGNTIzMkY4OX0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9InswNjdEMjcyOS0wOTk4LTRDOTMtQkVFOC1ENjU0QzBDOEQ1M0J9IiB1c2VyaWRfZGF0ZT0iMjAyNDA1MDgiIG1hY2hpbmVpZD0iezAwMDA5QkIwLTk4NjYtMzU5Mi1BM0E2LTA4NkJDQzI5MDlFN30iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDUwOCIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins1M0Y2MEFGOS0xRjdCLTQ2QjgtODBCOC1GOTk5ODc5QTBBQzF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTIyOCIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNTIyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        7⤵
        Executes dropped EXE
        
        PID:6280
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dfirefox --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{69052B1A-E97B-4485-9133-F787F5232F89}" /silent
        7⤵
        Executes dropped EXE
        
        PID:5656
    - - C:\Program Files\AVG\Browser\Application\123.0.24828.123\Installer\setup.exe
        
        setup.exe /silent --create-shortcuts=0 --install-level=1 --system-level
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5920
      - C:\Program Files\AVG\Browser\Application\123.0.24828.123\Installer\setup.exe
        
        "C:\Program Files\AVG\Browser\Application\123.0.24828.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=123.0.24828.123 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff68bbe23d0,0x7ff68bbe23dc,0x7ff68bbe23e8
        6⤵
        Executes dropped EXE
        
        PID:5024
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 taskbarpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"
        6⤵
        Checks computer location settings
        
        PID:5788
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"
        6⤵
        Checks computer location settings
        
        PID:6004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.29.1535818195\83529949" -childID 28 -isForBrowser -prefsHandle 7216 -prefMapHandle 11388 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e193c2a8-de63-4475-97a2-274fc962878e} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 11168 23de25f5b58 tab
    3⤵
    - Executes dropped EXE
    PID:7476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.30.76214050\504541467" -childID 29 -isForBrowser -prefsHandle 7488 -prefMapHandle 7484 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85cef0ce-7380-4565-ae73-ebb89e3cddee} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 7496 23de25f5e58 tab
    3⤵
    - Executes dropped EXE
    PID:7484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.31.626557959\2071978121" -childID 30 -isForBrowser -prefsHandle 7664 -prefMapHandle 11228 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27ac2f70-389f-48f6-bca6-dd658f44d033} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 7636 23de25f6858 tab
    3⤵
    - Executes dropped EXE
    PID:7492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.32.821400358\1583380181" -childID 31 -isForBrowser -prefsHandle 11520 -prefMapHandle 11524 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de1bb2e4-b72e-493c-ad69-1c0af4516748} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9320 23de2df2b58 tab
    3⤵
    - Executes dropped EXE
    PID:7872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.33.403061122\1142654813" -childID 32 -isForBrowser -prefsHandle 9396 -prefMapHandle 11544 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c470ce91-7130-4786-913b-f0b7ecad0ccf} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 11168 23de2df5558 tab
    3⤵
    - Executes dropped EXE
    PID:8048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.34.1990459536\1221921064" -childID 33 -isForBrowser -prefsHandle 7496 -prefMapHandle 11536 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ede81560-2ca0-4158-a24a-cfcc89dfb88f} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8160 23de4008758 tab
    3⤵
    - Executes dropped EXE
    PID:8100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.35.1836691257\1312998575" -childID 34 -isForBrowser -prefsHandle 12052 -prefMapHandle 12048 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3721613-b530-4748-a50f-ef2bd19deaf7} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 11924 23de48e5958 tab
    3⤵
    - Executes dropped EXE
    PID:8180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.36.1975867065\1206947466" -childID 35 -isForBrowser -prefsHandle 12112 -prefMapHandle 12116 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b0f8f9d-9333-41b4-884d-cf475f773b03} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12104 23de48e5c58 tab
    3⤵
    - Executes dropped EXE
    PID:7600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.37.1715334201\367207784" -childID 36 -isForBrowser -prefsHandle 12164 -prefMapHandle 12168 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5959dd82-6600-4f6a-bfde-769d9a80093c} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12260 23de4610058 tab
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:9044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.38.2025684585\1395016594" -childID 37 -isForBrowser -prefsHandle 12152 -prefMapHandle 12156 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9afed4c1-325a-4a9c-b6ac-0e6dc9e3999e} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12084 23de4937558 tab
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:9052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.39.387319560\158832281" -childID 38 -isForBrowser -prefsHandle 12088 -prefMapHandle 12144 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84cacea5-45c8-434b-9f9e-4cd4488a564d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 7260 23de4939958 tab
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:9060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.40.1255495057\437264107" -parentBuildID 20230214051806 -prefsHandle 8120 -prefMapHandle 12196 -prefsLen 28210 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f583690a-5c17-4250-9e0b-29522da673f5} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 6176 23dddd65258 rdd
    3⤵
    - Executes dropped EXE
    PID:6380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.41.745716769\995753836" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 12200 -prefMapHandle 10048 -prefsLen 28210 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61bad004-1593-4265-acaf-5f5fe2a197da} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10844 23dde1c0b58 utility
    3⤵
    - Executes dropped EXE
    PID:6432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.42.268055561\1000274646" -childID 39 -isForBrowser -prefsHandle 10592 -prefMapHandle 11236 -prefsLen 28210 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c98300be-8d88-4242-9e9f-95a626f15984} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10604 23de0635558 tab
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.43.1051956823\1824300197" -parentBuildID 20230214051806 -sandboxingKind 0 -prefsHandle 9316 -prefMapHandle 7956 -prefsLen 28210 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4f922a2-dd45-403b-b9d3-893f1aa89778} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 7176 23de15f8258 utility
    3⤵
    PID:1124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.44.1737893251\1129757618" -childID 40 -isForBrowser -prefsHandle 10196 -prefMapHandle 10060 -prefsLen 28562 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {718075a6-814d-484a-bb1e-33dca47d060f} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10820 23ddc576258 tab
    3⤵
    - Checks computer location settings
    PID:4928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.45.25958645\822495807" -childID 41 -isForBrowser -prefsHandle 11740 -prefMapHandle 11744 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23e93c1f-40c4-48c3-80b9-9562d60bcd34} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 11752 23de0e9bb58 tab
    3⤵
    PID:5056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.46.227981374\435396371" -childID 42 -isForBrowser -prefsHandle 10340 -prefMapHandle 11416 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4284edc-c176-4758-b58c-9b629069c3d8} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 7428 23ddcfe8458 tab
    3⤵
    - Checks computer location settings
    PID:6108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.47.1580483167\1267984557" -childID 43 -isForBrowser -prefsHandle 9000 -prefMapHandle 7448 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c6bf2c9-a131-4c1c-b805-ea06e6a414b6} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10712 23de1de3858 tab
    3⤵
    - Checks computer location settings
    PID:8744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.48.1897352940\1311184690" -childID 44 -isForBrowser -prefsHandle 8504 -prefMapHandle 11576 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd9163a7-9dd4-4b91-a0ac-5d3d3223e6d9} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8244 23de1de1158 tab
    3⤵
    PID:8936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.49.1977347692\1062316778" -childID 45 -isForBrowser -prefsHandle 8180 -prefMapHandle 8020 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8efd751-2c9c-4a56-af07-19a3f5d73feb} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 7972 23de2189e58 tab
    3⤵
    PID:8388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.50.708139306\499496210" -childID 46 -isForBrowser -prefsHandle 7524 -prefMapHandle 7536 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7e0b328-e9c4-4d6b-ab1f-69324500ab93} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 5624 23de15f5258 tab
    3⤵
    PID:7588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.51.1162847145\1437680126" -childID 47 -isForBrowser -prefsHandle 8288 -prefMapHandle 1472 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b340730-1f4e-4317-9640-030222334dcd} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8240 23de2d54558 tab
    3⤵
    PID:7264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.52.1500642886\1889567506" -childID 48 -isForBrowser -prefsHandle 8496 -prefMapHandle 8344 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d49057cf-922d-4b81-98f2-f5a0fa204c3f} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8104 23de2d56958 tab
    3⤵
    PID:7272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.53.710918571\827710373" -childID 49 -isForBrowser -prefsHandle 11592 -prefMapHandle 11596 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6f581a5-140e-4bea-af18-b7bba8b5189b} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12188 23de4886058 tab
    3⤵
    PID:7764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.54.1691827440\87576177" -childID 50 -isForBrowser -prefsHandle 5624 -prefMapHandle 7536 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0eaf4b9-36f0-4b13-a63b-86772ef0c525} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 11820 23de46f0358 tab
    3⤵
    PID:7776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.55.2064437003\696793615" -childID 51 -isForBrowser -prefsHandle 11356 -prefMapHandle 8832 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d24c2e88-390d-469c-837a-44ab1e2c442f} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 11772 23de4d96c58 tab
    3⤵
    PID:8220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.56.186357475\1668989586" -childID 52 -isForBrowser -prefsHandle 12428 -prefMapHandle 12424 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6337f259-841b-4249-9251-ffbc2c7dbf5b} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8884 23de4764c58 tab
    3⤵
    PID:7420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.57.1202498644\1120106701" -childID 53 -isForBrowser -prefsHandle 12576 -prefMapHandle 12584 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {615559da-cca6-47d7-8bf7-ea4d3cfe09b7} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8876 23de4fe3558 tab
    3⤵
    PID:7460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.58.644464509\1425392195" -childID 54 -isForBrowser -prefsHandle 12620 -prefMapHandle 12632 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d39e992-29d3-4cf4-a43b-d31ad3653b3b} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12752 23de5f9cc58 tab
    3⤵
    PID:2416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.59.292485043\920784221" -childID 55 -isForBrowser -prefsHandle 8844 -prefMapHandle 8456 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb73907e-2bee-4612-92af-8a4182d2a67d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8880 23de5f9a558 tab
    3⤵
    PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.60.1055455289\599611038" -childID 56 -isForBrowser -prefsHandle 10688 -prefMapHandle 7468 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64ad40e9-25a6-4029-8d64-eaa370166457} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10100 23de5f9c358 tab
    3⤵
    PID:7136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.61.449919691\1175515837" -childID 57 -isForBrowser -prefsHandle 11176 -prefMapHandle 11300 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fa59536-3a08-4b7d-b5f4-7edfbd67f14e} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10340 23de0635e58 tab
    3⤵
    - Checks computer location settings
    PID:6420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.62.1540456579\829626453" -childID 58 -isForBrowser -prefsHandle 7060 -prefMapHandle 11312 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cb94dd6-1dd2-4106-b64c-24d4cb52a91c} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9516 23de017d558 tab
    3⤵
    PID:6388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.63.720720677\1663155309" -childID 59 -isForBrowser -prefsHandle 9564 -prefMapHandle 8660 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5d99442-2406-4202-8873-9dc61c1cd6d2} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 6712 23de20e6b58 tab
    3⤵
    PID:5396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.64.733044708\2014954588" -childID 60 -isForBrowser -prefsHandle 11588 -prefMapHandle 1448 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44921f08-0a64-4152-ba6a-6a7be479e34c} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8496 23de227bb58 tab
    3⤵
    PID:8580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.65.713141522\654203231" -childID 61 -isForBrowser -prefsHandle 12272 -prefMapHandle 3688 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8245cb8-f141-4ab5-a4b6-d1107f432c3a} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9564 23de2df2858 tab
    3⤵
    PID:8984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.66.1811082511\1293554105" -childID 62 -isForBrowser -prefsHandle 5896 -prefMapHandle 5908 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e755a78d-d614-4850-bde3-719377af854f} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 5872 23de2df4c58 tab
    3⤵
    PID:8876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.67.535999318\1712118147" -childID 63 -isForBrowser -prefsHandle 5956 -prefMapHandle 7172 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c326f84e-0d50-4543-9c7c-64eec48a690c} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 5820 23de2df5b58 tab
    3⤵
    PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.68.1440966780\114722934" -childID 64 -isForBrowser -prefsHandle 12688 -prefMapHandle 12568 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b29d4966-b9da-4fa1-a6d4-28918d86b93d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 5876 23de4009358 tab
    3⤵
    PID:6952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.69.1525922212\1745321964" -childID 65 -isForBrowser -prefsHandle 12540 -prefMapHandle 12552 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47a6b5d4-b3f2-4803-9f05-514d65193dc4} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12428 23de40dfd58 tab
    3⤵
    PID:9148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.70.1431320150\284317681" -childID 66 -isForBrowser -prefsHandle 11576 -prefMapHandle 11656 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a58f8bf-6aaa-4353-b053-87a278141dbc} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12488 23de40e1858 tab
    3⤵
    PID:8640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.71.1946441463\527083688" -childID 67 -isForBrowser -prefsHandle 4616 -prefMapHandle 8560 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdd5ef6e-0962-4d13-ad59-5a4d12678579} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 11456 23de4138e58 tab
    3⤵
    PID:3460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.72.1516806902\658728581" -childID 68 -isForBrowser -prefsHandle 11224 -prefMapHandle 10660 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac93436e-e1ab-4d68-8741-8daa53770e2d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9496 23de4138858 tab
    3⤵
    - Checks computer location settings
    PID:7252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.73.1446548135\182566942" -childID 69 -isForBrowser -prefsHandle 8292 -prefMapHandle 10088 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95fab31e-34af-4dcf-8edd-0acb99aeb506} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12344 23de42aab58 tab
    3⤵
    PID:5728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.74.2143915403\374706456" -childID 70 -isForBrowser -prefsHandle 11708 -prefMapHandle 11700 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1df6d238-becd-419c-9497-cc162a94d6a3} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12300 23de42ab758 tab
    3⤵
    PID:8108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.75.1018192351\1767311335" -childID 71 -isForBrowser -prefsHandle 9396 -prefMapHandle 9372 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ce2dbdb-bba9-4c12-9cfe-c021bb1da618} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 5904 23dd9abd858 tab
    3⤵
    PID:7748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.76.1948997466\95466626" -childID 72 -isForBrowser -prefsHandle 10100 -prefMapHandle 12496 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b561184-fb99-4e60-8a66-5d9d282d582d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10552 23ddf191a58 tab
    3⤵
    PID:8688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.77.1829111441\123512846" -childID 73 -isForBrowser -prefsHandle 9920 -prefMapHandle 9644 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60d30a5e-e3c1-41a8-9c7f-ceb6af1bb02d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8168 23de0393b58 tab
    3⤵
    PID:8312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.78.90130670\807793038" -childID 74 -isForBrowser -prefsHandle 12448 -prefMapHandle 5884 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {734f42a8-34a0-4a1d-abc0-24d8397dff4b} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 11844 23de17c1558 tab
    3⤵
    PID:8020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.79.1902061897\452214715" -childID 75 -isForBrowser -prefsHandle 12200 -prefMapHandle 12320 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c7a7092-ff8a-4f64-9568-3a1304d4eb4e} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 7176 23de17bfd58 tab
    3⤵
    PID:7484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.80.1737415100\738281184" -childID 76 -isForBrowser -prefsHandle 9628 -prefMapHandle 8804 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4832ae33-acea-45e0-a5aa-a211a4e6ce2a} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9372 23de17c0958 tab
    3⤵
    PID:8220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.81.520171739\1126430066" -childID 77 -isForBrowser -prefsHandle 8728 -prefMapHandle 9220 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8eb95fab-c525-45d3-aa61-6ac1847af708} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 7256 23de44b1558 tab
    3⤵
    PID:1520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.82.359190316\1522157862" -childID 78 -isForBrowser -prefsHandle 11844 -prefMapHandle 5884 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0dd538c-14e5-4a9c-bb1b-140c0a556b81} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12664 23de44b1e58 tab
    3⤵
    PID:8536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.83.525272230\1814692784" -childID 79 -isForBrowser -prefsHandle 12236 -prefMapHandle 12584 -prefsLen 30633 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63b69f23-709c-4bea-a633-d154ce466f2f} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 5808 23de44b1258 tab
    3⤵
    PID:5072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.84.1114514778\1911176303" -childID 80 -isForBrowser -prefsHandle 8864 -prefMapHandle 12700 -prefsLen 30642 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd737106-c4d7-473a-b9a1-78dd69c07416} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10836 23de4fe6558 tab
    3⤵
    - Checks computer location settings
    PID:8288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.85.2022411948\1296425276" -childID 81 -isForBrowser -prefsHandle 6692 -prefMapHandle 12572 -prefsLen 30642 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2645371e-d7fc-4cc4-b2d8-90137731a354} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 7320 23de5fa2558 tab
    3⤵
    PID:8296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.86.351446363\888176318" -childID 82 -isForBrowser -prefsHandle 5868 -prefMapHandle 4468 -prefsLen 30642 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {414fa945-cc76-45bc-8844-d05e30019511} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 6040 23de5fa2858 tab
    3⤵
    PID:6240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.87.549190782\119459706" -childID 83 -isForBrowser -prefsHandle 4468 -prefMapHandle 5868 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1be56e4e-c419-4ef0-acc4-4d98e95c7f12} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10552 23de10eda58 tab
    3⤵
    PID:7836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.88.986363701\1028981960" -childID 84 -isForBrowser -prefsHandle 8928 -prefMapHandle 12488 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8479361-1fc4-4ed8-8bd2-d2ff17434f13} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10324 23de8d3b258 tab
    3⤵
    - Checks computer location settings
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.89.420996963\283438259" -childID 85 -isForBrowser -prefsHandle 9880 -prefMapHandle 9864 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f404906-57ce-4498-bd18-7a71a4f294fe} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9888 23de9f0de58 tab
    3⤵
    PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.90.1856048969\1748691002" -childID 86 -isForBrowser -prefsHandle 10448 -prefMapHandle 8144 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14c0dd26-a383-41b6-a1c4-720229bbee1d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9628 23de9e9b258 tab
    3⤵
    PID:6256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.91.3127808\1609416908" -childID 87 -isForBrowser -prefsHandle 12732 -prefMapHandle 9648 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33042426-3755-4280-a434-72ae6c2c40d1} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8356 23de477a558 tab
    3⤵
    PID:3896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.92.2144353997\303115715" -childID 88 -isForBrowser -prefsHandle 6984 -prefMapHandle 4468 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1240e7b2-6527-44b2-a428-4c8fccf02b40} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12044 23de770d858 tab
    3⤵
    PID:4380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.93.86479822\2092020724" -childID 89 -isForBrowser -prefsHandle 11848 -prefMapHandle 8960 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af464206-97b8-4559-8beb-5fde18f477da} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12616 23de9e9df58 tab
    3⤵
    PID:640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.94.215049224\630593024" -childID 90 -isForBrowser -prefsHandle 10288 -prefMapHandle 12384 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab38a577-cfde-41f8-a231-cd6c25e87eaa} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12616 23de770db58 tab
    3⤵
    PID:5944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.95.1058390240\1817744429" -childID 91 -isForBrowser -prefsHandle 10696 -prefMapHandle 8400 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43359277-4ff6-4d56-afff-9badd5c54eee} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 11596 23ddc574158 tab
    3⤵
    - Checks computer location settings
    PID:7760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.96.1195024804\834238312" -childID 92 -isForBrowser -prefsHandle 5864 -prefMapHandle 12564 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19427f83-e899-4f7f-9143-072c1bdf7a5d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 12416 23ddc576258 tab
    3⤵
    - Checks computer location settings
    PID:8436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.97.1503282866\2129398167" -childID 93 -isForBrowser -prefsHandle 8264 -prefMapHandle 6724 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {acc87de9-2fc0-47d0-9164-2b845f6f377d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 6944 23ddc5ea858 tab
    3⤵
    - Checks computer location settings
    PID:7644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.98.262259899\706448287" -childID 94 -isForBrowser -prefsHandle 12240 -prefMapHandle 10344 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e15afab3-bdd3-4861-80b3-0e883da330c9} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9132 23de06ab658 tab
    3⤵
    PID:6308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.99.540362638\1724456314" -childID 95 -isForBrowser -prefsHandle 12492 -prefMapHandle 8484 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43514d07-852c-4cc8-afb0-111a037fef34} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 6900 23de1013d58 tab
    3⤵
    PID:5608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.100.354353949\551726530" -childID 96 -isForBrowser -prefsHandle 11608 -prefMapHandle 12188 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8799996c-75e0-4859-98f5-3dec603f1f4d} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10792 23de10edd58 tab
    3⤵
    PID:3400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.101.1402543598\1892555578" -childID 97 -isForBrowser -prefsHandle 7012 -prefMapHandle 3556 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33c38b07-be1c-42df-9a8b-191681d45fac} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9072 23ddf204158 tab
    3⤵
    PID:6756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.102.450650537\508481320" -childID 98 -isForBrowser -prefsHandle 11740 -prefMapHandle 12052 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2157a6f9-d1c0-434a-9114-0d0d44ee1e3a} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8892 23de06d1958 tab
    3⤵
    PID:3784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.103.1351716984\2092228953" -childID 99 -isForBrowser -prefsHandle 7392 -prefMapHandle 10264 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2a18b49-be8a-4fa5-be0f-148da09479b1} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 11504 23de0e9c158 tab
    3⤵
    PID:8212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.104.1213600411\145972421" -childID 100 -isForBrowser -prefsHandle 10816 -prefMapHandle 7164 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4df4bb6b-c673-427f-a00d-a8405bd9952c} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 8516 23de1e32e58 tab
    3⤵
    PID:5156
- - C:\Users\Admin\Downloads\LDPlayer9_ens_com.roblox.client_25567197_ld.exe
    "C:\Users\Admin\Downloads\LDPlayer9_ens_com.roblox.client_25567197_ld.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetWindowsHookEx
    PID:8152
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /IM dnplayer.exe /T
      4⤵
      Kills process with taskkill
      PID:7712
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /IM dnmultiplayer.exe /T
      4⤵
      Kills process with taskkill
      PID:4664
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /IM dnmultiplayerex.exe /T
      4⤵
      Kills process with taskkill
      PID:5920
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /IM bugreport.exe /T
      4⤵
      Kills process with taskkill
      PID:232
  - - F:\LDPlayer\LDPlayer9\LDPlayer.exe
      "F:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=25567197 -language=en -path="F:\LDPlayer\LDPlayer9\"
      4⤵
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:5996
    - - F:\LDPlayer\LDPlayer9\dnrepairer.exe
        
        "F:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=328534
        5⤵
        Registers COM server for autorun
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:8200
      - C:\Windows\SysWOW64\net.exe
        
        "net" start cryptsvc
        6⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        7⤵
        
        PID:9384
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" Softpub.dll /s
        6⤵
        Manipulates Digital Signatures
        
        PID:9808
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" Wintrust.dll /s
        6⤵
        Manipulates Digital Signatures
        
        PID:10004
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" Initpki.dll /s
        6⤵
        
        PID:10308
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32" Initpki.dll /s
        6⤵
        
        PID:10400
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" dssenh.dll /s
        6⤵
        
        PID:10448
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" rsaenh.dll /s
        6⤵
        
        PID:10480
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" cryptdlg.dll /s
        6⤵
        Manipulates Digital Signatures
        
        PID:10544
      - C:\Windows\SysWOW64\takeown.exe
        
        "takeown" /f "F:\LDPlayer\LDPlayer9\vms" /r /d y
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Enumerates connected drives
        
        PID:10672
      - C:\Windows\SysWOW64\icacls.exe
        
        "icacls" "F:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5736
      - C:\Windows\SysWOW64\takeown.exe
        
        "takeown" /f "F:\LDPlayer\LDPlayer9\\system.vmdk"
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Enumerates connected drives
        
        PID:7076
      - C:\Windows\SysWOW64\icacls.exe
        
        "icacls" "F:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1104
      - C:\Windows\SysWOW64\dism.exe
        
        C:\Windows\system32\dism.exe /Online /English /Get-Features
        6⤵
        Drops file in Windows directory
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\E1E9E404-291D-48F7-B8CF-44DC6B074E56\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\E1E9E404-291D-48F7-B8CF-44DC6B074E56\dismhost.exe {7CE7BFEF-B14B-4AB9-B6FC-085C06CA23EE}
        7⤵
        Drops file in Windows directory
        
        PID:5836
      - C:\Windows\SysWOW64\sc.exe
        
        sc query HvHost
        6⤵
        Launches sc.exe
        
        PID:10512
      - C:\Windows\SysWOW64\sc.exe
        
        sc query vmms
        6⤵
        Launches sc.exe
        
        PID:10448
      - C:\Windows\SysWOW64\sc.exe
        
        sc query vmcompute
        6⤵
        Launches sc.exe
        
        PID:7224
      - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
        
        "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:10128
      - C:\Windows\SYSTEM32\regsvr32.exe
        
        "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
        6⤵
        
        PID:8684
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
        6⤵
        
        PID:8368
      - C:\Windows\SYSTEM32\regsvr32.exe
        
        "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
        6⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:9528
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
        6⤵
        Modifies registry class
        
        PID:9604
      - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
        6⤵
        Launches sc.exe
        
        PID:10700
      - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\system32\sc" start Ld9BoxSup
        6⤵
        Launches sc.exe
        
        PID:9796
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
        6⤵
        
        PID:9404
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
        6⤵
        
        PID:9456
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'F:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow
        6⤵
        
        PID:9764
    - - F:\LDPlayer\LDPlayer9\driverconfig.exe
        
        "F:\LDPlayer\LDPlayer9\driverconfig.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4300
    - - C:\Windows\SysWOW64\takeown.exe
        
        "takeown" /f F:\LDPlayer\ldmutiplayer\ /r /d y
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Enumerates connected drives
        
        PID:6396
    - - C:\Windows\SysWOW64\icacls.exe
        
        "icacls" F:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6980
  - - F:\LDPlayer\LDPlayer9\dnplayer.exe
      "F:\LDPlayer\LDPlayer9\dnplayer.exe" downloadpackage=com.roblox.client|package=com.roblox.client
      4⤵
      Checks processor information in registry
      Modifies Internet Explorer settings
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:8928
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query HvHost
        5⤵
        Launches sc.exe
        
        PID:10384
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query vmms
        5⤵
        Launches sc.exe
        
        PID:8616
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1104
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query vmcompute
        5⤵
        Launches sc.exe
        
        PID:6644
    - - C:\Program Files\ldplayer9box\vbox-img.exe
        
        "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "F:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-54d7-bbbb00000000
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:8944
    - - C:\Program Files\ldplayer9box\vbox-img.exe
        
        "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "F:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-54d7-000000000000
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3276
    - - C:\Program Files\ldplayer9box\vbox-img.exe
        
        "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "F:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-54d7-000000000000
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6020
    - - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --single-argument https://www.ldplayer.net/blog/how-to-enable-vt.html
        5⤵
        Checks computer location settings
        Adds Run key to start application
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks system information in the registry
        Checks SCSI registry key(s)
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:10988
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=123.0.24828.123 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffc5a6fdc60,0x7ffc5a6fdc6c,0x7ffc5a6fdc78
        6⤵
        
        PID:11204
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2092,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
        6⤵
        
        PID:4864
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2088,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
        6⤵
        
        PID:8016
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2400,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
        6⤵
        
        PID:4388
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3496,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
        6⤵
        
        PID:9456
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3756,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
        6⤵
        Checks computer location settings
        
        PID:9752
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3764,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:2
        6⤵
        Checks computer location settings
        
        PID:9460
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4140,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:2
        6⤵
        Checks computer location settings
        
        PID:7352
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4292,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
        6⤵
        
        PID:5692
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4820,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:8
        6⤵
        
        PID:1488
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"
        6⤵
        Checks computer location settings
        
        PID:7768
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4896,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
        6⤵
        Checks computer location settings
        
        PID:10512
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5368,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
        6⤵
        
        PID:6164
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5516,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
        6⤵
        
        PID:6428
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5684,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
        6⤵
        
        PID:5308
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5852,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
        6⤵
        Checks computer location settings
        
        PID:6372
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3008,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
        6⤵
        
        PID:7976
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3552,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
        6⤵
        
        PID:9424
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3568,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:8
        6⤵
        
        PID:5868
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6040,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
        6⤵
        
        PID:11220
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5216,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
        6⤵
        
        PID:9320
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3564,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
        6⤵
        
        PID:5076
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4340,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:2
        6⤵
        
        PID:5576
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6480,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
        6⤵
        
        PID:780
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6200,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
        6⤵
        
        PID:9656
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4424,i,2315754424630711669,2699103426111924961,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
        6⤵
        
        PID:9664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.105.1374714160\557466029" -childID 101 -isForBrowser -prefsHandle 7952 -prefMapHandle 10368 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3c2858f-78a5-46b8-9751-8ab911dff783} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 6536 23ddcfe8158 tab
    3⤵
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.106.1841039575\1951684026" -childID 102 -isForBrowser -prefsHandle 9560 -prefMapHandle 11920 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a569462d-d3e2-4dcc-ba6d-f01d658c8f6b} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10072 23ddcfe9658 tab
    3⤵
    PID:3228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.107.1480839756\1089596358" -childID 103 -isForBrowser -prefsHandle 12620 -prefMapHandle 2992 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5438e11-46e9-4a42-aee9-c0bb8a044138} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 9480 23ddd226d58 tab
    3⤵
    PID:2028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.108.2126583758\2058564012" -childID 104 -isForBrowser -prefsHandle 6352 -prefMapHandle 11756 -prefsLen 31177 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16fbf616-3d7d-4c95-80c6-538bdd2144de} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 10848 23ddc6bb558 tab
    3⤵
    PID:6772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.109.1726556785\857791188" -childID 105 -isForBrowser -prefsHandle 7184 -prefMapHandle 4996 -prefsLen 31394 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b8ac465-70d3-4708-b0f2-1ca9d7f4528a} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 11516 23ddd226458 tab
    3⤵
    PID:5592
- - C:\Users\Admin\Downloads\ArcticBomb(1).exe
    "C:\Users\Admin\Downloads\ArcticBomb(1).exe"
    3⤵
    PID:11260
- - C:\Users\Admin\Downloads\ArcticBomb.exe
    "C:\Users\Admin\Downloads\ArcticBomb.exe"
    3⤵
    PID:9704
- - C:\Users\Admin\Downloads\ColorBug.exe
    "C:\Users\Admin\Downloads\ColorBug.exe"
    3⤵
    PID:6152

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5036

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3604 -ip 3604
1⤵
PID:3660

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
PID:6292
- C:\Program Files (x86)\AVG\Browser\Update\Install\{447C6CDF-F0C7-4AD8-B498-66E9B027B03B}\AVGBrowserInstaller.exe
  "C:\Program Files (x86)\AVG\Browser\Update\Install\{447C6CDF-F0C7-4AD8-B498-66E9B027B03B}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=firefox --import-cookies --auto-launch-chrome --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- - C:\Program Files (x86)\AVG\Browser\Update\Install\{447C6CDF-F0C7-4AD8-B498-66E9B027B03B}\CR_A5259.tmp\setup.exe
    "C:\Program Files (x86)\AVG\Browser\Update\Install\{447C6CDF-F0C7-4AD8-B498-66E9B027B03B}\CR_A5259.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{447C6CDF-F0C7-4AD8-B498-66E9B027B03B}\CR_A5259.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=firefox --import-cookies --auto-launch-chrome --system-level
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Registers COM server for autorun
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:5900
  - - C:\Program Files (x86)\AVG\Browser\Update\Install\{447C6CDF-F0C7-4AD8-B498-66E9B027B03B}\CR_A5259.tmp\setup.exe
      "C:\Program Files (x86)\AVG\Browser\Update\Install\{447C6CDF-F0C7-4AD8-B498-66E9B027B03B}\CR_A5259.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=123.0.24828.123 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff60a9123d0,0x7ff60a9123dc,0x7ff60a9123e8
      4⤵
      Executes dropped EXE
      PID:2668
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  PID:5532
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:4644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x334
1⤵
PID:3300

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ua /installsource scheduler
1⤵
PID:5936
- C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
  "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper
  2⤵
  PID:6396

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /c
1⤵
PID:7784
- C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
  "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /cr
  2⤵
  PID:5308
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"
  2⤵
  PID:8708
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"
  2⤵
  PID:8848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:7948

C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\saBSI.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB
1⤵
- Modifies system certificate store
PID:7888
- C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
  2⤵
  - Drops file in Program Files directory
  PID:4080
- - C:\Program Files\McAfee\Temp3533232325\installer.exe
    "C:\Program Files\McAfee\Temp3533232325\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
    3⤵
    - Drops file in Program Files directory
    PID:8924
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
      4⤵
      PID:7312
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
        5⤵
        
        PID:10372
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
      4⤵
      Registers COM server for autorun
      Modifies registry class
      PID:9292
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
      4⤵
      PID:9748
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
        5⤵
        
        PID:9784
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"
      4⤵
      Registers COM server for autorun
      PID:10152

C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\rsStubActivator.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\rsStubActivator.exe" -ip:"dui=1c1b46dda2c024167cff8aa44f6656ccd148aa40&dit=20240508150537361&is_silent=true&oc=DOT_RAV_Cross_Solo_LDP&p=bf64&a=103&b=&se=true" -i
1⤵
- Checks computer location settings
PID:8008
- C:\Users\Admin\AppData\Local\Temp\cu4xzeo0.exe
  "C:\Users\Admin\AppData\Local\Temp\cu4xzeo0.exe" /silent
  2⤵
  PID:5548
- - C:\Users\Admin\AppData\Local\Temp\nsaE5E2.tmp\RAVEndPointProtection-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\nsaE5E2.tmp\RAVEndPointProtection-installer.exe" "C:\Users\Admin\AppData\Local\Temp\cu4xzeo0.exe" /silent
    3⤵
    - Drops file in Drivers directory
    - Drops file in Program Files directory
    PID:980
  - - C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
      "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
      4⤵
      PID:5576
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf
      4⤵
      Adds Run key to start application
      PID:10396
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        
        PID:10488
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:10368
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml
      4⤵
      PID:10360
  - - C:\Windows\SYSTEM32\fltmc.exe
      "fltmc.exe" load rsKernelEngine
      4⤵
      PID:10544
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml
      4⤵
      PID:10636
  - - C:\Program Files\ReasonLabs\EPP\rsWSC.exe
      "C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i
      4⤵
      PID:5248
  - - C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe
      "C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe" -i -i
      4⤵
      PID:9160
  - - C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe
      "C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe" -i -i
      4⤵
      Modifies system certificate store
      PID:9076

C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10
1⤵
PID:8500

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:9756
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  PID:10620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul
  2⤵
  PID:9456
- C:\Program Files\McAfee\WebAdvisor\updater.exe
  "C:\Program Files\McAfee\WebAdvisor\updater.exe"
  2⤵
  - Modifies data under HKEY_USERS
  PID:10600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c IF EXIST "C:\Program Files\McAfee\WebAdvisor\Download" ( DEL "C:\Program Files\McAfee\WebAdvisor\Download\*.bak" )
    3⤵
    PID:8440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c DEL "C:\Program Files\McAfee\WebAdvisor\*.tmp"
    3⤵
    PID:10756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul
  2⤵
  PID:10888

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
PID:10436

C:\Program Files\ReasonLabs\EPP\rsWSC.exe
"C:\Program Files\ReasonLabs\EPP\rsWSC.exe"
1⤵
- Modifies data under HKEY_USERS
PID:8788

C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe
"C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"
1⤵
PID:7820

C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe
"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:8316
- \??\c:\program files\reasonlabs\epp\rsHelper.exe
  "c:\program files\reasonlabs\epp\rsHelper.exe"
  2⤵
  PID:6832
- \??\c:\program files\reasonlabs\EPP\ui\EPP.exe
  "c:\program files\reasonlabs\EPP\ui\EPP.exe" --minimized --first-run
  2⤵
  PID:11168
- - C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
    "C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" "c:\program files\reasonlabs\EPP\ui\app.asar" --engine-path="c:\program files\reasonlabs\EPP" --minimized --first-run
    3⤵
    - Checks computer location settings
    PID:10396
  - - C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
      "C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2236 --field-trial-handle=2240,i,2289876268740821347,16548865100994729886,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:10532
  - - C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
      "C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2576 --field-trial-handle=2240,i,2289876268740821347,16548865100994729886,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      PID:5268
  - - C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
      "C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2796 --field-trial-handle=2240,i,2289876268740821347,16548865100994729886,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Checks computer location settings
      PID:8548
  - - C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
      "C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3832 --field-trial-handle=2240,i,2289876268740821347,16548865100994729886,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Checks computer location settings
      PID:7776
  - - C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
      "C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3592 --field-trial-handle=2240,i,2289876268740821347,16548865100994729886,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:9480
  - - C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
      "C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4012 --field-trial-handle=2240,i,2289876268740821347,16548865100994729886,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:10700
  - - C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
      "C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3036 --field-trial-handle=2240,i,2289876268740821347,16548865100994729886,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Checks computer location settings
      PID:944
  - - C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
      "C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3012 --field-trial-handle=2240,i,2289876268740821347,16548865100994729886,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      PID:10488
  - - C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
      "C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2232 --field-trial-handle=2240,i,2289876268740821347,16548865100994729886,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      PID:9088
  - - C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe
      "C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3644 --field-trial-handle=2240,i,2289876268740821347,16548865100994729886,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:8492
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 8316 -s 3452
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:9208

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8292
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-54d7-000000000000 --vrde config
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:10904
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:9528
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-54d7-000000000000 --vrde config
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5884
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-54d7-000000000000 --vrde config
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:7896
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-54d7-000000000000 --vrde config
  2⤵
  PID:10700
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-54d7-000000000000 --vrde config
  2⤵
  PID:9600

C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe
"C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"
1⤵
PID:11140

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:11168

C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe
"C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"
1⤵
PID:11216

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 8316 -i 8316 -h 420 -j 436 -s 440 -d 5684
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:9740

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:8484

C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe
"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"
1⤵
- Enumerates connected drives
PID:3740
- C:\program files\reasonlabs\epp\rsLitmus.A.exe
  "C:\program files\reasonlabs\epp\rsLitmus.A.exe"
  2⤵
  PID:5220

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:8520

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:8740

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
PID:10428
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  PID:2588
- C:\Program Files\McAfee\WebAdvisor\updater.exe
  "C:\Program Files\McAfee\WebAdvisor\updater.exe"
  2⤵
  PID:2424

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:10896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e60ccec.rbs

Filesize
7KB

MD5
d7680f57e1e7cfe0f8517a35bbe2cecf

SHA1
bd10fc6a72e5db625b07996436c6de5889e2d239

SHA256
5ca529a5c032a2d2356c43b6243f74c995beeed59b98ba06dd28ccd152bebadd

SHA512
42a0f993d494f0d33700ee440c129e18254f7d27bd13b3d55dbc351dc0c693912bf158130ce36e89f86d9008eeb7712b66e20a5e3a0649251cfde9dc00bafa8c

Download Submit
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe

Filesize
149KB

MD5
f73e60370efe16a6d985e564275612da

SHA1
2f829a0a611ac7add51a6bc50569e75181cdfd58

SHA256
9cf076866935a0c64366efaeff2ec76d45ac816030ebd616fd5defb1870bc30e

SHA512
2e44e87c285bb7b72d45c8119d08ea6f2d13cea77cf0005a3cf530790bb86c7f2df7c5edac9d86c9d7214abb224738c3bf6b31f6bf104051512bb1de133042dc

Download Submit
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe

Filesize
170KB

MD5
deef1e7382d212cd403431727be417a5

SHA1
fac0e754a5734dd5e9602a0327a66e313f7473bb

SHA256
7d410e9eabd086827b16c89ee953a643c3e2f7929616c0af579253fd8ca60088

SHA512
6b472a57fb89b128aad9ab6313a9ce8b171f7d73264c67f669adc5cf1f0421d81f654dad1419b620476abb59dd54e1aa03a74a26c5c93813f6fb8575fbd97d4d

Download Submit
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\npAvgBrowserUpdate3.dll

Filesize
506KB

MD5
c6a2bff8e96b5622bf6841a671f4e564

SHA1
fb638e9c72604cc1b160385fa803b0ea028e5d5e

SHA256
7a7a12e9c0dee713700081b9354647972a0f3505596df34e4c68aaba99046992

SHA512
22a99f860055388e34a056af5d5e35f2e33a9294784795aca52fd42685d75aebb523add836c5e4b9b2f68fe00348d11ee56cc10208fcc662b86a6169664f934f

Download Submit
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe

Filesize
204KB

MD5
cbcdf56c8a2788ed761ad3178e2d6e9c

SHA1
bdee21667760bc0df3046d6073a05d779fdc82cb

SHA256
e9265a40e5ee5302e8e225ea39a67d452eaac20370f8b2828340ba079abbbfd3

SHA512
5f68e7dffdd3424e0eb2e5cd3d05f8b6ba497aab9408702505341b2c89f265ebb4f9177611d51b9a56629a564431421f3ecb8b25eb08fb2c54dfeddecb9e9f2e

Download Submit
C:\Program Files (x86)\GUM37D1.tmp\@PaxHeader

Filesize
28B

MD5
e68634e87a4e9ccd30184881894f5a8c

SHA1
750d0a6c9185bb3a2d8837d54d8bf4fbaa4356c9

SHA256
57c4e71fad2d5c15a09ea440177235fcd3fb9ef017b69748b1df701b0ed18ebc

SHA512
4d983145e6830d782d08cd131918277789c2ca884b69aff35dbfa4418ec1b620962541142bd0fc40cd8a23eb73ae11f483bbef3555acf771e471e6b68f36f51e

Download Submit
C:\Program Files (x86)\GUM37D1.tmp\@PaxHeader

Filesize
28B

MD5
cafe7ff20803c00af318a4a0c50a3d01

SHA1
66261bd83e6cec449f167dc2612ac588d9114c39

SHA256
1143efe58b7b1ac71438b460f0c52e18112a3958f7ca719aa9a7082800c8d377

SHA512
c445b043c31400276ab578983c5c5675e0b0fe1097934959034a44553cd1ba4770e227757b33157a2c19952f007ec76af1f9df82c8b16069b6bfe9359da03651

Download Submit
C:\Program Files (x86)\GUM37D1.tmp\@PaxHeader

Filesize
27B

MD5
939ee98d23d3ce9a0c8a0fe9aac02cf2

SHA1
b48224bddd5ad890d749f1dd16de6f9c5d9b2af5

SHA256
cea3426ac194b93a31f869d26e69045effc10a0d89962220724557136625ba39

SHA512
caddc19a06aa9bba35641c5b8b2055c18e7f8c89f0603869be5ef7b283c83ab4efc1213ba18c536007babc492ced62e406ba34af96c3a949d3378b5cae0ad881

Download Submit
C:\Program Files (x86)\GUM37D1.tmp\@PaxHeader

Filesize
27B

MD5
fc8ee03b2a65f381e4245432d5fef60e

SHA1
d2b7d9be66c75ccf24fcb45a6d0dacedd8b6dd6f

SHA256
751a04263c2ebb889fdcd11045d6f3602690318ebaaa54f66e1332d76dde9ef4

SHA512
0837f2b22c9629990165c5e070e710a69ad4951b7fcfe28bd52354c4b8a7246672497b8aaf521a8773c7ec2a4249fc4318330948ab0d8db8c6c74da57b32f1c4

Download Submit
C:\Program Files\AVG\Browser\AVGBrowserUninstall.exe

Filesize
5.8MB

MD5
acb51434fd82eb460b052f05950b8dca

SHA1
707d192db2ce7cefdefce3037dfb85a18b8811f3

SHA256
29ffa251cb267969af445eb664df04d1a7badbcade61a7f754de42b6d4340055

SHA512
013dc0abcc9760c6298b7e48007eb1ac4bc2e453f06c1ce4aff218f50cd1e2c4bb44ad6bc5687edb057df8b0e38fa0aaada7a8d045ed08412278d3031527229d

Download Submit
C:\Program Files\AVG\Browser\Application\123.0.24828.123\Installer\setup.exe

Filesize
3.4MB

MD5
b4fb7b4e93e5f564e953e5a225a711e5

SHA1
27dee69da6379e54fc94516eaee3cfb3a34fe240

SHA256
e93a3b3e4609c966fb8c8c5233a86e206a4924bae4f59289614f2f9ffed29a9b

SHA512
bcc82dfde782621d37e37e14794d3431c0990a2bd3869c09905597824b0b140a3c6bce89150acb7e465ab942a102c8ee5d618817c053afd3442ce5f878c1d163

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
72KB

MD5
ccf7e487353602c57e2e743d047aca36

SHA1
99f66919152d67a882685a41b7130af5f7703888

SHA256
eaf76e5f1a438478ecf7b678744da34e9d9e5038b128f0c595672ee1dbbfd914

SHA512
dde0366658082b142faa6487245bfc8b8942605f0ede65d12f8c368ff3673ca18e416a4bf132c4bee5be43e94aef0531be2008746c24f1e6b2f294a63ab1486c

Download Submit
C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab

Filesize
73KB

MD5
6f97cb1b2d3fcf88513e2c349232216a

SHA1
846110d3bf8b8d7a720f646435909ef80bbcaa0c

SHA256
6a031052be1737bc2767c3ea65430d8d7ffd1c9115e174d7dfb64ad510011272

SHA512
2919176296b953c9ef232006783068d255109257653ac5ccd64a3452159108890a1e8e7d6c030990982816166517f878f6032946a5558f8ae3510bc044809b07

Download Submit
C:\Program Files\Mozilla Firefox\firefox.exe

Filesize
658KB

MD5
94ef2fadc18337ed24316f0244bca697

SHA1
d903ed312a4220453c7d336cf4b6a8b7ce9bd599

SHA256
f293de7a58dc35a39df67d982301b0dd8016162a4188cf73d74adb15062d7524

SHA512
ae3b5bfb1188ce5c6cc317fddd4e0e39253b95aa9df3232fd88a9b140f3cc9831ef2cc54c8aa960b43361eb8a88b0ed6cd1cb0990b0b84e3edfea2298b2db2c4

Download Submit
C:\Program Files\Mozilla Firefox\freebl3.dll

Filesize
749KB

MD5
c19f51b89ad2cec296f976aa67631ad7

SHA1
51ffd2b698a34d935b7653959c5d6ac21b6c739b

SHA256
e540e48084d8c8f4ae7a136c44170ca2336e27c21c3ad69e361eb79f88432593

SHA512
0bb68147cda4d8df36480aae44674b9ae17248e10e538cfdf2f3919dc9c518559c5b214e5afbb5f80c4aefd2df56d34dfd674b312666e11d6a367baecbe7aad8

Download Submit
C:\Program Files\Mozilla Firefox\lgpllibs.dll

Filesize
39KB

MD5
77f3426729a77e237800980ed1ef73b2

SHA1
0066ec482db4fc154ac6bd7e7bf57f7441ef1e1c

SHA256
9441aa194dfb9281e00b68cbc01585f03c01df43f9e40f43c0539cf781f62003

SHA512
074723a7a8c9870dbc6fb8094ff9d453b56c7360a3062a23f7e230f94a9a3caa53895d1470bf91609c1ea8479a49d047017809f7d036572b057316e70772031d

Download Submit
C:\Program Files\Mozilla Firefox\libEGL.dll

Filesize
40KB

MD5
2a11780e0ebd58215f765a46608d4da8

SHA1
a3bb419aa7e87afaaf210c338dc9b8bd4e920e47

SHA256
103b80f5c2733cd5da97b22843b1eb7a35c21523a65d3899b7fccba21a29a69e

SHA512
763f30cc56cc57ed975a5bc098743af8645630148a38331d8a4bcdb07e5deda9879b42f8b70bc826010445ebd0a28522bfaa3309984dbd16667e7ff95aa48020

Download Submit
C:\Program Files\Mozilla Firefox\libGLESv2.dll

Filesize
4.2MB

MD5
d850856ed922cd88976d8fe6a289eea6

SHA1
59af5d4f8ac83545d2a27aa815d99a1fb56a3cbc

SHA256
900dd368db74ba07ae936cd81412f3be6237434d47a272970288b4d42bbd0191

SHA512
b4c91debcc3657e848ae0d610bcfe432da00063a11b88a88f1e18ef323a77f5e215c2f27126cea2bff2280625c78a8a576fd43b2b0ca9a9ba344bc47326a0f5d

Download Submit
C:\Program Files\Mozilla Firefox\mozglue.dll

Filesize
686KB

MD5
6657e7eabb71db0e926bf07d797a976a

SHA1
88589af17bf1ccff9cbed59985a99aee430d0e16

SHA256
53a6b58da55137f9dacd8215c7f2314e34b7a5fdf9fb79b88d170c7bd123fd31

SHA512
bedd5f0830f1d3f090f2e40f78fae44fe61d1296f63c126bb8f8f7ff326c93c4de97aaccb39149ad3d60caadca45609c829484f482aa0ba984bd61235c6357de

Download Submit
C:\Program Files\Mozilla Firefox\nss3.dll

Filesize
2.1MB

MD5
530a58256853d25086f4a91f5a2abc56

SHA1
824df0429ad774527e321347fde15ec6aaed908c

SHA256
488db23a02ab349071e7a0f207881a97bfd1b4246b33f1f2f950ffac0914f004

SHA512
34c83060b4f3795b2dbb5d53ce8480b49fdfaf07f9a11680d7fde15c1ec8612b028851d6031e30c11a4f277714d917749e944ce6825c7e05651fb31638210664

Download Submit
C:\Program Files\Mozilla Firefox\softokn3.dll

Filesize
267KB

MD5
cb6571552c23052756f5d9753572bdc5

SHA1
ee0e1f54020df2c574f1c6e4e7d02bc15fe0ebf7

SHA256
3d4df37315622d10ddebc1b5d38db4763bcb35334d964ef2fc62863c54e87dbe

SHA512
1b23aaaf765a466528a95ced79d6495ba1c4be0cf47616597c3d50dd49ba5e74be698d9c12348f5819566c467a62a347adbb79388c2fb1440050478e29ce5d52

Download Submit
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Filesize
797KB

MD5
ded746a9d2d7b7afcb3abe1a24dd3163

SHA1
a074c9e981491ff566cd45b912e743bd1266c4ae

SHA256
c113072678d5fa03b02d750a5911848ab0e247c4b28cf7b152a858c4b24901b3

SHA512
2c273bf79988df13f9da4019f8071cf3b4480ecd814d3df44b83958f52f49bb668dd2f568293c29ef3545018fea15c9d5902ef88e0ecfebaf60458333fcaa91b

Download Submit
C:\Program Files\ReasonLabs\EPP\InstallerLib.dll

Filesize
310KB

MD5
c3b43e56db33516751b66ee531a162c9

SHA1
6b8a1680e9485060377750f79bc681e17a3cb72a

SHA256
040b2e0dea718124b36d76e1d8f591ff0dbca22f7fb11f52a2e6424218f4ecad

SHA512
4724f2f30e997f91893aabfa8bf1b5938c329927080e4cc72b81b4bb6db06fe35dae60d428d57355f03c46dd29f15db46ad2b1036247c0dcde688183ef11313a

Download Submit
C:\Program Files\ReasonLabs\EPP\elam\rsElam.sys

Filesize
19KB

MD5
8129c96d6ebdaebbe771ee034555bf8f

SHA1
9b41fb541a273086d3eef0ba4149f88022efbaff

SHA256
8bcc210669bc5931a3a69fc63ed288cb74013a92c84ca0aba89e3f4e56e3ae51

SHA512
ccd92987da4bda7a0f6386308611afb7951395158fc6d10a0596b0a0db4a61df202120460e2383d2d2f34cbb4d4e33e4f2e091a717d2fc1859ed7f58db3b7a18

Download Submit
C:\Program Files\ReasonLabs\EPP\mc.dll

Filesize
1.1MB

MD5
6d27fe0704da042cdf69efa4fb7e4ec4

SHA1
48f44cf5fe655d7ef2eafbd43e8d52828f751f05

SHA256
0f74ef17c3170d6c48f442d8c81923185f3d54cb04158a4da78495c2ec31863e

SHA512
2c3587acab4461568ac746b4cdf36283d4cb2abe09fc7c085615384e92f813c28cf4fcb4f39ec67860eac9c0e4a5f15021aee712d21a682f8df654968ed40ea3

Download Submit
C:\Program Files\ReasonLabs\EPP\rsEngine.Core.dll

Filesize
327KB

MD5
9d3d8cd27b28bf9f8b592e066b9a0a06

SHA1
9565df4bf2306900599ea291d9e938892fe2c43a

SHA256
97fe82b6ce5bc3ad96c8c5e242c86396accdf0f78ffc155ebc05f950597cdbd6

SHA512
acefc1552d16be14def7043b21ec026133aabd56f90800e131733c5b0c78316a4d9dc37d6b3093e537ce1974219154e8bd32204127a4ab4d4cd5f3041c6a8729

Download Submit
C:\Program Files\ReasonLabs\EPP\rsEngine.config

Filesize
5KB

MD5
be90740a7ccd5651c445cfb4bd162cf9

SHA1
218be6423b6b5b1fbce9f93d02461c7ed2b33987

SHA256
44fa685d7b4868f94c9c51465158ea029cd1a4ceb5bfa918aa7dec2c528016e4

SHA512
a26869c152ed8df57b72f8261d33b909fb4d87d93dc0061bf010b69bad7b8c90c2f40a1338806c03d669b011c0cb5bbfcd429b7cd993df7d3229002becb658ad

Download Submit
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.InstallLog

Filesize
257B

MD5
2afb72ff4eb694325bc55e2b0b2d5592

SHA1
ba1d4f70eaa44ce0e1856b9b43487279286f76c9

SHA256
41fb029d215775c361d561b02c482c485cc8fd220e6b62762bff15fd5f3fb91e

SHA512
5b5179b5495195e9988e0b48767e8781812292c207f8ae0551167976c630398433e8cc04fdbf0a57ef6a256e95db8715a0b89104d3ca343173812b233f078b6e

Download Submit
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.InstallLog

Filesize
660B

MD5
705ace5df076489bde34bd8f44c09901

SHA1
b867f35786f09405c324b6bf692e479ffecdfa9c

SHA256
f05a09811f6377d1341e9b41c63aa7b84a5c246055c43b0be09723bf29480950

SHA512
1f490f09b7d21075e8cdf2fe16f232a98428bef5c487badf4891647053ffef02987517cd41dddbdc998bef9f2b0ddd33a3f3d2850b7b99ae7a4b3c115b0eeff7

Download Submit
C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog

Filesize
370B

MD5
b2ec2559e28da042f6baa8d4c4822ad5

SHA1
3bda8d045c2f8a6daeb7b59bf52295d5107bf819

SHA256
115a74ccd1f7c937afe3de7fa926fe71868f435f8ab1e213e1306e8d8239eca3

SHA512
11f613205928b546cf06b5aa0702244dace554b6aca42c2a81dd026df38b360895f2895370a7f37d38f219fc0e79acf880762a3cfcb0321d1daa189dfecfbf01

Download Submit
C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog

Filesize
606B

MD5
43fbbd79c6a85b1dfb782c199ff1f0e7

SHA1
cad46a3de56cd064e32b79c07ced5abec6bc1543

SHA256
19537ccffeb8552c0d4a8e0f22a859b4465de1723d6db139c73c885c00bd03e0

SHA512
79b4f5dccd4f45d9b42623ebc7ee58f67a8386ce69e804f8f11441a04b941da9395aa791806bbc8b6ce9a9aa04127e93f6e720823445de9740a11a52370a92ea

Download Submit
C:\Program Files\ReasonLabs\EPP\ui\EPP.exe

Filesize
2.2MB

MD5
defbb0a0d6b7718a9b0eaf5e7894a4b0

SHA1
0495a5eccd8690fac8810178117bf86ea366c8c3

SHA256
c3d2f7e0ad6fd26578595fb3f7c2b202ab6fba595d32dfa5c764922145db0788

SHA512
55dab7ae748a668a2bb57deb6fbff07e6056d97b6f88850890610ac135b8839d3c61f4dc505d3f32cc09a3ff2ce80ce663d0c830f9f399367dc03c92ea7ca89a

Download Submit
C:\ProgramData\McAfee\MCLOGS\AnalyticsManager\AnalyticsManager\AnalyticsManager000.log

Filesize
2KB

MD5
ae4c2c94a84ec8942c8ca003956b43dc

SHA1
8d583ff38e96e35a16e0b61c9a674781837ccd19

SHA256
663c1106461d80ed07fafa32ccfc559c92b072640b442654071946f19d3c313a

SHA512
98c2b481a0972aadb15e62b56385a3a958a98fdea84ac860ce8b3f471498aa8d9b8a822edb7568cb248607b0297fa2ddeab1ff4fb86c6e1ede6bd8f7cdb29cdc

Download Submit
C:\ProgramData\McAfee\MCLOGS\AnalyticsManager\AnalyticsManager\AnalyticsManager000.log

Filesize
17KB

MD5
5b88fe52fa6d14c4d1084ee3de7abe66

SHA1
562c3f114d78e7a32352f2d54fb6cea873fceb02

SHA256
f7649c3ab95202084928d4f8a34a64738fbd6c66a3d5063dd2e90bdf5fb83cbc

SHA512
6c009380f662c092d471eb9c26b8eee9e4872b29b0a6362696cccbf51e1c9c14923a71d1e4bd738a71f7a3130d9306be0c6e067f1e272a823b97883fceb986f4

Download Submit
C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

Filesize
4KB

MD5
6210d32172a9f06e6b5c9062fdd79d98

SHA1
b5d3900207ede9973ca67264ba753b4e35c36a99

SHA256
2bd9d54a17bc922ccddd0abbcce5af3f1a9ac9bb4f9392d2bf4c95b367c66148

SHA512
c4b44a99d9bfd5e9ed42802f4a746945be8db34fc0780a68ccbdb1840bcff39e634a97cb98f15ad76436feaf36d15a6b827474e7b22f0d18cc8bf60a8fef0336

Download Submit
C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

Filesize
1KB

MD5
40f2ad4ffdb6b7c0bb7516890deee2fc

SHA1
c37341b9384e793eb4b58122ba022e78f99ef7e6

SHA256
8a616f78e3001ce317a43e72516b5684dc6be11e0f6548466bdbb414b03fcf91

SHA512
a92c56c3c6371eb08c74234af17dbb5fa4dbddbb6adca8782b3b87ee66216e32f9809f62b0b2f282b3651fb1d7c25d2076df105cf6b9dd1e506867695ca7bf29

Download Submit
C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

Filesize
2KB

MD5
51831e436100397b8b6c5d92b7e4c94f

SHA1
b0ad5ea7940cc628beeac249bde8fd62f2967f57

SHA256
2d8f0c17623063c776612137038853d072c6bff0c4ed02c39de356b833e7ed8f

SHA512
03db5bccee2ff436cada1b2cae01447bccbecf23170d466a0903a2ee5a77f3fcd023e235677b8f2b5e87b62fcf402630c9d49902676374e697a25136b5f781f9

Download Submit
C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

Filesize
3KB

MD5
1a232775d8ac30333bee29ba5c4bd3a9

SHA1
1a1a60b1eb1aa892390fb7a7c42e3ff93db2b790

SHA256
bd7bbf80b46b5e038efae576122e57879e03af937a236bef8fd2b1460cdc332f

SHA512
85869027060947b402ae2806240d9e1574bfa6ea205e127bf3a90e04e79cc1fc80f383c0600c85b26df7c878b033a1ea727457555eb97487def8612db3029e08

Download Submit
C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

Filesize
4KB

MD5
c7efee28eac594218ca1b7923fc31631

SHA1
ea21b3dcd84860b85c367133c006bc8e5430e6bc

SHA256
5eb2aa86cae77f49794f2af1fca22e65389a77cdf2c207a38b2981d461335976

SHA512
8234fbabbc799e8b6c591cc0b671602fd549c05f2298b3d29cf315076ecbffeccd36211e85510c61ea2b8286d4d54a17b7d40747001a4404ed76e477512d46bf

Download Submit
C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

Filesize
5KB

MD5
49c661d6c028de0bb4a76db5a472d9d6

SHA1
ae182f3d48cd381cd0881c3aaeb1782c09a63731

SHA256
aa962c5bb560b3aaa25a97ca17d4ddc5e58bf9af3625ed105ad45454cbbcdd4d

SHA512
fc121cf1ef60b875e26a1c2164ca4c3d301591c73a9bdb498d5507c5874b8df246309c2ee2ce2896d620a0f497c9b847a18e8caba36039e9e6b6b12f0828fc68

Download Submit
C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

Filesize
672B

MD5
f7b1c8d5db96b560bb6ac31340823108

SHA1
a2c22490d003d16e6eb18d029dd3509363ddbe1e

SHA256
f30caf34b25de8c996841a4269d0bc470be847e86183d0c2e4c1569a029da845

SHA512
e22122e2a1c8e27a49cecfcdedf3f0b533b79c36356e6500e1733ba890fe7f0019e586a8de1816a72c0cbf7ec315454921c2798e43a045fc6dff4d6880bd37ed

Download Submit
C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

Filesize
1KB

MD5
ef224522c145ea74fad603271163aca4

SHA1
50719c96ada1bd854b2edf149cf837acf89fc2a6

SHA256
226e272deb3c1fd1486ddc393c5dc8d25f251960b02992ca5971713338333294

SHA512
770bee9fe5851378950fe8671bd21c2332d7e893b34878520f1f4e7ff4cad7b9cca9897711440fb5a7a90bc96db462f833af880c12680c9d219a3f34a5c7896c

Download Submit
C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

Filesize
1KB

MD5
67f2cf8bfd271cd1aa0c23ad4445da2c

SHA1
1e2920d8710830134cf31d880bdd76a2d78776a3

SHA256
327efac1f289905db4f8e7f539075cf0554c8696f1f33a13ffa62504f3f530e7

SHA512
3b67586fccfedf014fedbf22f85b6bff9e5c5d12b507f5c5a86d3504b3a583a6a088d6d1cbb1aedbc029b90a8e2869370dc946f916447e5e12b9612601455c90

Download Submit
C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

Filesize
2KB

MD5
1fc7ceee2741dbc234c4638c9c09e69c

SHA1
06c53d536e7e4ee183d37633eda158157dfcac52

SHA256
35614f040407e44442e4aa046583b7c770166ed44239418bf16bf342df0e8429

SHA512
671c05c6ebf644f1fc7f49d1774f0398219ee2408fc7c8261a6169fe06ae0ab396d514db18a9d997d456c61a11344d44329a29070da04d28b12bceb3763d6301

Download Submit
C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

Filesize
2KB

MD5
13efc17504afc5eea8a312e785bbe72a

SHA1
7f034192c0d1c860da3938f480ad9850b8d8bea8

SHA256
9dcbee64d7b091d064c9206172add063dc6baddcf1c43184752cc2207212f86e

SHA512
f208f713758cfd3b0c91e1e99e4ea5d0689bc15ffd268de715e6f9490aa42581318080c8052b3628c9e8e12ee4a8601bb03b739280e7c76030ca32f4b3850ca5

Download Submit
C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

Filesize
3KB

MD5
1d4c3f74a16d440bf5c6443e46160f7d

SHA1
a34532c7389eead135fa4cee2bbc5e116c7f1df1

SHA256
1f1b1ee2d69746815d59aa62fb09c43812a2a749ed6a32ce2233dc6f1b84090a

SHA512
5d64ec6c7c4e76c70663d2e45ca918cec82e0ff2e9a5c30051bd185171c1c4d604e771d740edc8339e056934f0b92db57feebe097105fa3894cf4c0dcae3cf39

Download Submit
C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

Filesize
3KB

MD5
efadfffeea5152afadf912937a3261ee

SHA1
da39d1efdba2c4d90bfab38db2d929532162a35e

SHA256
0d5c38dcb52d6083586e88ede51bc8146e259a7cf44c7bd5a55db5b4cd3a460f

SHA512
78a961b03aafd350a70173470d5d3a15c903df8ecea8b07e432b9afee8fb8f5bc8b1375d229b7930b708ac23738f9804cedddbe6694d38eef19645b0ff086800

Download Submit
C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

Filesize
4KB

MD5
9096ed4ffb8f2448281d6ec6fccb8eb1

SHA1
c321eedf4a9f2d0f022efa8079945cbd5cf228be

SHA256
ba75c536bf9595f20d449aeac53b3fe2281fc9b013cf89897617f67afda6f7e9

SHA512
43bdaadd1861bc8e3a2ba2eebbaedec0e5e8a0b3ea045b28f9d29aed759269dc4973b2d43af49073b03ed7803f97f5119b6e7f66b19610bf3d8733629fbebc3c

Download Submit
C:\ProgramData\McAfee\WebAdvisor\WATaskManager.dll\log_00200057003F001D0006.txt

Filesize
3KB

MD5
a041ff46a5095a80014dac2e66000ad8

SHA1
63c846e6feea47d2fa4c83a602bc92c74f355329

SHA256
ee0d87273e1ba0ebaa13f450a310182fc734b1afb34f91d49234cae15b53b16c

SHA512
152db377622387d196721e1cbcbf52a7eae6f250d0c6d21554571c64810dfa9800fc5772a183aa8eeec72548b6856b43fd39790cffb97cad9a82545afde9f795

Download Submit
C:\ProgramData\McAfee\WebAdvisor\WATaskManager.dll\log_00200057003F001D0006.txt

Filesize
4KB

MD5
12987015ef4f9290858a3e54018fb23a

SHA1
18ba051eaa0e38b5e8e5045b0eff5f7c72f5cfd9

SHA256
b617192553f8802173af618fdc0b58aecf5ab854a3b4235c14d86eff4794cf35

SHA512
e0754f94bc4b32d16527f8e3f513221f4326407bdc90e7eb75aed40690e5aac8535634e07f72b15d3e0e3ac6a769a5e267d3eac821c23a47bd1efd68454703ad

Download Submit
C:\ProgramData\McAfee\WebAdvisor\updater.exe\log_00200057003F001D0006.txt

Filesize
1KB

MD5
dea2993718738ea747f644f22af2e509

SHA1
3a06a2073e3ba8f0b9987d96d9bd83c6cb23b476

SHA256
64ed7e9f441149a448a0ca4823b906c773e027f651c14cb2e556ac4c38315ac5

SHA512
9499f86804132c512ba3250286a710c1bcd8c2f6fad8206d00b607f307bc7d12d710c364c0b0f4a5784df10d11404c9eb85cc510ca3475c01c06ece9249bee9c

Download Submit
C:\ProgramData\ReasonLabs\EPP\Errors.dat

Filesize
6KB

MD5
5f1394155a4451f8116abfaac47d3ef4

SHA1
1ff7cabdad4d223a6dca904b1015d8a667c1ca3f

SHA256
df1baf8a0792675a9c44b0268e2159c2d6bf01ef81f6732ca020c4b19af4b4fb

SHA512
6a1e37dcd3663483a0a4ea025a38ace813ae6a57a03b119fb5cadd55502a5c5c13289e91f261af1414824e18c5950ef5a5da63316c8e44b75557a45681ccd360

Download Submit
C:\ProgramData\ReasonLabs\EPP\Quarantine.dat

Filesize
748B

MD5
9f630997e279343d6bdf3fe796e0ebd8

SHA1
a2f7e3eb1b109538edb76a8d8875881c4390ad0a

SHA256
de86c445e6aa27f8c7d063202744638a1177ba107c8ec7a0841a584488fcaeb2

SHA512
07d6976bebe07472138f4ea63177e53fb1039344a18d799a6dfce65002ad9998973a84c340d04a18f42cf34ee910bfba1cfdd6e44ad00f0091302057065addcb

Download Submit
C:\ProgramData\ReasonLabs\EPP\Quarantine.dat

Filesize
1KB

MD5
9699ec544946ba167d7c54a9ef5bf9e1

SHA1
b829eaeeaec21dadd021454540979c6f62ea81a8

SHA256
1cf2e43cc49019084f79ac824e497ddb410f6356293250bdcd35a6e16bc74ad0

SHA512
ee4ec816bf19b696980dee1f01492902de47cd12f4c7121d40cba7282e96b23dcd9f764734ed7a9926f819da9d8812abb584270916cc327608b42c0d838b3b71

Download Submit
C:\ProgramData\ReasonLabs\EPP\Removals.dat

Filesize
4KB

MD5
f01e3921e18003648da56f5f1fefa8e7

SHA1
d3c5a3ece9bd34ef91873ceeee820c4dd7caf8a6

SHA256
fbdcf639d2c730fc0f5d164eebbd2f2987b298d57cb07c7c1d92dc10792e778e

SHA512
a4edea2e43dbcf01249d87a48051e72a2185c03c76e26a99bf5afedf81bb7bd7c57063ee0bc8ea3ab50d6eea3545777c96eda01989995c9cfa2513ce282eb351

Download Submit
C:\ProgramData\ReasonLabs\EPP\SignaturesYF.dat

Filesize
183KB

MD5
6c954a0c7d0d28beea1cac4c65632253

SHA1
008957f6d1f4a65f21713eb84203825f1b82b789

SHA256
68cbb1d6ee0dc57072e6d5c29a6f30ef2d2373a8fb6a5f17a1e860886267aad7

SHA512
527dda878c68878e9570431d824c2a7bcb3bb56087576488e7a881012b6f5b1d5818779e5c5087aea4e262e57932c5bd9afec198fc7ce9a077a66c659c17cdf3

Download Submit
C:\ProgramData\ReasonLabs\EPP\SignaturesYF.dat.tmp

Filesize
5.1MB

MD5
d13bddae18c3ee69e044ccf845e92116

SHA1
31129f1e8074a4259f38641d4f74f02ca980ec60

SHA256
1fac07374505f68520aa60852e3a3a656449fceacb7476df7414c73f394ad9e0

SHA512
70b2b752c2a61dcf52f0aadcd0ab0fdf4d06dc140aee6520a8c9d428379deb9fdcc101140c37029d2bac65a6cfcf5ed4216db45e4a162acbc7c8c8b666cd15dd

Download Submit
C:\ProgramData\ReasonLabs\EPP\SignaturesYFS.dat

Filesize
131KB

MD5
973a460ffffaa07b9591ce64f3301328

SHA1
e3427ccb5682afdbe67fa22a77886b2204031af6

SHA256
a2048698e2d32f61bf51b0b5c83d9bedb4013e2eccda047c6c249e0a82e70150

SHA512
2ebb052fb0d18e06f422cd1e5e1d526aea77fb0f95bb2c9724210dc4ba6c79f6f156b2b5e5cc7e4934c072a83b20eed838de4324de3771915e5e0e690672a5cd

Download Submit
C:\ProgramData\ReasonLabs\EPP\SignaturesYFS.dat.tmp

Filesize
2.9MB

MD5
10a8f2f82452e5aaf2484d7230ec5758

SHA1
1bf814ddace7c3915547c2085f14e361bbd91959

SHA256
97bffb5fc024494f5b4ad1e50fdb8fad37559c05e5d177107895de0a1741b50b

SHA512
6df8953699e8f5ccff900074fd302d5eb7cad9a55d257ac1ef2cb3b60ba1c54afe74aee62dc4b06b3f6edf14617c2d236749357c5e80c5a13d4f9afcb4efa097

Download Submit
C:\ProgramData\ReasonLabs\EPP\SignaturesYS.dat

Filesize
27KB

MD5
8de77a5ac1a0cb41f096b46ce93f86aa

SHA1
0f247215053bbe9799c18b5e2429d3e1f3f17c36

SHA256
b8a4ec881932f0387aee3b5fdb50bcef6c28c1952e99e06ca6136cb8bc978a72

SHA512
644bc1ce3ac4431dbc1efb67de09ed370d0dba488181ca334077f422c9493b8f1dd5006bb6dcbd02d4712998f6777b15d41e62ca429d2e4ffc3b24376b106fc1

Download Submit
C:\ProgramData\ReasonLabs\EPP\SignaturesYS.dat.tmp

Filesize
550KB

MD5
afb68bc4ae0b7040878a0b0c2a5177de

SHA1
ed4cac2f19b504a8fe27ad05805dd03aa552654e

SHA256
76e6f11076cc48eb453abbdbd616c1c46f280d2b4c521c906adf12bb3129067b

SHA512
ebc4c1f2da977d359791859495f9e37b05491e47d39e88a001cb6f2b7b1836b1470b6904c026142c2b1b4fe835560017641d6810a7e8a5c89766e55dd26e8c43

Download Submit
C:\ProgramData\ReasonLabs\EPP\SignaturesYSS.dat

Filesize
122KB

MD5
f1ebaaed07561200badff25c9eea5010

SHA1
ed1a95703b6dc80668307e1efe3b93bf00dc55c6

SHA256
70ca8aef3c32361a376e9687f2876cc166dbc5c429b70a1d01801c5a51e0ba78

SHA512
f8b71d8658ac74a6b1830f1cb74a07636b26055585d178df35a4b76926bafd16d2cbfc3ce96da3f8fd6bfd93daa053d867b9023c0ffebe9955e980ff5d224318

Download Submit
C:\ProgramData\ReasonLabs\EPP\SignaturesYSS.dat.tmp

Filesize
2.8MB

MD5
f371cf8dbadd17e03393aa21f3963401

SHA1
8b7a906b5d6ab57a3bf7b32401a286e812327813

SHA256
287e1aed9f449999e9852477960f8b67b2b77869463e1baabe63bec75142130a

SHA512
d910f4d48f4f34c0d9a68a89fc846e9c776081975c8d0bb14478c7978d8be43e4e2666f957deca1ea411032d08b9b2bed19849fe284e4a2ef91806c730cc570a

Download Submit
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Network\fdcfa483-c0bd-47f6-bbdc-faaacfeb692f.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\d5f884a7-b886-472c-8d88-720f0c96fa65.tmp

Filesize
168KB

MD5
fc07ecae96473eb238d9570ac145b9c6

SHA1
40e791064c6ab7fed561242fe76cef504e9d67f5

SHA256
7f1d458d061048520ff23161194483cdec65a85a83176afdf570f2e8af441c42

SHA512
14eb4c3fb47acb4684545a3ab7a4f3488c18b25d8342c34e32da4c9b25b8c62806b06baca5f6aee834284de45325680a5275f06077cbb6761a2386550fa5ac84

Download Submit
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\ShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\ShaderCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\ShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\ShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
93fa0c12629cc3652b91d65e419d3f2e

SHA1
7e3c0f89b4048702e83bafa13e3a0e8780d10c21

SHA256
f24b10d91442e5131e285e168cde0083b9bf8673677adca9c745d9eeb54a77dc

SHA512
4ad604f688e2b68587436f62a0f1a746d027c6a2863efc6adba39eb3300fd5820ace00d5f6e1edc46dc9c3e355daa0b18f4b706f98ed68e8f7f6976aadf88a9c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
d8084ffabecce7f441e22ab9c6424d34

SHA1
52d4b97ee7ad4c95fa4f564ae084e6e8029ab74c

SHA256
ba8eb55c666b5f4cab8816af956955cde512bad53e926d1ac099e08be2e87ebc

SHA512
8037c8277910a15f88baa2f106f39e3fd4cd8d7a05af297852322f0a37266eb2d7cc0d7161c258daf8859d02a52d834a827cae2f764d8db2fc7b4dce0be9c245

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\10024

Filesize
21KB

MD5
36270e390d373b6cc33c5822c4178dc0

SHA1
39aef50799b7c8e0893bae1ad55f28f651699358

SHA256
80e70a84fe719a39260c4cc205016d2a58f4702c07cc2bc386faa34fc79e02b7

SHA512
f891e4eb2a624756f00474cef0f1926c86d55fb306d116ccda470e4cdff3f316e48cd6d69515722927774cebc89e93904c4d7ff5dce4712f37cb93fd425b6c03

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\10131

Filesize
9KB

MD5
599ae508e9c74ff78f2f9b1c13a94b99

SHA1
5322d3979fdbae79b5fcd27e5e30203f2de78ecc

SHA256
03a4c1e90ced14c22db58880557fa7fcde281998f1aa843dd10f371787f60564

SHA512
7d24487cf66a01cadf6086df274fc1c7832c54e87b4a07bb9800dccb0077aeab885aa689f218b85e7c74d18481272bdcde38f3d04fd698b0ae39a16fe4163833

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\10188

Filesize
9KB

MD5
cdd760a64cef7f3acff039ecf8693c09

SHA1
dcd79952f015c643005ba8b5005a52eda903f5bd

SHA256
a24243aa659def43797c6c2994905211d28f690d208eb54677cff2f393bb2b90

SHA512
8c7ecf2fd14efee3fa11b4ce38f420a29145512bd8a1dec345ecc71cea341464d7abbccd33e210e675ed31b32bf85cfb05e424263830bb16dbbcda76c62201cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\10360

Filesize
9KB

MD5
20bfe324b5828c142adb5aab577963b1

SHA1
df484e47ae10ca4a7cc2f6d0f3585c51541b0835

SHA256
4940c262f43285473523bc6aa81c87c9370882c7b59b35e8a685030747f1565b

SHA512
d6b81628fe429ef45f0b7d214b20b509c6bb48ce095c75f5644e4b8b7f11a529066e6a8967a14e2bca60041b1d85187893205db4c407dbe2264c5781001709bc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\10438

Filesize
8KB

MD5
fd82e6f6865dca7286ea00d838dd97d8

SHA1
93005658ca71aab6e78f69cb44e5a86d8fbe55b1

SHA256
8ed0db3265df18ff743c7b4d7a8bb73b325f42af7003e5089206f3948b6217c5

SHA512
b83424ed8cd8526f418444186c6084b5640f575fc5a9757ae9a74e6740f867e5e3d6ed612729c432cfd60694ace45e87c665127439165f0cb776404631d683d0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\10827

Filesize
10KB

MD5
59ff14b2a6d537eb000a24f8c23caf3c

SHA1
4d72dfaa2816f5670111023f313dfaf330c7e5d3

SHA256
dc05d88cb5b6bc630f6229f4face977b29f4b1c2a27489eaa9c84b07b7f23dfa

SHA512
f311f5d4026c6abb54aae18ca8569bc97d065dc304da2543e2e6d37beef84e1b72063e76afb13e85d9282c06e6a68f4bc829607ed537a83aaf9915a8fd343381

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\10985

Filesize
8KB

MD5
5805a707dd94f026b6cf1fb9dde16525

SHA1
4ceea6e102e55257694397ac930fbb85f778e676

SHA256
6253023fa28339aa4a1451d67f35a8a044ecf059b417754fa0ced975f9e5ba63

SHA512
8b39f9a87cb47952fdfa513d05912b4475bd9d54a977745046c31624b005c40ccbd39dfe65453562f8fb5cd0ac96fa729b228fa5360b5bbe307b58ac8fd495bf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\11135

Filesize
10KB

MD5
75e07739a359c557752aec781aeb442e

SHA1
3909c7d1f0d396ee272e7f24249c135587bda9d5

SHA256
38730bfebb2c8673f1849ea8d60345ac45d68b60613b758656ad95fa813ada20

SHA512
6090fd4d26b79da7751442417710f99ab978877443593cb3c9da94f98b0fb57b0d5cc3e3f7604bb3bb533d7e9b0932ed6199b1bcf81add0643472060b59ba051

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\1135

Filesize
6KB

MD5
06393c85cae84d7edd58d1972153ff2a

SHA1
e84257e0462654702353a3a03887d93155eedf2b

SHA256
d7210074b4ed820c78ec323fb0052a6000a92106d490227218e6bbecff4e3714

SHA512
aea7847565f91d637f0dbd5707004e2377ce762eb287d3ba41e4c48d147a8cc0d49d3c77b71213d3eb04fb65e0cb83e009d513ca71621b8b31582c11e46683b2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\11381

Filesize
9KB

MD5
67f5a84348d18a0bb19e68cb26eaccaa

SHA1
342305687d8cbf2fcaf8eeb18c7821bf4656311f

SHA256
91a75133714a1cd070586b0e10e4aa186dd42fa0093563968da51c763a2480e7

SHA512
2790431808a4268cb16d2a1ef4f8dbe2e1d85637d0a9898921f04f065d73dbcde1768f974e6f1e72b2df663f90ebb57f8d7b881d878678cd7547cc61bf85cc3e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\11401

Filesize
7KB

MD5
4c3f10abf25a558b71119211700385bc

SHA1
840cfa7a0054eb12dda5ac54827e929a2d81f8ff

SHA256
1c92fc4a696ab2d6ad479436a97fd3fe877e9352e1acfe21a8985317809bf8bf

SHA512
b2f97818b83d73e4e55466585ce94f6ff3d38778dfd6cbb6ebd6d2f0e59c81a80e4c080e018836ae23d3308326475baa1c4cb32ddeae9bff7f579002fa9d4862

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\11429

Filesize
8KB

MD5
407d29e052e560bcd596cc2f8d224f39

SHA1
9438e49e575dc87472df0a2a60d5ae2a23d6c1cf

SHA256
c0a11ae50ddef7fc4ba1480632f5ed19d4d0d43abc17b8f802b1659aeea9a132

SHA512
0531c063ebe839c1161c2f9631f8f96be00db0e834a9caf0ebc24330c287626938f80443fd4d704771344cd8e9279bada546d7e3bd4cadcb51a6c0e319eb479b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\11666

Filesize
8KB

MD5
2bc58495920889cf119cc62aaca3801a

SHA1
4e1c3b3a3412453e3b9caeb0cc1844fde35b54b6

SHA256
aab580eace2c94ee2456db10d635151926b988ec9250d43ffa4d530b34308b65

SHA512
595b203a32f82b179b3b838c6d718e3fab9798b2d654394d6005e8fe7dd9268bc6981526111dcac544484707e4e3c697a3154610f6a558f27b7a44180aeb69f4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\11838

Filesize
10KB

MD5
f71443ac799c848515db61256789e342

SHA1
85a01fca1cbd06a29890a95ed15f4548116e6544

SHA256
c87c24aa12bcfc0effbd68e1b8e2cf59a680bacc02064984af51c13b1edcd600

SHA512
9cd973dd353ed10af61094423be451f1d99444bef897f373bb60624e701206d4557172342bf8cbae9248542e80cf30c280b2724e5a5a521fba413d72e3526ab4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\12043

Filesize
8KB

MD5
24e6d365fd935dfdcd3a6f0003bc6a33

SHA1
aa7380343f130c12f8c4a6f81884957499dedb78

SHA256
4664a5b03e5b0393dc8d7e4ece31341d08f7c8ed594ca2f81db8fd40c5ec539a

SHA512
ab6a2c0b3138bace99ee25c218aed17b12d826a89dc937e8e9ad528149a77fb3be9a5dd68c501fa5ea45ace3b4b501b27827e69abb4a27e58afa458ec20c453c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\12498

Filesize
14KB

MD5
77abaa044ba37cc7ae91a311b36c594d

SHA1
2b1e0d19df958d51ba7713d165ff40927869bd41

SHA256
a2b160b79f856b739256548ebd4c296b6320f83bd8a81c7a6d6859377b854b00

SHA512
2c701549a4ddf4948e755e81b8f60d2328d52b7e2e3a3458a15b241c597af87f42e395a16e5770e53b57e90f5bc42dfd2a2a0de679a0bd2ac8b88b540e6b1b37

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\1267

Filesize
9KB

MD5
e93fb9ef1cc76cebbcc587927c398a89

SHA1
b4d7eda0133424c9f6af83338554f711b6635fcf

SHA256
75cebb9ff008f71c53b57c7dbf4d314ce3379ea6ec5f6cb6091379cf87860798

SHA512
76894cbf048d91dce75a91409ecf030baf21c7673c8fbd725dd8f492e1963b4e7d7acd396a44023ffa47a8ba4430104d98a524483a954d10ebca023b355ad91d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\12899

Filesize
7KB

MD5
3385d3cf7f2ddb47f0fc9e891e96570f

SHA1
b5ec447a7432c9e2cd0ad46039af91c891033da5

SHA256
0fad535e7603067ea7b26c4230e86d707ec3cbf3a50948933d7126650efb67e3

SHA512
c6a9e9693fb0cd77e534746460da5f2a1dc9f7036d757a6e650cad99b8f401871b4eeafb8dde82a8ffba6061bc639ee1f597c170114622fed4be6b8be3b8045f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\12919

Filesize
9KB

MD5
010e0d31346c70855e4f9d72de5f4223

SHA1
8179df9b8748804c5dd88d75e3d13ad6f241cf63

SHA256
898844b2f6dd7dba3a530934e90e2574ed6104873bacfc30916453a9c59e88b3

SHA512
6d29d012413f6940ddeceb210c568bebba228e3c726de5d9349ee66de0f1cfff3eace2a60576b1462c004e9bf4b957386c87e8fa83753b1c59bcc4628a2d7d10

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\13155

Filesize
9KB

MD5
2c726e823e70c6c9d269649e37007e50

SHA1
161b23e78b45eb9da2dd1df069391b126f5cc2a0

SHA256
a025168ee5cd60ea88f61b0e1a7aaadcde331278135eff0aca71d90266301640

SHA512
a43d7018781052a13adc437748453a8c9edb25ebb7fbe18bc11468beeefbe5ad52e5313e96a181ab6da5ce6b80a102e11eb6f49b0f6f69ec3dbb2da3f062ca40

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\1324

Filesize
8KB

MD5
0510712c7136ff980ecfe5a04bd93d90

SHA1
53b4827a0f7dc0cf132d0fb4abc13e66bc65605c

SHA256
34fe2a6d296d3f8542753d962240396d6f8aae0270d3f8264439b11fb43b5367

SHA512
ad093dce5c508869219dc2b73b69c37766087c474fe138b8199b8a2867808b518a36b4ffe352201ca50fdf6170c800f146e53aecfdc691d34d66722380320b16

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\13545

Filesize
9KB

MD5
55a0b97643d89ce127371a8e04c68fe4

SHA1
62d330c140073facc07b34a749230dc6cd802b17

SHA256
d94c3438f7d3cf4d63b6a78443193d34d75653f47bd102227ac2cc278f9a2c8d

SHA512
afd68b6eddf7dcae40f6c6773ae4aadb38c50df5f91407bddfb1a9ca4c156293a12e39ce59aa8450f934d73fd63fcfbf57691122b6ec5fb27731cff80438cab9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\13621

Filesize
10KB

MD5
fb1b243aee2d9dfdcfb12f5f952edb33

SHA1
c4806184e84b3ae737de7f5dcfef54920ffad282

SHA256
4b6afa0574eb92876afa79dd0e61b66b3ae8b9740e59ec506d91d7a0d466433d

SHA512
a73e78d1814c3904dc490334a984848200b6af03c4c022de84a229f95eb03e59cb9d6f41ede796ca393634692767d550f06d3c98b18706785a9344d9f7058d7e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\1379

Filesize
9KB

MD5
1ba1342ee16fbb7b69f5e15540060133

SHA1
9508160ff8a0212502fc658f77d65c6084b52ffd

SHA256
616c578d464a90215e6a7329c6ab04584588f999ba6426c2a1c888e86f3b3e97

SHA512
acafa8f8588ea811b5f41b2a452e376ff7fd817bac9541fba8af4af1504ff6a5eed4d18ac6de98684eb0cb5657d905f6756f9db4f412d01565dbc56e2646617c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\13929

Filesize
9KB

MD5
a0c362872a7766d36106f16a0fc948c5

SHA1
5b13e00762f67272f6732266a7d3ab7485d6f87c

SHA256
3f63d36142c7ab9e4dab384e581f56e6b45739746b4f87f7883d94addcf386a0

SHA512
5d158e69c6bdb7b5070f46c2236a9c671ef63e35b41923bbec1e08a5d8c4dc2be9a6f9794f390bff4192a14a0ce36f297b0dd7a86865b628acf82f5f5be183df

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\14347

Filesize
8KB

MD5
babe0069b656720a52e1037864fbeca3

SHA1
82d5eed55c8419b938cf568b1b319449fd8b2162

SHA256
f068a477de0ac4c581b3828a87b7994ea43c9cd94f3fa487043c683da2469445

SHA512
6c8fa04b3d34efd0aeff05f6b4eb17a8fd45395bd95ef18125a252c287b3ffb1e1da1ad3d9790dfe9388ebfdc8805ab53c1162918aa4623ec1d79623421202aa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\14554

Filesize
8KB

MD5
69ff16864a364e9fb673d14851c75651

SHA1
4af2e466db0fdae1b275d9abc6769d2afcd1156e

SHA256
9d338d79de4c41f64c626b9a844a6f1d9482288ce573eab355cb16c8f2e39300

SHA512
755cd05068888bb221b5bdc96365050a7f9ea1875a74c3599a12a8ab7573621634eb8cad2eaa120b9b63c158f448229d192972b743fbf4c71a25a3a33e6bc511

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\14741

Filesize
8KB

MD5
0895b914196334f0412037612ef57fe0

SHA1
e30cb0be325c466101020873fb3b4c398fb8da96

SHA256
c895385936980fe7135f3b9bc636c31187892400034dc3c24db468e2d93f57ad

SHA512
cd54c59c9ec5c3b243b1587d2db420d20ba8161a33cdb4f0480b3ebe058c8bee1bbe9eba28596a014ed34ed1a09d1e636ddd42203c20c516dc6de2582d62fc58

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\14772

Filesize
13KB

MD5
6ed26b6080b27f2f360104be0b4fe68b

SHA1
42164cad02ae7a58c9078f9430c17ed05d3ccc56

SHA256
e0523e1c0f412f16025d3be12fa532d225556330324c7a41799c030bdde8b99c

SHA512
bd2eb767f842be294235e989bef16efbbf1d9c7669edd802f572604b8c6cabb41f96ea85615402c9be3ef1033920f362b932524856af4522a18b21ed10ba257f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\15093

Filesize
9KB

MD5
4d4a0b05b79fcc36fb8bf267041ff69b

SHA1
bb2ddd189a19fdd2567b2b36be3ad87dce885cdd

SHA256
14d4e4e71d4c36f5ef471fce430c7912dd2e84ccebe261ea0b38439eb4a31c65

SHA512
07a51351dfa824756e779b2c07a7fccf9f929a1c253fb9369d38fc673bc8e650099975accfae27fdbbbf406d98c1327ea324d49e85f80cb8e82b357222ab0006

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\15132

Filesize
9KB

MD5
d503e53d20986958f0653fdaa55f7cfa

SHA1
78753ea186fe8367e01d0c12dacd067003e5afbc

SHA256
b8bea81300adc202ec9842f017ae324200ba610132bdb9843a3f51d710835d30

SHA512
dc23f91220261a9f4577b3a5bf6da99b3e6d933967ffa0b9c7ed302c384e73c44919fd85772f4ce3b074c9bc1493c5d56de4275333cf36740700e3967ae39f4d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\15163

Filesize
9KB

MD5
bb8970a4d9280f16c1dd2fd8e84b9b6d

SHA1
296d300d6a611683afcfa5f9caf4feba67d5031a

SHA256
bf3432cb4cf2e8e370095b29e926e4139d7deb7893b0b7b68cecb0a4396a8dd8

SHA512
79ee637361ccd7915e6b99031bf0b53f172e0165f70b74ff0b4014410b9f0a2e83cc721aef746bd6c5eb36e5b257a4c31713eaef0faabb2ade9906e663e21139

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\15227

Filesize
9KB

MD5
faec6970d6bd51250dcd97b5539599d1

SHA1
d0af4413ead711b90a2e73cef4a726a1b529b7c7

SHA256
54bca8190f7e63327bfbcbff0473ab4e81ac7edaa864f8e6ca4daf867b59b5fc

SHA512
80d5a6a249cbffbe4ef02df1daa4309262b55d7d996a8b9262e0520b5b62f95e2f92d8a353c48a582dd23afbe9c6416c46ad752c57270d252be367ce4d0126e7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\15320

Filesize
9KB

MD5
73c0a7cae71075e455445b4152a61cc6

SHA1
ea6d5e401f837326bb52f8ff15ed64c4c5339ada

SHA256
72fcf39ab6cb401beb5ae10cc2a5fa8d2e4480c8d6c4e2b06f4a74678c69a293

SHA512
7fdabc443274f052f5b56f72492788cfa9d60dc989baf0eaf5a00536e903c5a8e546410ba6c971c8dca5595a94a6d0ab7e97579f5e734728d0a328484fd4611d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\15537

Filesize
6KB

MD5
f7f3542f22f38c441e10d8d699f1d660

SHA1
6b6e20268fb3243e933b63d59b960a5d8fae61c3

SHA256
6a37f6078345eaa249156902ba84d9b33d64466152b1c8c131e7942dce0690bb

SHA512
f72b32a5e3d6ccf386201285d74af3f59983e4d4c8ecb56b30b2284290f543d0814e38db2cd7aa8cb37c3ee406f90293c97f177df42d794720fd90b618c9b1aa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\16217

Filesize
9KB

MD5
06b33c99a5213a932c225a8b903af72e

SHA1
a7fb47e0a038f5d4125c0fa9c60a12406214962c

SHA256
f2e98b01db08291439301f9549f685e8e4596f009ce1a31b90fd3704524d5fd1

SHA512
88d4d3a60d4e3258873bb8464a6f260bec9101f53d601d816eca70f1caf92a53ad0993b1a5e161803d37bab10e5884e86e87e01b3e72a9df1531ea283ff7f296

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\16289

Filesize
7KB

MD5
77a99843d7e78f836fa0ad6b6f34930c

SHA1
2c76447b565ff61056fb961022a381758f6d3ef1

SHA256
66302b26155b6fb2bbb92f60665c40966ae0db7a872203ae27d278a94a60bb74

SHA512
63d50f8c8478676abb3eb7ccdd7a731cfc42faf33b3daa5106ad34c7dce821fcbb02eea8c107626b44abe8231f90641fc4e014613c80504051ae6d910411c4cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\16643

Filesize
14KB

MD5
f8258552090f150323428555de622df2

SHA1
e153f81421d5de55e86689d3d1e21ca1666827f0

SHA256
71ba403a37b00b8ea2289489f16c06e1345a5f5447812329dd60b1f881c05e1a

SHA512
da7824853af67ec7d339020233458141f9b39dfbcbe910836911cdaf4d33d1cc4a2db7dc8b80feaab0cfbb055985faf49b9d3bd5be925db2ec738e415401dbb9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\16667

Filesize
8KB

MD5
9aaa68047d5b8dd0dd477f1110e5aa3b

SHA1
3528b754b7fdc23169e6634b045d4dfbf3bf76b7

SHA256
ad19f475cd1740c4ebcae81d90c328b7782a16eeff42b1b7be033a41ccba2cfc

SHA512
cc5e392a4bf4a362815ae80fcbc23d25bba3889ef4672a68c35bffc925c28cdabf6e1d2a1caf09707b5798e071a168f9e8e72ebba4372bcacf5cf635fa5ba65c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\16779

Filesize
10KB

MD5
7cedc7465096058dd7135d4706bd1b7a

SHA1
d0e1e3e8e35c90f151635b9c77d508622da1f899

SHA256
acf09bf40c5909ea94d9bf4cbd9ea1000f2994af8872811de88893639a5ab114

SHA512
c598ec18505fd781b64ae8b33b5d2933c28a0c95da2062acf7d384a93282522d07e50e4ccacb98f65b235c8748de5504f39f0de186982eb5ffd6372a0d0c7555

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\16838

Filesize
8KB

MD5
a84b08bf24449364de2483acd90b1cfc

SHA1
1ca5a4dd3302fef13b312be74f05a95dd655dbd8

SHA256
b0f251eaa23ceca04905bc3b4af58744b0364f4c1bed80dcda91bd70872880c2

SHA512
386e4742ab6f51b24e84b2afb21dae15a73b3b3460ead9adda7a0785845c1abfd7b2482f1f8abcb47713d4da6f068574a6a53b6a940009b865b34f1c34721359

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\17006

Filesize
3.3MB

MD5
a36f12a716a35ba31cd3937502784d3f

SHA1
249bf6d9546618e9aaa94efe2ee546480c81b6e2

SHA256
5b194ec49ba18335f6f9dea0e3adff1eb51d2d7f3149397c16663a888744e3cd

SHA512
6a77c088afd94ae70c8a194e5bf483d9ecd3396754bf30da21dcce8bc006a90e58b59cfc62122bbc4ea9101a8518fdb57dd37ff384ecc8232bbe17204fcc5587

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\17186

Filesize
8KB

MD5
cd45d74105bfe040de8583bdce639056

SHA1
8c8645f44e42fa4807c2eba1a7398cc4a96a31bc

SHA256
69eb43ba3cabf5b8dc1f1fee75c999c3d464c2a548fced6ffad10c4c21ff26ae

SHA512
770dca659ed0826a23481394d4ecd36a35e98512a705340b5a73bca70d2b12cee9956541adfa2bebc98cc4f863aaba9c1efa5d789391dcfb8201e32a86e35f5d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\1744

Filesize
9KB

MD5
0de5f28ed3b189d9504ab0dd5b552584

SHA1
1ff1eb5d279386a69b4517d5cfe425064e1e13f9

SHA256
20d3c142a5f0f602528b89b77dd3d765b48a0516ec438f2253b04422e37fc6f1

SHA512
eae549de65e05d13e37432bd89b12c3708ab9e409634c2761f8dac8c1925b97412c293e9d1c40ef2d1651bf7d88e108cbc830ec92b11527fdc5dbe00932b6098

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\1766

Filesize
9KB

MD5
391b2be883062c4ffd239d089de93e1a

SHA1
1a1b1827397df0e332aa1ae29fa0410e7cdf8101

SHA256
e2ba6cdb21529d4fd5cb28e91d80792f773b35ad5885170f62216211d8ecc96b

SHA512
0e0f497622c27ff4b61e1dfad4aae58cd3c0181033c1426024c759bf0592809d17fc6d312f748f01869eb5e1f2d21cca55e8acdea1faa95bf0ee7a14ebdf58ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\17696

Filesize
8KB

MD5
c8aaba9724ab69b5d7f9753ba0bfb633

SHA1
0e75f096ee247456baff917423ee1c9e4a0d0794

SHA256
1eb8ab9e7d85ff25609baf5ad3249442d230bc8a41b0fcc1262e481bb7d33eeb

SHA512
663e51b817a1537a1facc7f3b30b1046b935b29f3ad099e7758cb18ea4d2233b3c87933641e1c676f28df3f36a0970028ea60785893b06b2db755fee6f710363

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\17819

Filesize
9KB

MD5
fa6b4b423b362622a9dd5777e7a72298

SHA1
2bfc432dfd81255b363e56c51f29ab3c62fc0443

SHA256
5415671c442819a3fb0e38f0f9598f65992f6bce94781782a7440761f28803e2

SHA512
f3c5bc259737d799f12b1ccff7efeb71805c9f4980e8819b8baadb3c23b0f6e2248577dfecc38a267f038f12e0c41ea98d1b8c15d3284bdfd0e42190ced83a00

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\17895

Filesize
7KB

MD5
febaaf5cdafca1773f1014bcd8867a61

SHA1
e15be42c9a8eadfc7ccf57488b822518a34ea424

SHA256
52a8a05d3fb1fa9e4dee638fb1afe09fa3b1acdbaf9948627c1ca8dd1f56723b

SHA512
1b5975286d035acb9a54c49b01b3490314eb9abac3a7e455887799d42900ae07c4c55b56e55b7c9ba72b7675f1ab7b919bb675f3dea1553fe5a1aeb3281b0c36

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\1803

Filesize
8KB

MD5
b24cd809f41d04304a477961531ac155

SHA1
25ac1dbe555ba5e2f09dd0893e385a43273060c7

SHA256
0570bd405d170f7b62d534f42d6ebe8f2085e268975b32a2a8a195836ece8887

SHA512
562c8c26c718fe066529c909a12fab78fe02a8fd3c9721d8f5bf189106d85474b7f59fdfb46efbe2b3471cf76dd50f5a6e1cab2794b43e9e5d4685e3162153a5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\18044

Filesize
22KB

MD5
b9b3870b476b2b03d0566ce344df5a5c

SHA1
6d01bf32e73608c0165814c4e1ebe523b8c31fb9

SHA256
f0765d61ddf2d8f481f7e74968cd05a32cc03f16abb98e4ec3c8730e25577245

SHA512
c129221402c6e2541ff3d5435bf233e8f709e351af0c59740fbf7a8e169b8968c342fc9b8d7ec692685cf025005f2d7129d30ec91fb5cc476570f981d512eaa0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\18092

Filesize
10KB

MD5
0096dab73ce91bfe7ff342440a9544a0

SHA1
3888a08120d3dde08ef2e80da6ba3aa4dd685642

SHA256
b410462073502cc4fe38986a195e3e4ab77b5445d1982a28310dfd68e492c75e

SHA512
c431be126d5df5f2cfed902ba3e5df56f3d5aded21d2b9c27e59efd42ae86a3fa6f1dae05ec853cfb9b26522f16544145bca7dc09dd196cf7aa03c5c86036d2c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\18145

Filesize
9KB

MD5
3c5d08a683ff81b662d41e36c8ff5e86

SHA1
649a0530f6a2970e131a21a3b0a39c1891c289d4

SHA256
ee5a658e0dc56f7bf3e984ae591688dfc6089a88af5604545c72b5a66160d086

SHA512
730347ae29b498c8adde9d09cd7239f0d1c5c35ca162a60469cb76390746f71abdb1d14bc229c14528fdee0d175e31977d072af9c2a6d0de63f020d22c84e580

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\18428

Filesize
9KB

MD5
8aa425bf5e85eee494082b62534515cc

SHA1
9b21f75e92822fb5179088be311ecadfabd2278a

SHA256
631c02a58cceaeed0620b920c234a13c920615dec0fbca3d867b6cd86ed5c653

SHA512
3a98c8cf5aa5193282ef49ccc17d00828128b3db7c03be6e09a77dfecc06d87eb0052f81f7cdd71b48c7ccabe6e85b1c23c41fdad2659708add374287135c5f4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\18593

Filesize
9KB

MD5
6809fd5265114f2b8365e021da0d287d

SHA1
fb60a819213cac5fe55c6f5fee46d47f54a01cc2

SHA256
8388657192479807f4a37a7d7204fe0a2403683f0529efd7aa6a394a5c1ffb36

SHA512
7f1f5d1007902da4415f5c7aa74755fa8a445d5d6f1f6e44105d03a73b4fb8e939bf205d23435be48619437f1ac0fa1563e6d7911738eef49c4c075185de65c4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\18594

Filesize
9KB

MD5
ac9e994443049942f1ab7b3075d12485

SHA1
9dd2db33b5697e721ef47deea4d51f8cdb73dd0e

SHA256
bf1f1718daa95c759f3c2c565cfb5a30dffae8a392b89d66706c7634a7e8c5d9

SHA512
bf11f25fec7a827cb5fdf12dfee65ae8cdbbb75c879eefd3e8dfd3e7188bca2a8e0c5a0eefc95b050857e7ad60a45864d3d50e30b3631184b6e809e854bcdc06

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\19515

Filesize
27KB

MD5
e5124ffb3f2ac8800443f55a2621abfd

SHA1
8dee491334b002f34da5d4c6ae1ea051121df2f7

SHA256
646a4892d95e6e584b5c900b79b7e9dd7c78136698a38b2405258dd9ab804f71

SHA512
237fbf0dffdabdaeadc2305456fef8a4f65b9b9fe43cc486bb7083570275a05dfe165459ba8492611e8429683b6e381a9b58dcf5436e6d2d0e2ea442a3269122

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\19928

Filesize
8KB

MD5
0f07358fe7617ec797c20a54ea7c7a0a

SHA1
939b065b3dad7ed3b5c14fc4ad96e55c495efc09

SHA256
33e0b4fe37703e1d9e5a24f7139e6304598602551886ff5405cd5dd188b99e60

SHA512
c01fd46d1c958f258739a56b14b61e05c815da8628593a5ba0ad996152c0974ff7fa5d6eaf1a1b67c37c378e46eac8c5c671c139503de7cdf382c1a9cb9bc96b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\19931

Filesize
10KB

MD5
b5aef432f9b25da92bfff6953c13123e

SHA1
c5ac8c935419c75ca0943038d39370c21bdf1939

SHA256
d29f667f0a00c0de9aa9bd1493639308a14a79984ba7ed243019ffd29b84faf4

SHA512
af0af4016afffc35dd052aa927b7726c62d5b019256b73eaa37a493637464089bb09fac7bab2165ddf1276de1cd924b976182774b0ba9eb1a76a17f8a18eddd1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\20003

Filesize
8KB

MD5
7e4c4179ef8b3da1170e3219b928ba40

SHA1
27a6e1070049f8ca50db42ad333cefdc8f4147c7

SHA256
d732106f51f50788be11cde40c09125ce8148017fc62983f2c9761a42dfa495f

SHA512
845f6b6238d4ae56010cb7cc4d5510d4c4f722f020c5fd49b3f3bace751800a194f1607183087dfdbeac1e1c91cfd3cf5942337ba01b19413b1f27e78477ac1d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\20068

Filesize
13KB

MD5
14973340eeacf12e961baff422fdb390

SHA1
14b3ce9f74332e44a307066c4058842a26683ed8

SHA256
8ae2b76566197c57416b817a1f5b1ef4cdf60bf9c15868a8aa0f76aec8dd0fb4

SHA512
96e6e8e8de9934814f8cb110d2f7f0ae0ca875b780928b54ff6ce945b400d13cdab1641e14ad48875d442987c54f2ca13f544b27fe0b4257a2e59a3434a7d2ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\20104

Filesize
9KB

MD5
904739fda23314b9291aa90b83298c82

SHA1
231e8a1bb50eeb076f93e8832581f7b7a7c69753

SHA256
3d1e83c5d1566c31274d8b3c0c899a472e22041369ded7c80606ccc2f7026614

SHA512
229c89adbae626e28333ee7ff76965ba09004ded342b51f34f4670928eba8e818c7a89fd0f8e90ad9535550df52c6750dc4cb3e3f4c292454bcc846f983fc64c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\20239

Filesize
9KB

MD5
dffaf41a31839748ce38574591d93ed1

SHA1
783c4e4b43cd0901f4906583dec0588282f35e1c

SHA256
0c8d8bc0ccb35595d2e4fbdf4331ce506a28ec68585c10b8ea1d21de9edb5793

SHA512
2a391a6a5de72139a81b4c375df09b0c2dc299bcd426452d2d456d8a9069fd430a0cf888dea2c68833dc83e758c678fe3c3211f5b56b6e861ea6cc6f5f298a56

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\20380

Filesize
8KB

MD5
439ae725ee9ecee0772c11235931c8c0

SHA1
3df7e7de15f9340a0407e0241c8d7bb2d88f2e1b

SHA256
ca8481731ab8e6b95235810cc489917e54fa85dd461f6dfdb45e8edad8f0f474

SHA512
549fce078e09206c36c2b2ddc8b4e13f906feed18acdeece007890eafcea9a1c07f0f5dae83f656f711ce96742720eaf4b741072d4880ca4f8ab6baec539f15f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\20704

Filesize
8KB

MD5
d7ac365b0d21c3364cc41fb1f3baf29c

SHA1
be55344cd3475641bfe327d7efa84f91176a9430

SHA256
ec99f9a273ff2736aabfa0d900a6af8163deff7434675214f557059c9e0f41b4

SHA512
801e1c0aff425beee38b2ccf29af44c141ad6265de1bc6095497534860bc20ff56edf30db743465b850cdb1eed8b44203983ebf23274afc0be7ecbcf716dcbd5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\20861

Filesize
8KB

MD5
2ad06e2afeeeff6b550e89037920661f

SHA1
4f1a2b8609c4e2c385089c87efacb77f8e677971

SHA256
69a059e84b6eab263d5a6874588e66c8cd3f1b908899877583f199239e991203

SHA512
69054c95edfc0d2f8f5abe9573877a4bb28c72ec1d7c6724f489c43ac81770ae56fe7908cda675e96289e6adba26ddfa7b37afc9cd8e49925a4ba2a3c0bd0267

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\20869

Filesize
7KB

MD5
48d75202b0c2264d1df21be5b8ea4200

SHA1
9fab5ff2275d5fa4479f27b6393c2c5911fd9c07

SHA256
012f44f8278446ad95c561f92c6f5169eb868b6410843b75913e1abdd49c1827

SHA512
c8e94aaef85fae773b3f7fc18673ff3b232619e90e46d86be7373ca8c91df45768c62c3204661f57b369987282746b9570f2e6b833f75c7b081a7984392b3657

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\2145

Filesize
10KB

MD5
b328d01c301412c5e40806156a62b98c

SHA1
911c6665bd9f3bf4b47caa57adbbd9943716a3df

SHA256
5d8b0c2e73608c59be69e5be7f6f992311bc5bd6864be66aee0f78ca6d28038c

SHA512
f9417097770fb9b4b5c56378634ba87c97557f9e8294068dd97fa05621772e5b918c2228180abb0cf660e67337817b7d2d24ba6a5c9226617b746f07b31156bc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\21740

Filesize
26KB

MD5
40380066b343a102fc30f99d09ae22c6

SHA1
9e8600c0eba721da11ebd65f32ec8159f0b62177

SHA256
ec3a0f6fd1b8e4e4afc0ef3b8f6422efc3c09a52f85236324efd64a120419750

SHA512
ee3a77d8334625ed120716862072f0fc24cd9bcce358d7558a9bc36160e565b9a68e3495fcc3ec0b4913a73b92279c1dc8cab92bfb4608ecf9c3c7ae89c83dde

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\21911

Filesize
9KB

MD5
c4c24f40db3cd4de3a9eb8a60239c8e3

SHA1
614692f842be2709965824f3db60d94dc297046c

SHA256
06cbc4fe2131fec3b77bc36638fedd7295540055608a23cdcfca45b5f51abf54

SHA512
92890f43b1ab1e37f686c6386bc1dbbf83c9dd09355d91a69637275cc76ac9765889d7c1532d2ffe4de4a77c576601337cda610b2fc43833305c597125326ba0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\21958

Filesize
9KB

MD5
ec92f57451e438617d308004cff98ddd

SHA1
38fcf6d42fe6571540868bfcef71a1ea1239d899

SHA256
35c377f6b67736a3bb721608d875e2b902c6ef46a82346862f92270db5c30eb5

SHA512
4e0ce253108cb3c1d1a3845cff78f9c7ef40df1653d4bc73854bebc72aa043dff558fb9e8bf15b0b1d9a5510bff89e27f6e8edfdf8e5da475c8ee6b44b00e775

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\21999

Filesize
10KB

MD5
1440af0115fcf2a728535ff99d74e278

SHA1
1bc797db9cddce61126bde36b3f7d539053838ba

SHA256
8d14fec7f6457058ebaa36ac0d8c130cf6fd8d723f4399b104c5e774c2fac0b1

SHA512
0c3e92e01714d0ec66f83799626722110772abaf044c597cd92f7e894d61fbb3a327fa74736a8330d48fa8432b3a4cc9edb35c90551957baab8a6fc601e6492d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\2213

Filesize
8KB

MD5
e2b8b3cb925353fc85050941c7fae09c

SHA1
86d151a4f6cf7fb40185bee9a506b50640070c10

SHA256
288e90b01b8dc1b11425f272c6e0611403b1f9e3b3be1bf3fc7d9cb2e28c19b3

SHA512
0fbe8a049c9f60daa2cf0fb7a82ff3a278d824850d76fcaf8b15a7bbbe3e3f5eac93e3e77f01f61adbb5a43c720f083719c261540e9a7deb820f8306d87ae33b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\22726

Filesize
9KB

MD5
bee3507fa8f2f36bd1545cf24ac88f61

SHA1
8d866f06782470bf983b23a809c6ae8929d921ea

SHA256
eb59c0b7d2949aef1d1aacca28ae6fe898e62807a161c6f6074247f28648720b

SHA512
887564f06bbe2373dd2b498c138f934d3c62ade6726a12df5fa8fe5f48a4ed7bdc4c22fcb16dc988887e683c94e540122bce0d46e6994be9580a10230263a9b9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\22769

Filesize
7KB

MD5
d343c4ee300b6de30e149f0b929d3237

SHA1
f490f4e359d174f197a8bfd334702d6bbd79baeb

SHA256
1d0ddb827e34dfb6d2b248c79c95c7a96149173025d249b9ce471f1c81793cdd

SHA512
3f9723b4f680cc2fd8ef90fcc74a1922a9409ea5bc3c24b8a5e72e2084ba2cc0b02c73bfacbcf6e091636de437fbcb8f492e278b27bcd5ba7c64a4ba0c56c97d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\22894

Filesize
9KB

MD5
2db40f14bbb1167073f6adf8d5209f96

SHA1
e66bae0d1d704e499cb81aa3baca8395b23f69eb

SHA256
d8585310994508de0f68f2d8cf3eed5be89429659b98ea9ffa5f9ab2e3013a60

SHA512
2ffe5528b9bdc8380a75147fb7e8114882fe07a1f804df63b3757ffdb875265f472207465dba46b86dd4fe819c613f3c7137468de84d77bab074f944d07d4cee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\23217

Filesize
6KB

MD5
d7425d0eff4e62f7d127199e030c1006

SHA1
738b2c4cc43681ffa842f9d07a68edd480ec699d

SHA256
9d902ad8cb614112a4124ee356bcd0cb088af5d21fdf7c0391954efb575f5a88

SHA512
3cb050f1649ecc3a47551d6044ddfacaa4b5f1246621bc720a73af3d83d8240c7dbe70c5810974abc90760d699d325149cfa45913a34feb918ac516f113e3fed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\23269

Filesize
9KB

MD5
1f1d9c075dfa59d04bb1cb57b9e177e3

SHA1
e9f2d0efdfa00092fe994d78b014e6219dbd760c

SHA256
1a09d1212f0bc50b9b5aab73567f57f079b282f411fcf615700b428131f7f81f

SHA512
89fd3669a4d26d0450a3ce1685e0512859c9795781d451f07db54be4f966de767d32b7fa713a1ebb05722afd5360588636bc0e0460dfdd262ba514f69e1e71de

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\23455

Filesize
7KB

MD5
6625f6d57311a79d34ae6a11ea77f4fa

SHA1
e0e8daf770f12b2d6b97a69055f380f5dd65904e

SHA256
2143e44c7c0f3e53821247ab20020e47a08e0048fd9bc671b337d9f668c48b20

SHA512
c00bcc577cb3dcf1d3ba9339162e0a405305732262cf903ecf1a360fd604739db6d62427e3a58439440ab0bee2f595085c1aacd0cb0e77711486b99c13f7086f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\23902

Filesize
8KB

MD5
c298c957a8c646673dc6dadde1383ee2

SHA1
b102cf1f4b86a9d9b1504d48b07c73446429b729

SHA256
1f0a0698e637def6ddf2870472d4e52e6d1249ada304c9cfb532cd3828c6f3da

SHA512
e975335dafe2fd831a4ef1fa91d671a044d7e4fe716b850330ec9066e880c6f2b03233642eff9dcc1eaf467d242a705e492dbb635341bbec1fdac02069479877

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\23953

Filesize
14KB

MD5
027dcba996e7141da1875cbe6683b5ca

SHA1
f5157c16aa8917cc0ecc62e44d1bc58ad77ee48f

SHA256
717bbea4af5b93ec7c87026a0d93ceb4eff777d7235a7822f29d4e20bb3697ef

SHA512
d8ec4c9018de39c872e9dc04a03c07b15ba2076838d3fbb47ccdf5eea86486c8986318c22bc64cac9290137ca5b77b495d1abcddfacc5dcc8e2b302dad829840

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24155

Filesize
8KB

MD5
18c26cf9622a1ca7a02053d8b52e4a2e

SHA1
67eb126919999fb7858acbd229205bc163cb6dc0

SHA256
eebf4883abf89bf15ac60f7b574c336d0834b3585b33f909135afacc65ab818c

SHA512
cb063f519576f6df475aee571bad698366eff512155c46e0537488f17f075c067da67748b5e2d1080fb96ee6d4a93d87aac304a4d1970d4bb362fa9ecbd20a41

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24194

Filesize
21KB

MD5
f0b400bf11ead402488a10213f2f8906

SHA1
812032c46ee1b71b6c8535bc40e87741695c6c28

SHA256
17f3fa0ca103c19c841765b90367f70f19de40c26a871ab310b42dd6d4027a00

SHA512
d08daff357fc4c2794b3f916ceee17850d8faf954c43670a1f6fdc6ab54be8fd6f520479c58354bee6e2cf5bdbfb92a7fc32b1a7b79b6ffe26a1af109a04367c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24286

Filesize
9KB

MD5
c85631d210982130e37794aef7dc0dae

SHA1
7baf2f4a3ca125c45c470bae6f6315a6b612d8d0

SHA256
e1c8a47164d59e0637a023bd6dacd14aeffa81ecc67ef18980e97ac51c533841

SHA512
28dcf27b52427dfd20b83da733d4719886817acad071b8e617286232ca7791ff4dccec0e43aaf83f278990d31625f4b90c9ab2162fb5f6f4b6d6f902b84eeca8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24320

Filesize
9KB

MD5
c3b9d2815827acae6c4430fff4e77d96

SHA1
087c17b3dcf17a5b1e96f41b5ad6f21614e6670a

SHA256
1f83f881e587e5faecfb1ad7902d582ba80ce7f2eadb60228d603349fe7961a3

SHA512
235fb7265eeac1558cbd68fe27a86ffeb742325652370384629ee8c95287658093edb7ca709789e66bcc4bb7ed728299cfa790ad6e9659f3f70b08a36e9d3acb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24340

Filesize
9KB

MD5
8569e69122f49c08b8e230eb1273be5b

SHA1
85f21e9742d179ff075e4becad904faf6c9d3a44

SHA256
9dc8d1e67bf505d9265988f5e22b778f36e54aaddf812223c730f30b5b4baab4

SHA512
519023462b4e37fc68958d7cb063a236f19947e4461e1820d9c795a1bfe7eda2ed7b558ddd768a063ef0e4a21b53acffc223ed46986a5b763950d513fa249e44

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24575

Filesize
10KB

MD5
5aac79cd2525138c809e002bfe2c3421

SHA1
28eb751404328d906a877686d9106cc092add5f2

SHA256
755ce4e05775d9fea38550d62a2618a885f67bb592accac5dc0b85a93f510397

SHA512
77029c09c56541acc0a4bd761f48c20026c5da5860dfd98df3355bcc167d2a489f4ff818579bc7ea9d10022e7abe8718d3ed6d695e3cc407af156c01de766bc3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24705

Filesize
21KB

MD5
4324d7303655559f2fb264589c4cc14f

SHA1
38e36e7a1a1f0cce2ebb03fd0b0bde37862b8645

SHA256
5d55b23b3243322b1966e8ee3778236c0a5ba2e206db59a1477b7d5300a60550

SHA512
4ee13da1316231526285886c77d80c776e5cf8824276fed40b9f5c7c38fc88bd924c4064decf16c4b64d8ac33120bf57df6ed755a2765b876af2ced11052452f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24752

Filesize
7KB

MD5
652ac38d19c053c93e835a6c91e893dd

SHA1
5d85d6a4675e0fa9d0631b1a7348968a5716a6da

SHA256
39d3c6f28e1480f34bd5e9957f4cbb6d6362bf5dbe46c2201031b4270d6dd2f6

SHA512
c56533e509b14ae9b6458a93ff3b3afe7500b370ba05930089d0a20577c99c717fc7a329b664f5ce62c3f9629f73fb65a29f06913792b0992bf35b194c08c791

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24789

Filesize
8KB

MD5
881a92a0e537f4ba7f79d6061bdbc582

SHA1
a7146645a745b914dba1d5047ac769e6f7f1dae7

SHA256
cbb535783420d4bd6946f8f8510d97ae97ded8b637b5e5aa4c886e4e62530ecf

SHA512
164abdedb269d148c0dfc222bc45b312db19eab6549fb64a2a5de5875ff60fc17d5d122e4c4c57d3c22427722fec548d07011ca13e34c0f99678deb5adb9edc5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24875

Filesize
8KB

MD5
6a7f28813a62d9a35f17a5162597f6c8

SHA1
da4517591aa1f12e6d4917462764220aff8288a9

SHA256
e785280806550a90ed2b61c341ba7ffa8d60bbd0111cea84e2a4b728471356e1

SHA512
0f680134899cd06ea3c9bb48d7ae8bef65078bee0b88435ce1895b3f444543960ec3a316367840ccfce52168651640c4a3bdb0bb0f71bf4593d6a61a7453c8c8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24893

Filesize
14KB

MD5
88c67ef5cc90dba37359c00f8b36d046

SHA1
6a4814e34a293f8594da0ab9cfa4d50b72cd4789

SHA256
e7011397b2d6590b7f37e42ba802e3968344147b7a7a224ee3389288bd0cc45d

SHA512
e7ad0f491ce747e0d5bf42634f944d65ddb91067d883e3966e41562b22e0c770d40e729c4c61f8488716ed9091f1459b06817394f3c467ed2ddc68783a59f6ac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\24929

Filesize
9KB

MD5
e3bacf9c167ba79efbc20ec1f48d7c33

SHA1
dbc7caaeef4bbdcf89fa42a66a6c6885565ad323

SHA256
fc57bda1406dce89ca558d830c7f66964388e0acfe2294892cd90d23c933214b

SHA512
62b3bc22ceb02b8848f72e22491e6260bf5336146efaf943e92f1df650bab16fd44ec4e5e9e277dbdb58100232ad310adda0604c7d129f5da389cf8ef0564466

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\25565

Filesize
7KB

MD5
4f4fbe511a30c233595b35a13ba010a4

SHA1
18d68ac05639bb6661db4992534f4b082b56fb55

SHA256
bb43cfe06518cbe07c8f725b511ffb7608f49e3a95864a9f3ec798bc0e595588

SHA512
b6c3fe3d6b40373ee727fbe7abd07f9857282b347513ed631a5d1f35a02e84ca38ab3e4361467b143e1b5aaa231d1fb9943f12e327d8a3077ced59a25376a0c1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\25679

Filesize
7KB

MD5
4ff5013e6e0bb6004993ae3e7a69b15e

SHA1
ff6c19c59708e36f4e33ffc91fbbb08b2849fc2d

SHA256
6be2f9a0023cb99da4514fd6980d3a79b6f87021dfa9cca1aaeaa211a8f5e153

SHA512
a853086f3dafa02d21fc083461c3d9ac652d2ca16c5649462d15f410aacb6498976b2226fbfd96b49d22ddc9ed2029be9b6ca86d68d0c2cef0d5f9f91c674e3e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\25850

Filesize
11KB

MD5
f229a849f6846f0f2bb9920541aa514d

SHA1
7afd10815d5c762bd3e29826b14b7336efbba337

SHA256
75f3dd633c28a9e73e192389c8dda5c84eea46e9b6b7bc37ee094d19a47afae3

SHA512
746014c6f0ad336006d20a98979d8041fbdb7821c70fe8cd486c62c0a06601efa7a6d5387817e2573ab14b007795695dacdb238e653101a915e2f4aca8673404

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\26007

Filesize
7KB

MD5
0b87c7d03704c98d45f64c8e9ebffc2f

SHA1
3c2dd03e5cda828b82a54cb6d7fdbc146cf674a8

SHA256
4c43e73ad3805dd0f2b814500ea62dfa67864ef43d572424d7ef4717f5b85458

SHA512
c970c3c7c7b3ba71709b05f9386fac2d871051202ba5d928b51f62cbebece5f179c0a1b3115c5fce49bf705f5c3d66b3fa3d6122e28d1ac7f4884c09c3237320

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\26122

Filesize
9KB

MD5
a7249a503bc475d2d67e578e7cdca5c1

SHA1
d4a24550d681cb6787757d23cbfc40a1ea2177f6

SHA256
20482aebc1e87f8022f39125d236a698fcfbc12597723c98d53428bec43db117

SHA512
e9af67c42330eeaf95e26efc63b0d481929227a5c74aa860c0fbcfd0d2003529e2041713c7de06d51059674df2ca8f89f34ec2af623f5527c2db930574023bcf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\26292

Filesize
9KB

MD5
6222ed6453b34f7affa7717f7f05c0de

SHA1
afd82ccdc85dad22868926865897e8e442b35075

SHA256
e7e97ebe76bebbd7fd36fb1aa5e4956485ee3b26ba336633df4d2823eac15c97

SHA512
2e42a833b7f74162e8e5c79b8ce8fdba24de17d33ca753fd7588f669337222e8d06cec48824499b6bb495115ce32353aad97819e78a71c34eeea65f4d8890d41

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\2643

Filesize
26KB

MD5
5acba0b860a0a3530a1ecbdf5198df25

SHA1
23dbc6976c164c1b530e75eced152fc2c3235d84

SHA256
869fa5d28d3c9678636d3b882ca8ff4c60b2deac5ff9ff39d67f44694863df3f

SHA512
3616ad4cf34eb069defcf4dbed82a3fa843007bb148ae91f973f94f6707e9d30d83e111f8ad12272ed2e1c161c39efce528222ae04a7f207011a7f58d2be4931

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\26489

Filesize
8KB

MD5
7d8b851996855f251c286c46527fcb38

SHA1
b42e3ed8b5ff1b3d1309c780d64d5cc77136e0fe

SHA256
49d4f2d186f3c0065930c5a065463227186a4be428731cc0dfc9c059e0390deb

SHA512
f59f9e74a93610e17884befc56079d77566e7258cc8320ee075bd0bb8d1d27dacf647d2f1067cad03ad20134a034ec76cb8d01b423f4718ad4a96e924b23c1b6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\26575

Filesize
8KB

MD5
c06280cde4eecfcc2b93e96b17d728b3

SHA1
78749ffcd58a59f59413f38907944ab94cee3770

SHA256
086ee396c0a2385f96aa696ee98c1d87e2470f61a064d167c1803a226b17866f

SHA512
5d3c820d7fa035e905e6420b39a2a7a258ed710fc40e854eac4e7bb1aa355be079d30f15400a372b7a6b08e8382b356af6b6de3a928c7e2602c6635add885b86

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\2696

Filesize
7KB

MD5
306dd7f10721cde38b5ce442e6a97e83

SHA1
3402a941fbe40de10d81f28de758a82144056090

SHA256
9a41ad7da99e2398622dcddc2c7cd77ee00a940d4eabfa5bcb79eb5ab01c21df

SHA512
d4ff23c618b73a25319caae5da28504ee11daab8dc6a4d613960173e9e7b1f76deabcbec9a59bec198650f091f5045f2e1f0cd97e490c0c32ff34eb0b183dfd2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\27077

Filesize
14KB

MD5
71d8522f804a92ed7d518fec6a473bb9

SHA1
b8376a58743c37ef7d9a6576e9e79ffb5ac6a81f

SHA256
7173de3ebe11670f914cc622b43bdaf920cd64d2f2b3faab941a342087b68cd8

SHA512
107c3dd249cdaaf870fe21299b591c7583874e002383f4e022993217892ec263769ebc13253ee4e78f036160f9795e1a13294b458b716fc61bc4cefed3b806fa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\27156

Filesize
7KB

MD5
951c8665dfdf236fbfc960adea05ae15

SHA1
2fd53bfebc0ae6629a4d92fe96686341f7a3e182

SHA256
40f0165658185a335894b3c995f52049f6831484d2319a7c6ad3526dc52c2068

SHA512
f7e6120a0b98133e0c0437210d484dc88ca2a4765eb4b9e2128558290d2211030082f23afe024c4fbe55239e5f43ad460b3e75a7eae68dbdc54aa8a7b73a9e1f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\27480

Filesize
9KB

MD5
2684a5545ea1b3a24fecdbabc777b7ad

SHA1
58e774b22da4591bd45334a5b2d62d1d2990842b

SHA256
8b2b2ea1e130aaf0a9bb3e7b69ad0adcb35b3a458a1479ee9ad9cfa05e7dc1d5

SHA512
68c6e705a2c3aa9f9a4bfb4747326c8f17afa5f60eaacaf4bbf80b8c68d70ebaf7060515fa84c1f722b5b9662a2bfedbda2bb050b29a8a3d8d28cf195e8bb176

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\27552

Filesize
9KB

MD5
71ceb0b3a8ac8705363036e271c6c400

SHA1
d07b24640307325b4912f48176175d4168980d93

SHA256
68ef983ac105393b3e015023bdfa625e9b5310d60e2c66385f1d9e1da3b70dce

SHA512
6f5b04e5b4c9ac7a3e86d306d1bd7d1ea6641ce0d5a809fcb1b6206bcfc685f08ea204314ff265d825ac5b032be91826bc1ba5735570ad3e65d4daee1c096310

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\27709

Filesize
9KB

MD5
e9a71708a9cfd52e530da5a68183023e

SHA1
d2f7feea631a8b5df68ea6c15a50066a6df1de6f

SHA256
67392c7fbab5f8c739e509dc8004efc4f9a5e97194d2b365f6ebd709dbe94cfb

SHA512
9129329e0b9371b355552e264834293a112ac78659eec7e5f5a037bda815f63ea04fe0cd774c43c6e5eb1ad4c9c8666b39fa00e13afb9b7173472060b8456d23

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\28094

Filesize
9KB

MD5
bf8a4997a274a0af78a807d7d80602fa

SHA1
6d5ab80a5b59696c5f664ab32387e499b95b0916

SHA256
68370d288a49db67efab1a98dfe3c1e8e470a90eed279b742a582d3a945adf5b

SHA512
299148cb3f4c315c859b61cd24339d6e494efb91094bcc9577275b2ac5f8d7c804ac74893fdac3592873b524997a3025f5ceb4b6415ae427d6da857ecf149630

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\28118

Filesize
12KB

MD5
9b715c54bbc99d157e77199211a9d52c

SHA1
9ad67fc37ac352cb1ab44aff91aa47d3b1264cb3

SHA256
732db0d7c34f8e730004bccd36974bd66dfd392291b09ec625a32d7f6b4fba8d

SHA512
b5a5ffe50cb103f158bc8de11d88bf966383f78983a33d2c8401b0e15346f96726ea1e12fef3a99d41f3183ef71fa6367564dd48060d2b33c3a0dff39d5640fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\2815

Filesize
8KB

MD5
4d25ea28c8edbda6b92c27b0df8ff49a

SHA1
4a7667652476d04954cc0d5ebe1f96e45d10ff94

SHA256
0a2255dad2b11eb28dc1ae1833724a0ceb263c87fed7a9e8905dd0594ba0973d

SHA512
d546cceb5c0540c4cb9133d5ea612f7220a2178aaff20d70916cd2d6f3d2dd4e4f89547bf48c5226e99136b9a2024068aad7ff8e6f655163b67d267ea5e9d368

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\2819

Filesize
7KB

MD5
120209d165affc7b198d4ef721f718c4

SHA1
b81342a00551ccef20a2749acdf09d5b508d562a

SHA256
b9207fd6fb1c552607c7950e24976762301105218dad7fecc26a16ac781477c8

SHA512
68609e43855cc123b5271d25d88504655142a9e85e360cb50b5477edee8269bb3de64468e3ed08a6166cf82fb5d518863a1cb1bc1ea7bb7742a3dff81a36278f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\28266

Filesize
7KB

MD5
d1d74610d143e89b87d6a50ad877613d

SHA1
20fcad215bf14373b806b6764320fb558fefc869

SHA256
789e487f9c809a7d4cef653cd988ff23faf8e64735b4536ae1664101cf9d1d32

SHA512
05f1820ea7c3e2c23b84033413ce6a69016a7ce2909678b5d956ac91fe818537c64a3476bacaf38d34acbb4d76fb7e72aaf8038a6b4c691996e141c24f6a88f9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\28325

Filesize
7KB

MD5
8549958ed7034d61e85097a9f45c3c31

SHA1
08b0617c869c14442f401b6f571f3cb704ddaf9a

SHA256
5561c0ac59d6a8e0a76bde5983a5ef30d0422315a79e0f449c5f1b39e471cf8c

SHA512
5e4cc05f015ae45fce3442219341f42f70b4fbc11e0fd94fc58df7f17fb917e64dd43c5d668208fa7b7ad38a37cab62d1325ed61fdba79e5f879469968c842db

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\28502

Filesize
8KB

MD5
222a33f8153a4c8a484c485b60c5c59b

SHA1
52a8c63169c65c9a55f6ee4f46eef80424ef9df3

SHA256
62c544bb69fc790100404332d399baff6faa2bc1dd73dde26eee3c0b843097f8

SHA512
f06a4e5d05cc6796d58653f08a43786abf6c213e1f13da50d8fd20e693f21f4616fd9dd1ccb0a90670ab87da65edc4671b7d78722b6cd89ebee10ccf17cbea00

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\28560

Filesize
21KB

MD5
a60aae872d90844250f0b590e7f4c02b

SHA1
1b996bbd3b2ac7b2099e90cad9d11ae7350755b4

SHA256
0a8e4151b9a3541779613c5d4faa58cbefee0de099857b02cea1dbf95e0adbdf

SHA512
3d88ce6ec414393d3d0b222447c7e3f0ad320ee8c5ac2f6425a6172afd966abdcc08a158d98c12078a219c17c611befc8cbb189281b537e5c202edfb969bd262

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\28627

Filesize
9KB

MD5
80ef99e5693d7f06ed4d5b182df15e0c

SHA1
302dda7623d27cd5083f19dbc2c7ade400c8e4f6

SHA256
0687037c2c387be098f5012b44f65e706a936b36aad3bb8b1bd9a17b4fb88f93

SHA512
5d1936d426b5f2ddf01a59d2e2297438c48bbb4c345d2a24bd046730d5d5c873bd442e120429ad408acd174fae7def720261c04ae63fa5a2c91a391b38a5c0b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\28891

Filesize
7KB

MD5
58b1a914cd87be8fdd1efb68741d48b5

SHA1
83229580f668847fedb7607d983d16382765b69e

SHA256
b7ac5a9c25f9b8135cd2fe6ef55f37ca6fded6bfea9fb3949d36d2139de7bcef

SHA512
47cb4de5efe72fa5acfc5ba14ad01b8fa7ce1c291f9579ce1af5d2ccda0365e37343acf2394f3345cd1c1fc757b02f7b7ca1badf5f693f633616c37c4e03adbc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\28951

Filesize
11KB

MD5
120eac76af0c7f9b1e0b24a7101ac2bb

SHA1
682b840f31e6b0f611ae8845d51f1615785b7774

SHA256
6ba201d2dc88e41eae1148abf7ca99653de599afe2cf1865ab79e0ba3577f442

SHA512
1f8e276f3b172596068a06b53ea7ac9e7a11ec2e6e224859916d336a3288cd449074269ceb852f6dc6290f3ffeab096b46cb2221ca2253414b8040ba56d4b794

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\29098

Filesize
8KB

MD5
3e0e5f981ef4e7430b3310eca721f5ab

SHA1
74ef1d96b1a35bc4bbab0a8194a94d9fd902fe5e

SHA256
2ab1ecdd64e1032332d4957c7646218afa1b794df8bc31c1914e959c243f4008

SHA512
4d9248777b1448e1c97b518ef6161e35cb541028b2550b3599b1f9c366680da315aba83278c16589bdf38715fd8bdec33e1326d8cdd8b8a43072a62669d5e0f6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\2924

Filesize
8KB

MD5
b81cf4a5f9e725c761be3c9c2bb6d662

SHA1
4d26383cc7a1ec20b085ffe9e3f9f77ff03a2b31

SHA256
43ba4979920486297a3b9c834d3d11f069381518923633f90185ba2b63db2fb6

SHA512
8d00190d4fc77be0c9bc7f2e1d03456d2d4903fe2dade17b3a0ef7ee079b8c9dc450bf31de73433f67484b94685109bbd8b4ce469e77dfbb077b7ea3ee32baa6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\29475

Filesize
9KB

MD5
eedefefae9df28030ab2573bf52bc25a

SHA1
ef2f57032144edd0205194af009e15af6fc5a559

SHA256
307613046450cb7c7ad3a4fe5973837573b1b0ead215c56582704c200e95b93c

SHA512
a2c9dd55db5e8a96787f39afdd1cd2506c9944696ae8f5a440a2a255c678e58f33f4cb415248e6f4c2212b939cca31fbccc0fcf656703a7707df1669630d4fc8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\2976

Filesize
8KB

MD5
5d61f8350f70c48dfc05105cc536b5f0

SHA1
dde74ed369daefb053fb7c0684202589a1c9c771

SHA256
4f0f2fd9869b5a639e365e5ba2f58eab3756f2223b08a3bcf96443879774ba2e

SHA512
c5fdf57d64765c7766f9b4f975694bab1d0e57a9c260716340445cb3073377aff1bd01c1ae66089eb30cf9f755b300ace7110a23555e3493da40739b8867050b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\29800

Filesize
9KB

MD5
89f2f6edfb938c574075c38c221a792a

SHA1
0ed16cc49bbc0478257264198a99defa4462fc54

SHA256
2ff05edd558f134b25c90d2c9142f2daeffa7f176bc93500af7c313bfd06d1b4

SHA512
5ae9aff7926a5b412f51218059763be970c49ca24632a3e3435dc02f87d7949a4eb570a4b3d0ccf3441ca05a3b66c21f9cdd92197ec6c6b04f20d0a3a1ba8363

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\30144

Filesize
8KB

MD5
da7058fbba6009868c0e51da1d8bb434

SHA1
2665f17f8f56d5f102b0453ae2b49b298f979496

SHA256
ac25bb6d5c2ab6bd6763383c405c4ce7f782816663c78f7d8f17d2062e22c382

SHA512
58844d950ce79398d473b4910b2e46c235755f1e5ae76c6a0cda3984f4b540f41be349f205c248d3fd7dc5c1f93f28678e4016bc9178d9ab1d8e19e0f9c66217

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\30249

Filesize
10KB

MD5
e8f6057d9fb915f11f435e2b224d637d

SHA1
d8da3eca1424b17eefe227ffa25fbf3774c566fa

SHA256
5ba8757345b97e0386624685f922353227f18fe832ae2949f8558c0219cd2dc3

SHA512
5d9e0b5cf98438789bcb7e2ff12b32689f6c9c7d5211221a3a18c80ee4b512d376f87cd3e71de3cdd2e431f7fbb189aef58771d23977992840ac981a01eacbbf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\30402

Filesize
8KB

MD5
201721b70c665d23cb9a7ae880088b30

SHA1
068ef6497a52dd66b30ac1a7736739c4913a77e0

SHA256
6dbba31c947dba743ff261054330740e00932d2c458b72d5e28b63140b336b01

SHA512
3b8b599ca22efa955f1008657f692205a002da9b235c2053ff603908380708a4701cfd95790f62db90b38104d6ef3149ec7f28cec1585a10463c4b0c69271dcf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\30510

Filesize
9KB

MD5
263be2d2692e63be941452a684e94c3e

SHA1
86b6a61ce36df56db018ad630b0d2f84bc6662c7

SHA256
754a5bb80c6144e970b1610aa8e8e101dd60dbed2a1e051aab83bb68d4128179

SHA512
a4c45e722e662cee353c1395d246c4ba4269bcd57065ca46c7ceeb00194b882dcf02bd3e43f06e3531699683911ce2bac8113155564badcdfc2374a0de8f361a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\30513

Filesize
9KB

MD5
fe15bb7211b15fdf121a48dadcb72841

SHA1
869f32254f9fc180a4fe104b482495ee950e6462

SHA256
54bff2a6bf87daeb9e1b74a7e7dfcd12cc434fc9fc56d52440feff9ac3d237e5

SHA512
8dfe82b7059f8c8265eae140936aa9ecc0e65a19a760e2c1d029f64b1a2ccfe31abc5d8bc5d7ad7baf1a472456da1d118017f36e633c8bb5f360911f6ca0d5b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\30524

Filesize
7KB

MD5
d7d51eba24560f428ecfc4f393d080db

SHA1
791ce95d02e8530dc4cca0e6cc42ca171b719385

SHA256
04d62cf5e7063a6ddff3f3029c5fc9206de7be3677f5467c3752746a3d7d651b

SHA512
5995e45c335307dc11a2062688ffef6f4a97083212b4311aaed8fa414fea4e5b86507e44b50dd5d68e1dd88a50a72c10196ba1b90a9d6cdc11fd447935332591

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\30638

Filesize
7KB

MD5
19c2a5badaa575599577e7fa379e3a1b

SHA1
2d8f8266791b71bff867670dee9421caf0ffee7c

SHA256
badac6f4c7a43ea5dc2f935c6ba0a7f34b7b3ecaea2236239e0a30bcf44b2190

SHA512
2871bda4667a269d61e838e47660c26394ab7a12f3ac90fac216af1c3031874bb6b237a7e639b9a69da2e2238376d7f58a293c928fde84d09b1244c6c722241b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\30709

Filesize
14KB

MD5
a53fa9ad41249e4e00814f0a4a15f4f5

SHA1
ff07df54ac3dace44ed70a56328548ee593e5c9a

SHA256
6214a8a6fb661526428ce1ebedcfbd965fe7f183aa1d9ee7fdbaa626951fb626

SHA512
a9a80b67ad4ae3633ddebac48fc8574342fa82e7ceff0959916d97089b0c02369acef6e406f4fc0ea67695cb350847b22378f38cc29ea472ce331eee41659e04

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\30994

Filesize
8KB

MD5
417106ae15b873ead7b8c761b7a32d51

SHA1
9ce308eb8a518a3fde1b34da60d7f1bdfe8db88a

SHA256
a574b424e034dfaecf2e90205d0fb51994bc0ec1f1f968f749d4ca3bccea7182

SHA512
f593a58f9d91af035bf58186265a81228707530909006b3e0a384e902b43616725b383e8e3e753313d08adcd0011a106b1e3fe5089f5b8a189eb0adb092312bf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\31320

Filesize
9KB

MD5
9a5feedb1162e20bdfccf107fe8651c8

SHA1
df9b36f672fab39a91f2f4a994c6dccb1827d34c

SHA256
93f2a5906a6566e0e390aaecdc8b9b15ea354617721f0d222b2eb3e23f66b3c8

SHA512
f13516df7a496b8d2e644e739104fbc40b8f70aea5dfd2c5cc4572402d56a6effa468b14fe7778f8385ea0d9365510761c60157fb80259c604c4baed284f7bb2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\31346

Filesize
9KB

MD5
a206738c2c4b8aa9ee2ada82ea92346c

SHA1
49aa2396e3597195362a9be5585819c942f2924e

SHA256
42971a214235c0b50cf132e8c7915140bcb2fe9e4dba25aeca24e975ff6674d6

SHA512
2dd95033e66313240a757f1465e16d2b5b4943a3c7609a052dbc73f5f7b002cdab0cb1cbe0b221a430fa031d5e6597814d2b42267a84abe154b1ac6d3020f1e7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\31423

Filesize
8KB

MD5
d6b2176cd96e0dd14bbce5aaca16b29d

SHA1
4d83596ff70d6956e3a4fe5291c5903c77d53225

SHA256
06fefb8ff62be83485e24e0242421ecf0096d94ec47f2c00e07faaf03d672ba1

SHA512
b2f53b2c4e9087b14391572b8f6f650d4690c12bda9c295f2ae5b8e6f0c96adc06a756d32c26d684277bb1f9597239eb2b35700fcb3e01be3a8247099a5ff85d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\31432

Filesize
8KB

MD5
d8cbadfc22645d3cc2418767ff5e3d9a

SHA1
cdce9aa7e27788c0ffeecbf3df9afed7842f39e8

SHA256
e09a85630c72e5a1101697bfd4353fa57f95b36e73a0a1ab06179fb2ed199464

SHA512
c05c98d34f5f9a313cc5a230a09da9be43504238d1b504ed270af162acaa81915ba263f5cc2b46e3a903fbd8e06c159f31574db5b00ad679eb59fc4c5d92bfa8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\31645

Filesize
9KB

MD5
053a39d8062ede11534a820b1fe72175

SHA1
6573a6b58bf063f7eebd02fa4626f9ab22e0a6a8

SHA256
5cf0058d0ab9bf043a854170cb0754282eec74103e83a0cd0c5168c034f15eda

SHA512
c61f5bef91b95e208c753a52c8e2463803aaf85f8e542f03a8fd18c4bc04e1194801b2b0362492aa53c120b19f5bc4ca25a2068f59186174def6faf6cc2ca193

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\31827

Filesize
9KB

MD5
9d48b7815a751befcc08d0298d598e71

SHA1
59be6e248f095d99a0471d05981f8c6f1b1c6a37

SHA256
62400a5b6059982e7b7b30ff72fbbdfadf330d7345ca8be49e146315bb8c76ca

SHA512
c4844f9fa955c41cf1c2c762d32739a7e5a52dfe74bed0ea62cd8bed7985dbe0025c6a826a09d552ac726da478f7d1cf5777fa51c59b39d07cd1a7d70a2bf046

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\31881

Filesize
9KB

MD5
7c4ec2dc385626bc8f33c0b2bef1a135

SHA1
2ed3bc8311c8fd858666d352827b12e6c0415666

SHA256
a2d56c75ce27d3786d98241760a24beddc014399e27189923fee02204f563800

SHA512
17bf2ed5f31660fc331df7422b6f9769b67488b371685a53548c010b1b3b31cd9229d4a45744d0eab0fcb29908ca1d42e8eae8c332ea6d4c00bee447fdab13cb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\31943

Filesize
8KB

MD5
6feb4ef5a9df347524e9f00bfe0485a8

SHA1
8c0fc81986764751b31f2b92a0217f8c2edad1d3

SHA256
b685852bb8b5e5d242e411d8523037782020c79a086c9cbe1e8c457223468517

SHA512
d075af41da66cb9d513bac221b3fd2e17cfb1b71dc63492d6cb28eb34475330d0b56f4bbfd25ef720dfe3fc0d326b7c368343acd71dd7b7b40f07975655b5b38

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\32013

Filesize
14KB

MD5
80df266cb4df20185d3843f51f01dcf4

SHA1
f0855e65a8c4a2b2d149c7d0636838cf8c44843d

SHA256
d68883feaf147f53f587cc8c288913d04dc06a5dbb4aeee33130cd4ca2011753

SHA512
4c526b0f15cb63331434c187f6682429a30e016c870bcb7461573b1bd1ac6360b984ccca6fa63ce39c7cb5916cae95c6b2fb7cf42bdb950529eafefdd20aae38

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\32381

Filesize
9KB

MD5
a3d85d52934fe9ea3a652b5c8bafe547

SHA1
ca550759a27e9556ce3f62b8735a7e206449f0d3

SHA256
c19b4c4bf16d01d84d1b0123f8961218187b55d601b696b36d7d63b4f5e5b1dc

SHA512
e06673ad7bf64af3c2a906ab872d6620257f27f7162fb3efb676427581419e1e201c06ebe22b60afdbc870ef2365785951e7b4c8eff9179d1a30027212bda7c1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\32471

Filesize
7KB

MD5
c295e41f7aa7bafdeb93904ffb17319a

SHA1
7af2895d5a27a2fba4c52f6dbf88ad9a37b8819b

SHA256
4a95c674c982c0e91f9f760827c63f926bfcfcb0c3d506e5a822f0d58f8e5c23

SHA512
aeda1e9bdd5dc372b454a2031fb050ea7305310162ea6e6325a043ba3e37a2a82896ea5cdb75d00cb8badb5afc59119b57f3628481bb06b222b97872723611fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\32541

Filesize
8KB

MD5
a7255ad5e09931b49975fe52ace1d32a

SHA1
e9bf528e7a3d888039bb719e73bc800e3d38d4a9

SHA256
08e6d5075399615b73b42e5d2fe64df997cdc130399ebb606538cf72628189e9

SHA512
a1f0ffc645fc5a8b24a4f0585238e4165b4237c485056f6c65b9651993489910a9210b21bf4c38ae1cb26a0f783977824af3ac60d2229865bf32649e2203034a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\32576

Filesize
7KB

MD5
f6ca25df1ee38178b414fcc048975345

SHA1
4d4d59108f526e096473dbbce171b58fc3e60d80

SHA256
ed9138a7f9298ac4fcf43bbaa54cf118102a7e9ecdf6ba4c85dd978b68e685da

SHA512
3e389077a76fc259ee25fafc6d9073daef5905aba20bd39840eea33b86f309774eb1e798af1dd8e512b504d57100fc02044a329da7c245f41357d59c7076c753

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\3268

Filesize
9KB

MD5
03e64bc4207376280a54108a8928bc43

SHA1
8b0e176ad4798a18786f9e555ccdaede45c2a2a5

SHA256
a01d72e5bc82f1a872890d2b513426248ad684d1168ba698c5348294de482f35

SHA512
34fce847f16fce49dd8baf5b84934cf87c6cf719b27db6cb6c8613c187d83a54cbecbbfc64457e94439df823bb349186d1c0dbe7484190277396043534e0ee0f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\32717

Filesize
9KB

MD5
4059a0daf2787b0f8d60c2c34ba9557b

SHA1
d931c6cd85e8fb6bfb93e0ee1cddbf5c06b7e7e0

SHA256
2f208554b6536a88550027a9b2d6ac874edc1edbb7def7aca9d06857e73382dc

SHA512
74b4df7e9d21b289edc3e53509d53eabe72f288f14529fb76e06d1f491911ec6a6456f271a7d30fca6d575fb889c8e0ed81a86588a8415a914fa1ec760b38857

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\34

Filesize
8KB

MD5
ae30ae1e208976597402e782f3128864

SHA1
726b076005e88be20cb214dcdf90fc5ca956a7e7

SHA256
8c486a62f764dfc21e0a039da315f53b5e9024bb8ab935523ab2eda771b5e647

SHA512
d99fc891111a9bab99ebf22a953446f42841b28e30e79b3d8d17d62b5f730a1b530f59debe76944066bd27682751c00177009ed1715455ce9c096e0b886447b5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\3624

Filesize
7KB

MD5
ad4d27a41b80f14aa4e3cfa2fc95c228

SHA1
50811d060be2144fd5fdc0649701f6c53acf2bda

SHA256
c270cf5ff095690e925e9060b22441f3f8ecc4ae4b1aeded8caaba69ad8d3474

SHA512
139be44405dc7eb1121dbedc5a579650bd685d06aa5a3e8be031a975bf17222f77acce2f29ff44ca64c9e25cf2f7c8db32dfec4408cb6729fdfa86f7042ba5f4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\3644

Filesize
7KB

MD5
bd4c44a51235ce41f5d16fecc86358eb

SHA1
c5a0298a5c5e0525ad90fddb29465ba023b2a99a

SHA256
89f255ca3e91e07cb2df767b5526455a6e9fb26caee3ed82590ec5e12d91500e

SHA512
b3160068fb8ae6f757d822285eee1a2d83b3c1aefbafbddbea2b84768a2b601be7e3ebaa7bb1e664259fd9fb70a4ec158cd0c4c08e175aaef441e10aa4fc58bb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\3984

Filesize
8KB

MD5
d89593db86767104ed10d12b702e2b48

SHA1
cec2e0a4a094d776744dcfa3d6c31d6fbc479f16

SHA256
34137af8b95cb88572871412a65fc94a03bf9d9a39ac6428c1bda2ca5bc11e82

SHA512
d7d553ab44d84168ff7d3cf5fd9c0b6052605fa85444a0b9ba35ca159ff06318e2d51b84404a9536035bf7800cb02aab56a165d71aac9700f85fa9f0deff8eea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\4273

Filesize
9KB

MD5
1781e51af88c4867a6672f8ef207da4c

SHA1
614695705208bb8cd79d16174daa1e3f2f51294a

SHA256
79529f2e4e88f8ee16cc699de1434d9e694ad2e3748170168a8c6168452a3502

SHA512
7bfda52748c05e34384d0ab4aec4b168d8d7c24cf5261da71d18d563bea847e8c8509b413a532a6f34747e4bce5d188cd56630e6ae3d8a7076040b32ba67259a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\4348

Filesize
9KB

MD5
3ef33d559d072970083444d4cbd16b25

SHA1
d46c568a8c5dfde21f5b5f2c19c674470ee8d275

SHA256
3f901eac3b5d725afd7e0331dc08fc87a2a7de9c69f1c68bf190bd1ec9300370

SHA512
21d9a811633238c98a5621134e2e6422063d4962b25b2c7e14f1fc031010d42f3c2e7767ef76c53fa436a07d7e9c979035f60faa1ff2054eb982a77bb6e4a433

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\4645

Filesize
9KB

MD5
bd6faf774e6540a0a505ca95e284098b

SHA1
b075b33253ac911fab3146fdc735fc17c733609d

SHA256
abcc988edcff65b31267df76dd79fd4fb117547128880b5d5d3506afbdf13418

SHA512
467391d2785ac329cdacb7d1ddbe2afdcf2224bffd983fcba6fd14d876ab553e7d3e6b1f0e1cb0cbe5e52c675f600c8d0008451cb894365e1bb1f2e0e6b7858e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\4805

Filesize
8KB

MD5
72af2cc8aa87aec2a3aa163ee8827dd6

SHA1
1d11895f7ce80f30b1fabab87a874f95025868d5

SHA256
0ed20918a9b0114e9bf90d4becec86a6899d584901b4bf100477e90aebfb0574

SHA512
7d161684954fa6f6e531f54b5ad004490a704435964f2dfeb291dee17042cee9f9f308c70af6e9cdc53269cb374994752c3e1b823149ca189ffda756e20954d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\4971

Filesize
9KB

MD5
7afc2334a0f0bd13f71b7aaae6a0a807

SHA1
6628b3e19ed9f32c038f68404a65440b1f80c989

SHA256
59755676356397c42db525811a271884ef9b74962d908e26835e5a5c08a91d98

SHA512
3c3a316f565a178caad295ed65d6f427a07fd6d94569fd36837abe1dc4eb49ba77a30abebc4632ff28fb48379c6d43ec506df67be7471a9100391e7bd72e5f8f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\5206

Filesize
9KB

MD5
692417ef7709d36f26f21b235c12f1e1

SHA1
df00884539726226a3cd59de5bda39c271c88d70

SHA256
f92b79939a923ab6a62b5f3fd83971202de84e97b08fb83f2905b1b6951012e1

SHA512
99bd769b57308617dce47e26711db94a19d8ac85bc4a2bc354101fafdace71736783d1e5fa28f8245bb7d0e462bd6ff7c5c8d8864b1285df65ccea18e6da1d99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\5336

Filesize
28KB

MD5
02aebbd21077625c702558b8643e4c0b

SHA1
93838c2ecb99f97ddd6ffa769d93f321a8dae7c6

SHA256
c74c83cc521311488faeb53b676940c58ec5553a2a337b4de7032c2400764a81

SHA512
975ebb2a5bf3416f7f22ad81f8abc520bc71e37290c462f1fadcb7fe0a5db8543d338a606205e39022be07789daa5bc9708ca87dd0a0d35c722ade98b90e1217

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\586

Filesize
11KB

MD5
9363d40abdca540236077796d4b3918c

SHA1
54dcac36edb8fc6e73a2d854849b3367c1677e59

SHA256
d3b2bc35ec69c46a6e1b55a9cf75bc76574fac32c8219342951ab6412af1df09

SHA512
8841ef40c4cbed7b72c94c52362ac5f99068d8a8c30d6734966b060d581b63f8decd98a961ad4c872bb0952f274c21281ee1f6ab844acc4661eb4c9b4e9fd310

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\5860

Filesize
26KB

MD5
3e5b1ffe05809de550ea08c5824da53b

SHA1
09e9a3ec1c91afc2502b2316def85ed2b41f21be

SHA256
5a43ce31ba261b441f0f6fc1f30929160b2afa5286771ba5dc23e649396cc3f2

SHA512
38538aa79f66d6e8677c741172ee7054a995a6f27ef2cbb169e61de3789416123caf8e283667fa4040f35cc101f92f58b700de58c377ad73854d3da3eae356c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\6080

Filesize
9KB

MD5
62adbed9382e8fa66bb2b0aebba05bae

SHA1
7d3501f0a96f9f56841369ce25dc06e645d12001

SHA256
5af01205017e9deb81c2fb49f4c99e07ca5316c398545785ba47fc00f2ebdefc

SHA512
89f2fbb66bbabe680b42524448596ace92f90037811a7b7614d03bd7315e34ad276a04dea81e55fbf1a650ddb5ee990be2357d9f4f8956012dc81e47b936a33e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\6151

Filesize
9KB

MD5
4b8c501fc81bafa77855e31ff9e532ae

SHA1
7e59f251c3e8d404a75213e71fea772c38ced58b

SHA256
872258ed9630706e910d0ba3fcda27bd7d1bfba074a8ca643131b842b000cfa5

SHA512
762f5a855efce2f5788e37b5c1b05fb29d364394757c0d276b2277b85c5fb8e2a7a7ae90048f23ae1f0955456b637310c4116c8c84cd5477a7fa2f58ba048c3c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\66

Filesize
8KB

MD5
35df43cb6f1a162d2e732a30ffa50669

SHA1
450baa0134cdbbf6d3c20e2f28c691612adea0e8

SHA256
c443e3badbba43b8779ecee0ca9d849c3dd7fcfd9d09bc4b591236e039fb284a

SHA512
b8f0aa6fd9bc9dad958c51f8065da1336a42e7d21f6c1376816d92834dff5665c21124754e5d14b96b015cd3af1d00f8c2613d048d1eee1993def191d085a2fc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\6676

Filesize
8KB

MD5
ba5ddc737d7b02c3a7b91b0852fdc271

SHA1
c37abbd21f9af6a6b33e5bb9b65ae88a85cb0d29

SHA256
6c1238336828eefaeb2467daf2cb75a2b2108c5a6fa70458aaea9491d5df11c1

SHA512
24756f88f4dad9a48b45617143e7734f027ccc519199c8d14e36bda238a51a77e26e6c08f4ba8949cd0dd4733cc8efaf2f327f394d5ceef57097ceb46957c61c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\7015

Filesize
8KB

MD5
169edbef9bdc1ae0135dff2878a1664b

SHA1
3682949c1f7d358aca7e50523e4e330e554e5a13

SHA256
63ec16e27835fe16973172d733ea8683a586814e4d3fa6e31eefa9fbb30bd96a

SHA512
9196722cc61204709afe643bf999efe94c606fadcc26ec5978a8908c1f7caa18d0b4d5d8c25c85037f9969a06ad6189d4f4997c15c64a0dc6e6a6673c347b897

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\706

Filesize
9KB

MD5
bc30b884de7540d6e5449385ebf2a477

SHA1
7684e5124bc37c21a4a82490faa595ea2873e108

SHA256
10598eb6dd0182f377219b35177a17f5956f6bd1058e8c14abc7c9be73fd3612

SHA512
1074b187e2f70e957e3b05157e71ee67826fa6cedc6b56e46bb641ce58530875587c701c5dc0611b445bb870b9f62189b7ed10c71824e8ab4a41cdeeb8e5b134

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\7958

Filesize
9KB

MD5
4d034680b06db5d9660963bd49938b5a

SHA1
bcc33957a896c84188645eb1f4b97d6f1a95025a

SHA256
6d0ff807fec0729dcb319a5b09ee9e1b76e4e13b8cfbae9d94d26df27f70b469

SHA512
b88b13e6e5904e0a5e9fd25b69101534528e90fcaf973685f7bdbf732f723efe8b1bc5fbd4d0f44b04e655d4882ac681114dcf279d6d52e7564ac47782198dc2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\8359

Filesize
9KB

MD5
9c71277b3e446dd46f5a403fe1ca74c0

SHA1
7d428e35cc01cb4e9719c3cc8909c77c78d05b9b

SHA256
1fdacfbf6844dc01155f8971e4acd55da5241dddaabe347ecdbbd0825f96c5ee

SHA512
eb7ca6378106436fa71d57faff34b695f420b0e8f57761c967798d8b6a2d83d2fb3e53379de914c6b053304c68bdc5c480a5e585146609d9540317e1c03e4352

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\8593

Filesize
9KB

MD5
ce69800ad63457662c84a0716bc9876b

SHA1
2620a6cfb55c943afe5e4cd17d5668cd329a1329

SHA256
018c8218e93f0e51d31618eade63b021e08cec30c096acb4bcb628bcb3047d2f

SHA512
6c0b11d3485d500c8758718fc805c2fb6349d575603c16c350f7a27b4e45519d7685aeca2f87afe3c154020829107eb3ce3a7da2888ceabd404751cee1c2b1e9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\8693

Filesize
6KB

MD5
48ecb56ceb1cbef5942f6fc21d713b1b

SHA1
6b505a1c5cf41618d08a348c98699b413ba3b56f

SHA256
e4e667917cbf255980c9845866030212631c0b75fac150434e81e6922bbd7574

SHA512
23718a1f1c8964f18d4fdb984399c070784bdd22c1055dc3af5a0cab4bdabec105321445fe85db9b9813675e0444a2dae8fbeb3462567694ca412b1cacddd700

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\8718

Filesize
8KB

MD5
f68cb9a9c2892631a595220a77838b78

SHA1
db0b38333896efda579cb1c8ec404fadcc612bba

SHA256
55f339718074d3159eb9953aa5b9aad851311160db19a0dbf21a8bfdee521dcb

SHA512
8b396900573eef463a983e6f8667f4ecc03cc30cb7201cf99700d0613caead3f097d2f1d517f4c2ca9664c431076cb710ddcb3fac6685816a294febcb2783e97

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\8789

Filesize
13KB

MD5
1405e2ecd8d81195b7d633fcd3b1a91b

SHA1
d3446db50739bc67ff62e5b173dbad81d42f8de0

SHA256
af7886c1ab02264f5ad1ca4f0c76c58cd584a3eae7a334656b137ee31c48598d

SHA512
b23450c6aa72e1ff3f9569aee69f8dc13ad2b6ea6f1f0c235eef322d2d3afefd9b8a48b43417071327f5b1c3e10e174c67e54f774e9dae08622fa2a04a3866a6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\9227

Filesize
8KB

MD5
79ef75fa8bba5434038aa2bfe66c5c28

SHA1
3cf3f1afb5e29d86eecb8bd0c7d56b7c4a36bfb8

SHA256
620773d3ab112a7cb237d92c26ddbcbe775979ce40936a510b4dfe07a02b9789

SHA512
da0c9dd3bef963de55702601de823553071be0a8c34f56b5a08f44cc9c33bf11ae6c1007c9acdf01333f8530b52b514b0d41ae7255fd1020a65f7c0194240334

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\9254

Filesize
7KB

MD5
2fc514dee48f026dc9c07ff654fc1a9b

SHA1
071e2ba771e0dc1a81ab3efc0102b2535eef03e0

SHA256
7219ac70c24afd4881b0d4ab3f50f0dc5bb698728c922427444a698211eb06b4

SHA512
6270375a4e8db0ac05a335fd1c44c874588d5f8ad13005245d8c7f5c9aa1a5b76b86f129701cd2e1c3ab0e8e6042caa3a75d94896b602622693f3e72e5b9fb77

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\9439

Filesize
9KB

MD5
543f3cac665eec97946338c814d7c579

SHA1
5e6e8d7f463b98ac1f1faf28c204b68f710d30a8

SHA256
7f97a2e8e4a1eecfc272a3ebc8a0523d499ec0c9232936079de22c9aa91f714a

SHA512
5f7a4210be67a7b8ab397bf7faed612e235ddb8757b02a80a047fe80a55790cd8e53e28328bedfbf6bb2f61e5e2ad6378c773906024c093a0f175b04601b82c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\9475

Filesize
11KB

MD5
417e8aaec649f4b5d0cac351c817ba58

SHA1
1e4d67aaa2adaf968089562262766da346f004d6

SHA256
d8517f5796fd6101f7dbdd172e1c0e70c02f7ed5f5efc7e10521f922d58e2319

SHA512
c150fa2f47d29b97f7457e4787430ddf761c80013838e0543a03253ff8d898958727bcc1c029c8badbe80bfa307f7b27c175a6c5c8702ddd99eb21d8d54548f0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\9582

Filesize
7KB

MD5
251f8c68560ea0aa857183460349ab37

SHA1
442f80a56587dd012439b3777a0e51cc7c416ca8

SHA256
d6e74197dbf1da8379be0806723a805f2256be518f3f6a21107806b56d81ad00

SHA512
eaffacc2c574d28b202cb3fbd65a5c8941d540208b8eb55327ae07968b099bbbbc0a47cd8231e7282090f3fd64820b0db9afaefaa41933fab4702da3c807ab93

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\9746

Filesize
10KB

MD5
dca40669ae9d9940f3e136aa6bf683d9

SHA1
5f10d2dc84c179f03819feade45eb1d80816c2cc

SHA256
739d999ac05569f85f0b8664ea44d915a6d643e23ad732f23ee35ae8c4f7ed30

SHA512
cd35a88c7690e64428ed24794ecf8c9107c1f948cf9ead93c7ef314c89fb6d22dbfb6febf8057b4cff2ad1ec87217876ac54fd2e5b9a0239b100f8084459e0c8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\978

Filesize
9KB

MD5
e9d8aedd783c5dbfc3f6798d943f6e48

SHA1
8fac2a0a247e11eecaecbdfa01a6270b783856c9

SHA256
b6aab86554a9f251611d0048f8995d022eda012dd06858be5fa446932852f83c

SHA512
20747c6abfd1dc63117eddd82885511fd4d57a07bf6856f448a3999a0b30e030a9d6c806e8e060ed9d19cfe5382cf2580b27af5be75d9661d6886eb40178f34c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\doomed\9907

Filesize
9KB

MD5
437032307ed631e093684f9d6af0e4c7

SHA1
77451dcd286d34fced6f2a1113d0603fe79d9515

SHA256
910e508c4de94114977eecc2b64b11c183a190c11d7c15acf890284189cd15b9

SHA512
749ff1a62e4301ebbfb38bd9965ef98dc8794db858e1101d73f667946ce0def33e93e164bd03f80bdf23922d78711ef1f4bf997e8ab9181a1cb15f78e2feaea4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\0328FDA239344066D8E2890161CD86AE97FE0DE1

Filesize
42KB

MD5
89c7bdf6f5f5659ef2c118f155909a6e

SHA1
9fefdf3de7dba2a284072011a4d4912866c352bc

SHA256
6bcf2ddce63f42db0d0bc0a19eb1230e6766d431f7a18f2cf3086148c838d84e

SHA512
29809eefa82496caacac008c84db4dba51ab9adadb24bc16de201dd1119ab26f1cb01e041a98eb6b75c41547718f6bbcfe0761e58be00b0d609d8028df1f46a4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\03917DE066844A0B95DCC41D32E066EA7277523E

Filesize
25KB

MD5
5eefed974c65eb787dd75f5f478a20e2

SHA1
4cbfeab405b85fef2de9cb61196bc81de7164428

SHA256
7b8ee3f3c0dec9a3c7b5a0ff4fd7515a1b749ff58d520a136380d703fd182fed

SHA512
b03e67dc566dc56d52818b5fb1f3eb96a7b4b648dcd1a975a79eaf4139259fd903362991274a906e90b40004f45b5905d4f504df14985be6491957e1d95608b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\085DCA12C4E5662F8913E60CE0D7B1AC7C9A34C7

Filesize
12KB

MD5
1cdb85c1b687271f01268725230f5753

SHA1
b99c79a654b33726225fd06b0734bfe0b38bc80e

SHA256
3e78364f632bfe977ce2ccb6adad36604cec2f3c79bbf811c7b5b733c5a97c41

SHA512
c57da0f696007efee9d5c7a02dacb6336245b32c20702371892f1110979cbc2b91dc066074f6bc1c3c5daf90c5b85989d9d228ce280012ef3e221a775869a700

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\086D431BCF4DA0D2AAFD163536FFE4E5DE5D6E66

Filesize
210KB

MD5
5bd97e4f1f09b0b6d9066bed7aaa3978

SHA1
a961da83af226e2e0934af834adf0fb084882feb

SHA256
17f671951d66a42a9f298297f48d3805f8e0d91e5d1bb0fcb07972493320c1e9

SHA512
3d2583f9ddc6c7127982410b0cce052185b140d9ed1c59ea9c2430ed1156841a028419cb3c391850c19beaa61ba97e5c4da76e7b35aa187a535c6d23ddb9f6b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\11C04DE57428944158D7945EF8ACD2A26D7193D1

Filesize
32KB

MD5
f44384b4d282eb7af617813cbd7af5b0

SHA1
6fe138c113b325ba5938b58cda13e591b64ca97d

SHA256
126a8d47c0345b2f5ccc4033302ecd8ae9c860f6b7818b79ccc6b3e11176ae14

SHA512
d21620c7d1c3f6d1516cac5cb12770011f1d4221cc19d6afdbd316c1692c05990791a2250407ea90c40fd96b6abfc1b93312946a95d416cf6f624fbb5531d6ca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\12E5E4870ED2F8D99CBE7991E6B7AE5B887D0540

Filesize
59KB

MD5
5600acc3977382db13c790a1ec78e0b2

SHA1
084d27f224b9c1c09a164fff08fa55e470ab14f3

SHA256
98babbf33f09b819d47e37901088db0f420c8ce8cf79150e81da1647bd4125ad

SHA512
1a3e2f6cfe4ec30138e5acbe871d0919862bd722c924eff2016cf767a9893bc34da5aea1598b8b660df3544a490b254240cf4c73a01ee3db81dfd770d3d4d1f1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\186BF01A4D2ED9970C022ADDD0312793CC6C5B37

Filesize
56KB

MD5
ecfc553aba74b2af18ec01d23461b7eb

SHA1
4ba850a6bd2d92fe749640afeb20116cdcce17ed

SHA256
b5e5a1c1d9b95de731bb58716b8d1e9a47c12fe411cd0e4d2d03f2408be01167

SHA512
87e75820f620bbbb1b31cc30317d930ba7fdff1130242ad5f7fb205e7dcf98be420eb30d0fef974945a6af7fedaddf2be43a274523ab52475cec9ac80db2b99d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\1B7CEBC687AE7B6BA930471F374D93ADF118730C

Filesize
15KB

MD5
c50a80c27a0ad53d738d2a25c5121a20

SHA1
cad4ecaaf2330400053715088ffb3713a8d1dc77

SHA256
1b5f14f4851bb64363505cca130a4cff5e7d6c76a9110fd71e4f8977d4648390

SHA512
45f4882fc556970fa486a3c1bf362dce7324b81af4005d4d37ae9882fd70c25a356620b12923067770aa39f6de9a37f924cbeb06e8e343ae04dc38479311a03e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\1C99E48115B19D7E3BF6659A82DB2A6A33B850CA

Filesize
116KB

MD5
050a62fc67ea587aed97b4289e798718

SHA1
cb375b9b96c7de035a45a4b03f024e850e25ddfe

SHA256
579be1f7a4d6d8d8271b42c36b3ac3f941b6b87373e6db636f9fbe56468be8fe

SHA512
f6ff053fbb4006d21bf3719a53fc7d9b18c363ad11eefa9472c8b06a627d072c446aa9fab1b403f3b37882ef5b2623014a9163fb87f670fb0ac438aa1140c157

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\25755E1915B380FA6FA1EB8420CFBEC6ED474AA3

Filesize
13KB

MD5
be7a9c8e014148d6f6e80c676f3ffdca

SHA1
9839092ea208456c578785bc81a00155edfb9f09

SHA256
8be403e90c313f1372e3bf00e765d3c6c19a29645229971aa563dc6e69ababd0

SHA512
a328dfa708e8dd5ef52a0d5522b416f8ec966cb98f6539cabb44e230edcbbc32308f45af418e56be2373e153c43938e610d13aa0ddb3f188e121f7e713cef9c1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\288B98D7346DF5DD3079D60756AFCA2EC6DEF87F

Filesize
31KB

MD5
ea4bfcd95303c0372a033f6c9fee815e

SHA1
fbb8d2e81c5aac77ca9397fd1e3e45b2c5ab7f47

SHA256
6095dae0c6533a69e395e85bde37b14ebee217ee5197458c439e078546398ee6

SHA512
205209f50f4c1f303c8b5e45af835a126f9228cae9d750526f259b16008942a2010573ecbdaa9d4083fc27843cac70a0c9214966c3bb0a2254e7922227886de5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\3466086799AF07879F518E0F9D3D8B2BDABEB019

Filesize
2.2MB

MD5
b7bbde4d2780d2136973525e13f14054

SHA1
d60b3f540d0e6b36a57cda27e3cddd29f1621907

SHA256
75b8146756b2f432b50a175d0b282cfb686d9c2ac8f9b637bf063e3aa3ee8c45

SHA512
32a39030813c8ea034c281778b8fd1b7d0ddef8be45e5bc3d29649412a8db1eebca6bac745565dd5f6705015ac3beae05710bb7678a0b51f1a046c2215bcfa1d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\35F269A26B2084FEE394E08AC37356844FA443CA

Filesize
259KB

MD5
6a1f7a1311acb1ab681fcdd85083048f

SHA1
085e65ec1cecc9066b626d4724cde95fed692f23

SHA256
48f1ec884891f916453ba832c98a0329fcf77a24d2932b15ee66f7bb66df2ad5

SHA512
c1ce0ca8fb5d867c67a217a9e412e8a21f891ab65bd20b76eff97f166813c1869dcdae064c06d7b8bed71a81bdbec141c7d58e18f9cc4b28199eb6ee474f9ac8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\3AC1EA83E41D2414650E2F57B66A2B6F0275EE0D

Filesize
28KB

MD5
eedd18009440350564411a46e65a5894

SHA1
3a84b325a85ade3d15f3af1d562d9e96e00986d6

SHA256
bd2aa9f139b8462fb389058ef7ba23bc409786b0cb4fe2e23934aecba1bd6ec1

SHA512
911349f3356ec4b82e7ed9fb5ca04e0e9cb3592c894b53b3952a5c3c955ee3ccba3560cc3ca95a23db6491617757529c3e8aadbef2acdda4695cad05266862ba

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\3C38A2D7B69FCA0CC83182723057436F0F8327A2

Filesize
29KB

MD5
2cae64efb5c0727a5d8080cb4fcd0840

SHA1
6ea86a2357db3a5fafa42dcf267dbf974080f84b

SHA256
eb9084ea882ebcfc7c0113bc7a7ebdcd4f3e6a22609e7d28b94e5752b54c9dfd

SHA512
8aad82eff4b00e7cdfdacd2d361e190eab20f8e4671bda1ec7e3f5e8a035c0aa702b740c1ed028ee169429a85b08d16af7bb7fd4b2e685f2175fe3e740322261

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\48E7471D0E3511F6E0E7D639C9F03C1AA861B498

Filesize
115KB

MD5
38ac6938e020f0dffb66c7e8c192c8c8

SHA1
208f7296c8befec6261341715fc09e361d5ba506

SHA256
3826bbd935e2e93461a60d3425cfd36c2937ff0dc5814d7072ca73fadf7daf57

SHA512
b972d52a1abff720b7b8bf8ae17280c7f19a4ad7d0cc369d8982aaa5d19e26baf013bc79a2d31eb1facaa9e3dee7c7741713a2901472eae2f269ebad597effef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\4B4A8F9A1D3D6A437FA7EC7E756AAD5BF74D3995

Filesize
18KB

MD5
1281a5c080365d9aa4aa75b40ca17d3b

SHA1
3061ef38113ce1bcbf8edfa372396d389e594166

SHA256
d93a2f9f53f35106a94897e69571bb05040c5af7c3ff64ff5600df006728e58b

SHA512
b8ceccdb9eacb95becef44420263039ee1bdeb42a30632186f67873cbcb90967bb3ee5b13d2e51c7c6ddb4fd52a0a5939f99be50d9d6687a8639b63068533098

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\55E4667628ADFF4424F2998167359EBAF7DA31A3

Filesize
24KB

MD5
0df13ec932088ca22fbb4e83a3dc4a7b

SHA1
d6df4c3bfb200ce282296c8eeb23bcd1a9503916

SHA256
f83a7716a31e7d44b4d469d333cb49044e9230f411ba58aa787acaade2fed7b5

SHA512
f7c23b4839a7f7cf7337398158fb711fe331a60e2e698787bcba9e8936d45bf988ed8c6079af186c513bd25fe4496af125db30a5689cd4d52b6120cf8299b6ec

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\68E135BE51C5620821148BD480760BA119A133AD

Filesize
44KB

MD5
01a28e0c3755a97a40ea685b56a5692a

SHA1
b36bc2fc020720f40c14c49205562fda38e8975c

SHA256
74ca9b8161e910029ad1d0200467af067d6ec6838afd628f6260dd65d28f5b06

SHA512
bc6d92c2d20ab1889d2b257f1d4d9c626426ed83e8281acf427befa44d1afb566d4981417934d8a22a8402f1d47f134aa56a3aa9b248bf5728ce83ee0ea63e22

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\69A3FC6F1027C5F5D907579933725219A81FEF1D

Filesize
122KB

MD5
166cd58684c6765de70e8f21aa90eee0

SHA1
2aab99607893b474e15532351ed4371334b6ae97

SHA256
2f7b2bc58d25c60edf0906ec14ae830ae34cc7e38c10cc53a16910123442f4ca

SHA512
43a342c3e21f9b816ea83989800834c1a6a62289b055f8269b0af2421ac0ad2a257aa826727323922cc600ca90168db2ac20a032b1526d80189968eda621ea76

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\6A6F808A09B8AF63EC558E5595F7345D162DDCB4

Filesize
29KB

MD5
6862f5d602a5b9889df2a3a6d6bee18a

SHA1
3fcf0a5eb7d156897fe6aa6d8f2cad9c8c890dec

SHA256
14137613ce0b9d02b73200798874aa332208fe73b342ca4306c932136ac50318

SHA512
c55452b4f9eb96ef40e819bc9d4a91cb735e7653c99df4c2089c1a8ebf0ac14db90e7edab398bd1ba47fb071417d6cc99dde6a2426bb2c0d8cb5699516dbb574

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\6B3352996EC9F06F224BB4F0AC1576FBE1411153

Filesize
17KB

MD5
e490459017c01f9453eb246df13ff5a2

SHA1
b7d9b9fcf85a929938c5a43c29324e1af14eac1d

SHA256
9b68199c1ad847581ea2ba0cdabeb4d461e306e0a32be6ec346fc95334479bd4

SHA512
e5f9aedd01b26cbb4cc1b8a815db8fe68da019b4ea81ba026ddee1981d2ccfd7c0da9d55c05f22991cc60b5ac16695fa83182c27e9b9e2451bf99d797c82f1fc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\6BCE70CDB0B679A250C6C5782C4BC52B1C2AA0C9

Filesize
103KB

MD5
ffb5bc5864aaac651613b1a6796eff23

SHA1
92ab646603275902e8e01a1b7b8ab0233abcea9e

SHA256
d1871e6c8bd577c29171ae8a2aa417e6affdf7ab8c1ad71f3f4247ac17bfda45

SHA512
32d828d660190845868c9d664ea1d6d4dd07fd75777a7f28faa1d5b4e9293a675e07a8921d6d5cb57a1911127f2fa4e2349f3e6df1ce720e6455cc0aab5f5d10

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\6D4248442A5B744725103CF26B6AB629E63B1F9E

Filesize
67KB

MD5
9b67d4e9e6712991ffb765c30d2db272

SHA1
67854a31025e994b81966bb2e2317180fdb9d5f7

SHA256
9d1f58749491e70ff9abb816a06c7d1ee7eaec8f3e381ada2da6e6bcca396fdf

SHA512
ac7fafaa19a7ba5c085cfb6bb981d47998bf14700494575cffa5d9dafbc0bde126f69087bb6f070547899bdbef9cc26dc887ca9ec7649242349fcd2454cb26f6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\7A80E441AABF2DC1CCC724C7DE4B91A9F4B2600D

Filesize
107KB

MD5
8eb832afd3b48818baa28e07c5d7e681

SHA1
b1a70dffd9565090fe15c3138fe4b44811d8fa4b

SHA256
01f009eee17c49cf5f0fb0c4165928d202fff5d3cb6aef807bf0ade92e9b0bda

SHA512
232917188b5c563ba3ab64d86961b25f27ad5ff9fd59905565dc8f8d94d937aedd2396979daabc12c4a1b7bad8df3bcd12c69ea8e675c2262b995301b215b8b8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\80DDEE4A9E0A0B7412B052E7C7984D65FB984BC3

Filesize
250KB

MD5
633f4ff3df5db3a414b66c2828f7b5e0

SHA1
4f6d31afa98a8aeb619d64d4e04ffb5abbe14eb1

SHA256
b0444388688bdd870a362f326981b6fa338091fd13c70085422dd39676bd1065

SHA512
48d89bce736861ca4dcccd237798965fd61c0eb92fbafd459557f8eb51670347dc900ca498537cde519099c16bb89dbc69540b11ccd574d8837538dd40f1d49a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\83C827A6B3038B61FA9069DABB99C952A9469BFF

Filesize
55KB

MD5
8768512ab78087cc0f3da72f49d76d1e

SHA1
db801d54d23f0d05e7187142039f62b6d55d88cf

SHA256
43b2687055e96ceda60301cc2bfe8551759c7720b4943f7122cdfe77fe6c9e14

SHA512
c84451b203612d4f93fede94e3e8f66a75d389100529bbede0591beac7845aed33e4d1b86d996cb082f98a3ebfb7e5cb07083de694d4d0e95b54f785a07b5e81

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\8D2461A6A9A7FE63423472405D0D683070A17E86

Filesize
25KB

MD5
20de9bec6baa9e6edd7ffe4d98fadb08

SHA1
18037370d93ee5407c20505da40951636936cd95

SHA256
61ea9d0bf536448b80a29c7d9f0b0728cc4fecfcd9b99ce13dfe98506f3198b6

SHA512
33ac0776f409a5471835dfc865c2b40966cbdbed6adba50320b78655a31f507391709bb0b542be03d7f47efdd031e585f0d0ea806c43fb2f80b4ce90765091fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\9166DFB190D3EC7ED07C8D0A9507C31A88313E9E

Filesize
247KB

MD5
2db477c3bafc1a96616958f1ab098577

SHA1
59ab7fa985d6745a3b651c24e3dcde5b0f9a4352

SHA256
4d99f0291374621e6103b2899c8c2d692d0294372b3d16bd74b2e4bc1a60f9e4

SHA512
249d2f6fc1660044d84e4b223266462ade1d64e812ea6990e87c595d81ba8cffdc028c349d041f5c2502dff7d57dd3ada96775f9ec330fe59af5806b00fcdd61

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\91C9B0D5DC174F6DC40097EDA74D1499E73D60D3

Filesize
26KB

MD5
2a8da073837cbb361b4e480defe6203a

SHA1
a85d22d6d81f3b6563de401a71d19098bcde2d44

SHA256
d0c027fa3ba662ff5c10b964c936dc515ce281b912f703f71c388f5b836c5b45

SHA512
8ca9ebb5808bddbd2739d918761f9d3ac4f8cab7eeb9e1a2583d64e65cd585ef374ce42cf50a02e14e58fb521bcab7cd3d536001f2451f8a5b630510d8250bc4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\95BA62C99B0F2E2E0C9C9F001BB11FCBE874937A

Filesize
21KB

MD5
d2aa8ed634463dd5d46950f776c37fab

SHA1
157b3316e8350819f3126de744a30b0526fa09ed

SHA256
470586007ae5905f99133ee9a922c11201ec323ea2db464a83da4d4e3a4d33bc

SHA512
4bf0cb94c1f6348c52f79bcd2b0520328113db485831dab0e16b6cc279483218060105c34f819717455dc9978e22bf6ab2c0a7960609b7adc9df71aa03dd6ef1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\9F72320EFB9CD3E5C8ABD411D06CAA9BCA3ACBE2

Filesize
996KB

MD5
808f5a35d5764e9e4b7fdc56c01309b2

SHA1
a3119d848572124e7dbb045b4b3be8138ed36517

SHA256
299532055c8a6787a0666db634e95cab053ecd8e78b9b9b0f6835e5e485ebc50

SHA512
e748974e5dd65e17021102bf65deeb9897eed38974d8f9c4a4efaffb7833d8bd865a242a94c965e66aad1e40e8277861e983ea1432116a70fd10f3c2abf45560

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\A009B44A1B9BCC076D111F06397947E57CA5F58C

Filesize
39KB

MD5
5d4a2ec259599ee96cc1d2005e72750f

SHA1
3feedceedd839f060edf015c818cf2f8872d87f9

SHA256
345ff1ac57f9ab607e577628342eaed8f83a38f390fec8a34c68ccb7571648b7

SHA512
cebce9dceaba0303e6beb69ce30d235ab06d865a6c26e8708a9baef1b77596b071468c9f4deec0f10bfc49c4648aa08bd5bad07d76d847c5975926f6dc878d7e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\A105765AB1A83000DC314E7145736B844CEDB239

Filesize
57KB

MD5
78c98221bbcb20eefb40a4f0e1d591f8

SHA1
61fd0d73ccc2496623fa134f7e8fa937a283889e

SHA256
dde834a1001b8b5ec9dd478ee04244ef212c150caf81abe223fb46e4d3f00a39

SHA512
458d6fe86b6333a3d0db422ab2435d28a694e4ec7ea4acf853e3780dd104316650f8bc0ba4da55c5be4dfbafc40ca6d9066c5fea4d6cd2c0bb33425ec28cfcca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\AA5654EC575DF7D190BA3F20D2698EA32B9501B3

Filesize
14KB

MD5
e5c50695e55f87e0afd4bb613092b866

SHA1
62639e3d7ea627aa798ce6ae203f16d8ed77bd5a

SHA256
e985315fb4bf4fa915c15a1935eb060ea81001fa58bacb23c071676cc27d7d2b

SHA512
308a459b16fab5a477fcc29bcf7fd54f9e4a622b213dce4b4c3a0f297789b874271976d365a5660c4d8c1a6090b2c2356029e9f351d5584e980e46ac7ed1dd7d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\B6E76CB3D6BBD24EC4B7DFB8600B14D6695E8230

Filesize
24KB

MD5
b172048f37104b621956c257d5394030

SHA1
d695017cfaf224c3b45f385f0bced375af7f3888

SHA256
0926cb4851c0b17eecccc16647b5ae6bb835fcee19a5297fae2e1b388a71d466

SHA512
a7b07af2ccbf6c9d3be1748f881ed0799f68c1d5ce42ba05a3d2191368e97a3f4356a77339f1f5463510b909bad264669949c4f12b78e78093a3ba4cfd6c08a9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\B7DFAA48376B6DD216B282CA105E159891C17C90

Filesize
24KB

MD5
3a34af78325b045dfe858ba4f3202537

SHA1
4a2e8aaff1050a06c4f079694d40eb85cbf5ba6e

SHA256
b0d57af64cca557adb9c20de44df39252157147bfdd220b47249ab6080f321b5

SHA512
d1f6c3b9442631e89c519218c6d8195beb36ce6b64da104a15e66d2940d7dc0ec7a1f6289a178a20f49427d9a31f7f9f8f11f7b8b6507653dab458af6fe38450

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\B7E4E569F6FC80B2DCDD41ABAEF99CD24BEDFB5C

Filesize
116KB

MD5
bed4e80bab213dbb32bb34d8952b5e66

SHA1
2191fcbedb07471feb71cf474ba6470fe284e22c

SHA256
adbce3d72335ee1b3ec82e64954162aede0b743fc2046cf6f8a9a991a14f891c

SHA512
5b90c0c7e4750f7177aadf255490eccb5b2aeddef1079cdbc51b139101211e05289b7d4ac58383d7e681c28ca8a872978ad970caaed149b697732cfb5c449400

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\BD4CA1D4B4266D61825709642FCA56121B4B4D98

Filesize
56KB

MD5
9c648fc33d397da33c1411921c8186be

SHA1
748ba6049d88eb1bff0c0b6c27bfc70cba2a71b8

SHA256
21246e0dda56bafa9ebc22d8393dca7d0ec9d01c9a6fc3877d880d1105a09b6c

SHA512
5081ae6eaae7717e7073cb0743c5fb25930924fce9da334eaf83cc90f9c09e9d165a54c83a174acc88565c8e4216c6b4b644eae0f5ca8a7f92940cd897cc4db3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\C35FDA7C5603B55CFBF6660F3214F284EAB0AA14

Filesize
1.3MB

MD5
b1470dbbdca844c1a4e3c1092665400f

SHA1
45d6d814fc01249919aa253b0c2227266734f702

SHA256
6a4ffba439f43a3e30340f34545dade0cc200313dff945bd6c6719a1b8e04793

SHA512
e4a2c7eb6b1a1f427b47fb7b307eae0ab030f8e9713028716704fb65c8a5e22c1e54026627d565f0bfcd76c51df9b6085b344b5f0f45287baa483ebfd7cb6459

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BA

Filesize
13KB

MD5
8bf7daa5a1646712e6c2ecdd74397299

SHA1
889323ee3f30b144ac28609b517e9c1d915c0865

SHA256
3b1a40c256afbb1a9fad15a98f22622d70f492036b1fdeaa95ea1c9ee97506d3

SHA512
c3df3c30370d3dbc4a7736786096631fd15973d2541ff50f84642055e3ccf734c4a0acb37513f818935a1cfaa96ed57a0f2bb0316c7b4cd3e12aa6cacbf02a23

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\CEF68508EB9B66B0E81E2EEF96312CAEC849D4FD

Filesize
26KB

MD5
c07d2d20149991f30014503e08f5458f

SHA1
0e5e32116fa3f5ab35fadeb97a207e11978166a1

SHA256
ba05c8ba08036240b5d833385e9c9eb8da5df1205f8c7ac81d800394c32aca19

SHA512
92706260e2d27b05a5e85c64f674d866fe03815dc27f67492d0f4fbbf091483693a1c5eda5e1193cafa9de6aedea8c4fa561e3a556b9dc6850190e891c0005c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\D2AE98CB2FBD8AEF4B2DC541E784E1ADFD434E4E

Filesize
33KB

MD5
2bf5d0dfd3e608fb4bea04d00cd0625f

SHA1
72b4dd48d4cd1ed4aba0afd6949aaba279fe35f6

SHA256
83f42e04de75b1de5852dfe8301f8874a7d68ee70091f38b1708b12423245be2

SHA512
478d9204d28b5836d6e99d879c42f0a0332d13eeab86ebab30887e684d5154ff5adfb0f423861e81a9d19a086389bed7eaab7705bc14758ce0f9450d8422c3a6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\D2EF2EA23714260BED0C31F765D6FC7A15DFC578

Filesize
901KB

MD5
6eb6ee4668c19f4207ed781d35388ced

SHA1
c64736796fa4cbdf0cd55fbd08e193639f925fa2

SHA256
ec30e37c23b626073031590a9010bb968806d13e6e0f9c5148000c2efc3503eb

SHA512
378101ef68017409f072b33a9349a0d45771e70eeedcdef91e5b28f9bd86158ec53d5ed0688d213c5b9bf9f1cc729a5fe62f017d923ee06fef9ae9ee1ca03c85

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\D55AE9680692C277445A1780212F3FA25ED815CC

Filesize
20KB

MD5
a43ab0f89bec3136759eb3faa476bc79

SHA1
1c6c7381c0ef0ed41c52b28ab5c37516aa685d6d

SHA256
4a1c35ed3a2c7cdace6acd24953345c8c3075136eff7213ec4a6924d864764e8

SHA512
cf6b76d4adc807ca2958dfbd6fea8adb1eae3a3de3bd3d983c1db5ae1fbb8fcf875786f24a962a9d0b42ce5a16e4e4ac66618beece16933cd6203eff197023f6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\D5AA3A2894729A8BD264ECE9438C93C8DC7BAA02

Filesize
87KB

MD5
82cded5ad7f68919fcc8f42f84e537ab

SHA1
c3334aecd153c0a9ea67750b2709b5f6444e2a33

SHA256
4a21b1a66592bb3b4fdba9e13fc672ba2e002b6ac4ebb829416ec6c60f03bd51

SHA512
06766e74158d65b06bb152f6825ebfe1614492aa75da31e30a27098bf58a7feb4058ee949c39f80891e71820696c839810587ac4aa56bc103013835754f55553

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\DBD78B5F0DD5928F802E6B4677A914D2D6B73B75

Filesize
74KB

MD5
d78955cb96dc3aad8f1d401e542943f6

SHA1
24b998dafd933dac0fbef3fbbcb2c952f18b0ab5

SHA256
e3f966ebe2e03c8f164763af8dd79c2f3c451cc461f5eb67f25ccef8903c7ffb

SHA512
442374ec6181811b8cf4b2753dbbdff0ed286ad999f63d7e4293846ee16e0a8eb60c0568a6390f2e564145f98e95410e70d46c5440e935d45f05d2545f418d91

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\DC3C70309C4F9DEFB89A8E20C702CB35D640C017

Filesize
21KB

MD5
a1dc5186755ab8983b13d5dc68b3b89d

SHA1
490cc6329c03171a008744a5a561f3dd7db0c855

SHA256
e2b5bc350a955cd1dc428789895db83807b77649c2eaca24c821c91572cd5ba0

SHA512
2bfb4a6a16ead9c64f1124913037dea05c9dbc71503260a79b1cca134d1c64ef6b2bcd1cae60836fa0ed78c5ed5acff81239a7fbc2e6d78b6f57e8aadb7059a4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\DC9E13EAA57709CC60E9D3470C48772A270A82E3

Filesize
13KB

MD5
bfacbcaea59dc8e560e318e5aaa9cbbb

SHA1
0482a010f74607ac9943e0b70d43695a53972367

SHA256
eaa092515b341cb214fb85c80f45a0d289e5d29527dcbf2c00176f8616601529

SHA512
e6fd0a06cf001a0db1d9d90ff4208cbd42065d914c51e221a80e8e0c52aec810197f670dce34bdb97fab4266dba8495a8823b141ab9af952246b0036461a27bd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\DE6410D7D10A034A4B6C7DF000528E7D2955C71E

Filesize
139KB

MD5
8beac0e2cec6966498dc3788929db14e

SHA1
ac1d0d0fd66c2a4b0f42f11802d360ad9fe51f16

SHA256
fb093ded9508f4fa1593861ed6c2a9d65bfb6c674d798f67a127ff0198e75510

SHA512
9f967bac672dd3366841fd22338c83a5efa2b2d9d53c17d705bf9edb33a851a6b055d1c58cb983dcf7af6712d22ccd752d3d61fd40e951c1b2400d9401578bc2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\E5CC5F8505B9D5A5851FD829606D4AF17468A7FF

Filesize
2.0MB

MD5
e5912de14160d04d7211c19aeb02f6a6

SHA1
b159a2eb309c0cea122b5f1c68fb726f7fdbc4e3

SHA256
7010cc964ff5733c14c0c1e972c86cfadce18d9f400723a0f917ac337c41cfd5

SHA512
35bf16889d127a9c3dbd380de661b9bce48941050b9a33ec4001099df9bfcfa604847aa1321bef412fa53ea072389e06e467f2239127793356098201e628cde4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\EA3C5AF3C45060903211F86E53CD624C30B5EA66

Filesize
82KB

MD5
ecf19c8355ff2c3d3139bf3541575590

SHA1
c79886490d663b177e95ce09a31990607be1eb27

SHA256
2d87ed76f5f4a8f01ace33d39bf36c448a4e3efb9703940d8e4da49dc8d680d3

SHA512
6068d8e69a31d3b45598b3d3123ac8455ad87e12bd598ddbff4e0043d142e1b9c5babafb7ffa77215e4d0faf665f91430265c55e0b9ac8ebc8bf9df62a35f000

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\EC0C0344B63814F895C4A37F082EA786C659EB5F

Filesize
524KB

MD5
7665419d7b936d713960a9a7a041200f

SHA1
c47dcf901442f9c3558bab80885d1a4b8ac87294

SHA256
04e022740456db8492001d87055efe38739aa714c66325d34aeb578334acde79

SHA512
c3656b931acdb7b016a435216fd6144635fb8426a556c2965b1e4f726e10c9f376130e58b91beb5dc9de253e2152c965a3c5ea3c3e2de4859d03cd0e22d58500

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\F13AA51EF0545345EB6C3CF9EA3EB529D0F2CC1F

Filesize
1.0MB

MD5
4a8116a7ce78e361048e296c8a777741

SHA1
b6dc406c0c0532e94b87815fd309a2c32c0400e9

SHA256
891281c71d8a67e4972c4a551b406d32fc5d657a9b02abc8b31117f45d6401f5

SHA512
8c3f41b68152f181befafeb5c56bf23f79ed6fe2b4d959a1113ac63c37dfa9fb9a1dcdf071525cad1a40a1a52e8ef55e2ee77dd799ca25493ca3f9ddc7f47470

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\F80A8D476BA092DDB4CE508AE77BC6E5C29CC57B

Filesize
18KB

MD5
4864c48c42361eb8b6b48796c844f184

SHA1
63613c277086036c0c04918cca5838e8c01df7a9

SHA256
e8bc24f61d5061a4d2897722c18761002abb91b7870186666c3c9a9d50bb3ab1

SHA512
9a265b61413f4a11981ef43986e6af65124e3e1e257ff1225d9d482d3455315c79c7cf76953c2255e20fed199116e107bcc6569dbfbb60be2f46cf67c10a28dc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\F884B417DE2A596726379F94AE3819DBCE9F9B00

Filesize
30KB

MD5
70b0f085b5c0df15d04497d8cc15eb11

SHA1
6f02a969865712e3de2e3abb8c0e62534d72875b

SHA256
864a2b3d23fcd7f1c2119796b94048f8f8982caebe4019f013ed439febabf887

SHA512
10eadc7e0d741c92d3026e73927d7ae588227994c4fcfa0106bb01de84d829e3bceb43e3a7ce626ac27624d7928bdd206a8f5f8939de31320515c9a6ded553fe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\F8BE9D499518F26DA2C974465152FF993B4E53BE

Filesize
15KB

MD5
62ac94d03d2b49d6237436c6adfaaabb

SHA1
ed1c13b08d5c5307224399010fc12a52a6a867cb

SHA256
05286e4b7432c8aa4db224f405c83b7d368a4a6f35209b1bdddda3ee3a14e012

SHA512
837bc93b6059f3a27593bcbadd82e02f37531375a13c97fd3b73aad11761992a4dcfc86368f67d14af9e975f2b312a902801b8f9ed076511417d33eb27f6ee9f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\FA42EBEC97E7BC4BD8596DD821DBD04B2CFE6838

Filesize
1.2MB

MD5
5a0efe393dcf18e4e937cfeeb3f91ff5

SHA1
2f41839eb9248974411c9bed6f8fa055ba924093

SHA256
a297d2393464ebac320027ed038a58a01d520b7319c19d028718adb74dc64664

SHA512
a20684fd10ba1809890d947b9a8b67958cc44e924b2b0203130998c27a3bbbc1a9315643bc0bb4257f6f907008e23209052af7d04e5d8faa0cb2e44a697b463d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\jumpListCache\sYxkeJkhwRHNfnjHE7xnrw==.ico

Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596545268433896.txt

Filesize
81KB

MD5
65b22677c9ebc60c33fd47d9db3f0ca3

SHA1
6d458421b1bed2471888e3dc9cbfbfb70d7a6875

SHA256
c737a4cd52f837c866cfb7e97444f4203bb71e8252c2ee6fead6ad694ed24a0e

SHA512
159cc63c2ef81672c5e4bcb020a938e18e1fad7b596a20d1cc4cc7b5505132952786d5ab23bb09ec07f05e4aba0bca7ffe52c778f0a50e9abb7356fb7a0c0d9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\21034abd-b674-4e50-aca2-3563ba7fcb13.tmp

Filesize
71KB

MD5
23905ea78979b66c6d307de1ba55cea8

SHA1
73c187582cf3a843367751b565180dbdd88498fd

SHA256
d3e2dd4dc06d3f0feeeb44ca24cd60d076931ff6c0ac1692b509f40f58d8595a

SHA512
a32f59e91c5be60eb032f33a5ff799e125143e9da4d93ae0b57abdd80b778ff0001ea28d553a947560b54b9d214ac96e5d0ce98d36d655b26f1b6d4ec64dbeae

Download Submit
C:\Users\Admin\AppData\Local\Temp\4f231b25-669b-42e8-9be8-1ace4f5f9021.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\5f6e5549-cc4d-4a9c-8d1f-01361dfdf5fb.tmp

Filesize
936KB

MD5
79e1a051e0bb64259538622f94be9988

SHA1
9b53e95bdb4a0923ed84a69972dc7168bc2fc942

SHA256
5bbcdbe935746ee78233c06331293ccf7a62f359cfd2d88a910cfcb8d9ec65f4

SHA512
6beb6aaf5afb4b5f36cee371a149ce5dab8a4553446553a1341996affe10f888f6ec2de19cf3ef355552d71287844fa8cf988d90bf050008f4a7591cfaa31511

Download Submit
C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\installer.exe

Filesize
27.5MB

MD5
d2272f3869d5b634f656047968c25ae6

SHA1
453c6ffa6ec3a0a25ae59a1b58a0d18b023edb16

SHA256
d89a2423da3704108861f190e1633d2100ecc30b4c40bd835ce54a6934887bc9

SHA512
41072ef6f382cf6d4d97ebc2a49a50a9bd41b53508a8586fd8d018e86aed135e8ac2cdd16bbf725e4f74f14ecfcf49789d3af8924b6d5dfa6b94dc6bf79a0785

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll

Filesize
67KB

MD5
7d5d3e2fcfa5ff53f5ae075ed4327b18

SHA1
3905104d8f7ba88b3b34f4997f3948b3183953f6

SHA256
e1fb95609f2757ce74cb531a5cf59674e411ea0a262b758371d7236c191910c4

SHA512
e67683331bb32ea4b2c38405be7f516db6935f883a1e4ae02a1700f5f36462c31b593e07c6fe06d8c0cb1c20c9f40a507c9eae245667c89f989e32765a89f589

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2efykfv4.e5g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cu4xzeo0.exe

Filesize
1.9MB

MD5
03e9dc3efcf042073ec1d52236b7fe27

SHA1
57fcce083122b9f4a1c5b6a208c9fccfe9590d7b

SHA256
6e94565a66b670e61301a03f597f4d7f138b5ca4fbc53f9c088bfd39a835463c

SHA512
16b74b6a287f95a0510123472a119d8624ead6804a9b6c0b35207eeafbef16f562100107b12573de9ab483ce29e9b8aaef9c355279a3de06f978b546d45fd756

Download Submit
C:\Users\Admin\AppData\Local\Temp\f44c49a5-610e-4553-bdf1-3e9532b58ebe.tmp

Filesize
90KB

MD5
65a028a0d2831eed0228ecda4ab9ef2f

SHA1
86d5eaec3e1c7ecde3f37ab36a017599ddcb2138

SHA256
5cae2b06bc5525e26e08cfaa43be7a5f8df88053397676cf81a5402a1ea0059a

SHA512
edad812dffcc0c8b399d3c5c216973bab2fe9e9dbc0d2c6efffc8cca5f1c58e126b83046c4c90febf003f3afd3d3c12c9ba46ad9d18975f2a6c5094643ca4f87

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaE5E2.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\123148a1\8bd7064f_59a1da01\rsAtom.DLL

Filesize
158KB

MD5
875e26eb233dbf556ddb71f1c4d89bb6

SHA1
62b5816d65db3de8b8b253a37412c02e9f46b0f9

SHA256
e62ac7163d7d48504992cd284630c8f94115c3718d60340ad9bb7ee5dd115b35

SHA512
54fdc659157667df4272ac11048f239101cb12b39b2bf049ef552b4e0ce3998ff627bf763e75b5c69cc0d4ef116bfe9043c9a22f2d923dbedddacf397e621035

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaE5E2.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\17444a9c\d9e9104f_59a1da01\rsServiceController.DLL

Filesize
174KB

MD5
d0779008ba2dc5aba2393f95435a6e8d

SHA1
14ccd0d7b6128cf11c58f15918b2598c5fefe503

SHA256
e74a387b85ee4346b983630b571d241749224d51b81b607f88f6f77559f9cb05

SHA512
931edd82977e9a58c6669287b38c1b782736574db88dad0cc6e0d722c6e810822b3cbe5689647a8a6f2b3692d0c348eb063e17abfa5580a66b17552c30176426

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaE5E2.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\3337e3d8\3f9c104f_59a1da01\rsJSON.DLL

Filesize
219KB

MD5
d43100225a3f78936ca012047a215559

SHA1
c68013c5f929fe098a57870553c3204fd9617904

SHA256
cc5ea6c9c8a14c48a20715b6b3631cbf42f73b41b87d1fbb0462738ff80dc01a

SHA512
9633992a07ea61a9d7acd0723dbd715dbd384e01e268131df0534bcdfcd92f12e3decc76aa870ea4786314c0b939b41c5f9e591a18c4d9d0bad069f30acd833e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaE5E2.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\e42fa1e1\008c8f6e_1700da01\rsStubLib.dll

Filesize
248KB

MD5
a16602aad0a611d228af718448ed7cbd

SHA1
ddd9b80306860ae0b126d3e834828091c3720ac5

SHA256
a1f4ba5bb347045d36dcaac3a917236b924c0341c7278f261109bf137dcef95a

SHA512
305a3790a231b4c93b8b4e189e18cb6a06d20b424fd6237d32183c91e2a5c1e863096f4d1b30b73ff15c4c60af269c4faaadaf42687101b1b219795abc70f511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaE5E2.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\ff14054e\c4c3104f_59a1da01\rsLogger.DLL

Filesize
179KB

MD5
b279550f2557481ae48e257f0964ae29

SHA1
53bef04258321ca30a6d36a7d3523032e3087a3e

SHA256
13fe4a20114cdf8cd3bba42eeaabe8d49be0b03eec423f530c890463014ccaaa

SHA512
f603cbac1f55ad4de7a561a1d9c27e33e36de00f09a18ff956456afec958f3e777277db74f0b25c6467e765d39175aa4fcdd38e87a3d666b608d983acb9321cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse146C.tmp\JsisPlugins.dll

Filesize
2.1MB

MD5
bd94620c8a3496f0922d7a443c750047

SHA1
23c4cb2b4d5f5256e76e54969e7e352263abf057

SHA256
c0af9e25c35650f43de4e8a57bb89d43099beead4ca6af6be846319ff84d7644

SHA512
954006d27ed365fdf54327d64f05b950c2f0881e395257b87ba8e4cc608ec4771deb490d57dc988571a2e66f730e04e8fe16f356a06070abda1de9f3b0c3da68

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse146C.tmp\StdUtils.dll

Filesize
195KB

MD5
7602b88d488e54b717a7086605cd6d8d

SHA1
c01200d911e744bdffa7f31b3c23068971494485

SHA256
2640e4f09aa4c117036bfddd12dc02834e66400392761386bd1fe172a6ddfa11

SHA512
a11b68bdaecc1fe3d04246cfd62dd1bb4ef5f360125b40dadf8d475e603e14f24cf35335e01e985f0e7adcf785fdf6c57c7856722bc8dcb4dd2a1f817b1dde3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse146C.tmp\sciterui.dll

Filesize
6.4MB

MD5
f40c5626532c77b9b4a6bb384db48bbe

SHA1
d3124b356f6495288fc7ff1785b1932636ba92d3

SHA256
e6d594047deecb0f3d49898475084d286072b6e3e4a30eb9d0d03e9b3228d60f

SHA512
8eabf1f5f6561a587026a30258c959a6b3aa4fa2a2d5a993fcd7069bff21b1c25a648feea0ac5896adcf57414308644ac48a4ff4bdc3a5d6e6b91bc735dc1056

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss1D84.tmp\AVGBrowserUpdateSetup.exe

Filesize
1.6MB

MD5
9750ea6c750629d2ca971ab1c074dc9d

SHA1
7df3d1615bec8f5da86a548f45f139739bde286b

SHA256
cd1c5c7635d7e4e56287f87588dea791cf52b8d49ae599b60efb1b4c3567bc9c

SHA512
2ecbe819085bb9903a1a1fb6c796ad3b51617dd1fd03234c86e7d830b32a11fbcbff6cdc0191180d368497de2102319b0f56bfd5d8ac06d4f96585164801a04b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss1D84.tmp\AccessControl.dll

Filesize
26KB

MD5
c36eb8336b91d277dfa8575eb00d6364

SHA1
9ec81b49e7675548449e010950bc50bff7cbc960

SHA256
4336e05960fee8c775b343209911f14acbfdde1e8d5aa9d1f0ea680fb4407307

SHA512
0abe6e367d1c934fec8a89617b5fbfea5ab7f8e557ada7a667aedb495f637c8782a2f4723c2d68b9edae4f426deb5bbc0536f643fc65ecc2cd33295078474394

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss1D84.tmp\CR.History.tmp

Filesize
152KB

MD5
73bd1e15afb04648c24593e8ba13e983

SHA1
4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91

SHA256
aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b

SHA512
6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss1D84.tmp\CR.History.tmp

Filesize
124KB

MD5
9618e15b04a4ddb39ed6c496575f6f95

SHA1
1c28f8750e5555776b3c80b187c5d15a443a7412

SHA256
a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

SHA512
f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss1D84.tmp\FF.places.tmp

Filesize
5.0MB

MD5
e5abb189e14cbc7bac6b36b3db824406

SHA1
de3fd6004ef0c65c7f9023406f974737cbb2919a

SHA256
3903f23219df624531098ccf039de16a01e0916a8f8a9c7bfcf698cd12d5aab0

SHA512
31634cb0a3f8abe68e9beb2781e9e24e2d11f8042d6ef271f1e059fec15dca5a2ab01d2315d9cab6223534a858b997e9497476f482c8037e513c246df11097e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss1D84.tmp\Midex.dll

Filesize
126KB

MD5
581c4a0b8de60868b89074fe94eb27b9

SHA1
70b8bdfddb08164f9d52033305d535b7db2599f6

SHA256
b13c23af49da0a21959e564cbca8e6b94c181c5eeb95150b29c94ff6afb8f9dd

SHA512
94290e72871c622fc32e9661719066bafb9b393e10ed397cae8a6f0c8be6ed0df88e5414f39bc528bf9a81980bdcb621745b6c712f4878f0447595cec59ee33d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss1D84.tmp\jsis.dll

Filesize
127KB

MD5
4b27df9758c01833e92c51c24ce9e1d5

SHA1
c3e227564de6808e542d2a91bbc70653cf88d040

SHA256
d37408f77b7a4e7c60800b6d60c47305b487e8e21c82a416784864bd9f26e7bb

SHA512
666f1b99d65169ec5b8bc41cdbbc5fe06bcb9872b7d628cb5ece051630a38678291ddc84862101c727f386c75b750c067177e6e67c1f69ab9f5c2e24367659f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss1D84.tmp\nsJSON.dll

Filesize
36KB

MD5
ddb56a646aea54615b29ce7df8cd31b8

SHA1
0ea1a1528faafd930ddceb226d9deaf4fa53c8b2

SHA256
07e602c54086a8fa111f83a38c2f3ee239f49328990212c2b3a295fade2b5069

SHA512
5d5d6ee7ac7454a72059be736ec8da82572f56e86454c5cbfe26e7956752b6df845a6b0fada76d92473033ca68cd9f87c8e60ac664320b015bb352915abe33c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss1D84.tmp\thirdparty.dll

Filesize
93KB

MD5
070335e8e52a288bdb45db1c840d446b

SHA1
9db1be3d0ab572c5e969fea8d38a217b4d23cab2

SHA256
c8cf0cf1c2b8b14cbedfe621d81a79c80d70f587d698ad6dfb54bbe8e346fbbc

SHA512
6f49b82c5dbb84070794bae21b86e39d47f1a133b25e09f6a237689fd58b7338ae95440ae52c83fda92466d723385a1ceaf335284d4506757a508abff9d4b44c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp-3nm.xpi

Filesize
14.2MB

MD5
2f745ffe684b784e18143577dd8b010f

SHA1
9f4209b22736fa1f24ffda884f8ec7e5a5a76955

SHA256
9b6b3a8ea6f5614d059574a616f4f35926abcd180c32d3d4693e277685a78000

SHA512
335f20aed71c048b946977660c45f17b2978a48c4d655c9369754f1a3e5e5e56ca38a48e37e9a42a5238d9a451e2ced6d53c975a136e8d3c852dc3b4aba93340

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AVG Secure Browser.lnk

Filesize
2KB

MD5
d888f42e6cc329e7778029a3c679f0e1

SHA1
5a9328556b8289322d26fdb348d4a0bb23e70c1f

SHA256
68f84e35bbe10fc2dd26134349b3edd16d027608adc4222d1584abe17b439c4f

SHA512
26835e4e6339bd3f08cd686cd6b22ccbdde8b13aa987d8b24c971bf876244c691c453e2c029c7f87cc5499dd090b47d6c87812910f80c088b9789551ec2cb694

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
11928638bff5af61198eaeb795e7d56e

SHA1
fbe913cbdf66d6f89db314ed0de6574adf4dd161

SHA256
57e691559b2396fc09df5db46c90c85a98c7e13672422f40b7908ac2cec1fb4d

SHA512
103567eea4a496f40a2ec7f9ec2aa4a2e2f9fbfd99661ce520979bc7ef619629ea11fb6f935805bc749a8704ab8308ba9eb8c152f96e425528b77b2c92d3feb7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
822462aa731fc9fd6e2d8e35e061053d

SHA1
02d9f46e5c5b150f3f35283d9f6409b8cb325524

SHA256
2e7537502a6b5655094efdb9885fbd8a3c47cd2c1fe2426f9dc8110ed8c57b36

SHA512
40d0d76125a681c5b1347fb9de2f17d53ceb77b31449325ff83b1f148c9ca59b064c9eb78755e012e72796a60832bbf9685a84eb3a766e346d569002bf88b317

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
0a905941dc9ee14d337c079d5bcbeb36

SHA1
d2406b563badce67bc30a8a87a2d7a718d7c58d4

SHA256
2c08ad0e59e5ed7dadf9d007ad79b2783655a79bc1da7f06921fb2360b886b46

SHA512
ab87e3182455835d6c1e098ac3bd39efaebbfa4b780f787714d0e657d1d4bce0d1e481b518963dc2f100b1dd331dc1659c4b389f29f784e7bbb8b24bae869fba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
5777be4b557292dc9e4d5f90e3629284

SHA1
f689ba1c3a73243aab7b56419451a291611c01c4

SHA256
f1591460b46ad4d30b8e29ff20b786f2df6b96b313b91ac753f5fc2b3d6faa50

SHA512
a5bd37d46f814a7855699afeae6955d9fd8d65ebd4d34dc33494944bcb3a6dcbb92e6eec7d134e1da753ef8826dee2dff268de19b776a875fe7cec9e22d984e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
cdeacaecb0231f8085cf07125728f2ac

SHA1
c72532d67ebcdc09b766f041ebe159532b1db585

SHA256
3da6aea6a8015f9c47c9a6bf786d9aa3971cb96d17259dfa79de9410a4c4fb7b

SHA512
4c72df690343b10a510d3439c0e20a9a7657915afeef11117c0c2b4da7ad7aa5ef000fa733e709d7184186d8303305a67dc9a89b92d24756c1f232b2db974802

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
2e944a91ca07fd06071ee5508602276f

SHA1
54b1e89333e8120a5366cad7715e66d07263e92b

SHA256
332350d806699ba13b4b623690c8b607910acf4e7c30c26ae3c2dea607053b73

SHA512
b9c1707851ec01d7bdfd2cb84ebb0930025494c2d35418256e56a83de701f6b45a8bd54028b64425ff78f4bd258b6b3bf5778970325867497dec035fc4840337

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
b1c8aa9861b461806c9e738511edd6ae

SHA1
fe13c1bbc7e323845cbe6a1bb89259cbd05595f8

SHA256
7cea48e7add3340b36f47ba4ea2ded8d6cb0423ffc2a64b44d7e86e0507d6b70

SHA512
841a0f8c98dd04dc9a4be2f05c34ecd511388c76d08ca0f415bfb6056166d9a521b8bc2c46b74697f3ecdac5141d1fe6af76dd0689350caca14e9f849ee75a8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\extensions.json

Filesize
43KB

MD5
ad43d3f7144fd31c881d61ee727340ef

SHA1
5c5cb0e6d90c23887d7c1dc4eb9b0d5653f92499

SHA256
30bcd3be6633b6bc0d17c2ab2d2c6717acf31bd3aaf9ed594412a9bf407f2cf8

SHA512
31f7c799b2f2d327cd1a671db101d7cf1feba496ca2c7c197e6ea8222aa2c63fec5da563564aaf9f3d6f89f2091e183cbd85fa877111144707c86907b73f1363

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs-1.js

Filesize
6KB

MD5
97dbc7a96ce67c88862d3e4f92d6cd94

SHA1
ab51c15507bbb04a24ecce87218e7e4e75a21bcf

SHA256
56d31f9c99820f44f31a5b289414a40386b847058d6853bdeea2d26164d1147a

SHA512
bc9d80ee2d552a1af73937e5de21404149918da27670c97d204701e9bc2d7b8d2f3fbc99ff81a1a17e491732970d9f47ab45fe6bfa359256074ba99f90ef039c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs-1.js

Filesize
7KB

MD5
1e56e5e5eee1111994fc5793ca340c6b

SHA1
50dba982f7c3618a547d82ee094486814ea515da

SHA256
7bc8e6c83b6a362d32f9a6f71893baf4fd9e111032a1c53557ed3ab8ab506cbd

SHA512
24f94f44100cc01a4e674f64973295c5b1bfb33e7dbd108b3d48b53478043009d1fe20a7ade9380a67ae1fe07334e725b50fad521863c6a2ca7a36d3ea1b6781

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs-1.js

Filesize
10KB

MD5
459215ee1b9918284ab373cff8b1a5d3

SHA1
366e431fd056593ce0e5e576af1395a5fb012392

SHA256
eddb66f7d91cdafb34a650b2387ce1fdbb604cba70c8085ed730d190dd1f3015

SHA512
41895dc56baaf958c059e2854aab9ae4785cf75dda79d9ca4f5d12ad6441225c1e0329dbcecddf39ba72a5075d9492f32deec5623c4e81bfc5c76b701e43a853

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs-1.js

Filesize
10KB

MD5
ceb8651d071d207ba4f681e5dd1524ca

SHA1
ae4ae761778449d899e40c46a09e21cf5a65ab0f

SHA256
75c89b6365da6fd3563995c97d92edf2cc7f137933d708b615274d80f35d795b

SHA512
cdf17b94bba552dfaf9372330e851f3a69f27f2f893719f95d865ca10f07738437753fd0267b15b3dedcdb271daedf0b19fba6409312de202357a6f8ceae726d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs-1.js

Filesize
7KB

MD5
71d1bc8cd1a95837730640d7159b63e9

SHA1
4fc6efc81a0958c5d0be23abf38a3e1b7cf9785f

SHA256
a39500c3480ed1de2af429b95f54717ae8ea473cb9914a9198a168cb25bdcd70

SHA512
77bc5b6176e6b684c42991b0cd8ad7f8db9816b217d6486b095bff84bf552a648bbd2d372fa96f0a9d4ba2f9ec2c339324e10f69c05d0899933269e9628edaea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs-1.js

Filesize
11KB

MD5
2f55de13038a5134aa00a8be011f5741

SHA1
2335839b565640da2c7685756912c261e304ba44

SHA256
a2417e6da2f58fb6f6bd279000c5b60f26b4dfce5a1eaf67ba93bacf1df98ec9

SHA512
f7e51b7ab2220a0bf8c35988518155b88ba546cf52918afd25dd107742298b417c15758506efd4f7a8c770dcd35d2fa3728070ae16ed94d737e50993e6eb5e88

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs.js

Filesize
11KB

MD5
b14d3a142df55461db5823389f06c194

SHA1
0bff514e764845ca537e2bd001bfae1e4082c6df

SHA256
724e8e6a90f94a82c9137b030a43c88fb150c5f026adad934a4c2d0ed675b9e9

SHA512
a75e98f6372e962dc87f385431f0c7310ce45afb2130a928e836585b0a11296868c33c6fa50f905d916b5a9526a572fc6cfb64bdd645d86ac79b7b5300d87a63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs.js

Filesize
7KB

MD5
c22635ec08e251098f9ba1f4e9312262

SHA1
12a2570b1ec0ca74b31d2251ec29248f3b14481f

SHA256
009998c4a8c0b85adfa7fa499ffbf0053dd6ebb865781b0052bf208280781ac5

SHA512
df0a0774ad11012d979fd9ec3241f6f5ace744bb3f913c09652c4cd95bac95d88ee54e8f7322fd87bbab8615d95bbe19915b6f3cef53d155c49321a6401e7bf9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
af040740e537e0204385711467b28907

SHA1
cc9d10962067e47d2621ddddbb7d0da3fbb4257c

SHA256
acd0081ba454deecbd09ffa7834ccb27efeb386ebbb3885f3576d20fea5c91b7

SHA512
6693240c07b358e4e51052a65af29d6f5322af8a0ffd77f52a108add9745af5a473f492fbfc12dacb64a7de5deee4358a59b80b64b8ef537d34ae999ae58f88a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
b64249d6f75fe8ff3edda701b93595d9

SHA1
0847357a0faabe13343500496267583794b11f73

SHA256
216f6696a3824afb0b3fc87d2996ef519532283831ac354c56af5f060d006d53

SHA512
ed168c32f7a6fa5ea6fad4e1411a8fe488e636bfbed8b6ee36e6fa2079c01016e6440a5b3cb601e5b889ec4addc08f7271b5b328cb46f830d75d03562169345c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
3ba6737d910a0b3a2cd7c3d45e2fade8

SHA1
7fcaafbbb70de5f0af5a3c415660c098d04475fd

SHA256
4b8aa8008bbe9cb874fbd7935a15677cde16904b0eb6535451e9c05fc2fccb07

SHA512
1ef2457d548a9ab2b792d64f01cfda00427b1350167e92d6179cab658fbf9fb3ab686ab037373d86997d9ca371860e18f4ee20ac7466bd5d02e5833753911047

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
f24648da53b2c65dcc0dab9eb44eb0d6

SHA1
72405c76b494306169973ce03174953d2f253451

SHA256
55bf7bb0619eeca54b749a878fa9b7f60b3fa39996ee1ff96b9193404b3aa42e

SHA512
972febc2435328ed88861c853eed3160ce4b0f4a58ef3b85f555193592b25c16d51ceecdd8948d411eb9f00b3851d1bbbe83da337ccead7b115ed8ff88317518

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
092d3532ee2894857bfbe271d97b69d0

SHA1
0b456bd8b49481bd2cbe5ad7f31c49ab09a98937

SHA256
ab2ab6484ed0a34b67acd87cbe54ef941d13375ab17d08220dc10c4b2049eb93

SHA512
803c56158baf87aa9d4a44a85632b6854b26e87d5dd4a4242266ee3eeeff3bc656bc56cac4ae16698f9f4f58e8d22bf3acc95bd3dbb1dc646fcb95e11e818ae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
24383797df385344142f484c6a2f9f22

SHA1
bc2e65b61d487c3bbdae9d169a2397abfb110f43

SHA256
3d7fb5c4facbf6f8eb602865c14611bfdbf989d6d733c449e9e046ea0d164b8f

SHA512
d75001a79060ff65e3ce6a6fbcbf16cad99436995af5d2a1dd2d793d188e553666a16dd6b495d21c0ba1ed0d8ade0fd4d8b50e276dd183da0a8f47072be7331c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
cd3e056e13040794fd3076723da10d04

SHA1
f71ee3b118f0392354c87432d6b39159d9a5d5d4

SHA256
aa490c484f25f3a78a9a391c1a6b82ee52ed27992cb44441c26d5bf0e767ff4b

SHA512
5ea66dd6888475eddc1326e91fc443e4a4cf1664e719453458116d5cb859dea8b5ef8aa587f408706897e261b3ddf592c3740e9a051b3bf1259b4b66beac245e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
4374e49aa4acff710f37070b61c00c12

SHA1
e70e8f48d9e30acd58fe89c5e51e5bbf9a2d270f

SHA256
4bf313e5b9706f35544c4f22bef8b46efeb90e12b3b663c4d784ea2f1a1a5b33

SHA512
a8c037a57af26ad50e5714d73748cc375f07bb55734e8987e0ab671a640eb900cbb68e1534eec262a7529aac4a463ef7ea725a27b68d4d6b523cfb37e28a818d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
7fec09b3ebd013b661e33cb14af28aa7

SHA1
1c0cb0d06edff5cdf7afa68b74530d94ddfe40ca

SHA256
d7b9ceea8946e78d783b24d82b0ba3e2ccdfe0edf6803854ca4a594f7920605b

SHA512
838bcc8cedf1600278daa50f8c14edcb49c6041ec972eb111d63a99031cd615dbfe6ff53c738e7c6c1d11e42344a6c38928fd3b80fbdea7665f5ef35f147e723

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
22KB

MD5
2985d3efb7bda951aa07ea58de78f714

SHA1
b886705072dd089b576cd5f8ac19fb4ba2cc9319

SHA256
cd4a1f958e9b8436f803a592642c969bae6347e3c291bdb55e935a9f8d5d650b

SHA512
654cb775726e5d2530b120adc4062e1d111bd5e49976b1ef42fb90ce8370f0a0250cf84897ea230ec0612a0fbd6bc72ac24c3952a517dc47f97a6dcbdc414c1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
9d34d79e5f3b7882e25d57e4dfe016b1

SHA1
d51101686d54f561c27bc7fbbe10e463e39061eb

SHA256
58340e7a9006a09e1e9a2cf7c02090d63588aa7a0b04cf69501611abd832d83e

SHA512
bc5a7678540b44561f07a822a8f3791466b77ee975695eba85df29f06a52b6f69fffa6b6f2b30112f4826889baf2f8cce29b4903c1dcf9a0f3ad5c436b03af16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
705KB

MD5
c0cf73b8a58dfb08d4d1a8e175bbb283

SHA1
77d0185a350bbbcc4ced96e142106b70537fdb2f

SHA256
11896f2ff37e2d9ad1ec8886f3ef541a1294c3b7a0d096f35a285c259abef806

SHA512
11ec6ea7425c0cc677b012a02130399491b4bfa13a67c931969614a8b771bfca68c0539eb270128c79b44bf3ebff909235c64a418829e9711466e7f6b2d3d12b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
0be400675471104b1e3e869acffe9fbb

SHA1
3c6506880e0f45b991e05e11741b511e69e8c63c

SHA256
2326ee3fef0c763c7fc9256ec9b662d47f862ad57094cdd0d7e1cc8417e7edfc

SHA512
dc42e9894edb263fec3a59f0770f4a5c0968c66214809dc0fcece1c9cf87e1fc55fe15c91a32083208e4d16a486cce84edfa6d9936867a2cb3f83ed73640fa44

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
708KB

MD5
e4808fe7e54d4c65ae5182ad17bc8679

SHA1
357a1843f6caff9cc7b72ec6276530cd04af3e13

SHA256
451a378ec4dde586220cf50662a028cd6da6ff8cc1f5504b5f69c128fab71465

SHA512
4f981f034ab532713ac955d6d95ed846a90657c943a00b14e32e86b8682792f60dc28370df5d64c6c80cb2353a8b4809a67e1e13200bfc4a9d5928115d34c0bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
aa3b797f270cb42cbe1590de17881e79

SHA1
9d0b7988597e07d0ede24888757defc5c899f8e6

SHA256
e1af4fcba851606667cf97b398f29a78f400297b97cc4b290b808557e1ddd7c0

SHA512
63f58c32681ddaac5931641279724030bfd35ad24ea0ceaf938f87edc93db343fc0c446ecebaed369d70b8c235851807457043e22a9efbb634694f772d21642a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
93b6ece53c66b2a871ea1cf4392ffaf9

SHA1
61a4f4c0d22cc151e279193e2c0052b93d85276a

SHA256
b7a988c4a54e92e6ed679f97afb6b50499e814019bf9d0cf77aaecb26819da88

SHA512
6b7af4fdd1e2b0d0f4e84c2c16139bf90eca253059a5e3fd1e242514090ec1014fa7eb8f6b70cd4569c98ce2693b29ab5febcad3500ca0c4c1e14a96ed8012d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
ef067e7e13c949bafe12a6b1703ec20b

SHA1
af2819702062e48abc0b57fed16ebd28c9489158

SHA256
58f3fe0815fdf5e61ab0276806fb8013f36d1d2fe373169e1de42799c39b2d96

SHA512
d1f2c5fe4ffd796cbc724f27dc34b17900ee1f6a6d270fcf3e421aa192f829ade3f86ea2a4cfff0a0b29dcab7d71ca2f962ac71f95b91eec0d18d5db587be2cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
ae65085772bb0c007e1e2cb3c67071c9

SHA1
be895908e18245771a10fed3a37fd5d03cd69883

SHA256
588f48284b39887cf1282cb6dff6281a18f37f40f90aa1887e8b9667706fc6ff

SHA512
f663ba878003f9c58f1036d030bf614edff63677f18ba07ff7642eeb23fc0acf88ef680f1a38524f95f4f000d742897cdc9ff5d1561000d606118ce386b4990b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
710KB

MD5
be1db4d1384141daeb5dddbec08569b9

SHA1
59c320071e4399409c56e780ccc70d86f34e5073

SHA256
ffef8e59e3cf4e3b246d11fd7f8dd6cc2e9cd371efd4034c9f013f315bea8fcc

SHA512
7da345f5523928c3a4db661fa8120ea66e933f0a009193bc49f67382456d0c821d802459683380e939e1b154d3f59869391957f7ad4e68f6506fd2d2283605ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
cf4a2ef8cfbae58acf3422faf895574e

SHA1
ca89dd71f121236e6cef00386941361b75cf9be4

SHA256
4f277a94d62ca96a3a706921cbd7c6fc7fdb274aa26ebd0c27d586c8bf5a5862

SHA512
17cd1c35902eab115e5e04cce34e285b5e8f6b949eac0c3a1f916b84f3036e1e691538919cfadf64b9610e519d6b62513a68da3b4b3a2d4a6d8d40104d43a3a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
717KB

MD5
335e83b01fab6fada6b52b85fdf283fd

SHA1
4990e3462da4413c51e982ec1bea49acfeb65355

SHA256
73f946249c99ebef7555f71181a1516ccf41754ed5f7f7ca3b45a536b911ffe1

SHA512
6344cf4376e7aa58e35b6e0da520339de022c68657c561d8dad4af9a5135997ddd2e121c4318e3f47b96d0c5908514daa0c95d0b69bf386e25b6afc0dbd039f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
60cfbf178ae2c1213ae694e50f397771

SHA1
3ffb2baa390d96cd277cb58a41947f8a6c8e922a

SHA256
e4c51e754d6ecd5cc49cc4dbe6f797b055d92cfd7080da41edc35fc6796da311

SHA512
bf748ad21d78e8914f8beeeec9c6d5e98c69546d482a24c0ad5610dfd7035e6a970ad4cc14dbeb2e8bf7034a5da6d5ff11c03890475b7f8aa03e5d93a049a167

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
4753f7f8a4b642faeea9262198117c83

SHA1
cffcd41680c595cb833ff8f6521e4e36b2f733ad

SHA256
451a0a011cd006b650c51037089e53545185a3505b2149bbc7f75a283383bbe7

SHA512
58193fcb3a161ba8e2fc7eefa51e5882ec9d37ff6a3a6127fe09f63036ecc0a3f094ccc5d2058c4c23d4e0f4bd46a148a1430536e5ab9ff5ba7ce97d0d8143e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
23KB

MD5
030299bf01f14d75f451a89e7f41c05b

SHA1
6786b28c549b0ed86b3e187c61dc55821e64c485

SHA256
503a26e17ade83f94100fa3464a80228511d4e31b15e7fb6a4e1130b952dd487

SHA512
2815dd275bc2d733e51dbb052225ae3d841dac06593633285336167a5478d69c70628d029bc3e41e0d055b266781cea2fcc9e3b197589aa31b49c36869b8b081

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
718KB

MD5
0a628428807b8dafc5117c402ec7d8dd

SHA1
9484686319b790a7473e1ebc14ead048b5774cb8

SHA256
f431ea9e8adbb995c11962627f6b746f1be9aca661c8422b5cec1df0a7d183da

SHA512
4ec6f02324ab2d773a02d64bbb58a17fa2377747741c68351917886252cf3de68afb6e4cd50e521fe05b8cbf58563791f103126b361239db4826c67dca90439c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
705KB

MD5
e8bb256d6299cef39e4ecefee36ecad6

SHA1
b2bd93670e65aff3f4cbe878031eb75d0bf05499

SHA256
971b2ed9a84d9d202f2986b84d92620e4648deed02d4d6c131164eb40acf06d5

SHA512
0fdf301ec86429a83ae897e9b6f5ca6ad4008809089be6562d44c3b2b0db027c26c4e4c5b7a015a9cc8e0bbe5d61e654b88811188f7c24b57c8d5c6777d6eb98

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
707KB

MD5
8897f5943cb755bd1a07b306dc8e6c70

SHA1
c6ad16d28655700ffb05e75edabe0c3877109bd3

SHA256
ffc00c8ad94f996669ab7b4b8f1704da53c3f3fe374e3df4d0eb5ff5227ebeee

SHA512
757f8001a5854b65abc708a42fc094ea84eac80bf964d688712d51a84286de95313a2e8a413af17191f17b6595f31b885ec486c53e8f657065a37ef6fab070e6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
708KB

MD5
5f04edd2b115bfff21245d22a31030e4

SHA1
1a1d15d0f2edf6baffbcf3b704cea0f07952311f

SHA256
dc24927b4af3eaa0e5525486dcda80066958817b62c894c078c5e0e4e97cf849

SHA512
cb24117ef5efe287f4abdf4f2d59b94ae81d08ef23dbded461f324f2880bac98c2630fe4f9bac7167a690b9c74f4cb913b6589d47a4a11e944b8bbfed0de6b5b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
708KB

MD5
3580a5397d66534d8923627a70b0b98b

SHA1
2f8c05ead773788d5a9de2761f69bc900dd31a2e

SHA256
72121c6f2317f82599163a59645c9f6965b6bec6274394f44a8bea2b56887246

SHA512
633e1235cb14673408d42f35e43482e74d4856ddad4fd6ff1417baa3cdab968c2b1baecdb6268a9dea2c8aab682e23aac0cbeb4fc33474ab71e203040be12b44

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
717KB

MD5
2c7e29f7294531e7b2b4812feaa931a8

SHA1
2bf7686c56c04bc83004a4629c26813f35c10692

SHA256
af9dc610d4ffb629566a298f64781f9281e83f12b5042fd84491637535e4c264

SHA512
25961cbc7a5396f1c1fefd51c5f36ec24d40589bb8ad2880e62a33307b6f08e51b8f9e80501fedba19ba67e5791e752f5615744a29ad4b4acc83c9afae149ddb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
717KB

MD5
f5b6d4ef8b6802b72caefaefa20caf3e

SHA1
f39d988907541744a174fa0f92f26fb53ccdf61e

SHA256
1c12810eacdc535cd93fa1e2131938049fbb4a518fbde0d58fb05775f7e58b02

SHA512
5d13f2431269019c93de24179211942c0d202608893007b79e240b3fb9cbccd4bf716ed9949b4e04cd5a89a5759d923f477c465e97f995418050f3fe66859824

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\storage\default\https+++www.google.com^partitionKey=%28https%2Csoftonic.com%29\ls\data.sqlite

Filesize
6KB

MD5
24baacde6274a7a94e61fe6918887fb9

SHA1
a9e2a985facf2e126569c98d0732973a7a58ef28

SHA256
173161217bf22271f76c57632b1654f196e6cfb8729ec81c4d8fabc0ad6b1fda

SHA512
8bcfa4be66b8a829a9feb389f4f4a81d18cfc453d741894d798a270c90653cab7d82d6d19fb19faba423cb3595135be5003fdaaf59eaddf2b24a730b0af043f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\storage\default\https+++www.patreon.com\idb\3713173747_s_edmban.sqlite

Filesize
48KB

MD5
df029e2cd5ab3c5bccab9b868ef70c8b

SHA1
7ef3870c1b444f5c349274e22145d2d8681cea74

SHA256
e84dedfdc2f971e3983f0a138d7729276756686e98524205be88303972f6ebd0

SHA512
b7c7a15b5001d4b8b0796d4303adb7f5ba8c671f94e62b0af5176aea83284293e03022e7c262f7c48ca2176c85c62ecbc28ce31025015567448d677140fa0a0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.1MB

MD5
4821528df205870e5310dbca6633d118

SHA1
5a7b7e722d770b3db93c71eafdd8db944b06b0d7

SHA256
44dccdf86fe31ebeae99891d9c7030c989195a2fce3bb0e1744e37dc9fff49c0

SHA512
e0246e0fc44ba93fcae04bc64a986e61d5cf06da2f177c4911b3e02fe189c461323c0814b07b1c0ef95d8dc5cf186f9110e53f7ae534a69b2bf1174b19c65cd0

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP\Network\Network Persistent State

Filesize
300B

MD5
8b9c075f298fe4ce5bcc4d54e7b1409b

SHA1
52b0a141e87a28dc55469d3918232a93dc9d1935

SHA256
d0f2844518447aff8dfd6c7ca362d562180b6ec413c17eb384140a1dcd3f7744

SHA512
380848fb3b14db85b31e60c0c73ca558feef24033155489fd82d48f60f23dcfe4fced1017ff90134953168e153be902a182a2b0a9db0747cc022954c9780cbf2

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP\Partitions\plan-picker_5.28.2\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP\Partitions\plan-picker_5.28.2\Network\Network Persistent State

Filesize
300B

MD5
ebb98e6fbd2ea6e7fef37ed6b8f163ce

SHA1
50f5df18d7e5920ca666cbcf6d5664b5d3cc5e47

SHA256
e80492a7ea5c39dcd54a655152b905e4ac4c9a4af697b42c7a5b61451c8488ba

SHA512
93893a5059b056689ed5b74f64897642cb8eb9c079649be8e909acc648593f7cdbf15c821198694b76ba100aceed82fbb43df58cf0ef571d2a0fa2de87913f1e

Download Submit
C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP\Partitions\plan-picker_5.28.2\Network\Network Persistent State

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\XuanZhi9\ldopengl32x.dll

Filesize
73KB

MD5
13a91913194e332beb95142e083f25cd

SHA1
0dced7b0ff24c027f2fa15b8d70af8aed4ef713f

SHA256
70bc64233308eb16b33dac7fd03b671c87940ebb2ac5edeb83b8813a1280767a

SHA512
56b62e5a5db5c914dea98ec01dcb11b1addf93be3ad72de2c67382425564d1fd3cae963257357c04ba38132c38655fadaa28ec287b8b4eca1fd0ff7981979b11

Download Submit
C:\Users\Admin\Downloads\ArcticBomb.exe

Filesize
125KB

MD5
ea534626d73f9eb0e134de9885054892

SHA1
ab03e674b407aecf29c907b39717dec004843b13

SHA256
322eb96fc33119d8ed21b45f1cd57670f74fb42fd8888275ca4879dce1c1511c

SHA512
c8cda90323fd94387a566641ec48cb086540a400726032f3261151afe8a981730688a4dcd0983d9585355e22833a035ef627dbd1f643c4399f9ddce118a3a851

Download Submit
C:\Users\Admin\Downloads\ColorBug.exe

Filesize
53KB

MD5
6536b10e5a713803d034c607d2de19e3

SHA1
a6000c05f565a36d2250bdab2ce78f505ca624b7

SHA256
775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de

SHA512
61727cf0b150aad6965b4f118f33fd43600fb23dde5f0a3e780cc9998dfcc038b7542bfae9043ce28fb08d613c2a91ff9166f28a2a449d0e3253adc2cb110018

Download Submit
C:\Users\Admin\Downloads\Floxif.exe

Filesize
532KB

MD5
00add4a97311b2b8b6264674335caab6

SHA1
3688de985909cc9f9fa6e0a4f2e43d986fe6d0ec

SHA256
812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f

SHA512
aaf5dae929e6b5809b77b6a79ab833e548b66fb628afeb20b554d678947494a6804cb3d59bf6bbcb2b14cede1a0609aa41f8e7fe8a7999d578e8b7af7144cb70

Download Submit
C:\Users\Admin\Downloads\Gnil.exe

Filesize
73KB

MD5
37e887b7a048ddb9013c8d2a26d5b740

SHA1
713b4678c05a76dbd22e6f8d738c9ef655e70226

SHA256
24c0638ff7571c7f4df5bcddd50bc478195823e934481fa3ee96eb1d1c4b4a1b

SHA512
99f74eb00c6f6d1cbecb4d88e1056222e236cb85cf2a421243b63cd481939d3c4693e08edde743722d3320c27573fbcc99bf749ff72b857831e4b6667374b8af

Download Submit
C:\Users\Admin\Downloads\Mabezat.exe

Filesize
141KB

MD5
de8d08a3018dfe8fd04ed525d30bb612

SHA1
a65d97c20e777d04fb4f3c465b82e8c456edba24

SHA256
2ae0c4a5f1fedf964e2f8a486bf0ee5d1816aac30c889458a9ac113d13b50ceb

SHA512
cc4bbf71024732addda3a30a511ce33ce41cbed2d507dfc7391e8367ddf9a5c4906a57bf8310e3f6535646f6d365835c7e49b95584d1114faf2738dcb1eb451a

Download Submit
C:\Users\Admin\Downloads\WinNuke.98.exe

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier

Filesize
50B

MD5
dce5191790621b5e424478ca69c47f55

SHA1
ae356a67d337afa5933e3e679e84854deeace048

SHA256
86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8

SHA512
a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641

Download Submit
C:\Users\Admin\Downloads\avg_secure_browser_setup.Og1yDlqA.exe.part

Filesize
48KB

MD5
8b25fbe15b30c93214a9f9ec5d6f86c7

SHA1
455bff4c2dd512b42bc1f358ea23e178a9868c4c

SHA256
809745e97136001027bc75b6a841134c099305a46326a45dec5d799d774d6406

SHA512
be7d395ab05eab0751dcb3537f9f43293f7a3a7369e727637b4bd061dfe3461c97fec44b6fc5da9ba3155050e0be561757ea6469d10e552b55a07681cc4969a0

Download Submit
C:\Users\Admin\Downloads\rZrOtwF-.exe.part

Filesize
2KB

MD5
a56d479405b23976f162f3a4a74e48aa

SHA1
f4f433b3f56315e1d469148bdfd835469526262f

SHA256
17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23

SHA512
f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a

Download Submit
C:\Users\Admin\Downloads\xpaj.exe

Filesize
219KB

MD5
d5c12fcfeebbe63f74026601cd7f39b2

SHA1
50281de9abb1bec1b6a1f13ccd3ce3493dee8850

SHA256
9db7ef2d1495dba921f3084b05d95e418a16f4c5e8de93738abef2479ad5b0da

SHA512
132d8c08f40a578c1dc6ac029bf2a61535087ce949ff84dbec8577505c4462358a1d9ef6cd3f58078fdcae5261d7a87348a701c28ce2357f17ecc2bc9da15b4e

Download Submit
C:\Users\Admin\Downloads\xpajB.exe

Filesize
520KB

MD5
bd76fc01deed43cd6e368a1f860d44ed

SHA1
a2e241e9af346714e93c0600f160d05c95839768

SHA256
e04c85cd4bffa1f5465ff62c9baf0b29b7b2faddf7362789013fbac8c90268bf

SHA512
d0ebe108f5baf156ecd9e1bf41e23a76b043fcaac78ff5761fdca2740b71241bd827e861ada957891fbc426b3d7baa87d10724765c45e25f25aa7bd6d31ab4ec

Download Submit
C:\Windows\Installer\e60cce9.msi

Filesize
32KB

MD5
66140e921ffc869e5dbd7d0337503f1a

SHA1
cc26b0818dbb2a4d3e242fd1caf7b45e036961c0

SHA256
d2ef84b42a4358e58f5566d842c389b229ba073fcef20b2a3007b6ce76a06d2b

SHA512
eb4a787e76a6700112349b5eba78a4467ba4a2364d30eade70acba480e4df1c5d48bcb31ca136f81b350c466911af97cb1da1ba964c2d35003a4e3e86c738772

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
245KB

MD5
c6fb4a0d8f1fda3ff621ad28528a6f34

SHA1
e242f9fb6140e7307389735daf8bb3437f4fdf3f

SHA256
e401efce637af1b962cd1112ced1fafbab0b6f6031d144e58b609c8bce2f3beb

SHA512
7f2ef1eeb9e4a79c06d08f80da8158f5c6cbb5130281fe4ae9fd8cdd4a4bfcb5d8fae56537da8898ca79ccaa7c7a758c61a550b5736e9483593011f42e7433f5

Download Submit
F:\LDPlayer\LDPlayer9\dnmultiplayer.exe

Filesize
1.2MB

MD5
0c81805493ab6e2ea8855e27dad4b63e

SHA1
2d1985e253b79f0071cf74ce067faf4d412d14db

SHA256
1beac1e13687b2200fdad579cc93d8216788a9adcaf0885b62af24fa1974c82d

SHA512
a69d94b97a5e74b418060c7d7902dee05ec6a02302fc2f063fb96b38fd6966a9c8419d73208f570b045d29b1f69c7c26dbe9f85abc1aeb7e4a6b4b17f0b7efd4

Download Submit
F:\LDPlayer\LDPlayer9\dnplayer.exe

Filesize
3.5MB

MD5
f9ddc9083ffa20efd46386eca87582bb

SHA1
8558d23be32806ae0dc6e85dbb548f1507240b1e

SHA256
c2dd00c3f8b25ff6b5d58317249bcd69a150bc29179bfb63cc2242fef4651cea

SHA512
3efed140be34ac956298959ee7dca4161c7b9afd0e06faccc1cfe65def71dd1c856cc16b80d6ad1536f3c7605f3501a75df3220b17654e4708306150deab3276

Download Submit
F:\LDPlayer\LDPlayer9\fonts\NotoSans-Regular.otf

Filesize
17.4MB

MD5
93b877811441a5ae311762a7cb6fb1e1

SHA1
339e033fd4fbb131c2d9b964354c68cd2cf18bd1

SHA256
b3899a2bb84ce5e0d61cc55c49df2d29ba90d301b71a84e8c648416ec96efc8b

SHA512
7f053cec61fbddae0184d858c3ef3e8bf298b4417d25b84ac1fc888c052eca252b24f7abfff7783442a1b80cc9fc2ce777dda323991cc4dc79039f4c17e21df4

Download Submit
F:\LDPlayer\LDPlayer9\fonts\Roboto-Regular.otf

Filesize
103KB

MD5
4acd5f0e312730f1d8b8805f3699c184

SHA1
67c957e102bf2b2a86c5708257bc32f91c006739

SHA256
72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5

SHA512
9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837

Download Submit
F:\LDPlayer\LDPlayer9\ldmutiplayer\7za.exe

Filesize
652KB

MD5
ad9d7cbdb4b19fb65960d69126e3ff68

SHA1
dcdc0e609a4e9d5ff9d96918c30cb79c6602cb3d

SHA256
a6c324f2925b3b3dbd2ad989e8d09c33ecc150496321ae5a1722ab097708f326

SHA512
f0196bee7ad8005a36eea86e31429d2c78e96d57b53ff4a64b3e529a54670fa042322a3c3a21557c96b0b3134bf81f238a9e35124b2d0ce80c61ed548a9791e7

Download Submit
F:\LDPlayer\LDPlayer9\ldmutiplayer\cximagecrt.dll

Filesize
1.5MB

MD5
66df6f7b7a98ff750aade522c22d239a

SHA1
f69464fe18ed03de597bb46482ae899f43c94617

SHA256
91e3035a01437b54adda33d424060c57320504e7e6a0c85db2654815ba29c71f

SHA512
48d4513e09edd7f270614258b2750d5e98f0dbce671ba41a524994e96ed3df657fce67545153ca32d2bf7efcb35371cae12c4264df9053e4eb5e6b28014ed20e

Download Submit
F:\LDPlayer\LDPlayer9\ldmutiplayer\dnresource.rcc

Filesize
5.0MB

MD5
f845753af4cc7b94f180fb76787e3bc2

SHA1
76ca7babbb655d749c9ed69e0b8875370320cc5a

SHA256
a19a6c0c644ce0e655eaf38a8dbddf05e55048ba52309366a5333e1b50bde990

SHA512
0a3062057622ffcff80c9c5f872abdf59a36131bfc60532c853ea858774d89fed27343f838dfe341dafe8444538fc6e2103d3aa19ef9d264e0f8e761c4bfce81

Download Submit
F:\LDPlayer\LDPlayer9\ldmutiplayer\libcrypto-1_1.dll

Filesize
2.0MB

MD5
01c4246df55a5fff93d086bb56110d2b

SHA1
e2939375c4dd7b478913328b88eaa3c91913cfdc

SHA256
c9501469ad2a2745509ab2d0db8b846f2bfb4ec019b98589d311a4bd7ac89889

SHA512
39524d5b8fc7c9d0602bc6733776237522dcca5f51cc6ceebd5a5d2c4cbda904042cee2f611a9c9477cc7e08e8eadd8915bf41c7c78e097b5e50786143e98196

Download Submit
F:\LDPlayer\LDPlayer9\ldmutiplayer\libcurl.dll

Filesize
442KB

MD5
2d40f6c6a4f88c8c2685ee25b53ec00d

SHA1
faf96bac1e7665aa07029d8f94e1ac84014a863b

SHA256
1d7037da4222de3d7ca0af6a54b2942d58589c264333ef814cb131d703b5c334

SHA512
4e6d0dc0dc3fb7e57c6d7843074ee7c89c777e9005893e089939eb765d9b6fb12f0e774dc1814f6a34e75d1775e19e62782465731fd5605182e7984d798ba779

Download Submit
F:\LDPlayer\LDPlayer9\ldmutiplayer\libssh2.dll

Filesize
192KB

MD5
52c43baddd43be63fbfb398722f3b01d

SHA1
be1b1064fdda4dde4b72ef523b8e02c050ccd820

SHA256
8c91023203f3d360c0629ffd20c950061566fb6c780c83eaa52fb26abb6be86f

SHA512
04cc3d8e31bd7444068468dd32ffcc9092881ca4aaea7c92292e5f1b541f877bdec964774562cb7a531c3386220d88b005660a2b5a82957e28350a381bea1b28

Download Submit
F:\LDPlayer\LDPlayer9\ldmutiplayer\libssl-1_1.dll

Filesize
511KB

MD5
e8fd6da54f056363b284608c3f6a832e

SHA1
32e88b82fd398568517ab03b33e9765b59c4946d

SHA256
b681fd3c3b3f2d59f6a14be31e761d5929e104be06aa77c883ada9675ca6e9fd

SHA512
4f997deebf308de29a044e4ff2e8540235a41ea319268aa202e41a2be738b8d50f990ecc68f4a737a374f6d5f39ce8855edf0e2bb30ce274f75388e3ddd8c10b

Download Submit
F:\LDPlayer\LDPlayer9\ldmutiplayer\msvcp110.dll

Filesize
522KB

MD5
3e29914113ec4b968ba5eb1f6d194a0a

SHA1
557b67e372e85eb39989cb53cffd3ef1adabb9fe

SHA256
c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a

SHA512
75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43

Download Submit
F:\LDPlayer\LDPlayer9\ldmutiplayer\msvcr110.dll

Filesize
854KB

MD5
4ba25d2cbe1587a841dcfb8c8c4a6ea6

SHA1
52693d4b5e0b55a929099b680348c3932f2c3c62

SHA256
b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49

SHA512
82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6

Download Submit
F:\LDPlayer\LDPlayer9\ldmutiplayer\ssleay32.dll

Filesize
283KB

MD5
0054560df6c69d2067689433172088ef

SHA1
a30042b77ebd7c704be0e986349030bcdb82857d

SHA256
72553b45a5a7d2b4be026d59ceb3efb389c686636c6da926ffb0ca653494e750

SHA512
418190401b83de32a8ce752f399b00c091afad5e3b21357a53c134cce3b4199e660572ee71e18b5c2f364d3b2509b5365d7b569d6d9da5c79ae78c572c1d0ba0

Download Submit
F:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk

Filesize
35.1MB

MD5
4d592fd525e977bf3d832cdb1482faa0

SHA1
131c31bcff32d11b6eda41c9f1e2e26cc5fbc0ef

SHA256
f90ace0994c8cae3a6a95e8c68ca460e68f1662a78a77a2b38eba13cc8e487b6

SHA512
afa31b31e1d137a559190528998085c52602d79a618d930e8c425001fdfbd2437f732beda3d53f2d0e1fc770187184c3fb407828ac39f00967bf4ae015c6ba77

Download Submit
F:\LDPlayer\ldmutiplayer\libeay32.dll

Filesize
1.2MB

MD5
ba46e6e1c5861617b4d97de00149b905

SHA1
4affc8aab49c7dc3ceeca81391c4f737d7672b32

SHA256
2eac0a690be435dd72b7a269ee761340099bf444edb4f447fa0030023cbf8e1e

SHA512
bf892b86477d63287f42385c0a944eee6354c7ae557b039516bf8932c7140ca8811b7ae7ac111805773495cf6854586e8a0e75e14dbb24eba56e4683029767b6

Download Submit
F:\LDPlayer\ldmutiplayer\msvcp120.dll

Filesize
444KB

MD5
50260b0f19aaa7e37c4082fecef8ff41

SHA1
ce672489b29baa7119881497ed5044b21ad8fe30

SHA256
891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9

SHA512
6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d

Download Submit
F:\LDPlayer\ldmutiplayer\msvcr120.dll

Filesize
947KB

MD5
50097ec217ce0ebb9b4caa09cd2cd73a

SHA1
8cd3018c4170072464fbcd7cba563df1fc2b884c

SHA256
2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112

SHA512
ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058

Download Submit
memory/980-6379-0x000001DEE0B50000-0x000001DEE0B80000-memory.dmp

Filesize
192KB

Download
memory/980-9906-0x000001DEFB250000-0x000001DEFB27A000-memory.dmp

Filesize
168KB

Download
memory/980-6377-0x000001DEE0540000-0x000001DEE05C8000-memory.dmp

Filesize
544KB

Download
memory/980-6378-0x000001DEE09C0000-0x000001DEE0A00000-memory.dmp

Filesize
256KB

Download
memory/980-9943-0x000001DEFB330000-0x000001DEFB35E000-memory.dmp

Filesize
184KB

Download
memory/980-9868-0x000001DEFB1A0000-0x000001DEFB1DA000-memory.dmp

Filesize
232KB

Download
memory/980-6380-0x000001DEFAB80000-0x000001DEFABBA000-memory.dmp

Filesize
232KB

Download
memory/980-9311-0x000001DEFB110000-0x000001DEFB160000-memory.dmp

Filesize
320KB

Download
memory/980-9881-0x000001DEFB1A0000-0x000001DEFB1D0000-memory.dmp

Filesize
192KB

Download
memory/980-6381-0x000001DEFAB40000-0x000001DEFAB6A000-memory.dmp

Filesize
168KB

Download
memory/980-6386-0x000001DEFACA0000-0x000001DEFACF8000-memory.dmp

Filesize
352KB

Download
memory/1620-808-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1620-800-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2568-704-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2568-706-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3588-709-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3604-855-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3604-857-0x0000000000A20000-0x0000000000A95000-memory.dmp

Filesize
468KB

Download
memory/3604-859-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3680-560-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download
memory/4556-738-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-2274-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-2502-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-1478-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-2526-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-1034-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-838-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-790-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-863-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-647-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-1651-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-1771-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-901-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-661-0x0000000000454000-0x000000000047C000-memory.dmp

Filesize
160KB

Download
memory/4556-664-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-2804-0x0000000000730000-0x0000000000754000-memory.dmp

Filesize
144KB

Download
memory/4556-689-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-690-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-705-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-2098-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-626-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-624-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-625-0x0000000000454000-0x000000000047C000-memory.dmp

Filesize
160KB

Download
memory/4556-627-0x0000000000770000-0x0000000000772000-memory.dmp

Filesize
8KB

Download
memory/4556-628-0x0000000000730000-0x0000000000754000-memory.dmp

Filesize
144KB

Download
memory/4556-1016-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-629-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-2803-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-631-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-2588-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-718-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-735-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-758-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-2716-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4556-1545-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4664-805-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4664-807-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4800-787-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4800-778-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4908-785-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4908-786-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5036-654-0x0000026D96450000-0x0000026D96451000-memory.dmp

Filesize
4KB

Download
memory/5036-660-0x0000026D96450000-0x0000026D96451000-memory.dmp

Filesize
4KB

Download
memory/5036-649-0x0000026D96450000-0x0000026D96451000-memory.dmp

Filesize
4KB

Download
memory/5036-655-0x0000026D96450000-0x0000026D96451000-memory.dmp

Filesize
4KB

Download
memory/5036-656-0x0000026D96450000-0x0000026D96451000-memory.dmp

Filesize
4KB

Download
memory/5036-657-0x0000026D96450000-0x0000026D96451000-memory.dmp

Filesize
4KB

Download
memory/5036-658-0x0000026D96450000-0x0000026D96451000-memory.dmp

Filesize
4KB

Download
memory/5036-650-0x0000026D96450000-0x0000026D96451000-memory.dmp

Filesize
4KB

Download
memory/5036-648-0x0000026D96450000-0x0000026D96451000-memory.dmp

Filesize
4KB

Download
memory/5036-659-0x0000026D96450000-0x0000026D96451000-memory.dmp

Filesize
4KB

Download
memory/5248-10008-0x0000022351160000-0x000002235118E000-memory.dmp

Filesize
184KB

Download
memory/5248-10009-0x0000022351160000-0x000002235118E000-memory.dmp

Filesize
184KB

Download
memory/5248-10034-0x0000022351580000-0x0000022351592000-memory.dmp

Filesize
72KB

Download
memory/5248-10036-0x0000022352DB0000-0x0000022352DEC000-memory.dmp

Filesize
240KB

Download
memory/5788-2629-0x00007FFC7B430000-0x00007FFC7B440000-memory.dmp

Filesize
64KB

Download
memory/5788-2628-0x00007FFC7B430000-0x00007FFC7B440000-memory.dmp

Filesize
64KB

Download
memory/6004-2636-0x00007FFC7B430000-0x00007FFC7B440000-memory.dmp

Filesize
64KB

Download
memory/8008-6303-0x000001FF94EE0000-0x000001FF94EE8000-memory.dmp

Filesize
32KB

Download
memory/8008-6304-0x000001FFAF8A0000-0x000001FFAFDC8000-memory.dmp

Filesize
5.2MB

Download
memory/8152-6282-0x000000006DD00000-0x000000006DD3F000-memory.dmp

Filesize
252KB

Download
memory/8152-6283-0x0000000008ED0000-0x0000000008ED4000-memory.dmp

Filesize
16KB

Download
memory/8152-6139-0x0000000006740000-0x0000000006754000-memory.dmp

Filesize
80KB

Download
memory/8152-6284-0x0000000006470000-0x0000000006494000-memory.dmp

Filesize
144KB

Download
memory/8152-6140-0x0000000073500000-0x0000000073514000-memory.dmp

Filesize
80KB

Download
memory/8152-6141-0x0000000008F50000-0x00000000094F4000-memory.dmp

Filesize
5.6MB

Download
memory/8152-6182-0x0000000008D50000-0x0000000008D5A000-memory.dmp

Filesize
40KB

Download
memory/8152-6158-0x000000000A670000-0x000000000AB9C000-memory.dmp

Filesize
5.2MB

Download
memory/8152-6154-0x000000000A0D0000-0x000000000A136000-memory.dmp

Filesize
408KB

Download
memory/8152-6153-0x000000000A030000-0x000000000A0CC000-memory.dmp

Filesize
624KB

Download
memory/8152-6152-0x0000000009F50000-0x0000000009F94000-memory.dmp

Filesize
272KB

Download
memory/8152-6143-0x0000000008AA0000-0x0000000008B32000-memory.dmp

Filesize
584KB

Download
memory/8316-10315-0x000001F641640000-0x000001F64167A000-memory.dmp

Filesize
232KB

Download
memory/8316-10304-0x000001F641330000-0x000001F64137F000-memory.dmp

Filesize
316KB

Download
memory/8316-10157-0x000001F6410A0000-0x000001F641114000-memory.dmp

Filesize
464KB

Download
memory/8316-10158-0x000001F640980000-0x000001F6409A4000-memory.dmp

Filesize
144KB

Download
memory/8316-10181-0x000001F6409F0000-0x000001F640A24000-memory.dmp

Filesize
208KB

Download
memory/8316-10188-0x000001F640BC0000-0x000001F640BEE000-memory.dmp

Filesize
184KB

Download
memory/8316-10189-0x000001F641180000-0x000001F6411D6000-memory.dmp

Filesize
344KB

Download
memory/8316-10196-0x000001F641890000-0x000001F641AD2000-memory.dmp

Filesize
2.3MB

Download
memory/8316-10288-0x000001F641120000-0x000001F641152000-memory.dmp

Filesize
200KB

Download
memory/8316-10289-0x000001F6411E0000-0x000001F64120E000-memory.dmp

Filesize
184KB

Download
memory/8316-10291-0x000001F641240000-0x000001F64126E000-memory.dmp

Filesize
184KB

Download
memory/8316-10301-0x000001F6412D0000-0x000001F64132E000-memory.dmp

Filesize
376KB

Download
memory/8316-10317-0x000001F641680000-0x000001F6416A6000-memory.dmp

Filesize
152KB

Download
memory/8316-10316-0x000001F640C00000-0x000001F640C26000-memory.dmp

Filesize
152KB

Download
memory/8316-10314-0x000001F6416B0000-0x000001F641716000-memory.dmp

Filesize
408KB

Download
memory/8316-10311-0x000001F6420E0000-0x000001F642366000-memory.dmp

Filesize
2.5MB

Download
memory/8316-10156-0x000001F6408F0000-0x000001F640914000-memory.dmp

Filesize
144KB

Download
memory/8316-10302-0x000001F641AE0000-0x000001F641E49000-memory.dmp

Filesize
3.4MB

Download
memory/8788-10068-0x000001D6608D0000-0x000001D660C36000-memory.dmp

Filesize
3.4MB

Download
memory/8788-10071-0x000001D647DF0000-0x000001D647E12000-memory.dmp

Filesize
136KB

Download
memory/8788-10070-0x000001D6478E0000-0x000001D6478FA000-memory.dmp

Filesize
104KB

Download
memory/8788-10069-0x000001D660C40000-0x000001D660DBC000-memory.dmp

Filesize
1.5MB

Download
memory/8924-6861-0x00007FF791760000-0x00007FF791770000-memory.dmp

Filesize
64KB

Download
memory/8924-6846-0x00007FF791760000-0x00007FF791770000-memory.dmp

Filesize
64KB

Download
memory/8924-6679-0x00007FF7A7E20000-0x00007FF7A7E30000-memory.dmp

Filesize
64KB

Download
memory/8924-6836-0x00007FF7A7E20000-0x00007FF7A7E30000-memory.dmp

Filesize
64KB

Download
memory/9076-10147-0x000002B8A8970000-0x000002B8A8B92000-memory.dmp

Filesize
2.1MB

Download
memory/9076-10094-0x000002B8A8350000-0x000002B8A8968000-memory.dmp

Filesize
6.1MB

Download
memory/9076-10092-0x000002B8A7B70000-0x000002B8A7BA2000-memory.dmp

Filesize
200KB

Download
memory/9076-10082-0x000002B88D590000-0x000002B88D5E4000-memory.dmp

Filesize
336KB

Download
memory/9076-10080-0x000002B8A7B40000-0x000002B8A7B66000-memory.dmp

Filesize
152KB

Download
memory/9076-10079-0x000002B88DA50000-0x000002B88DAA4000-memory.dmp

Filesize
336KB

Download
memory/9076-10078-0x000002B88D590000-0x000002B88D5E4000-memory.dmp

Filesize
336KB

Download
memory/9404-9967-0x0000000005F40000-0x0000000005F62000-memory.dmp

Filesize
136KB

Download
memory/9404-10020-0x000000006D9D0000-0x000000006DA1C000-memory.dmp

Filesize
304KB

Download
memory/9404-9965-0x0000000002F00000-0x0000000002F36000-memory.dmp

Filesize
216KB

Download
memory/9404-9966-0x0000000005910000-0x0000000005F38000-memory.dmp

Filesize
6.2MB

Download
memory/9404-10038-0x0000000007AF0000-0x0000000007B0A000-memory.dmp

Filesize
104KB

Download
memory/9404-10037-0x0000000008130000-0x00000000087AA000-memory.dmp

Filesize
6.5MB

Download
memory/9404-10039-0x0000000007B60000-0x0000000007B6A000-memory.dmp

Filesize
40KB

Download
memory/9404-10048-0x0000000007D70000-0x0000000007E06000-memory.dmp

Filesize
600KB

Download
memory/9404-10049-0x0000000007CF0000-0x0000000007D01000-memory.dmp

Filesize
68KB

Download
memory/9404-10067-0x0000000007E10000-0x0000000007E2A000-memory.dmp

Filesize
104KB

Download
memory/9404-10066-0x0000000007D30000-0x0000000007D3E000-memory.dmp

Filesize
56KB

Download
memory/9404-10035-0x00000000079C0000-0x0000000007A63000-memory.dmp

Filesize
652KB

Download
memory/9404-9968-0x00000000060E0000-0x0000000006146000-memory.dmp

Filesize
408KB

Download
memory/9404-9969-0x00000000061C0000-0x0000000006514000-memory.dmp

Filesize
3.3MB

Download
memory/9404-9980-0x00000000067D0000-0x00000000067EE000-memory.dmp

Filesize
120KB

Download
memory/9404-9981-0x0000000006D30000-0x0000000006D7C000-memory.dmp

Filesize
304KB

Download
memory/9404-10019-0x0000000007780000-0x00000000077B2000-memory.dmp

Filesize
200KB

Download
memory/9404-10031-0x0000000006D90000-0x0000000006DAE000-memory.dmp

Filesize
120KB

Download
memory/9456-10124-0x000000006D9D0000-0x000000006DA1C000-memory.dmp

Filesize
304KB

Download
memory/9764-10310-0x00000000065B0000-0x00000000065FC000-memory.dmp

Filesize
304KB

Download
memory/9764-10303-0x0000000005B40000-0x0000000005E94000-memory.dmp

Filesize
3.3MB

Download