Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	N/A	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	discord.com	N/A	N/A
N/A	discord.com	N/A	N/A

Detected potential entity reuse from brand microsoft.

phishing microsoft

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 70575a45e9b9da01	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7851DB31-25DC-11EF-A3F8-62949D229D16} = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DD76E31-25DC-11EF-A3F8-62949D229D16} = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "4"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078bfc26fc4742f4cb1a3219b6762c9f900000000020000000000106600000001000020000000f7613c228e0d7c556c7e5c27ee9943dd39d389a59835845414b54282798bdd58000000000e80000000020000200000004b1a68cd40bbe5586afa4daba67573a696edf2f94df31195e7274e111d85f95c9000000000b44062304d8b69107e6fcfefc6a4fb3a44793a9dc5e1b93ad1dc30f53873c08883d95286dc775ed2e906e58b36626eea3f52636dbe83b4179adc43420f8ce89e00321736772f40fa29277dd5162105e344bbd8b8dba0298850533eb11929dfbf840a1f45177d3dff3a6a1ff504edcbaa844df24203e5221f3167480afd5012551c835aebc758d62ad74557a0d04e1540000000f408c81c8adb74024f46ba1106ed3a58df55e86172893486bc8b2cdd226fb0f887a592ee66123355a5c67903a56344f5a2ea945e3ed150fefeee7ebb787a79a9	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0680b4ee9b9da01	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078bfc26fc4742f4cb1a3219b6762c9f900000000020000000000106600000001000020000000d7640696eca7662fd69c5c9bf75d1959e040a59beece79814bdbfefddc9f0368000000000e800000000200002000000068afb738d1fb66c9ea25ede3fe35017207741dbe9f17209ba0409629694273a220000000f55450d3f19a880f9ce40284a31652ad39d5a66cb5849024da969b2bdc08d28640000000c7f687dc1c99ae5ba258eedc3f5529a7bb23d708c1c78e9632c0d4a2708a1ba1eca591361911ba5fed074ed698a3e2f74d63f08b3f6e20f2b224ab2db29fa38f	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "3"	C:\Program Files\Internet Explorer\iexplore.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Desktop\MultiMC\MultiMC.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\Desktop\MultiMC\MultiMC.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Desktop\MultiMC\MultiMC.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Desktop\MultiMC\MultiMC.exe	N/A
N/A	N/A	C:\Users\Admin\Desktop\MultiMC\MultiMC.exe	N/A
N/A	N/A	C:\Users\Admin\Desktop\MultiMC\MultiMC.exe	N/A
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Users\Admin\Desktop\MultiMC\MultiMC.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\java.exe

java -jar C:\Users\Admin\AppData\Local\Temp\ViaFabricPlus-3.3.0.jar

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d89758,0x7fef6d89768,0x7fef6d89778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2304 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2312 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1392 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1432 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3456 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3476 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3668 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3752 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2648 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2740 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3680 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4076 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4112 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4220 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4244 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4304 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe

"C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe"

C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe

"C:\Users\Admin\AppData\Local\Programs\launcher\Lunar Client.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 712

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2604 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4068 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2772 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=2292 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=4392 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3976 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4540 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=2532 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=1432 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=1412 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=2516 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=4684 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4388 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3776 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 --field-trial-handle=1192,i,6800811222131126236,17284166699006364738,131072 /prefetch:8

C:\Users\Admin\Desktop\MultiMC\MultiMC.exe

"C:\Users\Admin\Desktop\MultiMC\MultiMC.exe"

C:\Program Files\Java\jre7\bin\javaw.exe

"C:\Program Files\Java\jre7\bin\javaw.exe" -jar C:/Users/Admin/Desktop/MultiMC/jars/JavaCheck.jar

C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe

"C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe" -jar C:/Users/Admin/Desktop/MultiMC/jars/JavaCheck.jar

C:\Program Files\Java\jre7\bin\javaw.exe

"C:\Program Files\Java\jre7\bin\javaw.exe" -Xms512m -Xmx1024m -XX:PermSize=128m -jar C:/Users/Admin/Desktop/MultiMC/jars/JavaCheck.jar

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.microsoft.com/link

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:572 CREDAT:275457 /prefetch:2

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.microsoft.com/link

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:275457 /prefetch:2

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.0.1631006381\9216654" -parentBuildID 20221007134813 -prefsHandle 1184 -prefMapHandle 1176 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96eb71d4-e48f-413e-bddc-ad67baf3316d} 920 "\\.\pipe\gecko-crash-server-pipe.920" 1284 10af6658 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.1.1305287547\538287703" -parentBuildID 20221007134813 -prefsHandle 1464 -prefMapHandle 1460 -prefsLen 20830 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ce1f2fb-ee32-4cbb-8eb1-d8bc699e7142} 920 "\\.\pipe\gecko-crash-server-pipe.920" 1476 b7ee258 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.2.841174683\782549294" -childID 1 -isForBrowser -prefsHandle 1812 -prefMapHandle 1712 -prefsLen 20868 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {73a6be58-feff-4671-8b0b-3d6093b59f80} 920 "\\.\pipe\gecko-crash-server-pipe.920" 1940 10a5ed58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.3.105497816\1734775496" -childID 2 -isForBrowser -prefsHandle 2632 -prefMapHandle 2628 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6d278a5-e0bf-4793-9e78-1f72a6c262c9} 920 "\\.\pipe\gecko-crash-server-pipe.920" 2644 f61058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.4.1037721206\1063845184" -childID 3 -isForBrowser -prefsHandle 2932 -prefMapHandle 2928 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08b3a766-d0df-4291-a66f-2172edce22d8} 920 "\\.\pipe\gecko-crash-server-pipe.920" 2944 20a49558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.5.2007981777\1090351766" -childID 4 -isForBrowser -prefsHandle 3764 -prefMapHandle 3236 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c11689a4-9f1f-4f74-a5d9-2fd1f357e5ef} 920 "\\.\pipe\gecko-crash-server-pipe.920" 3760 22b74258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.6.1840971611\604520886" -childID 5 -isForBrowser -prefsHandle 3868 -prefMapHandle 3872 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {edb3e660-00b4-47c1-b558-f245cf899c4e} 920 "\\.\pipe\gecko-crash-server-pipe.920" 3856 25a32d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.7.1264474250\2028903078" -childID 6 -isForBrowser -prefsHandle 4068 -prefMapHandle 4072 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {645d83a2-9327-4342-b4b2-152af7e6fb3a} 920 "\\.\pipe\gecko-crash-server-pipe.920" 4060 25a33658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.8.1586392489\625508698" -childID 7 -isForBrowser -prefsHandle 4364 -prefMapHandle 4356 -prefsLen 26426 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9922a1b-2505-453c-b8cb-d317eeb888df} 920 "\\.\pipe\gecko-crash-server-pipe.920" 4376 27e49f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.9.486648114\496143156" -childID 8 -isForBrowser -prefsHandle 1828 -prefMapHandle 2824 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c662010-3f50-4a72-805f-1d88a57372c3} 920 "\\.\pipe\gecko-crash-server-pipe.920" 2692 f5ee58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.10.970952435\428791767" -childID 9 -isForBrowser -prefsHandle 4028 -prefMapHandle 4032 -prefsLen 26691 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31a4439b-e3c9-4e8d-bad4-6b570711b976} 920 "\\.\pipe\gecko-crash-server-pipe.920" 3776 22b74258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.11.318311355\2077744696" -childID 10 -isForBrowser -prefsHandle 4448 -prefMapHandle 4460 -prefsLen 27400 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92bc473b-3dae-46ca-a71b-7fa09b3d0739} 920 "\\.\pipe\gecko-crash-server-pipe.920" 4444 20a0c358 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.12.922086318\91952851" -childID 11 -isForBrowser -prefsHandle 4216 -prefMapHandle 3568 -prefsLen 27400 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec2b02c6-27d0-4b50-a619-b9e85e4e6571} 920 "\\.\pipe\gecko-crash-server-pipe.920" 3728 20a4b658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.13.1700407237\898542429" -childID 12 -isForBrowser -prefsHandle 3000 -prefMapHandle 1932 -prefsLen 27400 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {16297d61-3a47-4607-aa27-42b518c251d6} 920 "\\.\pipe\gecko-crash-server-pipe.920" 2996 b7efd58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.14.1345890651\891956059" -childID 13 -isForBrowser -prefsHandle 3288 -prefMapHandle 3628 -prefsLen 27400 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7334b8b-18df-4731-ab12-ca9c0802076f} 920 "\\.\pipe\gecko-crash-server-pipe.920" 2896 17d97858 tab

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.microsoft.com/link

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4072 CREDAT:275457 /prefetch:2

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.15.1722703873\40931520" -childID 14 -isForBrowser -prefsHandle 3716 -prefMapHandle 4440 -prefsLen 27418 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef213372-2bda-4af2-85af-f08ca6a8cb13} 920 "\\.\pipe\gecko-crash-server-pipe.920" 3692 1b255e58 tab

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x590

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.microsoft.com/link

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="920.16.1589081911\81773819" -childID 15 -isForBrowser -prefsHandle 3848 -prefMapHandle 3724 -prefsLen 27579 -prefMapSize 233444 -jsInitHandle 732 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9472b37e-088f-49b8-82b4-ee37f97c57cd} 920 "\\.\pipe\gecko-crash-server-pipe.920" 4556 2b66da58 tab

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	www.google.com	udp
FR	172.217.20.196:443	www.google.com	tcp
US	8.8.8.8:53	apis.google.com	udp
FR	142.250.178.142:443	apis.google.com	tcp
US	8.8.8.8:53	play.google.com	udp
FR	172.217.20.174:443	play.google.com	tcp
N/A	224.0.0.251:5353		udp
FR	172.217.20.196:443	www.google.com	udp
US	8.8.8.8:53	id.google.com	udp
FR	142.250.74.227:443	id.google.com	tcp
US	8.8.8.8:53	i.ytimg.com	udp
FR	142.250.179.86:443	i.ytimg.com	tcp
FR	142.250.179.86:443	i.ytimg.com	tcp
FR	142.250.179.86:443	i.ytimg.com	tcp
US	8.8.8.8:53	content-autofill.googleapis.com	udp
US	8.8.8.8:53	www.lunarclient.com	udp
US	104.18.12.46:443	www.lunarclient.com	tcp
US	104.18.12.46:443	www.lunarclient.com	tcp
US	8.8.8.8:53	www.youtube.com	udp
US	8.8.8.8:53	apps.identrust.com	udp
FR	142.250.178.142:443	www.youtube.com	udp
NL	23.63.101.152:80	apps.identrust.com	tcp
FR	172.217.20.174:443	www.youtube.com	udp
FR	142.250.179.86:443	i.ytimg.com	udp
US	8.8.8.8:53	connect.facebook.net	udp
GB	163.70.151.21:443	connect.facebook.net	tcp
US	104.18.12.46:443	www.lunarclient.com	udp
US	8.8.8.8:53	skins.mcstats.com	udp
US	8.8.8.8:53	cmsassets.lunarclientcdn.com	udp
US	104.18.30.194:443	skins.mcstats.com	tcp
US	104.18.30.194:443	skins.mcstats.com	tcp
US	104.18.29.96:443	cmsassets.lunarclientcdn.com	tcp
US	104.18.29.96:443	cmsassets.lunarclientcdn.com	tcp
US	104.18.29.96:443	cmsassets.lunarclientcdn.com	tcp
US	104.18.29.96:443	cmsassets.lunarclientcdn.com	tcp
US	104.18.29.96:443	cmsassets.lunarclientcdn.com	tcp
US	104.18.29.96:443	cmsassets.lunarclientcdn.com	tcp
US	104.18.29.96:443	cmsassets.lunarclientcdn.com	udp
US	8.8.8.8:53	o923049.ingest.sentry.io	udp
US	34.120.195.249:443	o923049.ingest.sentry.io	tcp
US	8.8.8.8:53	api.lunarclientprod.com	udp
US	104.18.28.130:443	api.lunarclientprod.com	tcp
US	104.18.28.130:443	api.lunarclientprod.com	udp
US	8.8.8.8:53	stats.g.doubleclick.net	udp
BE	64.233.166.157:443	stats.g.doubleclick.net	tcp
US	8.8.8.8:53	googleads.g.doubleclick.net	udp
FR	172.217.20.162:443	googleads.g.doubleclick.net	tcp
BE	64.233.166.157:443	stats.g.doubleclick.net	udp
US	8.8.8.8:53	analytics.google.com	udp
US	216.239.36.181:443	analytics.google.com	tcp
US	34.120.195.249:443	o923049.ingest.sentry.io	tcp
US	34.120.195.249:443	o923049.ingest.sentry.io	tcp
US	8.8.8.8:53	store.lunarclient.com	udp
US	104.18.19.135:443	store.lunarclient.com	tcp
US	104.18.19.135:443	store.lunarclient.com	tcp
US	34.120.195.249:443	o923049.ingest.sentry.io	tcp
US	8.8.8.8:53	static.cloudflareinsights.com	udp
US	8.8.8.8:53	static.moonsworth.store	udp
US	8.8.8.8:53	skinviewer.lunarclientcdn.com	udp
US	104.16.80.73:443	static.cloudflareinsights.com	tcp
US	104.18.18.135:443	static.moonsworth.store	tcp
US	104.18.18.135:443	static.moonsworth.store	tcp
US	104.18.18.135:443	static.moonsworth.store	tcp
US	104.18.18.135:443	static.moonsworth.store	tcp
US	104.18.18.135:443	static.moonsworth.store	tcp
US	104.18.18.135:443	static.moonsworth.store	tcp
US	104.18.18.135:443	static.moonsworth.store	tcp
US	104.18.18.135:443	static.moonsworth.store	tcp
US	104.18.18.135:443	static.moonsworth.store	tcp
US	104.18.18.135:443	static.moonsworth.store	tcp
US	104.18.29.96:443	skinviewer.lunarclientcdn.com	tcp
US	8.8.8.8:53	ka-f.fontawesome.com	udp
US	104.18.18.135:443	static.moonsworth.store	udp
US	104.18.18.135:443	static.moonsworth.store	udp
US	104.21.26.223:443	ka-f.fontawesome.com	tcp
US	104.21.26.223:443	ka-f.fontawesome.com	tcp
US	104.21.26.223:443	ka-f.fontawesome.com	tcp
US	104.18.18.135:443	static.moonsworth.store	udp
US	104.18.30.194:443	skins.mcstats.com	udp
US	8.8.8.8:53	ssl.google-analytics.com	udp
FR	142.250.201.168:443	ssl.google-analytics.com	tcp
FR	142.250.201.168:443	ssl.google-analytics.com	udp
US	104.21.26.223:443	ka-f.fontawesome.com	udp
US	216.239.36.181:443	analytics.google.com	udp
GB	163.70.151.21:443	connect.facebook.net	udp
US	8.8.8.8:53	www.facebook.com	udp
GB	157.240.221.35:443	www.facebook.com	tcp
US	8.8.8.8:53	cloudflareinsights.com	udp
US	104.16.79.73:443	cloudflareinsights.com	tcp
US	8.8.8.8:53	launcherupdates.lunarclientcdn.com	udp
US	104.18.28.96:443	launcherupdates.lunarclientcdn.com	tcp
US	104.18.28.96:443	launcherupdates.lunarclientcdn.com	udp
US	104.18.28.96:443	launcherupdates.lunarclientcdn.com	tcp
FR	172.217.20.162:443	googleads.g.doubleclick.net	udp
US	8.8.8.8:53	launcherupdates.lunarclientcdn.com	udp
US	104.18.29.96:443	launcherupdates.lunarclientcdn.com	tcp
US	8.8.8.8:53	www.youtube.com	udp
FR	142.250.178.142:443	www.youtube.com	udp
FR	142.250.179.86:443	i.ytimg.com	udp
FR	172.217.20.162:443	googleads.g.doubleclick.net	udp
US	8.8.8.8:53	static.doubleclick.net	udp
US	8.8.8.8:53	jnn-pa.googleapis.com	udp
FR	142.250.75.230:443	static.doubleclick.net	tcp
FR	172.217.20.196:443	www.google.com	udp
FR	142.250.201.170:443	jnn-pa.googleapis.com	tcp
US	8.8.8.8:53	yt3.ggpht.com	udp
FR	172.217.20.193:443	yt3.ggpht.com	tcp
FR	142.250.201.170:443	jnn-pa.googleapis.com	udp
US	8.8.8.8:53	play.google.com	udp
FR	172.217.20.174:443	play.google.com	udp
FR	172.217.20.174:443	play.google.com	tcp
FR	172.217.20.174:443	play.google.com	udp
US	8.8.8.8:53	beacons.gcp.gvt2.com	udp
US	192.178.49.195:443	beacons.gcp.gvt2.com	tcp
US	8.8.8.8:53	e2c39.gcp.gvt2.com	udp
FI	35.217.17.196:443	e2c39.gcp.gvt2.com	tcp
US	192.178.49.195:443	beacons.gcp.gvt2.com	udp
US	8.8.8.8:53	beacons.gvt2.com	udp
US	192.178.49.163:443	beacons.gvt2.com	tcp
US	34.120.195.249:443	o923049.ingest.sentry.io	tcp
US	8.8.8.8:53	encrypted-tbn3.gstatic.com	udp
FR	142.250.74.227:443	id.google.com	udp
FR	142.250.179.110:443	encrypted-tbn3.gstatic.com	tcp
FR	142.250.75.230:443	static.doubleclick.net	udp
US	8.8.8.8:53	multimc.org	udp
US	172.67.132.190:443	multimc.org	tcp
US	172.67.132.190:443	multimc.org	tcp
US	172.67.132.190:443	multimc.org	udp
US	8.8.8.8:53	ajax.googleapis.com	udp
FR	142.250.201.170:443	ajax.googleapis.com	tcp
US	8.8.8.8:53	discordapp.com	udp
US	8.8.8.8:53	netdna.bootstrapcdn.com	udp
US	162.159.130.233:443	discordapp.com	tcp
US	104.18.11.207:443	netdna.bootstrapcdn.com	tcp
US	8.8.8.8:53	discord.com	udp
US	162.159.135.232:443	discord.com	tcp
US	162.159.135.232:443	discord.com	udp
US	172.67.132.190:443	multimc.org	udp
US	8.8.8.8:53	cdn.discordapp.com	udp
US	162.159.129.233:443	cdn.discordapp.com	tcp
US	162.159.129.233:443	cdn.discordapp.com	tcp
US	162.159.129.233:443	cdn.discordapp.com	tcp
US	162.159.129.233:443	cdn.discordapp.com	tcp
US	162.159.129.233:443	cdn.discordapp.com	tcp
US	162.159.129.233:443	cdn.discordapp.com	tcp
US	162.159.129.233:443	cdn.discordapp.com	udp
US	8.8.8.8:53	files.multimc.org	udp
US	192.178.49.195:443	beacons.gcp.gvt2.com	udp
US	8.8.8.8:53	beacons3.gvt2.com	udp
US	8.8.8.8:53	a.nel.cloudflare.com	udp
US	35.190.80.1:443	a.nel.cloudflare.com	tcp
FR	172.217.18.195:443	beacons3.gvt2.com	tcp
FR	172.217.18.195:443	beacons3.gvt2.com	udp
US	35.190.80.1:443	a.nel.cloudflare.com	udp
US	8.8.8.8:53	files.multimc.org	udp
US	104.21.5.18:443	files.multimc.org	tcp
US	104.21.5.18:443	files.multimc.org	tcp
US	8.8.8.8:53	multimc.org	udp
US	172.67.132.190:443	multimc.org	tcp
US	104.21.5.18:80	multimc.org	tcp
US	8.8.8.8:53	meta.multimc.org	udp
US	172.67.132.190:443	meta.multimc.org	tcp
US	8.8.8.8:53	login.microsoftonline.com	udp
IE	20.190.159.64:443	login.microsoftonline.com	tcp
US	8.8.8.8:53	www.microsoft.com	udp
BE	104.90.25.175:443	www.microsoft.com	tcp
BE	104.90.25.175:443	www.microsoft.com	tcp
BE	104.90.25.175:443	www.microsoft.com	tcp
US	8.8.8.8:53	api.bing.com	udp
BE	104.90.25.175:443	www.microsoft.com	tcp
BE	104.90.25.175:443	www.microsoft.com	tcp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	8.8.8.8:53	content-signature-2.cdn.mozilla.net	udp
US	34.117.188.166:443	contile.services.mozilla.com	tcp
US	34.160.144.191:443	content-signature-2.cdn.mozilla.net	tcp
US	8.8.8.8:53	prod.content-signature-chains.prod.webservices.mozgcp.net	udp
US	8.8.8.8:53	shavar.services.mozilla.com	udp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	8.8.8.8:53	prod.content-signature-chains.prod.webservices.mozgcp.net	udp
US	44.232.194.163:443	shavar.services.mozilla.com	tcp
US	8.8.8.8:53	push.services.mozilla.com	udp
US	8.8.8.8:53	firefox.settings.services.mozilla.com	udp
US	8.8.8.8:53	shavar.prod.mozaws.net	udp
US	34.149.100.209:443	firefox.settings.services.mozilla.com	tcp
US	8.8.8.8:53	prod.remote-settings.prod.webservices.mozgcp.net	udp
US	8.8.8.8:53	autopush.prod.mozaws.net	udp
US	8.8.8.8:53	prod.remote-settings.prod.webservices.mozgcp.net	udp
US	8.8.8.8:53	autopush.prod.mozaws.net	udp
US	8.8.8.8:53	shavar.prod.mozaws.net	udp
US	34.107.243.93:443	autopush.prod.mozaws.net	tcp
US	34.117.188.166:443	contile.services.mozilla.com	udp
BE	104.90.25.175:443	www.microsoft.com	tcp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
US	8.8.8.8:53	www.tm.v4.a.prd.aadg.trafficmanager.net	udp
US	8.8.8.8:53	www.tm.v4.a.prd.aadg.trafficmanager.net	udp
US	8.8.8.8:53	logincdn.msftauth.net	udp
US	34.149.100.209:443	prod.remote-settings.prod.webservices.mozgcp.net	tcp
US	152.199.21.175:443	logincdn.msftauth.net	tcp
US	8.8.8.8:53	sni1gl.wpc.alphacdn.net	udp
US	8.8.8.8:53	sni1gl.wpc.alphacdn.net	udp
US	152.199.21.175:443	sni1gl.wpc.alphacdn.net	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
FR	40.79.150.121:443	browser.events.data.microsoft.com	tcp
US	8.8.8.8:53	onedscolprdfrc05.francecentral.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdfrc05.francecentral.cloudapp.azure.com	udp
FR	40.79.150.121:443	onedscolprdfrc05.francecentral.cloudapp.azure.com	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdcus21.centralus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdcus21.centralus.cloudapp.azure.com	udp
US	8.8.8.8:53	google.com	udp
FR	142.250.179.110:443	google.com	tcp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdeus23.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdeus23.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	account.live.com	udp
US	13.107.42.22:443	account.live.com	tcp
US	8.8.8.8:53	l-0013.l-msedge.net	udp
US	8.8.8.8:53	l-0013.l-msedge.net	udp
US	8.8.8.8:53	acctcdn.msauth.net	udp
US	13.107.246.64:443	acctcdn.msauth.net	tcp
US	13.107.246.64:443	acctcdn.msauth.net	tcp
US	8.8.8.8:53	s-part-0036.t-0009.t-msedge.net	udp
US	13.107.246.64:443	s-part-0036.t-0009.t-msedge.net	tcp
US	13.107.246.64:443	s-part-0036.t-0009.t-msedge.net	tcp
US	13.107.246.64:443	s-part-0036.t-0009.t-msedge.net	tcp
US	13.107.246.64:443	s-part-0036.t-0009.t-msedge.net	tcp
US	13.107.246.64:443	s-part-0036.t-0009.t-msedge.net	tcp
US	13.107.246.64:443	s-part-0036.t-0009.t-msedge.net	tcp
US	8.8.8.8:53	s-part-0036.t-0009.t-msedge.net	udp
US	8.8.8.8:53	fpt.live.com	udp
US	52.167.30.171:443	fpt.live.com	tcp
US	8.8.8.8:53	greenid-prod-pme.eastus2.cloudapp.azure.com	udp
US	8.8.8.8:53	greenid-prod-pme.eastus2.cloudapp.azure.com	udp
US	8.8.8.8:53	fpt2.microsoft.com	udp
US	52.167.30.171:443	fpt2.microsoft.com	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdjpe05.japaneast.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdjpe05.japaneast.cloudapp.azure.com	udp
US	8.8.8.8:53	acctcdn.msauth.net	udp
US	8.8.8.8:53	secure.aadcdn.microsoftonline-p.com	udp
US	8.8.8.8:53	s-part-0036.t-0009.t-msedge.net	udp
US	13.107.246.64:443	secure.aadcdn.microsoftonline-p.com	tcp
US	8.8.8.8:53	s-part-0036.t-0009.t-msedge.net	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdjpe05.japaneast.cloudapp.azure.com	udp
US	8.8.8.8:53	user.auth.xboxlive.com	udp
IE	137.116.225.129:443	user.auth.xboxlive.com	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus04.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdwus04.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	www.microsoft.com	udp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus04.westus.cloudapp.azure.com	udp
US	192.178.49.163:443	beacons.gvt2.com	udp
US	192.178.49.163:443	beacons.gvt2.com	tcp
N/A	127.0.0.1:52823		tcp
N/A	127.0.0.1:52831		tcp
US	35.244.181.201:443	aus5.mozilla.org	tcp
US	8.8.8.8:53	prod.balrog.prod.cloudops.mozgcp.net	udp
US	8.8.8.8:53	prod.balrog.prod.cloudops.mozgcp.net	udp
US	8.8.8.8:53	content-signature-2.cdn.mozilla.net	udp
US	8.8.8.8:53	prod.content-signature-chains.prod.webservices.mozgcp.net	udp
US	8.8.8.8:53	ciscobinary.openh264.org	udp
NL	2.18.121.79:80	ciscobinary.openh264.org	tcp
US	8.8.8.8:53	a19.dscg10.akamai.net	udp
US	8.8.8.8:53	a19.dscg10.akamai.net	udp
US	8.8.8.8:53	redirector.gvt1.com	udp
FR	142.250.178.142:443	redirector.gvt1.com	tcp
US	8.8.8.8:53	redirector.gvt1.com	udp
US	8.8.8.8:53	redirector.gvt1.com	udp
FR	142.250.178.142:443	redirector.gvt1.com	udp
US	8.8.8.8:53	r1---sn-aigl6ney.gvt1.com	udp
GB	173.194.183.166:443	r1---sn-aigl6ney.gvt1.com	tcp
US	8.8.8.8:53	r1.sn-aigl6ney.gvt1.com	udp
US	8.8.8.8:53	r1.sn-aigl6ney.gvt1.com	udp
GB	173.194.183.166:443	r1.sn-aigl6ney.gvt1.com	udp
US	8.8.8.8:53	google.com	udp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	udp
FR	142.250.179.110:443	google.com	udp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	tcp
US	8.8.8.8:53	clients2.google.com	udp
FR	216.58.213.78:443	clients2.google.com	tcp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	udp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	tcp
US	8.8.8.8:53	google.com	udp
FR	142.250.179.110:443	google.com	udp
FR	142.250.179.110:443	google.com	tcp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	34.117.188.166:443	contile.services.mozilla.com	udp
US	8.8.8.8:53	www.tm.v4.a.prd.aadg.akadns.net	udp
US	8.8.8.8:53	www.tm.v4.a.prd.aadg.akadns.net	udp
US	8.8.8.8:53	logincdn.msftauth.net	udp
US	152.199.21.175:443	logincdn.msftauth.net	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus04.westus.cloudapp.azure.com	udp
US	20.189.173.5:443	onedscolprdwus04.westus.cloudapp.azure.com	tcp
FR	142.250.179.110:443	google.com	udp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	udp
FR	142.250.179.110:443	google.com	tcp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprduks03.uksouth.cloudapp.azure.com	udp
GB	51.105.71.137:443	onedscolprduks03.uksouth.cloudapp.azure.com	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus13.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdwus13.westus.cloudapp.azure.com	udp
US	152.199.21.175:443	logincdn.msftauth.net	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdeus20.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdeus20.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdeus20.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	l-0013.l-msedge.net	udp
US	13.107.42.22:443	l-0013.l-msedge.net	tcp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	l-0013.l-msedge.net	udp
US	8.8.8.8:53	acctcdn.msauth.net	udp
US	8.8.8.8:53	acctcdn.msauth.net	udp
US	8.8.8.8:53	acctcdn.msauth.net	udp
US	8.8.8.8:53	s-part-0036.t-0009.t-msedge.net	udp
US	13.107.246.64:443	s-part-0036.t-0009.t-msedge.net	tcp
US	8.8.8.8:53	s-part-0036.t-0009.t-msedge.net	udp
US	13.107.246.64:443	s-part-0036.t-0009.t-msedge.net	tcp
US	13.107.246.64:443	s-part-0036.t-0009.t-msedge.net	tcp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus13.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	client.hip.live.com	udp
IE	20.190.159.67:443	client.hip.live.com	tcp
US	8.8.8.8:53	www.tm.f.prd.aadg.akadns.net	udp
US	8.8.8.8:53	www.tm.f.prd.aadg.akadns.net	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	scu.client.hip.live.com	udp
IE	20.190.159.20:443	scu.client.hip.live.com	tcp
IE	20.190.159.20:443	scu.client.hip.live.com	tcp
IE	20.190.159.20:443	scu.client.hip.live.com	tcp
US	8.8.8.8:53	www.tm.f.prd.aadg.trafficmanager.net	udp
US	8.8.8.8:53	www.tm.f.prd.aadg.trafficmanager.net	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdcus20.centralus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdcus20.centralus.cloudapp.azure.com	udp
US	8.8.8.8:53	www.microsoft.com	udp
US	8.8.8.8:53	www.microsoft.com	udp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
US	8.8.8.8:53	www.microsoft.com	udp
BE	104.90.25.175:443	www.microsoft.com	tcp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
US	152.199.21.175:443	logincdn.msftauth.net	tcp
US	8.8.8.8:53	firefox.settings.services.mozilla.com	udp
US	8.8.8.8:53	firefox.settings.services.mozilla.com	udp
US	8.8.8.8:53	firefox.settings.services.mozilla.com	udp
US	8.8.8.8:53	prod.remote-settings.prod.webservices.mozgcp.net	udp
US	34.149.100.209:443	prod.remote-settings.prod.webservices.mozgcp.net	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus14.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdwus14.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus14.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus07.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdwus07.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	l-0013.l-msedge.net	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdcus01.centralus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdcus01.centralus.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus00.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdwus00.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdeus12.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdeus12.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	ipv6.login.live.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus18.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdwus18.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdwus18.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	aus5.mozilla.org	udp
US	8.8.8.8:53	aus5.mozilla.org	udp
US	8.8.8.8:53	prod.balrog.prod.cloudops.mozgcp.net	udp
US	8.8.8.8:53	aus5.mozilla.org	udp
US	35.244.181.201:443	aus5.mozilla.org	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdeus00.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdeus00.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdgwc05.germanywestcentral.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdgwc05.germanywestcentral.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus15.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdwus15.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus15.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	www.microsoft.com	udp
BE	104.90.25.175:443	www.microsoft.com	tcp
BE	104.90.25.175:443	www.microsoft.com	tcp
US	8.8.8.8:53	api.bing.com	udp
US	8.8.8.8:53	www.microsoft.com	udp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
US	8.8.8.8:53	www.microsoft.com	udp
BE	104.90.25.175:443	www.microsoft.com	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdeus09.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdeus09.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	ipv6.login.live.com	udp
US	8.8.8.8:53	ipv6.login.live.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdeus09.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	www.tm.v4.a.prd.aadg.akadns.net	udp
US	8.8.8.8:53	google.com	udp
US	8.8.8.8:53	beacons.gcp.gvt2.com	udp
FR	142.250.179.110:443	google.com	udp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	udp
FR	142.250.179.110:443	google.com	tcp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdcus14.centralus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdcus14.centralus.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdwus10.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdwus10.westus.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdeus04.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdeus04.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	acctcdn.msauth.net	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	l-0013.l-msedge.net	udp
US	8.8.8.8:53	account.live.com	udp
US	13.107.42.22:443	account.live.com	tcp
US	8.8.8.8:53	s-part-0036.t-0009.t-msedge.net	udp
US	8.8.8.8:53	s-part-0036.t-0009.t-msedge.net	udp
US	8.8.8.8:53	l-0013.l-msedge.net	udp
US	8.8.8.8:53	acctcdn.msauth.net	udp
US	8.8.8.8:53	secure.aadcdn.microsoftonline-p.com	udp
US	8.8.8.8:53	secure.aadcdn.microsoftonline-p.com	udp
US	8.8.8.8:53	acctcdn.msauth.net	udp
US	13.107.246.64:443	acctcdn.msauth.net	tcp
US	13.107.246.64:443	acctcdn.msauth.net	tcp
US	13.107.246.64:443	acctcdn.msauth.net	tcp
US	8.8.8.8:53	secure.aadcdn.microsoftonline-p.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdeus02.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdeus02.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	user.auth.xboxlive.com	udp
IE	137.116.225.129:443	user.auth.xboxlive.com	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprduks01.uksouth.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprduks01.uksouth.cloudapp.azure.com	udp
US	35.162.46.230:443	location.services.mozilla.com	tcp
US	8.8.8.8:53	locprod2-elb-us-west-2.prod.mozaws.net	udp
US	8.8.8.8:53	locprod2-elb-us-west-2.prod.mozaws.net	udp
FR	142.250.179.110:443	google.com	udp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	udp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	tcp
FR	142.250.179.110:443	google.com	tcp
US	8.8.8.8:53	www.microsoft.com	udp
BE	23.55.97.181:443	www.microsoft.com	tcp
US	8.8.8.8:53	api.bing.com	udp
BE	23.55.97.181:443	www.microsoft.com	tcp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
US	8.8.8.8:53	www.microsoft.com	udp
US	8.8.8.8:53	www.microsoft.com	udp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
BE	23.55.97.181:443	www.microsoft.com	tcp
US	152.199.21.175:443	logincdn.msftauth.net	tcp
US	152.199.21.175:443	logincdn.msftauth.net	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdweu07.westeurope.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdweu07.westeurope.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdcus17.centralus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdcus17.centralus.cloudapp.azure.com	udp
US	8.8.8.8:53	clients2.google.com	udp
FR	216.58.213.78:443	clients2.google.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprduks05.uksouth.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprduks05.uksouth.cloudapp.azure.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	acctcdn.msauth.net	udp
US	8.8.8.8:53	l-0013.l-msedge.net	udp
US	8.8.8.8:53	account.live.com	udp
US	13.107.42.22:443	account.live.com	tcp
US	8.8.8.8:53	s-part-0036.t-0009.t-msedge.net	udp
US	8.8.8.8:53	l-0013.l-msedge.net	udp
US	8.8.8.8:53	s-part-0036.t-0009.t-msedge.net	udp
US	8.8.8.8:53	l-0013.l-msedge.net	udp
US	8.8.8.8:53	acctcdn.msauth.net	udp
US	8.8.8.8:53	secure.aadcdn.microsoftonline-p.com	udp
US	8.8.8.8:53	secure.aadcdn.microsoftonline-p.com	udp
US	8.8.8.8:53	acctcdn.msauth.net	udp
US	13.107.246.64:443	acctcdn.msauth.net	tcp
US	8.8.8.8:53	secure.aadcdn.microsoftonline-p.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	account.live.com	udp
US	8.8.8.8:53	user.auth.xboxlive.com	udp
IE	137.116.225.129:443	user.auth.xboxlive.com	tcp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdweu06.westeurope.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdweu06.westeurope.cloudapp.azure.com	udp
US	8.8.8.8:53	www.microsoft.com	udp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
US	8.8.8.8:53	e13678.dscb.akamaiedge.net	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprduks05.uksouth.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprduks05.uksouth.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprduks05.uksouth.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdweu05.westeurope.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdweu05.westeurope.cloudapp.azure.com	udp
US	8.8.8.8:53	browser.events.data.microsoft.com	udp
US	8.8.8.8:53	onedscolprdeus16.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	onedscolprdeus16.eastus.cloudapp.azure.com	udp
US	8.8.8.8:53	beacons2.gvt2.com	udp
US	216.239.34.117:443	beacons2.gvt2.com	tcp
US	216.239.34.117:443	beacons2.gvt2.com	udp

Files

memory/1992-2-0x0000000002480000-0x00000000026F0000-memory.dmp

memory/1992-10-0x0000000000240000-0x0000000000241000-memory.dmp

memory/1992-11-0x0000000002480000-0x00000000026F0000-memory.dmp

\??\pipe\crashpad_2560_DNZQOXJJNWJLZAVV

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5	18e723571b00fb1694a3bad6c78e4054
SHA1	afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256	8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512	43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5	f50f89a0a91564d0b8a211f8921aa7de
SHA1	112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256	b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512	bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

MD5	aefd77f47fb84fae5ea194496b44c67a
SHA1	dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256	4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512	b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Temp\Cab3036.tmp

MD5	ac05d27423a85adc1622c714f2cb6184
SHA1	b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256	c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512	6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5	49aebf8cbd62d92ac215b2923fb1b9f5
SHA1	1723be06719828dda65ad804298d0431f6aff976
SHA256	b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512	bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar3137.tmp

MD5	4ea6026cf93ec6338144661bf1202cd1
SHA1	a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256	8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512	6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	7acbbd4dc5ccb2d11f2eb740006d6b19
SHA1	a8dd19c4b1ead1de183a3061863c5e629facb6b6
SHA256	4d4503d537de8ac48be41da6ccf4f7e5d2dc504126f86305fe956fd7d129da7c
SHA512	b738a6018c9cc719189a07f5d953ba8b93ef78531c2f6de9d4f26e50b3c53b7b3cf43d21509f7412244564296ab4597d3a7c1a62cceffb1ae1bf5d624c5feb49

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	0f370ecd73230bc6b6b4c1a383fe3c5b
SHA1	dfcfc79a0c81b958c91251abb928be920df953cd
SHA256	2f06953d035c9b70c66c9ff2a8239c2e4102c6089aa909cd632def10318e96dd
SHA512	4b25a255a6509bf0d2d22d904f41f9b2572490656764c9340821c980e1e71eed7524b1db5fbb1d6aa847ab0fa18e3a9c0b0db3ba700367e005b6a8219bed8b99

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	5a213879fe593541e7c7521d3d478914
SHA1	524139f997e41235c38f75790641a1676258e0e0
SHA256	bce24a681a381026c3d101ec15c92dd4d829a773ecd0fd9cf78ff9e95ffbcc01
SHA512	b736e62143c940729a1e50c1e470aa36ee50c6118142652ee78f7b4f015f7b0f2be5ca6ab461669c596e29e5a27140d0e44023bdccbfcef3209db573efe8af35

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	a3447a5f94ad0222688847269c8afcb3
SHA1	a8ec15e65c0af623028b3a063ecfb185cd022755
SHA256	c6c697b1223056c1257694689e3bb431beaf9c219133522159fa6a1e1cf691fa
SHA512	d7cb8d307ca0283e4b8ccd52d1a30babd2664112688916d06ba1487db8140782a5b333114567cc14f450abc45b97257dce620cdff3e3e22f368e3adf6cb44111

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	dac5e4914b228b6f480f49243c9a8285
SHA1	30699af14078b986484687267fecb1e4ab040381
SHA256	39bae5270b025f4ee08ebff81390e46d00edd60433439bc780fc788ff3ca2da5
SHA512	46afbfeab18de6968c50b006174def2bd4726686b743e0e58bd12c77b2f9d45b6f59d2b3daf226dc480d3662e18bae9bef2828603ef952204c9e0d9a82fbc3e7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b

MD5	3e0e02e9c505875bd15fc5cf6d8e6641
SHA1	10d4d7294d7c37d00a86cb949e570a5d64927199
SHA256	c769e2aa1e312aaee6b828d4727bdee53a843ac736ed68e1378ced4d29964dce
SHA512	25111049a9dc8974e062a7e3b35c0b3615ae3fb40b40b418060721a5b802afb412f87fbf0af06bed8b8ad31c5481a46c24f2680466fa83eca5dd245e975b5003

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004c

MD5	591408ddf290b104fb2edffe9426676f
SHA1	2a8069bda3081b8f4ecdc6310e6b927d63e023c0
SHA256	1cd0768daa4e6ef3a31dd471708245f12e9a0bb30b0d1f787c428b2b34863f48
SHA512	2a5ba3ccbe542c87f97b06ba3bb3935c04595a18581497efd8cd93b8a031222b3dc7389a4df3d9464ce8ac53d2052c088c2839559f914ff5a47516be10994d6f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	f73df89fe10cb8ffb63c939aaba0b71f
SHA1	bad79940462962f2d4f0f875c0a2982cc98f3818
SHA256	5218a20964eb7033f0c616b6ede2b8ab2f2495f2179b914117087b58179b713a
SHA512	6d0568356b8dcd2e422770fbc92b0ee483426df5c9457705bca77c4fe358a519480c5328db1fae5f789983699205895029fc71dbb3f7681d328bc042391100b4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	65a1e917faeb3a57538147e80c4629fa
SHA1	9c89fc749ce9501ac38483e72e42a8f19d2282c2
SHA256	f52d6b582f187823f9ed87e523644b03a1456086d85bb630b72d3f82f763fd25
SHA512	f717d2ebd49cb5dc53aba8a5630c6f98b45665e34e128ceb8fb9f490e1b416c24287a668765fa9b5912c411f5e3e3b41c4c14a27ca3f8cd73d72afbf50f490fd

C:\Users\Admin\Downloads\Lunar Client v3.2.10.exe

MD5	c7a06e81c730e56b003233d2103d3e62
SHA1	e19fa4ff26b92543983ad8e0d2a04d03becf2e01
SHA256	472edaac1a6aa3e0dcf78c8d085d9eed5cf6134842f15f73307ff5b976532cbc
SHA512	1018a1f41032983333ebc9d64feb7c69dad0d6fee000f0c170e3761f32d28dc53da6369242fbf302cb6f3f33a35260c1286cc59e301c63200a4a6dfcf07a9334

\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\System.dll

MD5	0d7ad4f45dc6f5aa87f606d0331c6901
SHA1	48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256	3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512	c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\StdUtils.dll

MD5	c6a6e03f77c313b267498515488c5740
SHA1	3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256	b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512	9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	4f731df84eaeb4104de113a9a0154228
SHA1	c9d99ea1098551c1e9f1f1f8bdc834f7776e970d
SHA256	d9ea38cb97192df2e4041b4167f1d69ed3a74278c6decc9a4fbc0ee5d836d90d
SHA512	c9e9c6beeef4b2367b68e0a77f8933296ecd3372aaa0638e9b0e4c18ae89ae94a25b12d8b832723bceb3aaee3cb6e7f058b1b5d5f0429da2afbe7f14a513d479

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	a3cda25aef4615b37d10da5b80658cfc
SHA1	a97fe42f36b672c3fc09b8d386a2f70060616de0
SHA256	7814e8ab30d515a5bff59ef4a065d62e004a29c87705d5f3f6b9e6c611814bc4
SHA512	73800d1a44a51c103ecb9b8764125012808f882bf31b0b61f5dccf28ce652143423ccb50865232c44e595c170f2b53c5f65006d950b9f6f973ecf1ce85656665

\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\SpiderBanner.dll

MD5	17309e33b596ba3a5693b4d3e85cf8d7
SHA1	7d361836cf53df42021c7f2b148aec9458818c01
SHA256	996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512	1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\nsExec.dll

MD5	ec0504e6b8a11d5aad43b296beeb84b2
SHA1	91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256	5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512	3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\INetC.dll

MD5	38caa11a462b16538e0a3daeb2fc0eaf
SHA1	c22a190b83f4b6dc0d6a44b98eac1a89a78de55c
SHA256	ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
SHA512	777135e05e908ac26bfce0a9c425b57f7132c1cdb0969bbb6ef625748c868860602bacc633c61cab36d0375b94b6bcfbd8bd8c7fa781495ef7332e362f8d44d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	e1a5e78418d565bfda5f68f4d27b892a
SHA1	c4cf2ae7bbe9e1b61a487042c6f231bb10873300
SHA256	1785d100f42c33595b8f7587847f2c45882a7d2fba066f57cdd42f4d3e4e7ff2
SHA512	f72f718f76878dadc3387ab6bca2309699d9e765b52fdbbdbd13aab424cbdb614ec0907f8594a51cd1702238de368cef015666a9292f8013b6c004b160f713de

\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\nsis7z.dll

MD5	80e44ce4895304c6a3a831310fbf8cd0
SHA1	36bd49ae21c460be5753a904b4501f1abca53508
SHA256	b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512	c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\chrome_100_percent.pak

MD5	4fc6564b727baa5fecf6bf3f6116cc64
SHA1	6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
SHA256	b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
SHA512	fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\chrome_200_percent.pak

MD5	47668ac5038e68a565e0a9243df3c9e5
SHA1	38408f73501162d96757a72c63e41e78541c8e8e
SHA256	fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
SHA512	5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\ffmpeg.dll

MD5	3e93ea95ee4b03d8a48fbad652d502ed
SHA1	8d0dcc7ca720c1c5d68883aeba691e6735ad4254
SHA256	2f9a4708454200a0902ff26a4c399f4a4959601b99384a5938093a3086bbe851
SHA512	0e21b13d39433a0b021a7fefeb75425584d6643ef0ba599a8c813a597073b677b207e35ac914fbb86014b8db7637df5e853c587103696ee19611bf08780b1dfa

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\d3dcompiler_47.dll

MD5	2191e768cc2e19009dad20dc999135a3
SHA1	f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256	7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512	5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\LICENSES.chromium.html

MD5	1ca87d8ee3ce9e9682547c4d9c9cb581
SHA1	d25b5b82c0b225719cc4ee318f776169b7f9af7a
SHA256	000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
SHA512	ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\LICENSE.electron.txt

MD5	4d42118d35941e0f664dddbd83f633c5
SHA1	2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256	5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512	3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\libGLESv2.dll

MD5	9c58f3c971e7613aa15809cedad2530d
SHA1	3a2e7b22069393e796c38a4880bc18786968f253
SHA256	5bb86571983fbce3ceef8dfccabee9a3aed4a722e332267999e2839d6f56afd5
SHA512	c5bd9c1bc8d12c23818f28c9dd658ca5b7b13a9aa503d93354a8a37bdd12602eeb4b275f4e4578f8ebce5a702659ca93ee1ccd987997955878e6035caa30628e

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\libEGL.dll

MD5	d7b67ae3e96e30385ead9a1991cc3c89
SHA1	b4179b667843a369db4f13ff23fa3e1788272cda
SHA256	37f7ae92417c43a403afea4f5ea3d24f3177d4625abb897dee1d101503e822c5
SHA512	922c363f4d93faf6d5f7d7a98d645e0b15616a9d63e69ba9eb8389a11bc84b6ec7e26bdb39ffa27356e750c98fce938746dc8465f63b4158d35bbba01c8c07b2

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\icudtl.dat

MD5	e0f1ad85c0933ecce2e003a2c59ae726
SHA1	a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA256	f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
SHA512	714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\v8_context_snapshot.bin

MD5	1e4da0bc6404552f9a80ccde89fdef2b
SHA1	838481b9e4f1d694c948c0082e9697a5ed443ee2
SHA256	2db4a98abe705ef9bc18e69d17f91bc3f4c0f5703f9f57b41acb877100718918
SHA512	054917652829af01977e278cd0201c715b3a1280d7e43035507e4fa61c1c00c4cd7ed521c762aebd2ea2388d33c3d4d4b16cee5072d41e960021b6f38745a417

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\snapshot_blob.bin

MD5	d20922aefcad14dc658a3c6fd5ff6529
SHA1	75ce20814bdbe71cfa6fab03556c1711e78ca706
SHA256	b6bea91727efb8c88e7c059856553d3a47abd883e60dd60efc01b04dc6eec621
SHA512	dbd63a9f01feb3c389c11b55d720b5d689558626041fb1dd27ded2be602e5e2a8d210f785fde025d7b9959f81de3df7fef06981269b58be564df05aec190dd1c

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\resources.pak

MD5	ec486bb08ef8ccd459ed0991177b327e
SHA1	2ad4598a1fb4df722623ebccf488f59276c008c2
SHA256	50532d1ea84ca3b84ece09884d25e4b0e60ad6061ce4b28fdfdb1f7ff2d26d6f
SHA512	4358edc81aef7b51bc1462dc7e96eff8358c788e3c1044c4697dd9d9ce03fc44be22743d4d104ed7afbf1b36246c171e754288c873c6590513bc99632a78fd68

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\vk_swiftshader.dll

MD5	0ee6f9895fb0163bffbb31befa239e54
SHA1	1f3a6e06437b3a106e1c37157bd2e09355fc265f
SHA256	a606fbe565fe5d44b0e9f6f6b0c19db966a7253cb487aa399786033212a7e731
SHA512	574693bb71c13a8a01bd49428dd36794113e17c54c8e209eac37f69717038961102780bcc399e6f665f07db58b78b99440e108f76f9bf4c0ed103227dde8414f

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\vk_swiftshader_icd.json

MD5	8642dd3a87e2de6e991fae08458e302b
SHA1	9c06735c31cec00600fd763a92f8112d085bd12a
SHA256	32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512	f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\vulkan-1.dll

MD5	c69fd5738f707ce691341b067995975b
SHA1	fca66f67f9af4051f9318d64669cbd5a264eebc8
SHA256	3a626c022630e46e6dd1e420bd90c5fab309baae8bcee3326076bad5a462438a
SHA512	26ec59a950e00407d717832c802ba135785dc4dd6476aa1ceb9afae108a332f97b888c4efdca35c66a17e285ac195b29998a4526b12d778c4fdde6dcdfc4cf5f

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\af.pak

MD5	862a2262d0e36414abbae1d9df0c7335
SHA1	605438a96645b9771a6550a649cddbb216a3a5b1
SHA256	57670eae6d1871e648ad6148125ee82d08575bec5b323459fc14c3831570774a
SHA512	a789a4cad72106a5c64d27709b129c4ae6284076f147b7c3fcb808b557a3468b4efe3ede28033f981335d5eab986532c0497ddd6ed24b76189fe49366692ee73

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\am.pak

MD5	4eaa15771058480f5c574730c6bf4090
SHA1	2b0322aae5a0927935062ea89bd8bd129fa77961
SHA256	b05dcb8136751aee5eced680a5bad935e386bfce657dd283d3ec00ee722fd740
SHA512	b67e7dd24eadc91d4cd920f8864cfb23a9c67b2cecd54ec97e01705636604ce504dc417d6af1c53f374b58eddf71a12bb82248bd8fd68307161d4833342681a9

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\cs.pak

MD5	70f320d38d249b48091786bd81343afc
SHA1	367decdcdad33369250af741b45bdc2ca3b41ab3
SHA256	1c9448ea3aefce1a7e1491e73af91af772d8b22d538676a2beab690558e668fa
SHA512	02b08ed9261fd021e367995551defaf4b4f54c357409a362f4d2470423644913375cac444f62153ec2963a84880a30a36f827dbfacdd76a6222838c276cf5082

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\bn.pak

MD5	c8173f0cc63ca9e02c07abec94892b53
SHA1	2688b199cc40bb2082247fa451eac1304608e48b
SHA256	e6adcfb4f3b3bccd4a27edadc168b503c36551cd6b27fb24043efeb21f691ce5
SHA512	3d2317430722dc15c5d938fa55235af1caa03dcff7a574b44d37d89e7cf2c94dd2e84518b3eeca4a5a8dbec1b99d94aed97429aaf55c63998002d50ce9cb5019

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\ca.pak

MD5	d193a3ac614f64f4754c9df5cf00e880
SHA1	0da0f7c1a4048074f6fe9d70704aa93ff75e42f9
SHA256	4ecfa3785ab52564e0bd7dda04d59a30163561588a04f3bd1b1b71de051d2c53
SHA512	e85d18951f9a1a86514d577f9b19a4b3727523c15b4ccdd17217f6fdf69a0e774a36874108a05de1be3dcee1720b0cb19eced2d3283f57f41f5f9c5e233e1c68

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\bg.pak

MD5	0e8005b17ac49f50fb60f116f822840d
SHA1	f2486da277de22e5741356f8e73e60b7a7492510
SHA256	50e4f6b9c387adf4baba3377c61d99326cc3987928d8d60b88d1ac29352820ea
SHA512	5df18bbeabd56e70d4c5a80dee5b7ce48259000665941634937e556e3b3a1c6403aa45c410f6f755607549c9dd35d722987b447c50efca51228ffeca4628756d

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\ar.pak

MD5	2b2dfafb0d258c1d2b58e51ae1ee9ab5
SHA1	2a538491ff4023d29bdf2a053447c6016138d9f2
SHA256	ea49bc2ceb6b185030eaa0ee0155feca90e632390417299113b02fbe365ff731
SHA512	6b629ed83edfea1b1ff3c379009332e413c420de651a24160fae859e1e0948fbebab99c9da714df6dfad3b9e472dece7bee95815ceca428183f4ac0bd6d42ff3

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\hi.pak

MD5	18bdd1d8d1d5c6a5fb2678abaa1ef6a9
SHA1	e40602e86e758a518ec70bb6a9cfa23107955301
SHA256	1f49622ec6682c90e03fc42c319074565cf9d3532a2a4e3798e2f6cc159b2e8a
SHA512	c859118e7c1be0642ba9bb1112a98a8fa7114a00711f578971a55aab7254b1ee9bb3899c852b79a002596f29e02f487267aca7033e38cbfd14c90b2989b9595e

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\mr.pak

MD5	f26bc5673e02a93212220d71cf1bbac2
SHA1	8d0ab40fc2b35b75f99538951acfbf6a348c73a3
SHA256	0877f2e75e0b9f5e709f0a0bf7cc793a02ff5bbb28bd6a8b6b6012760c1bbff3
SHA512	9f3a629dfa116cd92892d120f0fdecc5f57043dad232311bdc8c218ae9317f49e655b8b8dc8399639231f2321013190a667d22b6b2735bbcbc375c438dce9aaf

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\resources\elevate.exe

MD5	4043cd3d05c87337109c7a4d0e8c57c1
SHA1	b1a6479e7f6b78dcaa6d341e6a9b6a59fa3c17cb
SHA256	6d5b7ee395cce80201870376e685e5a1e934b96110293a26d216f8dd081d0cf9
SHA512	8ebd6ff8bb2ac303eb68b2e3c68e80e6fc844488b619702842c09d055a658dbff8ddadd89a4cc0f59b5679aec7b0c4a69ac6f29dd95e65b82b8827f988c52f1c

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\resources\app-update.yml

MD5	9fafe2931214f36d81e3632b0be80774
SHA1	cac08ef88b787dfea0acc0d18e559fd9180819ba
SHA256	9161bcc9763091ff3670ef98eff99d004c0f67f13b5dd94715c661fae274cf33
SHA512	a671cec02c8957864797cad7657b4d2165b40980410db0696cb6dbd05b9485f0491065f1249461fb7777d73cba601f8d1035c9c2718a52a56a217da859c03217

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\zh-TW.pak

MD5	1eb532e97b84db33a50055bbd7d36200
SHA1	7aaf0560a16a9754059871a000d237964f3ab0c8
SHA256	6a43c8fac5a0ce7c7a21b30ac7bc2167488e17c81c76c00f0b92b49e9e46e469
SHA512	c946d82bd6ced6e61b35acaf7ace1a61f226c4891caaeeeec9ce4a3ab45e6f43c35dbb388d6d5fa925ed020d7d10f951fa2048269d0585ad3b723f5ad8f4eabc

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\zh-CN.pak

MD5	d1145f2dcb13c5ba797df5a0792553c8
SHA1	e8d9604300d6413fc896d252a0261be2dfdebfbd
SHA256	6a9a1f5b7674da36f20cb76af7e3e75e9e56873539e8a3b32895ebba439af83a
SHA512	f54adffc7d40866fd53dbb238687116d46354f79580877b5d4d93840494e604deaeaeb7e825f6a00d020f3c58d1fb9df8af667feb64c86f243ecab57765623e9

\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\WinShell.dll

MD5	1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1	0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256	9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512	7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

memory/3056-1350-0x00000000038B0000-0x00000000038B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\vi.pak

MD5	e088be14dded779f50feabc4906d5ae7
SHA1	0eeca2c7ea82a03b6373c84adf1a890f29e18b05
SHA256	25aeee59775ae38b21a091107022312fc228f96dbea906042bf3626b7cf86b98
SHA512	af9d1e415a6d06c28df9abaae1f337bf4dd3e323dfd5560df5fb35d01c6801b9145072ee85ab4c524c489fb6cdea956ce327b8c4f6820197d76fc2f33171ca3d

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\ur.pak

MD5	29403f3d5c8f6ae2a768de2fbe8b368e
SHA1	da83015565980ea1a24f5493be6311f06427269e
SHA256	2520ba8471c840aa075075524c4ad2bde10f43fa7a1b623aa14555180ecd30ef
SHA512	a0709280adec39633ca19daf9f8bac6c17a999101246778a63cd9e172dbea2f281b20ce197290c4af6c7601ee7956da42f17e31461a1bd8b8a4bce3c36dc87b7

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\uk.pak

MD5	83e5f0092b6d72403b60fe0e1e228331
SHA1	989ed480b7ef55dfc9ccfbef1a5b9b0e104693d8
SHA256	29d68d90512ee9952635c7e074d5ab210531d93ae24c11a8f91bca20b685e9a2
SHA512	9895928ee516db7d4395b2788135a814031b9ba45e3a837e633bc253b08d6f380e4078d4d3fd51ae37502a39ff45a0166969fb62365e890f4960a51040b20941

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\tr.pak

MD5	193f0c0a8218f05657e2590ea4ee6004
SHA1	dd3ffd7f67f72de879903a231271c20aee56f695
SHA256	676d46d19d1673eeff4f5e908aec3b53a6273c440e69e7d655ced6c70531cb9a
SHA512	28606d710d44c9a82c2849fa5ef989bac1afab53cdea99a825f80aa41dbd38a9ad6f0f44935f45439922ca2bdddc89c61f8ffcb999aa13fa45558551d5216e1d

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\th.pak

MD5	a4d1594635d26330ace7054bc025b76d
SHA1	bc4874a6a3b1d1886f05858ef2f653ab3520451c
SHA256	f06a45f0395c3e42e42c46de2c19a2a104661b47be6f9ee97f8c68b05706ef1e
SHA512	731485b139ba0ed80dac5e582ec36f53a805a867ad33551741b805e851a9d2356fb1894232395d4fdb200defc988bcf6d51e58834b542c398c1012e389953a3d

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\sw.pak

MD5	9808a9df2da0844b1ce1a2a4213c48d0
SHA1	541f24f006ddb3361ff1e5015f097ab799120fc4
SHA256	1949953d638f266ce74d84c020174c074780166b880e7c2ec38bc6047bbb8ecc
SHA512	66b256e02ce11ea0273cc5bfa78e56faf8b250208d1e868bf4af77cbefd1c891708573d63873a5d02436f884544a6550176afcd3a8220cd35d64b88987e94404

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\sv.pak

MD5	a813b566c9e630910e6ca946defb7202
SHA1	2e25d2479715a572c096ce19b8dfd7a6da5339eb
SHA256	48a71912e4843b03358fede7176b2e57ced83d3a1344a92b989886374dbded62
SHA512	b348404135e147cef93c246c826107f9df170b294e9d0cbf576d2812d0ff3d2b7794ab5aba55cf729fcf7135a495d2ff591db62fa61e2998290ff02538a0e48c

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\resources\app.asar

MD5	288677adcda3e18ba543ace5a6775e7e
SHA1	5214899790b3b30b1d4f6b02be4ff5abca488637
SHA256	6c6e9cf856c88d1482c87511cb10376a1a21091f00c7e51f5e7292f6eadc4b65
SHA512	7fdfde41c91933e6c8020eebfa6d69a35df5dd14eb220db4958ad6000fb9517c6905bec3edcdf8236794a703701bbda36c251f353f7de93b9c425f080e2838ff

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\te.pak

MD5	d262c33a8c2b4949dff36cc1980e5f05
SHA1	e1ad725c388c4a1a386b4ab6170601863c943c29
SHA256	09ab1ac2b69f868539d4f2e59dfea8c3c2f418a5455777e4c91d13c5ee55ab4c
SHA512	0202f6ac32878926422d542ea96b0bcf8b168f8ec6b928121c368711856fd5f4781a24b15851cdb5892246b355d0dd37504d4599b24e9fe8a723b8dfbfeed29b

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\ta.pak

MD5	d50aa6815b63aff8c443622cb8bfd849
SHA1	fd247855e6e428109e7bf2e0018580cc6e0663c8
SHA256	6348cc2d385b9808fdf1b815914dbfb26f552da4d10f85b2613a5e6e9f95b8fa
SHA512	620e2f9ab9998c68d667e32ad9bbfa2569f7a60fbc2a67d7492c6c215af2a1037708e38b4ed7932074d29a140581fe0ffedddb362133a941966044b98eaa50db

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\sr.pak

MD5	5d70a218b7dcccab0406fa9239ef800b
SHA1	cd231758f84a0d56545d0a234a58757a18a58d0c
SHA256	a2bc6b064ff1f7b15707f61bd76ddd9d889bd982c4182e9e74272d39c6235c85
SHA512	ef6f71e0d9782b5ed6706d9226c1a7fb5a4323b8dc8de25737c7dcca87d04c16b545372127670de312079be993823f565de1aaaf5ad833bec5baa0856c19b0f3

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\sl.pak

MD5	ff14d5f9484350396780bea7f3bc64ec
SHA1	de097f12b70b552824de69141d6ee1969275eca4
SHA256	b174c4c49654f7d65d223568c700bfaace74238447ae63171787236ce2aab00e
SHA512	011bcc3980d21e0900d1da334a28b72623b22b527a4fc3d96a8f78fb055dc87cd1433a63d8b4414a0a86cf2ded5833a395214910b17433a0545e04d1ce4875b8

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\sk.pak

MD5	fd001b1b02597bbf16baf3f0baf3c6e4
SHA1	e4c703fc115e02833fe08caab1e62775b5812473
SHA256	f9cd222838721a618c23c8f6493bc9699c795c0063998f1a8d506b4b7a297cdc
SHA512	0ee991da6b8ba1bcc3cc27abc645af43bb93edddbf182496aafeeb401d71ae10716335ee0197f1987c21b3abb441aaac968b9a76e75ae77fcba4cc48847f5b1d

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\ru.pak

MD5	9ef6fd52dec5613f9e80204a84c7f2ba
SHA1	fbb8c9db815126fca3c62c810432a71b6965f2aa
SHA256	d0068b9ddf8a9e6a5b1186bd0e00ed9f09224ed56ba7e653e2d54158d938c6f2
SHA512	0fb442ef86f75ca2cf58a677bd25ffb7c420f98250fac7f5f25e2272d4e7dc505a5f3eb3665b62bec189496154b05a1462b6f17a0e9aeafc1517b71e2d813953

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\ro.pak

MD5	938e62fca60d7b54e9c54cdd1f745f06
SHA1	5a61a1ef3ae855ff436c5d7f45b6ec271a5228aa
SHA256	82e69f505222125ea62f8e90d8030d82a1bd49871192cb4274a8fd9d0e03d577
SHA512	d3f43881fc951c961cfb34babaa6eba2aa9175865dc07542dc529ab1c11d15703c03a7e8193c004b004d13f0a0672bccb2fcdd1cd88f32add159c337281d6d5f

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\pt-PT.pak

MD5	4816d83e54beaa2f94c671d56361c04e
SHA1	5cae66c0b7079d778ac87ad48777afd85b172d2f
SHA256	a903ca2a8e52f987e23d040de7403b58d925a6c39668d3bc0822fb2aadd34cb1
SHA512	0d3a39e1205ce9366818cb51d38db035b80448dc1e2d2d6bbd7d5df693641582043b45b4a78bbf2334159616187dc85a51e623bb6878b1498d9bc7acd2a6ffab

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\pt-BR.pak

MD5	8dabbceb430a6bc190ee344541fa8e2b
SHA1	44c7da04bac8c9ee67c8d6a0eeb491cf7ffd2479
SHA256	6d54f87f6c8b5e01bd0da9a961236344e95e85c3dc55fc92a34542777d6f6275
SHA512	4d36d527f1769501d1fce208738028d5ba142716a6243798212d5a2403dc5c950dcb3399e571cf3a11b1f35d845a6ba6798c38074d0ed66c894b1c18ab800159

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\pl.pak

MD5	7b5d41611b92b24ec8b36b66feb11f9a
SHA1	3d6c36f404c29d59a24970585931860453f5c88a
SHA256	69e16e41f5fe7fa18557b938874f20cda6879f3cc616ead9a815c1381fe94158
SHA512	16ba52cc799132e4525d220ed595d3969d4cecf163ccea6b62fe2211003b0cc44090c4d384e9cc4e32800181b7f7e0810da5a0d2c908f4625ff8382cfa3c177e

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\nl.pak

MD5	b525894276852be4ab42ab7044fa164f
SHA1	d3d035522265718def8125f5c4a1d3e74832dc2a
SHA256	c7a18764ca908ec7f66c48cae2be06fef95213d7a5580b45f9bacee474456167
SHA512	36b11f1df92df27b007fd640b589c6b7b30cd889bc297635bdaa40bfcb4332ff20911edfd23ce74c1c8963dd658f77bf4b9af50d3c281717f58eb23a598783bc

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\nb.pak

MD5	bf9bfdfab1479bb52254329d7aa229ff
SHA1	cd9ff35321731b839ea6e5f31f5de0bfb475666b
SHA256	96747543d9b2dbfb4482d4c24d7818d366545b2476633ad4fec8cc958ab760d3
SHA512	ba8e62d0a87c532ff46f2129724dd2f1bfdebd99c2606e0b9608cd07841776faeca15d04ec6241020c232d4c07809d718f40cf4ad9231d6a8996d55973486629

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\ms.pak

MD5	d22cfc1b78320157685839f14253fa1d
SHA1	0cfcb5c176d708e26bbca2427be611ce6609eb93
SHA256	c7b56e9ca2f75b4414c13144ff4deee1459c2a7cde79730d863ab234cd4c2f8b
SHA512	2eed40c50a63e362dfe2f172d16e4545f5b19c673e71db674bb004e4e6a4cf793ed4a44ee80d86b05aaa6cc4356c207476afdedc2b35017421ea9b9fa6ebc81d

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\lv.pak

MD5	393c296fabe0c4c64a7d6b576d7d2cf7
SHA1	16c0605e5829cde9738e1cd3344a59b74fa1f819
SHA256	91642c04de64f88a5c49b4eeaf5d627554e60d56fc40e7cd58cd2601b0d3dbf2
SHA512	067cccb059d4526c104880a26ebf04c7e2498c49c5641abdc91785e859bc0be1475ec58cae9ad1eb076f26fb9215ac246155e123baa13c06a05e4f22a002c2ad

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\lt.pak

MD5	edb2c872a4fec5367cbe68035ef0ecc7
SHA1	b4d42bcc83c98dda1ea2ef962d097f6fb3d25c71
SHA256	1bd385b780f3d13d41f8cf782a322e37be889aee273ffde3d8959e0ebcaabd0b
SHA512	dd801a1aac2242e3f532e968b4c9639a2c8bf3eccc17470d9aa8bd6730ae4be3e7276fb782c7908bb6f87d3ade20a40c644b9db5d2201d96d91fd95ebdf429c9

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\ko.pak

MD5	cd2310448ba6689cc73d0b2e6dd2791f
SHA1	7827179d3fb98a5abc2ad38e20d942b83b397235
SHA256	cba6b7633cce796407821264e176a6266f80c1799ade16bf16893d68144236c6
SHA512	c3069bab640ae43856330bb8b3a0e0a4ca058a68a0fc03b8efc0ce1dc2b517f11380fbc641221e29b4a527d685ece72107fb83cdb9b539390eaf6a30c21bf36d

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\kn.pak

MD5	59e6642f09ce97cfa4a4173413a1b036
SHA1	777a96a4aefbe138f26c8697e66633452285eb2c
SHA256	58d16195170f76e40e18ee0ac2e10e1b73bcfd083821158927a7d67a51bcbc42
SHA512	66deb67a4ce1914f5f27bb6423e5be62e05d0a36320accbe653572a437ce033ed5d26858a62d8c57476b34e1718d580f34ab44a3886d8d22d17f642d70f0138e

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\ml.pak

MD5	b690b0f01954735e1bcea9c2fb2ac4e4
SHA1	8d98860e202b15a712822322058e80a06c471bb8
SHA256	83d187cd70048f4129fa65ba148c74a04a47ee1f14218e7c85b36fe83e87b5e3
SHA512	786f08019a0917d0b3f29aa2d1885db6a6f995990fd8faaf41a9630f8347b4d210a844cc6690a41b4af37d60e11f41fd2675df1a01bab5915e20cd9bc69b4541

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\ja.pak

MD5	dfd5ab27c326a1e1f87943a3079a2af2
SHA1	3aaa73a6668e1249e4d51c8fa8e0c6868fde9da6
SHA256	8260f4c9500b64d541386a8515fd0c9ddef82e3f044951b7b51a33ad81c1128f
SHA512	d701674fb6e19bcdf297b19a9fe3b81c7f446019a8c2fd3e90e19294765b1e8ad4f0e40e4bac65b2db313a4f83eb050b5871ee4d74f9ea372208b7abd76c524f

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\it.pak

MD5	e0e5580e8882f0eae4b5b21e6c7828d4
SHA1	51e32e51458b5839112ed9dcaf500403c45ac1cd
SHA256	a7f555e7e797e1de1a66cfca8c7b709b0e542ca62e7de96e034701fcef316d0c
SHA512	1a2a4948a5538158e6dab7ca7b3b780ec7a66a0aadb889fd451e07b32336ea08b88b5d57759e335fa967f3b4bb1282e952b97e496d798758159c70eed2e5acb2

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\id.pak

MD5	6a406a9adb5c25e35c6838828ef30c17
SHA1	2a1ea1dcb75217ace04254644845cd038df6a980
SHA256	af63384cf7d1d39e57decd823dff7538ab2b1e7e36e9ac61238477f7889d1d46
SHA512	ac7afa288b768a730027db0780b0f7c9f42ef990e4e22751ef1dc85e4841579a6e252293fb04d61b0cb591ccaa5c74d37bbd380afa15308c80ea32070019a361

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\hu.pak

MD5	0b62fc2b60b8a92dc506550339766139
SHA1	abf0b1ae99ae40d87f86ee04bdba467674fc1039
SHA256	6ca150d0fc35492bafb411bbc520f3b34da6399969fa9685ae74201623882560
SHA512	aab6058e2f41282ac5a9394cdcd503efdeb6b9eb8b9a64cc1215e31a806e60a34966b6823f91a97bfb81656d91ccfef3a226165811e6f4208fa436e1d04c1242

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\hr.pak

MD5	d80178f9df2b72a24a7dc58b5aa13229
SHA1	cda864bbfc6935cb4e3e30a6eaeabbab5264d01d
SHA256	e442d083c32d752d1ef2225d84a4f1a91efab768e86fc63a7ed22c10fbf7e520
SHA512	c08380fc0c415a529a035e6e9c0eebc719766c656a3d9e3a782f21b4fef320688e1d11de8c3a5d0e59a102c9fbadcc960478a17c534500e137f4cb0e697ec9b9

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\he.pak

MD5	ec16b50e6575cd6863df282847cac3b0
SHA1	a59e089951c3a5dcfac165774c68651055b829e0
SHA256	c3955c97b6998f1806f8871fd3137f6f504bdd091f8bd1ff5ab8cd089474ae8e
SHA512	3c640430e3391be156aab26f6057e966348dff50ea946a02db947e2316d3a915c29f329faa26725a90af4d06ead7c7fc28cfa7573033b2b9546fd8e4d2bb7ab1

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\fr.pak

MD5	59e1e573153a209c56ae3bcb390b898f
SHA1	45f8a5469651c032c453b14bd68c85cdd6c75fc2
SHA256	976622fb851378f57f81423e5625e40d0753d7a5e34caed2c39e4b130a3427b8
SHA512	91f1b88ffb9f3362fbab7d607a68c4ca65e6b89fef7de0c986067ef7fd013c0ce35bce328ff3546cb7aafc296993e46a908ac506bb6a141088cfbc5ead948ba4

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\fil.pak

MD5	cbb431da002cc8b3be6e9fe546cd9543
SHA1	19fbf2715098fc9f8faba1ac3b805e6680bbcca4
SHA256	ab107369d45e105a4cb4f2f6bc8da2a8c1b6c65d5e94a7ab3e703e619c083dae
SHA512	3cabbfd021e5814587dad266c4f5c9f624e9d9278f22658dafd65ff2ad2bdc5f6df8a8672614b296cea826819211e12f8e77f183007c0a79075e2f0980b99911

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\fi.pak

MD5	a9fc339d49ea069bd81380ae1fa0ef11
SHA1	5f376072f38e94e252d72c5660d8120a41d73469
SHA256	e6454458dfbe150112c37f8b02f8c72c593af22e8be16980ebc854ad113fb763
SHA512	3bee6723485a9eae4aa9bfd4e7fb490ce7a0aa12cbe41443b8bd28a26fe552cd31f4a1487bd98c6bc7774df1ea16b1de94ed0f52af59baf9e17b3db815404c4d

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\fa.pak

MD5	e2bee9eeeac231de237100fae0aa77c7
SHA1	5e5eeb59656e2f8f4f62bc618966d38cc06a385b
SHA256	7a856070430e3cfad15b96b153b1cb483cca9a1b9a43453df3707b09c748a3f2
SHA512	5593c4a48e679f0f6283c3bca69838f581b6f928cc7170737778458393b6b85fab0e6ca390bc5da840f4b79de9e638015bf341c1a95e8f99770886f5354ecff6

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\et.pak

MD5	e7ea23d6304d5d600d884f4e3b3cb2d7
SHA1	99fbef7eb1bde7df398cce9faf6c7c357769334a
SHA256	292eb18ec61502b0e952b447f73a66143c56dd95f170981945e5aab53a6b32b3
SHA512	23dfa1161d11faf440241b1f48f2ddbc8ec086a8e18da351734656551f0f54fe4c94b490c0d3ecc378a3de7f7713a1626a7a6c21da2500b9597b44fd08197d50

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\es.pak

MD5	d584992a0670c5771147c01266d17362
SHA1	d6e70e43585564d520e4b1777fac0b1e7bc6ed37
SHA256	f6a01c26bc18dcf701e1d4b6ff76602f14c4bb9adf9dd176c9107d5aedb4503f
SHA512	39db436a05955a3ad3b54ace4f2f0e8a313797d3ae8eda9cf1cab6f2ea1edba0a82c30f3b589b8c5399ed06e9fcf4ce9059d3d5a07472f05ab1f0819e42d5b73

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\es-419.pak

MD5	088de6d12071ea5cf8d4a618ed45e7d5
SHA1	f12a76d18b84b17906f5f8cfc78cbb370b026b09
SHA256	d1019c780e836e0c30fe01928d23ecdd0ca04ed8ee886adb3428e3683e4ed6ea
SHA512	8da7326cf99cce53d7ccbec0c177ff9cf6dc0009431d6c89b3e8f0475bbcd0dac4c888460b535c1070ced62f1bf1c614bb0fbe9c5583e66c42f30d6e025ed7d6

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\en-US.pak

MD5	809b600d2ee9e32b0b9b586a74683e39
SHA1	99d670c66d1f4d17a636f6d4edc54ad82f551e53
SHA256	0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
SHA512	9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\en-GB.pak

MD5	a1aa885be976f3c27a413389ea88f05f
SHA1	4c7940540d81bee00e68883f0e141c1473020297
SHA256	4e4d71f24f5eea6892b961fcda014fc74914c1340366f9c62f0535e9b94ae846
SHA512	8b6d67e09fbe7a2152a71532a82c1e301d56cdde34b83a9f17d9f471e258b255d5b2d4a0c39f38581da3a31cec24fb403156a8e493560d7206e1ec3db7e68b72

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\gu.pak

MD5	a9e6d8e291ffec28551fccf4d1b06896
SHA1	adc9784433fbf2ee89bcfe05baea21beb1820570
SHA256	716ea0433e19edb5113dc8a25ae67c2587bc17c7fb63a93ac473bdcef8f72d34
SHA512	3a60002dc6a9008cac78bbc050fc36d1053bfbd21ecf4d0579b2780985d4e7a7aec94483d8b0b8dd7a899b8435d54a27bba68917a23945431183eda021722697

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\el.pak

MD5	16bcd10bc81dd8a5b3ad76c90cfb9614
SHA1	240395860971fb9205d28602d4d4995007ee5c75
SHA256	6a06d1d6b566214f7c3b693052beec488f7aae5ceeca26781a5d66fade39388b
SHA512	353a26b21848f4dd30b3aa1f4196b23571e177893ec6912db4570493664ed987e688fd66c04e509ecc58233476ebe59453260bc3569136f275fcd681ae54a174

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\de.pak

MD5	141045fc1f94f93e82db06db4f7321c8
SHA1	d63d226c531a710359cb65f4e6aa190f593b4d54
SHA256	47253e2fcf0e4691f29b3ebbe8f888a97b28d6aeaf73ab000857a6b8d0907ff3
SHA512	85c27fdc9a2cb9310bfbb05d0bcd668eb2156a37765d8fb59496739f6f1eae12afcbaadf5eea8f2db2ad8c8a0602f83500bff9cb71a429174a80bee16ec10118

C:\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\7z-out\locales\da.pak

MD5	0e4207e2cf5741a8968617df9174a681
SHA1	bf9b7558141ad30bbc921992e48d48cd6d6ab475
SHA256	438d2b1fd396c2108ca3902f69eeb372219edd5d95fe70970d8ee9e64556c9a4
SHA512	4ed8368013912c408f7e5f7b4f6f1748834e5506307b92f4b669c557efd27363a55b4e2918eb7707e798878c9492b765f24ab9c90e843f54e8641c4646bc72da

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RFf76f6ec.TMP

MD5	46295cac801e5d4857d09837238a6394
SHA1	44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256	0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512	8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	512de4be535c685f3ee7182b35dab9a0
SHA1	a72335898ab27526349ea6d4b18e865ef669d809
SHA256	00508fc066c3e340bbde62c49bee24a125664fc3a59a3991c29386b9b9730d82
SHA512	0ba36374a8628521da62163c515a33f153face39cb345a37e1ed24246690408c73ffd0e0545f5ceb4bd834580b402c31437481582845a8c0ada957991802d81f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	1d098f750ef9ca8d678e4b764d078938
SHA1	dcd349ef5cc65a3de040373772957a2709b17e3f
SHA256	670fd2500ba295d3a211317cc0d732ac50ee01e33d8107e02146e6eeebc3a372
SHA512	802e6ea777c81bc00b7b8017fef5d7d64fa618e331948299413e8449802843439f2368d7803722a0fe01f7dcfcf619dbcadd06ab346a5d05a9e8c5bb9f654052

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5f594517-57a5-45c3-a66e-d5dc2d1ce2a5.tmp

MD5	7c7537ee2f902f01fb9e9ec6f059bad5
SHA1	638b9875a9c3f8a62697c4dc89ce6e9984124060
SHA256	59382cf9428701a3d0e74e207a1d80ad074a1003669ab3607cb52530f8a54b5c
SHA512	a2be700c806fc4a07b5bbfef3d42c66cd341c0f284a47bbdc18eb1cf47abaced4f8e2d4cb2fa7f26830bc9462ef0576b97ed87e251e387b4a36ace19942334f5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	ef00dda9ec33d28b177a65dcc543417e
SHA1	c453a082f1ffbb72ce505893877c095cc90f4947
SHA256	45338abb38b9e38a23bc7e206a53cebfdbd6c469730c9b632284c887b9e8d1f9
SHA512	79937cca7f1e6091261d6b334d7a3a338b05216330a40cbd3aeb9da3dbc5fc5186c90ce77eafde2a05f5a0737bc39df12f6ed9d426d6d324b290e1ddc2bd89ce

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

MD5	b22571ee44ef2080016c1e6c6648845a
SHA1	115d6df805a78462f7c750a861922b0e2abd0de7
SHA256	adf2381b1e610d05bcb0c9e03798e4dfcfe77d10d136ff5a4d8226fec19334bb
SHA512	4015ffa6a08e42d85157cb216e995d6cd6a7fbf408dd13abc2a18f15e46dd3e0f1ee2d2b5676770ff23a1db0a5b2a1b74b6c6104299575e076ea0a31a3f10750

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

MD5	d19f357145a2ee96291ea0f34504aa36
SHA1	26ffce889eacbee5c4e96fd8b61c2ebd84cd1730
SHA256	f085d23e60e753705381c1861cb512e90305651e4107b9a3db6529367e7ccce6
SHA512	25987b8c3d8c56b26039c6f1e46eba6161739c93b81434822b0c85282310b63387e9c2f9af5de6dd7812ddf1eaf1491b10467c8fb1f1c285783ffac2f3496efc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

MD5	52c11498c7b62200b2eaad6e044a3a9c
SHA1	053e3c71de096a11aa3403ec3747ae21be8026b4
SHA256	19fefaa1afb5eabbca7e26bf75082224c4343acc80d295eb1f8b637cc94f0c75
SHA512	245f3bb8d4c340ca4db5e2c17b67273ebdffe4525e454d415415d2e7f4c95418508679cdb28762825556046a32be4b6ade933010c60bfa2117497c3c3548c3f0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT

MD5	206702161f94c5cd39fadd03f4014d98
SHA1	bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256	1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512	0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5	ae1bccd6831ebfe5ad03b482ee266e4f
SHA1	01f4179f48f1af383b275d7ee338dd160b6f558a
SHA256	1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649
SHA512	baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5	82d53e9bf66292ad96e0329a9f28d4cd
SHA1	a97a20ef0112291cb477d47722dfaa276bfd5ec5
SHA256	3e981c8c14e1e3a339709a77a219a68d30d043d1ad9ebb3a73d7f13de0cb246b
SHA512	44691115776eea7c2b15f7ebe3184602b980c62e6fb159f251cfc287872fce429fb42f51e8750853e25e663514ebc9bf5cd5aa552b87db2211c7aa64f9cfce7e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5	3a3f82904e09a5af94a03cebc3c2a6bb
SHA1	64d6a90d2ccd062222fe428c3ce1ba9f2069a8c2
SHA256	8ef4def4dfd71f56a51e1709dda2c8bdd0636f0571faedd13928512063fc8c57
SHA512	de35f94b8da671f28e1c1a2baf304f7309e5af97a7c152a1d07cf860069084fe5725fc71df5fa0fff7ae687108b57a5534dc5d02d2d4a551202ef1cec05269d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5	fb9955f69ed0fe6e4375fd76d5e6bee3
SHA1	b88bbb4b538935c565ea77ed79c9d268e685b7e2
SHA256	44c6432765662fd2ec3fda5a05b885591c8b1fc0659665a8c9abd6a1b8c336fa
SHA512	0ea1a4ecc9efe7f91472409ee55a92bf8c4ea5c41b249c9732dd232d033031f029b134a8c9c62057864610bb0cc5604c9dfbec2181262f2b71110e04ae9a7904

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	249aa208c27836f34e1f41de7c1850e8
SHA1	317d4340099ba4cbf69cb39a6ca16d979e7fa4a5
SHA256	0ade1e8d5eec0a230be0bcaf0197186ad25b3fc7e5487b1139de0ad81aead58e
SHA512	ad07b4565c583f245ba11cecf5a38730d9517144ba5c6b2930c106080f5945792ecc8069d7bd674411db1fe944f0d249b53369cceaba8003f51d5f15bdbb2dd7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	8c5807de37aba89f1cd94a38234f261f
SHA1	3f34de1260fb857bfe57449dbf6a7802dab49678
SHA256	7e6ef5ef698dae65da45fdea70b57e0255f4a23fc3faba8e090e4260a26ece36
SHA512	d8d4d6634bef51da6625a7275753f337369ada62f792dd9eb7f087fb895243727341d35f2ec9c95ddf765c4f0843a337838d8d0781ca3d17d1d294c670671ec6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	07fce15c118dc5d958cb0df23fb396e2
SHA1	2f0a951b0ab0a78ff7672d3681c8f4d487180161
SHA256	3bc28697dee59b3eec2afa11deb6befb926b5dfb314b91d61be59cbff74412a9
SHA512	af86e686d897dd38e7b46c4cc5366f01c1730dd2b92b0476391111906c74625750891632e4f6671e51ad04cd21954809c3b40dc81fe57d46f55578501237e8f5

C:\Users\Admin\Downloads\mmc-develop-win32.zip.crdownload

MD5	f6e7de6d810bbcc2cedefb305f55f503
SHA1	8c97a85d96bde53a607cdd434a5085eecf978c3d
SHA256	100b85a1e544ca868a5498cc88fb5d5f5775fa70bb336c87efa07528bc313271
SHA512	8aa10b2f3194db8c8e57bb33c7c37942310214ea7832df4ced82da33e522feceb6f88139919f1ac6b3f3c8cc09733943611eabaaf019c34cb81ffb2935c3a57f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	8f9e0bbf6c7e21908b728c92c01f86e6
SHA1	92ea9a2ab1343df370217ab0b97bdd22bacc9249
SHA256	b42993c9e968984f1d66e8566f2a82b89f35f4444043b4f365c74c9f06e2e1ac
SHA512	8f48d37e3fd5e7717936e457453d69a6d5d621bdea2569200d5b54a52c05edbeb48a1a29d34589c4058f57252c909e86ebf8a85a1835d4c25ff4bcdf2f0d03dd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	db087fc417fecff8dc610cb67d0e255b
SHA1	3d3e97c1124d151123cbb2a7e03de3db8a8a7780
SHA256	bf4932599f090da41a4e67e303b3c2cc0917b3833e953ac12d083895da3b1b4f
SHA512	37bcb9f9c39a47a1d79dc5479eb155bd886069546ee6fe578206fae820737e701b954deb91e0cf03d63bf497230373c65a45ff18f9753472f264e1841423ec2f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	0fe8fdf8dc990fd3b1a71e07b979b23c
SHA1	af3806159939fcb487046e2084ff781c61838ba7
SHA256	ba68282f156eaf8fecfb45619ba8e95a4182549411397c803f92ca0689ed6786
SHA512	1e28cd5d920557f4f79e23a8ac4a38777150a87970438838cfa9c2b2ce470c5383925f6cfb4b2eb02a37c14f43ea3231d614ba4718c3ffba200af99b6f1800a2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	09357e1b7b771e97597daab39268e2ed
SHA1	1535c72afa4b1386e3bb1bbccd4498050f361226
SHA256	b1492a62643da90450dbdae649df21d82a3f11cfb2c8dedd86ba6e32a8c0fc96
SHA512	27452752f4be68398b5c5bb5a28db2fff3135744dbf8e3c2aa36683eb7bd808a174e411b26e765552f9c796ae97437a6a84d717cb2348850b582c63b207fdd97

memory/3952-1984-0x0000000000330000-0x0000000000348000-memory.dmp

memory/3952-1990-0x0000000000BF0000-0x0000000001234000-memory.dmp

memory/3952-1992-0x0000000000400000-0x0000000000A23000-memory.dmp

memory/3952-1989-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

memory/3952-1988-0x0000000061740000-0x0000000061771000-memory.dmp

memory/3952-1987-0x0000000070940000-0x000000007095C000-memory.dmp

memory/3952-1986-0x0000000000BF0000-0x0000000001234000-memory.dmp

memory/3952-1999-0x00000000051E0000-0x00000000053F2000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	60d66b5d75f3191475d05652eaed0b8a
SHA1	752abd2ab63c485dbad45555a6234cd288e1a7d6
SHA256	d0fd11c67d0d909e7ef7cf9c270abacff00d2ee5616838eaa19366ec10e344b1
SHA512	c5b1fa122617f30c373c6b1c4706b144a7c9f1c437f6822f84dfec3ba09c64d50a0be6f432e441f27343de859b76cbc4ad9d05cf4b6509e63480318f6c5321da

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5fb0259a-0356-41a9-a323-749583bacabc.tmp

MD5	225def7012e4cd2fa020d142cd693b43
SHA1	3885359974da2b8fe7685932cfb4e334334164bd
SHA256	f822000f04f713c23e326152863fa7542fc3cf5fef161c13444c89df61262225
SHA512	f175d1001df7e6781998ec14e2b6ef9dcf89f3f37869fd632a3e286781cec9cd30b05f100e7869628bb5b92b4d4473f10999d6fc812f44ecaa2ead6768cc63af

C:\Users\Admin\Desktop\MultiMC\translations\index_v2.json

MD5	78e5bfefc547cc05a3a79e738310c4be
SHA1	61fe877f878f0ab410904927dfbfa17b451bce5c
SHA256	0fec483153f5e18a4de781de16ed2638b3fe6acf2de595e4c3adfd852c2aae68
SHA512	776c142eb0dd23614fd24e4e0b26b339f6bb07488ed0f470f35e21047e207c569b845c1116b87c9424752b3e48ab28f7e16e3fcdda60fb1bcef410db666695bb

memory/2292-2041-0x0000000000430000-0x0000000000431000-memory.dmp

memory/1948-2050-0x0000000000140000-0x0000000000141000-memory.dmp

memory/2340-2062-0x0000000000140000-0x0000000000141000-memory.dmp

memory/3952-2065-0x0000000000400000-0x0000000000A23000-memory.dmp

memory/3952-2066-0x0000000070940000-0x000000007095C000-memory.dmp

memory/3952-2075-0x0000000000330000-0x0000000000348000-memory.dmp

memory/3952-2078-0x0000000000BF0000-0x0000000001234000-memory.dmp

memory/3952-2074-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

memory/3952-2073-0x0000000061740000-0x0000000061771000-memory.dmp

memory/3952-2072-0x0000000000020000-0x000000000002C000-memory.dmp

memory/3952-2081-0x000000006E600000-0x000000006E674000-memory.dmp

memory/3952-2070-0x000000006FC40000-0x000000006FD41000-memory.dmp

memory/3952-2076-0x0000000063400000-0x0000000063415000-memory.dmp

memory/3952-2071-0x0000000061940000-0x0000000061EB5000-memory.dmp

memory/3952-2069-0x0000000064940000-0x0000000064954000-memory.dmp

memory/3952-2068-0x000000006E940000-0x000000006E964000-memory.dmp

memory/3952-2067-0x0000000068880000-0x0000000068DAF000-memory.dmp

memory/3952-2077-0x0000000069700000-0x0000000069894000-memory.dmp

memory/3952-2082-0x00000000051E0000-0x00000000053F2000-memory.dmp

memory/3952-2089-0x0000000066AC0000-0x0000000066AD0000-memory.dmp

memory/3952-2088-0x0000000067740000-0x000000006779F000-memory.dmp

memory/3952-2087-0x0000000002C10000-0x0000000002C20000-memory.dmp

memory/3952-2086-0x00000000626C0000-0x0000000062706000-memory.dmp

memory/3952-2085-0x000000006E840000-0x000000006E852000-memory.dmp

memory/3952-2084-0x000000006C600000-0x000000006C615000-memory.dmp

memory/3952-2083-0x0000000061F00000-0x0000000061F11000-memory.dmp

memory/3952-2080-0x000000006A880000-0x000000006A9F6000-memory.dmp

memory/3952-2079-0x0000000066C00000-0x0000000066C3E000-memory.dmp

memory/3952-2118-0x0000000000BF0000-0x0000000001234000-memory.dmp

memory/3952-2122-0x00000000051E0000-0x00000000053F2000-memory.dmp

memory/3952-2117-0x0000000069700000-0x0000000069894000-memory.dmp

memory/3952-2108-0x000000006E940000-0x000000006E964000-memory.dmp

memory/3952-2107-0x0000000068880000-0x0000000068DAF000-memory.dmp

memory/3952-2106-0x0000000070940000-0x000000007095C000-memory.dmp

memory/3952-2111-0x0000000061940000-0x0000000061EB5000-memory.dmp

memory/3952-2105-0x0000000000400000-0x0000000000A23000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	fd5e7aa039a6e411475bba8edaafb855
SHA1	a87255be221a65f306486ff06a1d3e1f0a56972e
SHA256	2272a12a9dff6a0e95f08dd0869d851b52eb9f1dc6ec9626d5b5587fefec50e4
SHA512	558e39fb961cd2b4e2f561eb202fcb9a7f5061939e0b5ee7b81d169e33c0cc97901fcbab813b58454b387f5100b7d6b11a068d997c932b7e02749b3fc6045210

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5	a266bb7dcc38a562631361bbf61dd11b
SHA1	3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256	df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512	0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5	ceffb1c73df4e08c259e38d773b8436b
SHA1	ba1e96698287d5e798e74aa4a77b28a9c4801837
SHA256	5371780c32b04b4fb4c01db227b7f8ff156c774c9a191e74bcbf9a867c1574b2
SHA512	fb510b407354b258455baca2d0686e58fb36c31d42b7e72a8d1005ea7ef9e4d3d7f042ecb3fa3005522e8afb0a782b2045230fe818a0238eec95b23ade535939

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	e6b6f8c8cb23199edb37206ab9ffb4e9
SHA1	3d85348058fe7228bc7d322398064bd2ea1f9183
SHA256	9e632d40179ca236ab038899c88684c40240418a067dde79ef55c79edb8e1a0f
SHA512	1c452d9dc63931c5dfa92184f6b0c3cb3124fa1862719d453af1068cc930b9fb35e0360410e3d55bd39f3e3b075c04f466adf2836cdf1e711490736d584f1953

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	51ae7016a6dcc002db90e263ab139b55
SHA1	ced89737ff8c2ec27b3e70232d6aa354f035f72b
SHA256	459010c2c0bf5b930b759360ea07ab191748fabf06ed308d3b179771bdd6e632
SHA512	a9b42fbee5219c72c7319c437bc22e24ce1fd787876d8ced764e72ed3c226a97ed6e26155342fe20a6af3ec3d6ebd8b370e94f96166760f76ba3251679fe38c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	9eae4d761e1e3a8f6f8c7c9cd6f0a960
SHA1	08372b11731077a192a6aad362e7f2470110f006
SHA256	a13aaec5eee65d65d5c2c5eb65722bfb280e8ad74858e54a7c6e069eb4702fa1
SHA512	4dc7cc767862ed83bd327ebb7b82470663fdebee3a1b1f7738e657e4a79859124b58c841ba15f5625bbcb450c947cbe1679d8383b1b0d0ed2eebe6e93c130838

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	44438e0b81f3a67f4c0520d434cf1f69
SHA1	568be69eeaf18900a5afdbd7e99da1ae9bdb0752
SHA256	644869a5bb8a257bc72f163a75a8fd7291b4d6b74ddf57813f76722144804c73
SHA512	c64bd57cc68912fb5983294efd2c827f3720803ea8c878dccf3f042d22820aa91beb62f3762aac707e552657bd60bf4a29c98cb923883f32fc5f6b14967d701f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	b25d737aed44f576ce2214a3855c792f
SHA1	51947f21c79b8639b37498b17aa065cb7222bf99
SHA256	8203da010d3b115d0f28e246043d274844376609e02cdc7bc4c20d39327df646
SHA512	aef03e0efc40248cab2e84ff0104e7ce82d1fa6d36af89e3eed28ea08816f42bd5ec0b694d22191725b4c031fce87bc3c91e5c1277ec77bcd927c68dc80cddfc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5	e4a68ac854ac5242460afd72481b2a44
SHA1	df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256	cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512	5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5	1bb712329242b20c39593a09b7d2b05b
SHA1	34df46313ead4079e630105a629c3af4047e5481
SHA256	6ec22f0f4616c1b1080f633dfaa08157b062935c573e8507b7dd17eb881ba681
SHA512	8d00532a7fde742490ed403206d48ebb7a99cb8a5bab3ad9e16b47e139ccdc556cb716e47a64fce06665720edbce8785be53570c7060e8129b60ec20f0d9f87d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	cc7a9ddc521d9cdd252cca32254c48ba
SHA1	0cb1652f9c84ce9628f72b08fe478895895ba5f6
SHA256	a7f43df084f7342ecafff30250b8ffa2b32c51993bda8549f55bd8896be3e265
SHA512	7f636db5f8a5b0d36042b5f5e8ec798879c40e4b2ea7548b8177d68c559380c30c70c089d0d0551bb99d6f716a8100a154dc6c7da20209ec594d48e166f8a1b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	c94d4280e785ec155556fb1648f9c831
SHA1	9093313f474e3b3c178fa3aaf689213ce1621353
SHA256	874b34e386979624c476903c41fe9a73537eb4dee7b026d5e4ce378409468256
SHA512	4839aaa70461f604f50a70fffe059ad305d131786cd6e99e99246218c2e7a42259cb91260746d9b4599e31f27483c7baa01c1964814cb67ca2428b4550084a49

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	72bc83eeeef7ae0371bd0dcddfb71814
SHA1	67924cdbd00a027503441883c7ff3439a10d7c13
SHA256	3f432e87cb2e59b12e90519bd09982399871475242799598530dce1a2211d7da
SHA512	416ff276b03f228ae10c0ad8874775c81908e409ddfdab96abf11bfff5ddebbbe700abcb40e3ac5cb1cf0ea06c254b6c7d829bf55737ec8c7687314bcbb612f0

C:\Users\Admin\AppData\Local\Temp\~DFE0FE4779C6AA5EDB.TMP

MD5	4e663f21c91680d4efbf13578875017b
SHA1	609e08a4f0368bf9c9e6b5a4557cc9757410bd31
SHA256	0d7591ff7dca1212f6e0fa1b6c4135dbfd8d8ced09d7cc2f90f08dd3270a9c89
SHA512	734cea46a234e13873e207f858b4f027f03d59c4c484e12ab37018fef3348acb4cebe5181bacd9488c056692950dfe0294f6dcd25e69c7a812ae1c005e7b4a54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	6430d6a6e88dd1d576cc59da117f6aeb
SHA1	500bf74cf58232042284016f1c29655ea2af2cca
SHA256	1793a3ebb5db0a758a74c0ca7a1f9fe34230b2d35ba93683b4c954883f093e62
SHA512	b24a57a8bfd260892c1cc140ad89b0fe0ff980a99805c2bf129526916fa1cc9cc143128f31f7ec58dcc496afd793589b9e5a464cd590231d99d64908edc51f1f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	7d51978cae28c022cc363d19c85cdf50
SHA1	d16a88db3f408b9be7d87134cc1007b0b0c68b9a
SHA256	00434b5a4ea1e95b60ed2429953e484c436e12d0de639e81bfc5749b7c536fe5
SHA512	9c0df9a4f801ec1e0e42ecac699d9ac24f8aaff003c4405e6ac863380ea156df934f89b2c97f67ffe9b058c47ed5cae9e784b704c45a25576ef7bdebb8aa9555

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	f3572484190047f51f0cdc684483483f
SHA1	1fdd9f520e65f74570d34bbc3f69e1b81cdf69d3
SHA256	d2c154040c0d9adaaafe377a24ed3a375b29ad68eeb1471036c3b20b1149c057
SHA512	64e0ee715642d384a98154a8443195ca85d57a2b6ecbeca2c2cce4be4a2466db0c3063ad0a20879982254cd9057560662fad7e0448478d60ae5598a52a98064b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	b08ed1edd7d749da02ab6c76b837547b
SHA1	4b7b8a1324312b26a7d44e79c249b45fc8e9f7e1
SHA256	7f0f8e94788f70dbe2cd81f13c44104a60c21097da7ee936e4897b5eca24f7d5
SHA512	928332f290a15fd223af205d3f64a4b385ccda729f62e145375be2f658624c8c8d17ca04d67a3793ad631864368cc0ceb2738d1f9ab1182036c34b95ce06ed33

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	808239837ae88001e2ef759741d2b485
SHA1	0a7265c2a9f6a1d9685e99f0c7d31e7f570fd45d
SHA256	b1c40b25109b3da50fb536015a1027245ee2f6ebc51e12fd87f2e484abc5f3aa
SHA512	d6a993b336121fca66d5772e0d7a865f58344bd32af89c09b560caa9da5ae79b85d796d695bee779f8676e4b75efe081319d16066962332abbf8817ce0f18801

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	68a89af45eacac76ab344124f24d4d20
SHA1	1e13fcbde21250228dd515d4660b5bfce4fb23bd
SHA256	3e1c305173ed9c537f13232fc5296fcbcaf23c8e9b70d9b1d27babf0c19dc153
SHA512	795dc9556dbfc1ec21ed85eeda16881ca41da557f8fbb98f442adddcf2fc0528de24cfc517a7c3ef9e2901751b3bc2a2f3fc3564c70a92a7dbdb46ac26c111fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	37e1f622274a377de080fac4c03b4895
SHA1	8c29c9116fcc4757d16d97929d1fe9fe6d4ff013
SHA256	8a26eb97a9df5c5abf375bd829d1e28e2b1997b6b881abb67789468bcb32708a
SHA512	495184211bca13b6c546dca87630a8111416f22cd67de198255ab269c6dc9de0f03ee60794a628438f947d6a92630cc6b3a835e98e43846e4714b24354baf01e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	a8f305f19fcd22b4f421ba4ffd2e98dc
SHA1	8880a7fd083b6ac79807646b2b145d83af70eea8
SHA256	ac4bbdd04fc2a16af97a457db16c034f95a8a57212e7aead520075c95308a137
SHA512	9d6cab9fab15b235d94a484cf32c4d01c2da20e73820c45a37c6293ede8406c914c7a24a4fd122bdb3806740cf0af93d9e754c87eda0c162eef70ead3e3849e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	241a29405ba11cc63d5d87eab47e197e
SHA1	0435374fad7d5ec59708270ea565030798ac7cdc
SHA256	7525b48dd386b0bce2389f05a007ebedc2b3145c8e53dfef8c57e76f53db455a
SHA512	70c04bb7043ad774651a484908df4a13fe368818cbd32b6c0dcd34245b0b264116bac19826a6905d4cfb034ac4eb453cbcb5fe2c1aa9f1880c3bbddde1d3ea07

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\datareporting\glean\pending_pings\ec4f2fdd-06f9-4279-9696-41340028b3e5

MD5	3dbd6feb2979c9d51b5a202a730d7edc
SHA1	1686673e581ebaed6ee3539d390f2e0ed83fd6e2
SHA256	b24fadf7cf69be2118198df334b4e76941c00bac686abd2362bb0724393ae630
SHA512	6e80cdcf6f134f89cbc3faff5db73c0ef04818684c142b735ef47f8abd362f3855cbcccb7ab6515ef0f43fa0ac61f07cab93909b91cf88bcd963a1e6491155a1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\datareporting\glean\db\data.safe.bin

MD5	1f09abcae5c6102bdd89def7af4cd749
SHA1	82efd8c3f0f02ca5ff17249f611236603a6cfeb7
SHA256	dff3923225150707ce26e41c1227711d594dda7bc3e24369efc092f434e64e3a
SHA512	79dece6ddebae5cb7dbff649b5be3a1f58466b96b05f7350a60725eadac68b372b245553a7411b70430276004e882cd7ce808751f48361042b24198d89571887

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\datareporting\glean\pending_pings\3380dda3-84ec-4d32-a779-7b2fe88dd44a

MD5	33ffe1bc71cee54c9a587b5cbdff1da3
SHA1	9dddfd6fa25c9a5b4d592952065ea7c052a230a5
SHA256	34dc9e848e793ecb93a2f8545933f095bb17204b28b20f206b67519b645c26b6
SHA512	dd3038fd66adaad281aa804fdf9f4b5e2d516b4c456672b0cf181de8668e3939e3568b744ae4562db74c0a6309b4937aeeff9ec42aff98fc6d2b8e9df6fac4e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	b45bd7f5df6a400e335ae19bc8bdcc2a
SHA1	8dd608ba99bec306bf91c61462f80a78891e7df0
SHA256	e3fcbae06fe70aa849609134cea34770164c0b0f6b5d783cc06706265a542fe2
SHA512	fd9d38819625e10ece5be723668caa079f82dce11a3a415790c9ef604bf8b43f1e9fa91cb8584ea704e2f44140b39557ab7f14025b45a2aa3b55e03fe6fd3e9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	c31bb9a0ab0c694e39c241d9a3a4b937
SHA1	d314719d97bd508236f41c5e32ddaa0e4298f977
SHA256	4026daa9f8f42207d78469f17b2253d9f9ca87e9956b6b4d166890cd92f06a1d
SHA512	8955fddc3cf88962b185ea89fb317aa6be9b3dd564519c2fddb4966deac7fe54716c809271786ebd8d0de5454fa17550761a24e8e61306cbd17ecb0f6fb764f0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	17c10c3de4c3b91171e4662c23406578
SHA1	af51d7ff7ae62c5b3fc44d5d43c0338b9a52326a
SHA256	0af26ba55bf0534c64708a35d15f74d103c42175a0635d7d05b200b01bcb91eb
SHA512	2af78dbdde898b95e6803dab1f8d08d665971842ad773f117879797c57b632f2f408c33e8010023ad27be7ed721b2a8b12f4373d06181e3a5e410e99673279c6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	439fd584ceda723b8b063be2b2c5778d
SHA1	3d49d50c5a7bc89526193198e2333352269b30c7
SHA256	230b26f446fc0cceb520d80cbadf18e6a6158c47938fe444b83f7835342142a7
SHA512	4a89b9207552573a92f4c2c90f1c4216fc110a8a37616f9eb4ffd5cced8fb4da6cd2cb1b615c3b1ccc02d39fcdf36c1168b3ef081c7513e8786cf7fa3d9c526e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	9e75e4a3bb721e0294011b192e290ed9
SHA1	0ea2120b294dd0dec3c82aeea1a39654f384495a
SHA256	2228f8b42fbf47bacbd51a1c0f93dbfc4c458c15e34cc65e8518f8ba6cb7aa5c
SHA512	606b7d710ca4c413fd6dc2cd589bcf551aef6d3a43add5e107510ea1ce4efddb27ce4e7c6962659fec57db2fa2748a6f971491366bc9644a77b3d2fae9ac68f6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5	4320ce7420f98292514c38a19219b6ee
SHA1	dce25fcf96e260817b1ea364e92ccb44142bb95e
SHA256	9db1021823085cf69ee2fb20abadba274fa02c7cb5f26fef76579e3c55161b8b
SHA512	7396cc3f5e48b72c5dd93837e8abed8fd9ee705b3dabb00abf18670d119a8e781273468985af54f34a1bf9c77c2bceee14388d5fa7a793618e5100b0a34c33ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	34d31e12f74470994333b1b6ef6bd1f4
SHA1	3683b1756d324bb5f932c5d7c8523394d965593d
SHA256	6a75c74895334b27ba92751e3523d575ae93a7bcd9e8b591005660f41731fc96
SHA512	f841efdd0adc4e1f50f86c3a00e74a65f137ed23d7b8219b9ec4a129e505c75bad6104506850c53523017cf18f671b4da6e66b02cae9ebe327b9e094fe15191e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	56dd8665225b0aa3fe38bc929085d8ff
SHA1	78bc8f14bc619624b2d09692d8db22b442e78929
SHA256	44629241a3a2c02eb6350a492029f86990ddb526c04901ae80f54922f11c076e
SHA512	459d88b6aa20bf99d693e7c745110cb7dc99a1a0aa47695dd721c25504174b97b7f75e4f0c137ea57a88db4e38f12ba1d936e347bf2edc775e27cd359ef3a8c8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	67929d9a3a850b4bde92daf55ad6acb9
SHA1	87fe2458f4b7fa39b79fbd8834e1c16287fbeb33
SHA256	05408d8e96f6e2625e99cd70fdb0ad5cb1277f013353fb5515d1285b1f4cf4da
SHA512	072252c0ee5ce864364750b27f5187e39920c2da8efda7b7a7f44a5ba9943dc6c75c19a2dfc582718fbc9517f83efa76ae2fd4a5aa7616d9cd6472acb23d369b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	661c5ad0934e07b97b65b445e25b9ed6
SHA1	49afc0ec964a64b26807fe5ad0692fa4464e50dd
SHA256	bc65064fad12e1be90c7d8fa555a111ad1f917282f6bc13615352bef63fd21f6
SHA512	d2e86e7f2b5a1621155d24e16f7fe13de32d9b9729a488e3665a1e625b22202e2726e9fa621078f7bee7689617188965c7b95644f1a8276cf2aecdc16daf4e1f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\prefs-1.js

MD5	7b1c0386991dc7b0f7bc6804d96e3bf8
SHA1	6fb30e7f9d53994dfb8fa313c9689c8ebbe510e2
SHA256	b332cfa7ff1cde20f5e0bdb15804fb0b91162e98d839128960fd019279d4a2bb
SHA512	aecaca689e3701268ee44651d3a3c2e79a1f28d4da494dbb0f176fb55a883c7b59dfa18a67bd8bb3a516330d871498f83fdf31f2ec02cebf16b392a7589b2b8c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	e632996613f8d7da3e1cd7cee93ad791
SHA1	7a4e9998a9e7d052bacbef47c6ac21042b57aa8e
SHA256	5320fe9a0b41123b28d90a5f4128eb84f17d25090ca9e54651c5a8852cb4f712
SHA512	7ff3845dedeefb86ebd766c2e8aeabf5183f571418a400cfa08c412ff3a47a8c9461979b002c0a9624057106f361fa7d5bda34f08350e5afa33b8e67f2b3d4e1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c9e9eac6-0e9c-4174-9d57-10763a2813a8.tmp

MD5	aa2f343d030623fd0b5af6729d591baa
SHA1	7170505c3b9f6e21443f96451c6457d7d3e8847a
SHA256	89280657ad7a0785b5d528ddc8639bf4fcfa36e8174ba2c1d558f8b7bed48d2e
SHA512	f535f3af01c85f78e7504a3106448efc10ebf8c6980509d8aeb91fe57ee3d4610b052d7ed163cea20ca0ec966c7247bc39a63f9530cfb26dece6ef31e083ecf6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	ecf5e42943c7ed6a7e630f021376f65b
SHA1	a445a8760e77a108c28797a6ca983549e82f8217
SHA256	4f4a43f5b80b078d2ea60147cf23bfe3fe6b6dca2ec95e163bd76075cc99a148
SHA512	ed26f37cd122099e5e388fc8f395c2388804c4ab2dcd4903ab7265d06957af16175ef5b06f273e9a25f99b0dd964d5a9971646b864547b598ca8818cd4bebcda

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\prefs-1.js

MD5	703f17d48b701a1e8465cd850c2acdbe
SHA1	17057db63849ea76415259f3e4a993b092837b2d
SHA256	aab7c79cf5231ffea7ca1440e05d374d860699cd96bc823fc8543d037859c0d4
SHA512	c83d7b43bac3251d8cf83fec1da8f4932e4e78f4588bfd56e056fa1febed7e8522a86f6131df8a1d0009d877c7dcabf0b62520325fe6a38eca418adf0d58e2ec

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	f9d9180f938237a535729a53312e4278
SHA1	b2addc71005a1141c4690061f6869941ed8b32c8
SHA256	50cb8848ad461973e1d0906750be38f082459cdb0943769deacd85b4c60d2d73
SHA512	a68efc0da5aa3895eeb4d542987b2c0686e648ad60f642141cc93a565e57437f258db8abd7d9a984070ede36dc3f0e9db6d7ad3a84afd88728dac3ed62d97729

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	b30f9a50b3132e19ffc5e4c47bc4dc4f
SHA1	b1b01cb7a876e2e7304a120858e8596b181441d7
SHA256	5097e09add486d9288af9675a3ae19f1cf323e13b5905e127472788ea5e44aba
SHA512	78248ddcdf86944f0b638999deddaa7fab2071973c855598847ecdf5c907a6c4346282838ce91bd6d13ae1ad51e6d2a505a7d6dc42d744e228f07bc274413cee

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	64fee5dde348ff12175710ec5d9ebc67
SHA1	08055fce6c19f3923601ee178ee8d1ca74b1cd26
SHA256	12b0ae7e4db83ff768738252eff58de96373aa3281b77df97d7b82acd1434ce8
SHA512	12ad55b551591ed9a8620bf7070e35bd8b16f3ccb2d2ca808eaa302637edbe5604c2efb9eac899981a5dcd3fe9b832d90d165a8813cead7d28beb8dc374f94ca

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\A23636F05CF5F35CE84D1882AF248CCE3C38625B

MD5	ee851ad1f79c236ad89cb67cf91b597b
SHA1	a77f19be09701a82733fa1a83ffd545a454081b4
SHA256	d5b030d1f5b21292543c410a014d3e48978af0876a2c681bffe40a5dacbef7aa
SHA512	7d22fa29fd8837c20e4affbaeb906f613c8c792af2e4bdb83b08302f2392f344e38161aecabad7f54dbf2198e95f20c24b3a6338000cca7697a5894417874ff2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	335d8778c08c3b5c467d39423b433493
SHA1	54ae12bc77e2eec3f701ff1a8c6869630c6686e8
SHA256	7facfa5fc3b67e7b387b19914f7640e9902074facba4b0163c42f6a2f9db82df
SHA512	6b6969f78371d625a1522866937870f688e20eff390f1da730917e8547ae404e8f49e22fdeae4f21c71fdb566fc141d18c2d7db857e374519754c8e38984f87d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\datareporting\glean\events\events

MD5	c83876b264d210bdc6ad37a129431a68
SHA1	1ea3cea18aca65c2a57de91b0abb29d13600b3ee
SHA256	ac8e5043a7dddf7b74ea53a1e4441f10172b4bb629bdc9db0cc3640de1c57758
SHA512	2a21e75b2736cf9838df82cf13626baa8413bd0362399616aeae2d3751548da0d7629f94b0ab4afe7f5c0edd79250e65adf3cbf8f4f386742cdc497deae95225

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	22a4f909f0ef2f60e1b15e4067eb9de3
SHA1	10595d0e21d949bdb2b9b3028888d48c61e7884f
SHA256	e43137ea0777edf5b1e3f5941beb9deb9476acb0690cb7f881db2ebfefd313bd
SHA512	fd6bda8cd1d8533d8e33369f2ce592fc50f718942a87b4cbf4ebe42e7d889c9b1997254e0471ef29c9194db9f3f0b3b203d8346b8306711bd7c68549e252f41c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\06396DA20BCE078391BE0DAA85736848E6F8023D

MD5	66f51a1b0eebcf2bdb8d017ce6167b05
SHA1	9db582f44b6951c8d737571c624a3601ac671b0a
SHA256	5281da209c95f665037158056ba4b5a6be2dd8920136a1a3254decfd3bda1191
SHA512	43b478af505d28e5adfbd6e6a52649da15b8ff13da8c1a8986407c81c438835243d5761677251b6e62abafbfbf569eab1f2e9d0b96eaeb00e6f00216b2fd5337

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	bdea0e8087d8b9ccbf30e40b19df864a
SHA1	5ba55b749c882f59b1f6a2b2c2519455d7a58846
SHA256	b9bbc2d3e1c298a3b8b8481e8fa99ddec1764c543a120748ddefff2eb29c20f5
SHA512	3b1c8557fea141ed75561dffd677d753d04f6da2463cbd22b942ba3d930b0df47ced745d9eaff7f31a96530179ea2cd41e5ad4dd2a4df44d959cc976d81f17ca

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5	85430baed3398695717b0263807cf97c
SHA1	fffbee923cea216f50fce5d54219a188a5100f41
SHA256	a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512	06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5	fe3355639648c417e8307c6d051e3e37
SHA1	f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256	1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512	8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5	3d33cdc0b3d281e67dd52e14435dd04f
SHA1	4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256	f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512	a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\prefs-1.js

MD5	a36eedfc2a7a2a1cbf73e4d17da79b3a
SHA1	2b78b0e82ac88e87d61f9f27170fc5bda154fa83
SHA256	f7898e831cb31f028ac00a85a47270c11a5f4f94ac4e1f0febba997ad62bb0b4
SHA512	048f6b83c50e283c409501d9f4209cd4472e9bbafecdcc44de40674187a426c9cc44acfed398f579423dee09b652ae52bc89a2887c14083d89f7a8f96bf12dff

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5	a01c5ecd6108350ae23d2cddf0e77c17
SHA1	c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256	345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512	b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5	8be33af717bb1b67fbd61c3f4b807e9e
SHA1	7cf17656d174d951957ff36810e874a134dd49e0
SHA256	e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512	6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5	49ddb419d96dceb9069018535fb2e2fc
SHA1	62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256	2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512	48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5	33bf7b0439480effb9fb212efce87b13
SHA1	cee50f2745edc6dc291887b6075ca64d716f495a
SHA256	8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512	d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5	688bed3676d2104e7f17ae1cd2c59404
SHA1	952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256	33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512	7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5	937326fead5fd401f6cca9118bd9ade9
SHA1	4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256	68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512	b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5	0c9f9f725da2e19af26832cd3a65f0c1
SHA1	4f3930c06e32820864d24b295cdfe020e9e6256a
SHA256	508e69bdc901ca6a0ca7c0ffe3434d285671b0884fcbe8f569d9101c442a3dec
SHA512	1ba8328a55f5dc1d8bcf52acd2ba2ad0afd82f5a13f3bb98cdcedde699c886bbe6dae11ba7f72f7482aff4a9b026fb9915303b3e1061f19f696ad8b9853de6c7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	3dd6d969da3c5be32f4c2a8d9c1650ff
SHA1	8f63b7361be09354addfa8c178cca958f9aa8e3b
SHA256	6fde4ecad7729f219d0cc428052d5a450665e07636e9b5fff6e8321b617d21e5
SHA512	6de44501156901a31feb38685485c81645527fb1d59fc1119faff296e7e43fe77e3866378427676cf938982b48a638a5012a222096f7ec1fdcca06067e5e694f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5	c1406178247374a7f632b36a218406e6
SHA1	11ed490d5c119beca24c6db7cb99d188a0d89c29
SHA256	cb33df6f0e9cd2b865cc47e0616b9ab0882ea99370fcea3f928ef140eac044af
SHA512	791e815e0f531d476ee4c3f0d0ff316f0bdba8081cb8f0f67866e1dfd6ff7dc3a2416f368e06704d98c208826182943e2eedcda75119f98d819f122f52933bbc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	a750289542fb6483d4cfcdc855ee4b51
SHA1	5474f17e5e1f9381d1950d31916ce6f77cc995f9
SHA256	615ad8ee2342cb13fc5582667b134a3cb7984f2c21fc1726c928b350c5160e54
SHA512	8e8f2f3977f7cf2aebf45a3150d36ce47b198042429597332339d165952f6e86a35fff75a364d9f3ecdefbad8f51a307e269ad1908ac6ee26cea5b5a80b607ac

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	ad4d543ccdd616f08c43a21f8916fc0b
SHA1	1a35ae0a687a531e3fb2d2ca64e6896b3f07d8dd
SHA256	b47e7e6d7561517b31abd758fb9a61a881f2735073350fe874ee1f9cfe8fb25f
SHA512	7af619fc3abdfa0e9da2692a818dde4f4bc53f2cd6cd52f3a1e669813bf5403584a8dcc80609219887b43ec54cddd58302b145ac6aefdf99dc0edc03e0f7195f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c1737955-8b03-482a-b0b2-83bcbdb14796.tmp

MD5	40132f531cc24c58dd2245cdd9caf474
SHA1	4df193019da0b5625776f20c3c5702a120043d7a
SHA256	f45001a0dc26e6eb040c540ef78b4b4d00ae219b64571124135801ff2901cc5f
SHA512	76298503b219f43a2f0a2daac8ee456924c91f13f576fc7e64033ddee87ede0f43e631e949c2599a65c1b9655cda7a7d493f8e092015adb1a555dbfba2013470

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\logins-backup.json

MD5	a3157b910e257e316d46b302ed66b8b0
SHA1	e31df4b48dd854ed246b155ea95f16663c54cc64
SHA256	bebec1bb4967f0da11f694d8cc8bced1364e763f61816851dc6be94c1177f4e8
SHA512	42ba7c7692e69b416702b14c8f9708531e5fbd13d49299ed42508c2225fb4ed4823d9ba0d5a433f8facbf816dd581de7af4633f7eef08802574c80345e72620b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	5bea1707c5ce5652b843c9e269132285
SHA1	51dbec8bfa5e87694242df3e895e973ddfc9d5ec
SHA256	60e9424f5f5dcaa8d509f0eb4c2473931a325d41543f97520c29348f4b15dc3a
SHA512	23498bcbffe55c792d3f675be38e9b9a86de05c19e6abfdaf68101051d784e3e073407e4d006dd45837d890321256d4dc58ddb9b4a3efd87c1b7e38f8322e35d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\FA5B476B32F4341171F889F11B833267E8EB97CD

MD5	f7f10c3a7ddea8056fda3178126f5cee
SHA1	20a612cbe05ae8f876f39adfc5d0aaf1f5a582a0
SHA256	f88146b0d85053b4328bdb457f43fb49c30d105ea123574d9559793f53c26973
SHA512	7e75b25670d2b664f78a9977acb73a7f95d3526197f3e52f441a4616a0684ce777ea5ed192f639c0af23b9e58b2b5c424a5bb1a8f1dd6a52f8ef0ee998d55d08

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\8FE37EEFA58F1725BFFC2AB3D0B85586712AC192

MD5	1e24b767f4027c38f234bcf1ff1dbc42
SHA1	5767e49ac0c8b71a4633d9f089721d81ad900c9d
SHA256	5d6f044ff64d438537f1c7acca26ca73a56079d5b8e0bdb1258441e44759486b
SHA512	fb276bfcb06d8e14400f1ea351e281d4b5c18dcb7b20a79cfe3f695026855e53ffae7eb21e9a8da68713b42de79a7e31c6962dda506175298db44626a72d72b6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\46A2B896549F4DD736A114302ED121792F3B8EA1

MD5	b799dd829a55dcb988ddd7c27cd4d321
SHA1	bc55130ee7d67302c651721894b975c4ed5adc2c
SHA256	8ff4d120d585644e653b0bd00d98fcf5d267a757d0a816168efcbf20eae8e1c8
SHA512	e5d63fefc0c38a546909c28ccb9cc438862940224a1a255e37d57abc816f59cdcf7917d25598ac026f4dd33b1bc2657d9cf3ac38be7394ad57490408b4b4f1e7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\jumpListCache\03QQ4uOC93YvqLwY0r_Eww==.ico

MD5	433dc57eea045dce28cae0eae525268e
SHA1	5ed2fed05bdc619c38578fbd7da571792e081e7f
SHA256	9af42b74a7d764841806ada7901f64d630f477cb51061c84871890bc4e4f0791
SHA512	d40b65d555aa88221c75aabab57a68a543882d1329e4c19d9d3efbe90258f20d10c7e7257082a7158499e1a58696eefc5f7ea0bbdc30aad77a9d1d84d8ff7dd7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	3eed09dc1b4f419d1e7de9351bf5428a
SHA1	c273ddd14261caaa3fea86f276842e6e8e0503d0
SHA256	5c2c47b88cbc017986bd7c52d95e7b437ab5c00dfc26b886077a195083632f68
SHA512	3dc3d5c484bd9c45fa50a3a8736dc562bb0d1d5c6ad37eae382f1b52cd9ab0ea9594e1117828a288551763b426114fa4b806c9991889add0b8a5390d31d053c9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	966c0c467cdc65020534500d5f7353e0
SHA1	940a81e4bc3076f1e01512fbc1ad96a9768ffc21
SHA256	97e0f27d77f6d07cd9fe2c94b805b4b7dfde184e797a13c41f89123a20d8f709
SHA512	a6eace2e44adac144f05d753bae7435cab42f3454b82a45bb457a2db47ef84a46d973fd5edcf5af53d0e4c89cb09115012544890cc187bf62b73d67fba693d53

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\0BEA801F32E0881EE7D814103D91D9613C969880

MD5	96a2ef2bd73e8d5be7a2870f14512ec8
SHA1	8291dd59d4e372e4677cca5e1337d0d7ff59d312
SHA256	a36b969cf3f3adcf44f64e1f68908cc1cb54e4ff45e80b92b2caeb3d280b125b
SHA512	30b1172442c6819c17e55a29260ea0c9b2074a8dddb24a338367bb3dd591ebd0e0c212cae2f5019b130e10e9b03e7fb3c7a58e1b14acda2186afd8bd38873320

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	56d348b9586632b4524e0a466af02d97
SHA1	b8e0cda27cc77a36a0d6dcf454502efbdc6b3f21
SHA256	8fe86738956d1350e509742bc9b899a08267b583cc06cb36adb62d5fc40d1798
SHA512	3beabab440a0315a250a3087e731237f2642440c6e9ead8b3d40031773b0b10239afdb7114d7208e75efe881963002abe37ba101d64154979729b86d520c0ec4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\97E85550F91E1792F014DD35F068479C69B13743

MD5	5b612eb36a61a1bb9d41eeeaa034c6ab
SHA1	00ecc0872f8ca3e125cf69ca743aafce6100aca0
SHA256	abfd8f2e3ac8ee0b3eb1498e2b915e3f55eb80052bccd7af15abaa70553b77c3
SHA512	08ec02b4a1dfb6ee7edd7fbc69ffbbd60f65c23aff51e798dde4bdfeb1f49d336521671f07a4d866d1e456009039f2085c17377d056496794345ab93d672e5d8

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	b8ca413a04f975c62f7a10f0166c9cbe
SHA1	6ad9c1055afe6d765cb5b8dcf2a7e67a1e6c17a5
SHA256	54ef1d4b0aae973bef1b3cfec9e8d09b70b1c396bb4104d495db3fe23e8bef56
SHA512	2e84bcabca6290a119de3ad8575cf620e265f7b6a7f034f41458952338c09e2010ae1fbae120958ea2f39d25e00f0eeab501e403c0aedb17a357ca9a36d6ba2e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	ee9701864aafb869b8ecdf5356930a87
SHA1	66bec9ac57cc730fbd5aac27d089ddb328eee44d
SHA256	5988f2ae2f7bad31f0bf5020fbea45b2e5a4ea4abcca71da3b43e0c517817d67
SHA512	ab13d4b93325400a81dfb0cb6287a7c341b45994088372d2eabcf0e2faab2944a4e2209a2a8b55e958be1dc46627b720222ca472999729e76a63fed68a09ce46

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	b85b4df0f5c6fe58bb0d91821d2eb8b6
SHA1	1605f822c678ea271aa8578d8ac0b6e53ce387e0
SHA256	3e81a98c94ed144a334758429d788055a6e9918fbbda6e055f526af7938188c6
SHA512	dc910deded00369706a7705dbf18c5f13bc8ce5b7105f32862a8d7c09bbbc1c0c17b66d3bae1bd86fa645fe0dd990f88089a9ecc994e568c3eade9216ae177c8

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	65bc376b19fc012053d10f8f71ce5f26
SHA1	1a285c605f7bdf48b539e25bd25aede21347f468
SHA256	be9980fda1be13563501b68ab9e3b76214dca62ad6b7555954fcf37c97138d98
SHA512	a59e17f071cdb79f5184b25f5ae97ed3616e58f0eb4d2f38a3b73bc6c63ec05c97d0e0f345ff9aa8b903a353f2ffb22eb7975a921ec69c569667867c0493e393

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\logins-backup.json

MD5	1c132751cb80560f6b5fa8c65761787f
SHA1	abf09e888621501b7424fca05069292592d3c0d6
SHA256	03a267ff0516e60eb7610d6a14129b927e66231f96bf8e7f135743a3519659f8
SHA512	e5407bdf41eb55d4c008e9f3a7b88d0a2c87486e26fd890bf2393f75aac24764bd295757b0e79c2cbc19b7f22bcfa18ab9205852e22add70211e22d6e5486a57

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	ad5e04ba191e7c75a94ebffcab3e2be1
SHA1	9e1ea7937d5169f1cd9041518ac116ed674f1b6e
SHA256	67c3d432178a36fe9c2296cb2e0694e48fa9078126ba93971d498632e77e1b59
SHA512	0a02a1bd9cac095d8f56ebb23198833392b7d8338f8e07fbb2363f7be5e3a5ce3721412b611bbca31ddbed08e393c016a0cb3038890562aa7f2fdf92742dcd83

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	78df8f7428f26620a92926adfddd5e91
SHA1	a2e4e889238659f1943d6ad59a2a7231287a7c91
SHA256	7fc5150eae1fde6e695b613617d4d4000f73adabf4e6c32465388a3061390a59
SHA512	70b71460ade3d8ea0d5dac971967b3e97046bbd7c7dbca77edec31e744a48989499053367162505c63227d251f3b866329cb7ab1e410fafd6b609ff1b019a1e4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	8b020079f777af6211482130c7d8c992
SHA1	b46c40b66b184becaab452a80c4ff01834843c8c
SHA256	cf19ccba1b25760336cd27c62a0572e32885ccc7fff0b9804f2cb8833f9dc94e
SHA512	6888eb37c8a295cf375d688a6f2ab6a86cd202e8eb0ea61486014f1bc5709fdb1af129bdedda8df7db98edd81345c76c4611837948492f7994eb3d1373593b27

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	4ac39eecc89ff2880da69b05062b5b67
SHA1	315d6d68890d441a33bc709882bb7e4ff10d2396
SHA256	b0828b6f860e79d53b35e70215ec2a7937f1efe89a81ef23e27d9e4f776f6c5f
SHA512	85c7719483714dd4cfe18fd7c074a9fd84cf0f512f50f55f36c91d0e29b26fe86697c7e909a313274bd8ae7f47fd31609537678579fbd755466c7142b0ede7df

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\datareporting\glean\pending_pings\eeeeddeb-b734-40d7-8a85-c22dcf585251

MD5	651d2ea9f3f44a0338bb88e7382a096f
SHA1	7f5a5bfa81bde68826a1e7898b757b452d10e168
SHA256	b38ddce108596ef5ad4e9cce70876eee59bcb6a9ac2d1100b1e47cc43508d76f
SHA512	03ad3b946e724575f7324e44b76a93c37ab04d9fe33c096f000fedc3b2e70048892e21067bff7da7b084cd8851223b0cbe7e7a75cd9e6916f34c51b0f9ce661f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\datareporting\glean\pending_pings\805f99cf-c804-4cc9-b5d3-302194878851

MD5	cda637d85f742291661a90541ed180b1
SHA1	c5826d036254c61d77bb36ef4efef7772acd1545
SHA256	8123f57f55ceea5306dc5f7b9c6bca208bee67e45e45d15ba2d63996b9c40e6a
SHA512	896b835b265ee4d90d6f7acacc756768fbd7a5bd4b686fd168a92558af679b4113a70dca55779b529992915d7e35d2bd2437d8c229391fd0532ec2802529b362

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	b690519fab9a66d42cb73752760f59b6
SHA1	0e9e82920d7ff0ee7f1e4d16269db04d322ab343
SHA256	7f14c5746ea651d491d2f688ec935da660388e993166f53f7a44a6b2fed95b69
SHA512	f2fedd7aeaab0a10368a5bad77b9727f9006ed9fd542cd7953703708204b47f1fb11173c27cce954bea70e2c83e9bf7f466eaebdab9f4ebefca4fbc64e610408

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	fd32b1b577b07cfa1583a4d876e34555
SHA1	780f83c18a42d645cbc7fadc0c806439885bce88
SHA256	5af99f135812c611348f531c9907a6c47cf4f36003931c771fe2825595a237da
SHA512	f743aec7f467c170715eba82b6e0b82b9bed7d5555e0d6fc6f996fed101d7ad87c944186f4bac1c453dc3899bf3084c9c5714925c8b56aacc81f39b61d8508b8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\96277E49FD3EDB746A0B7BD189DAA42BDB044705

MD5	c8609237826c6b4433c0a4c8355e39c9
SHA1	3ff0fdd082d99f5b5c2eb26a92ed84fb2001cb28
SHA256	862a858cf15481fb53d385a842be7b010225cdc916c68e63f571217d6bd4054d
SHA512	e71f5bfa978d172375c05f3630b678b4bb9d7933069e68290dc04b15b7707c538829eca572dd8a590b05918747c51fb89f78217549af04131803102f366724fe

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\A18CEA7D50D43D4F950FD2B5DE2A19DB086B0CAB

MD5	7bf5b9c78af77fa3f736d3c393cc32fa
SHA1	14bd2efc7b12c387573b23e326213b9930ec234f
SHA256	92c080f71455ae3e52d69e6b4a86cb02b94bde95a5c6efd4f8678748f58d0524
SHA512	a28e2ae245d028c392fb90cf63e057c81916720b53db2f805518ed3f3d43321a3a0009d624db89227d846f157e7638c73314ff41f854ef46566d8f68628de084

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	cc520eafb009e78200b23075b60c7b3b
SHA1	e286d2993598c68028167e5441e0b75722c3e67f
SHA256	fdb30690a7e7704a1abff8e89dac25261b5f31da63da3d022d4084398462f739
SHA512	c4a795bc2e87abb8d0aead94251cccc8673c64c9189147ea27fcb046da52107156613a59ae3f3c81ac27be783edb586025543ffcbfe437f9437aa2b489164d09

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	68e33f12964a4fafff0d9515e9d2a967
SHA1	c8ae91b567a7ae2c4bb1bfc5125b522cc0ab4bfa
SHA256	662221a0b1eeebe0cf26d5196fae8c4520726a288984e80a2c8604f894de858a
SHA512	170f13fc6860f793d4f35384b60317701124e2bc80fdc98f0c9c26a8005f23b52db95f2216ff799b1e56ef10ad3b2d852b59574fb82b56875295d5c5868d39ee

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	70923804480159915a5b81e56dc24466
SHA1	02aaa608e517b3f0e3812b483aeae39f9ea47e14
SHA256	aff05851d037148358f3310cc90d36ee81ac712fc0090f6708a9bc897ab321fc
SHA512	5b9fb595f1a2ecbc8cbc6d2f2a3c202b5598c24fd8c02cb50ab617ca0ab985e39be14e8e32a5d2b6ee287865dc9c8484f0f459fe4bb89e90c56b259c1e54100d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	b2191d0614a0821b207fcf8d6c9bfd53
SHA1	b6b4e2c5a66bd21d4db891751fc58dee17df37a1
SHA256	e8c4f475041838f4b3dc63394b6fb331d6bc28b4293bb107408ce2c74612b8be
SHA512	94f365fc71ca71e7ff6d224cc22aeb55ed399f33f60e87c3e0f2c61238fc625be760df32c54fdbcad3743feddd257d20ca782ff0158923285b3d3d4a1b425e84

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	43f2999367a08e52957794e063be91db
SHA1	ad59d6af8dee5b4489037bbae1d1a50cdded4130
SHA256	123b19f16e9bd9925879233750a240abfa903fa822a8a333e94ed61762af89b3
SHA512	b6659258371a8c1232a08f61a47e3d691a9f069a2d461f9dc046461c6acdd4dce6dd77c3df696e8c23bc42e0a3f97a17208948844bf784a8f3f669c05dea55ae

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\8BB5D645EDC8EF979A4383E553CC0F5ABF47FAB3

MD5	e235077331ae5e94cae0b71de5a5b2a9
SHA1	f009e714c97eb7e3c4998a51ac424bc2a6127b0a
SHA256	2ca2b22c275d5621df376a3038961bdab7686fd68374c7418540ce594bb57fcb
SHA512	caa051d377a0a595767a0fbef9efa4b79ae7e41ee15133acedd87a309999fecf382ed3a2a852ff3f8069b56dd2d50db4563784c65ea4f0a054847afa388e7b18

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	4d924f40f6e5d302d11496942e410941
SHA1	cb55a5ffb78228794f58cd66d7c708f7f8c29a09
SHA256	cc4eb100209a7b1beaeac00a3a455297c9fc26a5968afaec0c6b4143c5e0f2f0
SHA512	83c38f441c6134daae2ec259885ff929d3559f39518a443ea3cf1931d6835580ab1cd2a4081dbe7d57bd91626370229fd8dad257f122e3a17bc936b7f88cdd6d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\prefs.js

MD5	f7a2fc03270b85924fed12fcf64f04e5
SHA1	5ec326f3ba2af2aecde31672e248f2a1ab555b42
SHA256	bdbeaef5dbc0a2053dc200072c8790117cf690b7a214381e3cfd4a471e0340ed
SHA512	337b96fcb8d38c8eda63f7046a46e755b6149e51f8e88cfeaf45fcef28c4092078e5f1ec47cfc03ca738c1044022eeabf29a77143c153a2f3548f807aef39c86

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	bb331c2562a8ff794f93a9510f8cafea
SHA1	4814192aa38a484d0d622a2bc2bd5e4792414fac
SHA256	bb4862746828654e66dcb281b963491b7cbc570eff2f702ee41be44e24c94e22
SHA512	e40ce5eaa58f19a86f56c9308fc02407aa8d021fb09ce899a94114f8fefb375602eb72c20f26cb8a399bba4f93382b91c1933e05db31cf80ab2b881b8bea50fb

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5	6a62afc787f4243e08a6c841864aa2e6
SHA1	8bab5b17243946794ea9c169f76090448f7271c7
SHA256	4623636cfeb7a21320659de0103dcb39b031a2063c5b5a33eb1a32ab8ff21d67
SHA512	d34f0bd19678828d3abc90833a0f4a9d0ceca4f8b97bf1c74cc28f5ff2eca9ae3bfaf4d139219761ac5203abf39ba474cd41ebbeb9364737f288cc2352a35652

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	d0a530bc703963f10c251ac206553371
SHA1	0105499c0f462b70f384027650cd3493e9d34dd9
SHA256	d0ed46a7818f5e3f89e5a1859937e55cd1c87a7a67a8a6269a596ff49cc387a8
SHA512	2aabc29e667c04589ad14bf710f9094f6ad74ee57f279acad56c8191c70123d20e931d039f076a86b59e6b765b731f17f759881917e59b115214e2f0e782bd70

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\2998B4B72B5FF34CCA9C2B24E0E4AFA1B8593A9A

MD5	2792e4baf920d4a51e97ead894c0d8e2
SHA1	54e87682247dfdeeb944958755c73afe0dea2472
SHA256	32c4afffc539ba4712a084f7a0c73a7663add1f47e8e3fb059b644c56ba034ab
SHA512	103e4491f3c1de44c772c1b13f576705e36463f0d3664c6da050cb2d6a33c9454d3044dee833c51ad2ff397b30e619ea1e32b53ff1a0f0adb3a6f2444fcecb4a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\633A8587C10E36A41250A8AC77AE67CCA0EE97A1

MD5	3c4aa830f0b477b98fd573d2a8f33294
SHA1	0d1f60347bd789858a1f74a3637188cd8c6875b7
SHA256	7253aed59c66129b6fdcd264ca9da11d1610ea575a502c4a7ca5da15efee7ba8
SHA512	e5a2aea7cc84403bcbd2c05d98957c0fbffe3c12cc2b46e7b93aba9dcc0ff2ca8af0880f3fa7aa81005d5dcbaa4e06dd4bb337085222837ff47c535ee23a2266

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\73436B07A9628C4BA7215389A4E4611F5FBC15AC

MD5	1cc0271c1cfdce32d018f664f8338b1f
SHA1	80d5fd03d14118c1ad25b279424bc2b1021679cd
SHA256	30cd442820a3ae7e5178d339297e6225be832a13bf627b7757cbd95f62a6166b
SHA512	9b2dc3ee7e4edcb4a29f8f544c17316191a822c48731cf9997ae4b4576dd65d6d093ea61b4e1aed2ae37f2597cd8d9d0b47ab2012fc605e3e45796c9b2e4c839

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\cache2\entries\40A372D2D17729BD9337CA2789D93ECFEB812BFF

MD5	3b7b86bc3b2ec5673fad424a59a947d3
SHA1	eaf4acfa82277d32db93a45a3f1e4e8dd1fb7eb7
SHA256	5fd3ca26168909d9388fe27afa4c5dba192ffd43047c3670ffe3272017332aea
SHA512	a272307f13df087f284ca79d9ff57d09bee4bbc06e946e0e0ec04fcf4fc5bd1c4e8a3b7310367e89d2d2f859b90bc06f7c80240327e0b77ddca2849d8c2184eb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	2e62ee6c4dbb789a55ef12d535ebfb20
SHA1	da2e35e458c5f49dffe20c7c8ffb2097dc3ee419
SHA256	fd3550b73f5da189d2ee8846c958ea465857e4f512334ef5da245652c4137389
SHA512	d783208ab3478b9b71c73729fe0af8e229111532e8068df1326c76dde0a57e7776644a9896f5dbeefab91de70c010bfc50a766f980260a43eff55a5693b92279

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	d722d9289df3f873612b47d7d32749a0
SHA1	8c9bc5bbc9e1dbab18a22ae62a737b5d05f1ddc7
SHA256	c2cd630ddba28bd8ea4651a1230b0ba9006af20e65993cc8fb4b8a89af77ba85
SHA512	bccb5b30ed848d56396b6c37093a78a2bb04e36872f6fc6922d5bc94dbb0d3e234655071f3dc9721626b52138d1f50d8e3edc33ac3e4a838c255aef43f6a5b08

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	79aece7c59fbe08fbd633516e6ea0d5a
SHA1	7436634c0ba8666fdfb431a42db07a02bb49087e
SHA256	c856df8687c8d83cb3538c914b41c296ddb2945b94f0105a9600a093eb485b09
SHA512	783279488a985b6bf07e14f492758bc10c1f083ba02ba47609abe3fae6a7aef88cc2aaf9568fd2c9d7fa689f8b569bd734ff07189649fec0df9bddcab3d93090

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	c5b2a179f62257288e3424d252e65513
SHA1	ddcc3b542d406023711161a19cb3b2800b718ab5
SHA256	2397d6659b4b0ae2c4e7cd50b6fa64bd4cf66f3135f7707a28f299551020f08d
SHA512	d5e1432b695d9f2b766b55441735f018f6dc72c141d299efab06e7a6b7c2033f29ac94433e3d22c238aecc8a34f96a6029ca9d0bacd8bf6ccbbe84cf4a281d40

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore-backups\recovery.jsonlz4

MD5	3b9933e357562e778e13f6d6b98d3c05
SHA1	7b767eaf1be30234cd5de97db17ca99a414f4884
SHA256	7c48137651a92d2b01c052f4112b70e394a7820a8bf85b8c515747c44a0eb3d3
SHA512	f91c89b0a2af5caa97a2876d84c287cd4ff3098b4860ce6f75996a2c00bec3d8abd399c9bc12cb8aeca6c048d20506947b90a70eaa793f6926e9f44228dd4599

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\sessionstore.jsonlz4

MD5	b324635eb117c4647ac13853be7b7cc8
SHA1	51c1c526c53867fa968cf6f9d530ed884a336216
SHA256	819881d22f610b96342f6c38f5447ee9adbabd172e343b259c5bcc2e687efe50
SHA512	710765b4828e8419c92ff8219ec15adb093b812c755d4267f66af5fa0cc615673d70c3761668d02068b79b436106c88c73834da6fd20b21b60d8c5473a39aee1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\prefs.js

MD5	aa5ce278e4d0f72bfff6553f4cb48f66
SHA1	3b63e144c60903b935d290bb1a076dff965e936e
SHA256	d447fe5a1f8f70110d26b663a4d096b59f710829ca260f995e39f2bf231c30d0
SHA512	b4f05d4484c3a258f2e419a1f32dfb5f5ae6b3df7f278a8223e36781a52abcde714de10116a774f5ff554dd2ec891b59cbaef8326e2630f23402b4b79bff89a1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	91e648c9faf5c49d54683c67762d9c0a
SHA1	b032de8bf5c7a33a9986c7dbed8a3d2e842e0f9f
SHA256	262eddf87fa549748560d5cf9fd52e33f097a7ccdb8dad2926478aebd39268f3
SHA512	c8a753008123428a1bdeebf67b1c440241aa6280356a82bcdc40eef76140c3f2b19961e702cdf7bd3d5a40b589e6b5ee8700ed02ba9b033e5cbad5125bf9c89d

Malware Analysis Report

2024-07-28 08:35

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

Threat Level: Likely malicious

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Sample ID	240608-z2s9xagd2x
Target	ViaFabricPlus-3.3.0.jar
SHA256	922989bee07d0a0bac9fcfe443a472597914300d3da5ea276d061798d441ce8e
Tags	microsoft discovery phishing