Malware Analysis Report

2024-09-11 05:10

Sample ID 240620-2v8gcsvhrq
Target engineer-taunt.gif
SHA256 f19abff1a72b1ef08d57541a0d21908b7bf3ae6797d1bcf08c6a81a7c312393f
Tags
discovery execution exploit upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

f19abff1a72b1ef08d57541a0d21908b7bf3ae6797d1bcf08c6a81a7c312393f

Threat Level: Likely malicious

The file engineer-taunt.gif was found to be: Likely malicious.

Malicious Activity Summary

discovery execution exploit upx

Possible privilege escalation attempt

UPX packed file

Modifies file permissions

Enumerates connected drives

Suspicious use of SetThreadContext

AutoIT Executable

Drops file in Windows directory

Command and Scripting Interpreter: JavaScript

Suspicious use of SendNotifyMessage

Checks processor information in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Suspicious behavior: GetForegroundWindowSpam

Views/modifies file attributes

Modifies registry class

NTFS ADS

Enumerates system info in registry

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
JavaScript
T1059.007
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
File and Directory Permissions Modification
T1222
Modify Registry
T1112
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-20 22:55

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 22:55

Reported

2024-06-20 23:42

Platform

win10-20240404-en

Max time kernel

2700s

Max time network

2318s

Command Line

C:\Windows\System32\spoolsv.exe

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\SYSTEM32\takeown.exe N/A
N/A N/A C:\Windows\SYSTEM32\takeown.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\SYSTEM32\takeown.exe N/A
N/A N/A C:\Windows\SYSTEM32\takeown.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Windows\SYSTEM32\takeown.exe N/A
File opened (read-only) \??\V: C:\Windows\SYSTEM32\takeown.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3572 set thread context of 3388 N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\VeryFun.exe C:\Windows\SysWOW64\cmd.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\System.ini C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\VeryFun.exe N/A

Command and Scripting Interpreter: JavaScript

execution

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1017044708" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1017044708" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00dcc3c65c3da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c3c93c65c3da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000397fb53428fc2248832c3f5980ef467100000000020000000000106600000001000020000000a4acdcd0e58ebd8283e3f498aeaee982be5b0437edd5a4cf27aa67ce39eb1b77000000000e8000000002000020000000c5ce96c5d89f7debd6a29cc023106e3dae2a229d7ec5932237b30a5798fa189f20000000b6c2d0fe516bdc8e30e733499fc3443a3e16e1c70faae2982196531301698e164000000048f4758bf32fabcacbb721147a9f414a925050a8c6e2c7713ea95635d0f2ad568716a1f18b96a72630a540c60977ea5ac3996f42fbba917eac05cb6a9b32f5e6 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31114085" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6814CB7C-2F58-11EF-ABE2-FAADE229C9AA} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31114085" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000397fb53428fc2248832c3f5980ef4671000000000200000000001066000000010000200000001bb1f814321d2041bcb62fdb9a99a2450b2af2b62f7c370ed9ec9da80b7667ea000000000e80000000020000200000004126a397b8440d65a0d079469e4df4cc7fe100daa463c3e240774e1c21563e5320000000ca901f678c899b887fcae45f8a5f13c0fd7d53ea66571e1229d69aaf331589e5400000009c1f302bc1d23fa4f15b9b453c0ce6c1429fecaab9ef42fe9b96ef868615e0e42f8cec81b7583aa4ff8f9d17bfcc9101dfb2fa6c3e5fe286de85e03a143fc5ce C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133633978646092419" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\apk_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\apk_auto_file C:\Windows\system32\OpenWith.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\.apk\ = "apk_auto_file" C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\apk_auto_file\shell\open C:\Windows\system32\OpenWith.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\apk_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\apk_auto_file\shell\edit\command C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\apk_auto_file\shell\open\command C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\.apk C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\apk_auto_file\shell\edit C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\apk_auto_file\shell C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Downloads\MEMZ.4.0.Clean.zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\Downloads\memz-trojan.zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\VeryFun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\VeryFun.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\VeryFun.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2008 wrote to memory of 1788 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2008 wrote to memory of 1788 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2008 wrote to memory of 1788 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2152 wrote to memory of 4208 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 4208 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 692 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 656 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 656 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2152 wrote to memory of 2664 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\engineer-taunt.gif

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:82945 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd8,0xdc,0xe0,0xb4,0xe4,0x7ffddc959758,0x7ffddc959768,0x7ffddc959778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4452 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4768 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5108 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5168 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3876 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3116 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2052 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4452 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4504 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3600 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5232 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5320 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5264 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4888 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5228 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2960 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5212 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=3048 --field-trial-handle=1840,i,7916694896991414716,3830008254340209840,131072 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.0.1107424574\1675007400" -parentBuildID 20221007134813 -prefsHandle 1724 -prefMapHandle 1716 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8799fab1-3cfc-45d4-9248-9cae053e6831} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 1800 21eccfe7758 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.1.1295574184\1776700313" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aade39ab-e9d9-4d2e-8a9f-a9b242874c5d} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 2152 21eccf0a258 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.2.1258112268\369479865" -childID 1 -isForBrowser -prefsHandle 2920 -prefMapHandle 2788 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6dbca55c-1288-4226-8226-55540a2991e1} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 2800 21ed1d95b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.3.851373979\1160998201" -childID 2 -isForBrowser -prefsHandle 3412 -prefMapHandle 3408 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {142f078f-8dee-43b3-91a2-3b0265b15aed} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 3424 21ed2207b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.4.1036222566\403519107" -childID 3 -isForBrowser -prefsHandle 4216 -prefMapHandle 4212 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8de2c575-f5ce-4a86-8942-95f02a0ee015} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 3408 21ed3ca8558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.5.1916326922\645617924" -childID 4 -isForBrowser -prefsHandle 4936 -prefMapHandle 4944 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {785a7529-5c48-457e-83ac-62e0ee87dfbb} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 4952 21ed42b7558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.6.765035125\273618766" -childID 5 -isForBrowser -prefsHandle 5088 -prefMapHandle 5092 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce7e9d0d-7a37-404e-a446-f40a60fc7918} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 5076 21ed459b658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.7.1884721576\5398922" -childID 6 -isForBrowser -prefsHandle 5264 -prefMapHandle 5268 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31b53dcd-e696-4522-a05d-3526cbf85a6c} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 5256 21ed459bc58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.8.1036144313\854147776" -childID 7 -isForBrowser -prefsHandle 5648 -prefMapHandle 5652 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a70d471-cf36-4fdc-b4fa-5ebaa694c5f8} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 5616 21ed5e77958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.9.1129568607\961163505" -childID 8 -isForBrowser -prefsHandle 5460 -prefMapHandle 5464 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1c58aa8-10e5-4ffc-86e7-776f99f77022} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 2600 21ed5428a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.10.1690616264\763909205" -childID 9 -isForBrowser -prefsHandle 4992 -prefMapHandle 5264 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2235b028-ffa6-4030-b3c4-ed6ea0187b08} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 5244 21ed6879a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.11.1579947664\2133697934" -childID 10 -isForBrowser -prefsHandle 7404 -prefMapHandle 7400 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a5826c6-713d-4449-b5c5-db09b7a0fc93} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 7412 21ed687a658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.12.807149971\304234587" -childID 11 -isForBrowser -prefsHandle 4752 -prefMapHandle 4768 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dab87826-be02-437f-be7a-96605e157073} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 5736 21ed40b6958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.13.1293744690\263477231" -childID 12 -isForBrowser -prefsHandle 9572 -prefMapHandle 9568 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {030f0d7c-c60d-4c24-9cdc-9f485b15b81b} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 9580 21ed756f558 tab

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.14.797774335\717066806" -childID 13 -isForBrowser -prefsHandle 4296 -prefMapHandle 4104 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2d3df62-da04-4b71-bdd1-a7392e0f79f9} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 4300 21ed5b36558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.15.271063510\401625273" -childID 14 -isForBrowser -prefsHandle 5896 -prefMapHandle 5264 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2969deb1-2eb2-46b5-8ea8-6442415cb981} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 4936 21ed1e9c258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.16.862641272\1318229657" -parentBuildID 20221007134813 -prefsHandle 4104 -prefMapHandle 4328 -prefsLen 26808 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {358aad07-c69f-4530-82a3-4ca9fce95064} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 7040 21ed5c69558 rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.17.573587826\1676841192" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4296 -prefMapHandle 5060 -prefsLen 26808 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d2bee26-4773-43d0-b852-2c10d9da9e48} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 7008 21ed5c69b58 utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.18.1097766626\739012350" -childID 15 -isForBrowser -prefsHandle 2732 -prefMapHandle 2716 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4f3806f-4827-435b-8c74-7698c11099cd} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 5264 21ed5e9d858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.19.940475540\2111970374" -childID 16 -isForBrowser -prefsHandle 9208 -prefMapHandle 5684 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {149f5de3-f8d1-4c86-8ab3-5cff3d28ca45} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 1036 21ecea10b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.20.1465086505\1489586542" -childID 17 -isForBrowser -prefsHandle 6372 -prefMapHandle 6292 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3a03486-f61e-4084-a9c1-1ba47b938642} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 7064 21eceb3e358 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.21.1080166433\442785430" -childID 18 -isForBrowser -prefsHandle 8856 -prefMapHandle 8840 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3738c1bf-f300-4498-b574-e247cbaf392c} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 8832 21edb1ac058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.22.1534830941\1215932125" -childID 19 -isForBrowser -prefsHandle 8636 -prefMapHandle 8632 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f2bfb34-a9db-4a27-8bc4-e4fe73c38d03} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 8644 21edaa4ac58 tab

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_memz-trojan.zip\MEMZ-master\README.md

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.23.262143662\554297195" -childID 20 -isForBrowser -prefsHandle 6424 -prefMapHandle 6376 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {954439de-a108-4c19-a1ff-0e3005f80862} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 7252 21ece93d458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2072.24.2114801558\108685955" -childID 21 -isForBrowser -prefsHandle 8512 -prefMapHandle 8516 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e815954d-2114-446f-bc31-d0c4e69904be} 2072 "\\.\pipe\gecko-crash-server-pipe.2072" 8504 21ed4599858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6112.0.2094471600\1111932405" -parentBuildID 20221007134813 -prefsHandle 1604 -prefMapHandle 1452 -prefsLen 21578 -prefMapSize 233863 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0eb03c41-9f8a-42d5-98cc-10407af6127f} 6112 "\\.\pipe\gecko-crash-server-pipe.6112" 1684 241608fc658 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6112.1.167422177\389929870" -parentBuildID 20221007134813 -prefsHandle 1984 -prefMapHandle 1980 -prefsLen 21623 -prefMapSize 233863 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5d9f06c-0856-4230-96f0-c52207b54954} 6112 "\\.\pipe\gecko-crash-server-pipe.6112" 2004 24154adeb58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6112.2.1436153087\1278737144" -childID 1 -isForBrowser -prefsHandle 2584 -prefMapHandle 2636 -prefsLen 22084 -prefMapSize 233863 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1847f6d5-0d28-4da0-9eee-a5ac5ff0ba25} 6112 "\\.\pipe\gecko-crash-server-pipe.6112" 2624 24164a89958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6112.3.1812626390\362157556" -childID 2 -isForBrowser -prefsHandle 3388 -prefMapHandle 3384 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b25dbeb-179b-4c87-9f02-8433c215fbc9} 6112 "\\.\pipe\gecko-crash-server-pipe.6112" 3392 241661b0b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6112.4.1278133849\549657884" -childID 3 -isForBrowser -prefsHandle 3624 -prefMapHandle 3560 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe0b1648-a83d-45f2-858e-9a22063f59e5} 6112 "\\.\pipe\gecko-crash-server-pipe.6112" 3636 241661db458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6112.5.1775770185\428374422" -childID 4 -isForBrowser -prefsHandle 4528 -prefMapHandle 4524 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bcec2cd-92a9-45a4-a35f-462a10d73f24} 6112 "\\.\pipe\gecko-crash-server-pipe.6112" 4536 2416785d558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6112.6.1983004665\887972910" -childID 5 -isForBrowser -prefsHandle 4672 -prefMapHandle 4676 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4051ca2e-610e-4950-b243-4b8bc5a11b57} 6112 "\\.\pipe\gecko-crash-server-pipe.6112" 4664 2416785a558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6112.7.1331392260\456731175" -childID 6 -isForBrowser -prefsHandle 4864 -prefMapHandle 4868 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2d19bb4-f0c4-47c7-86a0-c36128e7e497} 6112 "\\.\pipe\gecko-crash-server-pipe.6112" 4856 2416785c058 tab

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\Offiz.js"

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\PCToaster.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\PCToaster.exe"

C:\Program Files\Java\jre-1.8\bin\javaw.exe

"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\PCToaster.exe"

C:\Windows\system32\icacls.exe

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

C:\Windows\SYSTEM32\attrib.exe

attrib +h C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\scr.txt

C:\Windows\SYSTEM32\diskpart.exe

diskpart /s C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\scr.txt

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SYSTEM32\takeown.exe

takeown /f V:\Boot /r

C:\Windows\SYSTEM32\takeown.exe

takeown /f V:\Recovery /r

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\TaskILL.exe"

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\VeryFun.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Trojan\VeryFun.exe"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\mountvol.exe

mountvol c:\ /d

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.169.46:443 play.google.com tcp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.238:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
GB 172.217.169.46:443 play.google.com udp
US 8.8.8.8:53 consent.google.com udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 en.wikipedia.org udp
NL 185.15.59.224:443 en.wikipedia.org tcp
NL 185.15.59.224:443 en.wikipedia.org tcp
NL 185.15.59.224:443 en.wikipedia.org tcp
US 8.8.8.8:53 upload.wikimedia.org udp
US 8.8.8.8:53 login.wikimedia.org udp
US 8.8.8.8:53 meta.wikimedia.org udp
NL 185.15.59.240:443 upload.wikimedia.org tcp
NL 185.15.59.240:443 upload.wikimedia.org tcp
NL 185.15.59.240:443 upload.wikimedia.org tcp
US 8.8.8.8:53 content-autofill.googleapis.com udp
US 8.8.8.8:53 224.59.15.185.in-addr.arpa udp
US 8.8.8.8:53 240.59.15.185.in-addr.arpa udp
GB 172.217.16.234:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
NL 185.15.59.240:443 upload.wikimedia.org tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 google.com udp
GB 142.250.178.14:443 google.com tcp
FR 216.58.215.35:443 beacons.gcp.gvt2.com tcp
FR 216.58.215.35:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 e2c7.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
GB 172.217.169.3:443 beacons.gvt2.com tcp
IN 34.131.78.121:443 e2c7.gcp.gvt2.com tcp
GB 172.217.169.3:443 beacons.gvt2.com udp
IN 34.131.78.121:443 e2c7.gcp.gvt2.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 121.78.131.34.in-addr.arpa udp
FR 216.58.215.35:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 encrypted-tbn0.gstatic.com udp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 172.217.169.46:443 play.google.com udp
GB 142.250.200.14:443 apis.google.com udp
GB 172.217.16.234:443 content-autofill.googleapis.com udp
FR 216.58.215.35:443 beacons.gcp.gvt2.com udp
GB 142.250.187.238:443 consent.google.com udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.169.46:443 play.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 44.240.188.8:443 shavar.prod.mozaws.net tcp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
N/A 127.0.0.1:50442 tcp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 8.8.8.8:53 166.188.117.34.in-addr.arpa udp
US 8.8.8.8:53 8.188.240.44.in-addr.arpa udp
N/A 127.0.0.1:50448 tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 bing.com udp
US 13.107.21.200:80 bing.com tcp
US 13.107.21.200:80 bing.com tcp
US 8.8.8.8:53 bing.com udp
US 8.8.8.8:53 bing.com udp
NL 23.62.61.97:80 www.bing.com tcp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
NL 23.62.61.97:80 e86303.dscx.akamaiedge.net tcp
US 8.8.8.8:53 r.bing.com udp
NL 23.62.61.97:80 r.bing.com tcp
NL 23.62.61.97:443 r.bing.com tcp
NL 23.62.61.97:443 r.bing.com tcp
NL 23.62.61.97:443 r.bing.com tcp
NL 23.62.61.97:443 r.bing.com udp
US 8.8.8.8:53 200.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 www.msn.com udp
US 8.8.8.8:53 www.takelessons.com udp
US 8.8.8.8:53 www.start.gg udp
US 8.8.8.8:53 a-0003.a-msedge.net udp
US 8.8.8.8:53 a-0016.a-msedge.net udp
US 8.8.8.8:53 s-part-0036.t-0009.t-msedge.net udp
US 8.8.8.8:53 a-0003.a-msedge.net udp
US 8.8.8.8:53 a-0016.a-msedge.net udp
US 8.8.8.8:53 s-part-0036.t-0009.t-msedge.net udp
NL 23.62.61.97:443 r.bing.com udp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 microsoft365.com udp
US 8.8.8.8:53 www.onenote.com udp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 microsoft365.com udp
US 8.8.8.8:53 sway.office.com udp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 microsoft365.com udp
US 8.8.8.8:53 sway.com udp
US 8.8.8.8:53 onedrive.live.com udp
US 8.8.8.8:53 calendar.live.com udp
US 8.8.8.8:53 sway.com udp
US 8.8.8.8:53 calendar.live.com udp
US 8.8.8.8:53 dual-spov-0006.spov-msedge.net udp
US 8.8.8.8:53 outlook.live.com udp
US 8.8.8.8:53 dual-spov-0006.spov-msedge.net udp
US 8.8.8.8:53 calendar.live.com udp
US 8.8.8.8:53 LHR-efz.ms-acdc.office.com udp
US 8.8.8.8:53 LHR-efz.ms-acdc.office.com udp
US 8.8.8.8:53 e11290.dspg.akamaiedge.net udp
US 8.8.8.8:53 e11290.dspg.akamaiedge.net udp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 a4.bing.com udp
NL 23.62.61.97:80 a4.bing.com tcp
NL 23.62.61.97:80 a4.bing.com tcp
SE 92.123.135.81:443 assets.msn.com tcp
NL 23.62.61.97:80 a4.bing.com tcp
NL 23.62.61.97:80 a4.bing.com tcp
NL 23.62.61.97:80 a4.bing.com tcp
NL 23.62.61.97:80 a4.bing.com tcp
NL 23.62.61.97:80 a4.bing.com tcp
NL 23.62.61.97:80 a4.bing.com tcp
US 8.8.8.8:53 e28578.d.akamaiedge.net udp
US 8.8.8.8:53 e86303.dsca.akamaiedge.net udp
US 8.8.8.8:53 e28578.d.akamaiedge.net udp
US 8.8.8.8:53 e86303.dsca.akamaiedge.net udp
NL 23.62.61.97:80 e86303.dsca.akamaiedge.net tcp
US 8.8.8.8:53 81.135.123.92.in-addr.arpa udp
US 8.8.8.8:53 platform.bing.com udp
US 204.79.197.237:80 platform.bing.com tcp
US 8.8.8.8:53 dual-a-0034.a-msedge.net udp
US 8.8.8.8:53 dual-a-0034.a-msedge.net udp
US 8.8.8.8:53 login.microsoftonline.com udp
IE 20.190.159.68:443 login.microsoftonline.com tcp
US 8.8.8.8:53 www.tm.ak.prd.aadg.akadns.net udp
US 8.8.8.8:53 www.tm.ak.prd.aadg.akadns.net udp
NL 23.62.61.97:443 e86303.dsca.akamaiedge.net tcp
US 8.8.8.8:53 www.tm.v4.a.prd.aadg.akadns.net udp
US 104.18.33.89:80 www2.bing.com tcp
US 8.8.8.8:53 www.bing.com.cdn.cloudflare.net udp
US 8.8.8.8:53 www.tm.v4.a.prd.aadg.akadns.net udp
NL 23.62.61.97:443 e86303.dsca.akamaiedge.net udp
US 8.8.8.8:53 www.bing.com.cdn.cloudflare.net udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 89.33.18.104.in-addr.arpa udp
US 8.8.8.8:53 support.microsoft.com udp
US 8.8.8.8:53 help.bing.microsoft.com udp
US 8.8.8.8:53 e3843.dscb.akamaiedge.net udp
US 8.8.8.8:53 waws-prod-bay-231-5e23.westus.cloudapp.azure.com udp
US 8.8.8.8:53 e3843.dscb.akamaiedge.net udp
US 8.8.8.8:53 waws-prod-bay-231-5e23.westus.cloudapp.azure.com udp
US 8.8.8.8:53 support.mozilla.org udp
US 8.8.8.8:53 us-west1.prod.sumo.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 us-west1.prod.sumo.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
NL 23.62.61.194:80 th.bing.com tcp
NL 23.62.61.194:80 th.bing.com tcp
NL 23.62.61.194:80 th.bing.com tcp
NL 23.62.61.194:80 th.bing.com tcp
NL 23.62.61.194:80 th.bing.com tcp
NL 23.62.61.194:80 th.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 services.bingapis.com udp
US 13.107.5.80:443 services.bingapis.com tcp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 e-0001.e-msedge.net udp
US 8.8.8.8:53 e-0001.e-msedge.net udp
NL 23.62.61.97:80 th.bing.com tcp
US 8.8.8.8:53 80.5.107.13.in-addr.arpa udp
NL 23.62.61.97:80 th.bing.com tcp
NL 23.62.61.97:80 th.bing.com tcp
US 8.8.8.8:53 9b74f3fe922a988217d922c33aaccbb2.clo.footprintdns.com udp
AE 40.126.212.197:80 9b74f3fe922a988217d922c33aaccbb2.clo.footprintdns.com tcp
US 8.8.8.8:53 auh20prdapp01-canary-opaph.uaecentral.cloudapp.azure.com udp
US 8.8.8.8:53 auh20prdapp01-canary-opaph.uaecentral.cloudapp.azure.com udp
NL 23.62.61.97:443 th.bing.com tcp
NL 23.62.61.97:443 th.bing.com udp
AE 40.126.212.197:80 auh20prdapp01-canary-opaph.uaecentral.cloudapp.azure.com tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 154.109.199.185.in-addr.arpa udp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 api.github.com udp
US 140.82.112.21:443 collector.github.com tcp
US 140.82.112.21:443 collector.github.com tcp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 21.112.82.140.in-addr.arpa udp
US 8.8.8.8:53 39573e97e9055e3972b2fec960f25ca4.clo.footprintdns.com udp
US 204.79.197.222:80 39573e97e9055e3972b2fec960f25ca4.clo.footprintdns.com tcp
US 8.8.8.8:53 a-0019.standard.a-msedge.net udp
US 8.8.8.8:53 a-0019.standard.a-msedge.net udp
US 8.8.8.8:53 27d1de93b3d35a78b52fe009f8246b8b.clo.footprintdns.com udp
US 104.214.71.38:80 27d1de93b3d35a78b52fe009f8246b8b.clo.footprintdns.com tcp
US 8.8.8.8:53 sn1prdapp04-canary.southcentralus.cloudapp.azure.com udp
US 8.8.8.8:53 sn1prdapp04-canary.southcentralus.cloudapp.azure.com udp
US 104.214.71.38:80 sn1prdapp04-canary.southcentralus.cloudapp.azure.com tcp
US 8.8.8.8:53 222.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.111.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
US 104.214.71.38:80 sn1prdapp04-canary.southcentralus.cloudapp.azure.com tcp
US 8.8.8.8:53 sn1prdapp04-canary.southcentralus.cloudapp.azure.com udp
US 104.214.71.38:80 sn1prdapp04-canary.southcentralus.cloudapp.azure.com tcp
US 8.8.8.8:53 27d1de93b3d35a78b52fe009f8246b8b.clo.footprintdns.com udp
AE 40.126.212.197:80 auh20prdapp01-canary-opaph.uaecentral.cloudapp.azure.com tcp
US 8.8.8.8:53 9b74f3fe922a988217d922c33aaccbb2.clo.footprintdns.com udp
US 8.8.8.8:53 auh20prdapp01-canary-opaph.uaecentral.cloudapp.azure.com udp
US 8.8.8.8:53 auh20prdapp01-canary-opaph.uaecentral.cloudapp.azure.com udp
US 8.8.8.8:53 9b74f3fe922a988217d922c33aaccbb2.clo.footprintdns.com udp
AE 40.126.212.197:80 9b74f3fe922a988217d922c33aaccbb2.clo.footprintdns.com tcp
US 204.79.197.222:80 fp.msedge.net tcp
US 8.8.8.8:53 a-0019.standard.a-msedge.net udp
US 8.8.8.8:53 a4.bing.com udp
US 8.8.8.8:53 e86303.dsca.akamaiedge.net udp
US 8.8.8.8:53 e86303.dsca.akamaiedge.net udp
AE 40.126.212.197:80 9b74f3fe922a988217d922c33aaccbb2.clo.footprintdns.com tcp
US 8.8.8.8:53 9b74f3fe922a988217d922c33aaccbb2.clo.footprintdns.com udp
US 8.8.8.8:53 auh20prdapp01-canary-opaph.uaecentral.cloudapp.azure.com udp
US 8.8.8.8:53 auh20prdapp01-canary-opaph.uaecentral.cloudapp.azure.com udp
AE 40.126.212.197:80 auh20prdapp01-canary-opaph.uaecentral.cloudapp.azure.com tcp
US 8.8.8.8:53 9b74f3fe922a988217d922c33aaccbb2.clo.footprintdns.com udp
US 104.214.71.38:80 27d1de93b3d35a78b52fe009f8246b8b.clo.footprintdns.com tcp
US 8.8.8.8:53 27d1de93b3d35a78b52fe009f8246b8b.clo.footprintdns.com udp
US 8.8.8.8:53 sn1prdapp04-canary.southcentralus.cloudapp.azure.com udp
US 8.8.8.8:53 sn1prdapp04-canary.southcentralus.cloudapp.azure.com udp
US 8.8.8.8:53 27d1de93b3d35a78b52fe009f8246b8b.clo.footprintdns.com udp
US 104.214.71.38:80 27d1de93b3d35a78b52fe009f8246b8b.clo.footprintdns.com tcp
US 104.214.71.38:80 27d1de93b3d35a78b52fe009f8246b8b.clo.footprintdns.com tcp
US 104.214.71.38:80 27d1de93b3d35a78b52fe009f8246b8b.clo.footprintdns.com tcp
AE 40.126.212.197:80 9b74f3fe922a988217d922c33aaccbb2.clo.footprintdns.com tcp
AE 40.126.212.197:80 9b74f3fe922a988217d922c33aaccbb2.clo.footprintdns.com tcp
US 8.8.8.8:53 a4.bing.com udp
US 8.8.8.8:53 e86303.dsca.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dsca.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
NL 23.62.61.97:443 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 github.githubassets.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 a4.bing.com udp
US 8.8.8.8:53 e86303.dsca.akamaiedge.net udp
US 8.8.8.8:53 e86303.dsca.akamaiedge.net udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:80 tse1.mm.bing.net tcp
US 8.8.8.8:53 ax-0001.ax-msedge.net udp
US 8.8.8.8:53 ax-0001.ax-msedge.net udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
NL 23.62.61.97:443 e86303.dsca.akamaiedge.net tcp
NL 23.62.61.97:443 e86303.dsca.akamaiedge.net tcp
NL 23.62.61.97:443 e86303.dsca.akamaiedge.net udp
US 8.8.8.8:53 th.bing.com udp
NL 23.62.61.97:443 th.bing.com tcp
NL 23.62.61.97:443 th.bing.com tcp
NL 23.62.61.97:443 th.bing.com tcp
NL 23.62.61.97:443 th.bing.com tcp
NL 23.62.61.97:443 th.bing.com tcp
NL 23.62.61.97:443 th.bing.com udp
US 8.8.8.8:53 services.bingapis.com udp
US 13.107.5.80:443 services.bingapis.com tcp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 e-0001.e-msedge.net udp
US 150.171.27.10:443 ax-0001.ax-msedge.net tcp
US 8.8.8.8:53 ax-0001.ax-msedge.net udp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 sydney.bing.com udp
NL 23.62.61.194:443 sydney.bing.com tcp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 sydney.bing.com udp
NL 23.62.61.97:443 sydney.bing.com tcp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 memz-trojan.fileplanet.com udp
US 104.27.204.89:443 memz-trojan.fileplanet.com tcp
US 8.8.8.8:53 memz-trojan.fileplanet.com udp
US 8.8.8.8:53 memz-trojan.fileplanet.com udp
US 104.27.204.89:443 memz-trojan.fileplanet.com udp
US 8.8.8.8:53 cdn.fileplanet.com udp
US 8.8.8.8:53 cdn.fileplanet.com udp
US 104.27.203.89:443 cdn.fileplanet.com tcp
US 104.27.203.89:443 cdn.fileplanet.com tcp
US 104.27.203.89:443 cdn.fileplanet.com tcp
US 104.27.203.89:443 cdn.fileplanet.com tcp
US 104.27.203.89:443 cdn.fileplanet.com tcp
US 104.27.203.89:443 cdn.fileplanet.com tcp
US 8.8.8.8:53 cdn.fileplanet.com udp
US 104.27.203.89:443 cdn.fileplanet.com udp
US 104.27.203.89:443 cdn.fileplanet.com tcp
US 8.8.8.8:53 cmp.quantcast.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 secure.statcounter.com udp
US 8.8.8.8:53 cmp.quantcast.com udp
US 104.20.94.138:443 secure.statcounter.com tcp
US 8.8.8.8:53 secure.statcounter.com udp
GB 142.250.200.10:443 ajax.googleapis.com tcp
US 8.8.8.8:53 cmp.quantcast.com udp
US 8.8.8.8:53 secure.statcounter.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 142.250.200.10:443 ajax.googleapis.com udp
US 8.8.8.8:53 c.statcounter.com udp
US 104.20.94.138:443 c.statcounter.com tcp
US 8.8.8.8:53 c.statcounter.com udp
US 8.8.8.8:53 fileplanet-1.disqus.com udp
US 8.8.8.8:53 c.statcounter.com udp
US 199.232.192.134:443 fileplanet-1.disqus.com tcp
US 8.8.8.8:53 prod.disqus.map.fastlylb.net udp
US 8.8.8.8:53 89.204.27.104.in-addr.arpa udp
US 8.8.8.8:53 89.203.27.104.in-addr.arpa udp
US 8.8.8.8:53 10.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 138.94.20.104.in-addr.arpa udp
US 8.8.8.8:53 prod.disqus.map.fastlylb.net udp
US 18.239.208.65:443 cmp.quantcast.com tcp
US 8.8.8.8:53 disqus.com udp
US 8.8.8.8:53 referrer.disqus.com udp
US 8.8.8.8:53 c.disquscdn.com udp
US 151.101.0.134:443 disqus.com tcp
US 8.8.8.8:53 disqus.com udp
US 199.232.196.134:443 referrer.disqus.com tcp
US 18.239.208.52:443 c.disquscdn.com tcp
US 8.8.8.8:53 d231vab146qzfb.cloudfront.net udp
US 8.8.8.8:53 disqus.com udp
US 8.8.8.8:53 d231vab146qzfb.cloudfront.net udp
US 8.8.8.8:53 cmp.inmobi.com udp
US 18.239.208.80:443 cmp.inmobi.com tcp
US 8.8.8.8:53 d23sp3kzv1t6m5.cloudfront.net udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 d23sp3kzv1t6m5.cloudfront.net udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 134.192.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 65.208.239.18.in-addr.arpa udp
US 8.8.8.8:53 134.0.101.151.in-addr.arpa udp
US 8.8.8.8:53 134.196.232.199.in-addr.arpa udp
US 8.8.8.8:53 52.208.239.18.in-addr.arpa udp
US 8.8.8.8:53 104.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 80.208.239.18.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 216.239.34.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 www.fileplanet.com udp
US 104.27.203.89:443 www.fileplanet.com tcp
US 8.8.8.8:53 www.fileplanet.com udp
US 8.8.8.8:53 www.fileplanet.com udp
US 104.27.203.89:443 www.fileplanet.com udp
US 199.232.196.134:443 referrer.disqus.com tcp
US 199.232.196.134:443 referrer.disqus.com tcp
US 8.8.8.8:53 api.cmp.inmobi.com udp
US 8.8.8.8:53 choice-apis-prod-2120274730.eu-central-1.elb.amazonaws.com udp
DE 52.58.158.46:443 choice-apis-prod-2120274730.eu-central-1.elb.amazonaws.com tcp
US 8.8.8.8:53 choice-apis-prod-2120274730.eu-central-1.elb.amazonaws.com udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 46.158.58.52.in-addr.arpa udp
US 8.8.8.8:53 secure.downloadfp.com udp
US 8.8.8.8:53 secure.downloadfp.com udp
NL 95.168.168.24:443 secure.downloadfp.com tcp
US 8.8.8.8:53 secure.downloadfp.com udp
US 8.8.8.8:53 cmp.quantcast.com udp
US 104.27.204.89:443 www.fileplanet.com udp
US 8.8.8.8:53 secure.statcounter.com udp
US 8.8.8.8:53 referrer.disqus.com udp
US 104.27.203.89:443 www.fileplanet.com udp
GB 142.250.200.10:443 ajax.googleapis.com udp
US 104.27.203.89:443 www.fileplanet.com udp
US 8.8.8.8:53 fileplanet-1.disqus.com udp
US 8.8.8.8:53 prod.disqus.map.fastlylb.net udp
US 8.8.8.8:53 cmp.quantcast.com udp
US 8.8.8.8:53 prod.disqus.map.fastlylb.net udp
US 8.8.8.8:53 cmp.inmobi.com udp
US 8.8.8.8:53 d23sp3kzv1t6m5.cloudfront.net udp
US 8.8.8.8:53 c.disquscdn.com udp
US 8.8.8.8:53 d23sp3kzv1t6m5.cloudfront.net udp
US 8.8.8.8:53 d231vab146qzfb.cloudfront.net udp
US 8.8.8.8:53 d231vab146qzfb.cloudfront.net udp
US 8.8.8.8:53 disqus.com udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
NL 23.62.61.97:443 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 216.239.34.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 ax-0001.ax-msedge.net udp
US 8.8.8.8:53 ax-0001.ax-msedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.com udp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 codeload.github.com udp
US 8.8.8.8:53 codeload.github.com udp
GB 20.26.156.216:443 codeload.github.com tcp
US 8.8.8.8:53 codeload.github.com udp
US 8.8.8.8:53 216.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 aus5.mozilla.org udp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
NL 2.18.121.79:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.187.206:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 79.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
GB 142.250.187.206:443 redirector.gvt1.com udp
US 8.8.8.8:53 r1---sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1---sn-aigl6ney.gvt1.com tcp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
NL 23.62.61.97:443 e86303.dscx.akamaiedge.net udp
NL 23.62.61.97:443 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
NL 23.62.61.97:443 e86303.dscx.akamaiedge.net tcp
NL 23.62.61.97:443 e86303.dscx.akamaiedge.net tcp
NL 23.62.61.97:443 e86303.dscx.akamaiedge.net tcp
N/A 127.0.0.1:55095 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
N/A 127.0.0.1:55111 tcp
US 8.8.8.8:53 aus5.mozilla.org udp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp

Files

C:\Users\Admin\AppData\Local\Temp\~DF28FB039A61A74B16.TMP

MD5 a37138bafe75709357e2bdf1fe2713d2
SHA1 7b14d4d970629662aa9c4458b332cb7550ddeff7
SHA256 e96bb4edc387bcf0466136d87831e4bc95db5cb70531dfea55ac7660bcafc49c
SHA512 4fe4dc8dc5e85250611f6840e4b23358f7cd4f864d6e8ecb4d9e3ac6719766cf09a1305a290287affc76bc0c458844bba3f41e8797c5231cfe53955706f98d23

\??\pipe\crashpad_2152_EROWRXKWBZJRNTEC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 82939c7c0404e27eb4a340bf1e1b0fef
SHA1 fde1b282b4e4db86f137747da6961293cd3ae2ff
SHA256 236fe798bc1ef38d5c1f83067c37bbff617ad9b4cd81c153ab55db27d86453fe
SHA512 5026d441a18011cb9b5a52a5b543b2416869890f626a075c9dccd22c2d8ac617bf166c142cc3f484c87140a680d3766ddaaadb23aa7355f57f9e4b23a854b07c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4d613c26db8826cfbe12475be5be3e48
SHA1 6fb5f7ea1bbe306ef28cc1318c6663cea2073444
SHA256 4b5134e4b77d0c1275c649df3a84d95461f77c20452ac3b3e8412a6c18a8534e
SHA512 8fd8e191476b7d9ef8d4d694d14cbc84407a1453d0a5f5eafba809243a7ee36ef2b9a790d237b2a35395561e1487ef74b2fcadefbadf80c57b320c7379387e2e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 f3b28f2d9a69fdf34a5a65941414e38c
SHA1 676fa7a29cac5a205c8db85fc00da270481ab22c
SHA256 1f614189258ae9c040c9238c2ae37ed8f8e3e28cfda9b990405a98758c698c6a
SHA512 1d04324921329dc9a4d580d5b4645ad9a76b8c80174f5eefe6fc50cc2805b3d000e24946bcad7488db1cf7a4a331c5e9c34888a1f0efa6380640b031bd1ceb52

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 c1076e7f4f3cd73e074efc20d9e6e2a3
SHA1 1eb32ff24006a39b13d3f533c2afe6ec37c018b0
SHA256 6c9b46c709bd0daae375323c6e8b463fbf492ab878faff3bc30db3ca250f6015
SHA512 fc4414d0e9d4bc17069f9d9f9ce09902a7c469eaa79a9a72414b3624362321943e1cd2126d053c544acf24106e86742edddef40297cc3ba98193cc8257d20b27

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 083fc49dca6fd38f5c3c321c60a9b05a
SHA1 f60cd46a755d1d990799ec1ed12f1a07627f3b7f
SHA256 3345a55ae320aea4ea1b08f0a58d8620063d65f403bd086d561037c23258debd
SHA512 229dbb6e773b6a6930851135ce8d4e3c94adbf040d58c7e89329d9e2b54e14186864d4c91c6c64243dd4cff28a165867bdc573083d0032a2b1d6f16509976f22

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ba2b68f61b77541b248b2217e2637250
SHA1 a41d8c5fabcf17e9fca8fd5e93b95c62371179e9
SHA256 724f145858157c251944ee2277a8f4172fcd54492362402de7c74dbdbb30db26
SHA512 d77df25584ffa128a8423db2c71b08d2c8a94a1bd98e0b3b0f288ddf741e06a064adca11b7832ef969090eb22fc952feeecef41d1024abd007dded02c74a9224

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 837b303e95bcbb5eeaaee90ac09a4440
SHA1 33d164b561b09088c20ed8e9c7b56bacc7ff4273
SHA256 8f45835d5b221f710f7edac01c361cfabeab12bdf6fbf572dd0158ab548a0697
SHA512 448c9525bf62c608dea90c0e708ebaa232f2716ae4c6b1836835d6435967aa8734f924d876b04044888ef1ab1161b40af4ca9f786857791dff4a14fbf547bdb2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e9fe73242cd8a92680aa4476a61df954
SHA1 1302b03d9bb03effbcb550aff44353f0323636d7
SHA256 8a712e4bdfed3e70c994675ba049f05dbb2998ca0365db3c076f0a228c650b54
SHA512 64ccfacf15612c65013125024885273618d5d0e920cecac8697fd546f248d94f28fbb3183c9051cd2e91fff37ece6df916e402c98ecc559e2e24532ce3990472

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 16cca3ecd9483a8dc1ee1e158732bdf5
SHA1 95f702c766a75c7309b443b10455bdc97a702520
SHA256 e262556b9bdd867b6055f955200f44bf2c31c7e1dc1ade1ef401ce63986a9170
SHA512 1445f1fd551311839f5c50d267d6e7feb4baba030ce2a7a7f90c0ce9af3cb48ac49355b83de983da3c4557033b194d38b7f64aa447f410471a7e1e81c00f7636

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 5fff0720c46554b56e136eacbfcc1e41
SHA1 1d08332b6af08164638abe3a64934d8f23335b5e
SHA256 331bf28c15941abad7a47599d44ecfc9f6b786afc0c7d23f6171f1c1d2acfdf3
SHA512 89abe26b4cb529f3c7561b5430df143a4586c150688dbf16cfe4ba9004462ca244a48cc50c6fc80ce099df4c5a14f247469961578cd2f166ba15ee44d0c57e25

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 6efacac2d089cf3fce538d9f1b862981
SHA1 e10707aee20e9fdef61e53db994fadcd6717e745
SHA256 b9e7f3efff029dc59d37b2f17a5e5e42f8b1c12634c90833f571badf931d19bf
SHA512 f5b066b1881f3f522d645aef357eb8efa2ef84d5b7e7d8b185eb379621b445c6a1ac60c0082fe318ffe3cf2da08bec784bba46823a864d04f7fed3beaeeb0403

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 7e93f304bebd0b4a6076945c3464ec7e
SHA1 c14d3fff3f7d1bbba36fbd4a701cb4fc62fbf74a
SHA256 a2f36ef32ce4ec9b273dd4941cc54eb6580a134d54dd01f5933e4e47c115f531
SHA512 059dc15ad116395814cc93e8749cd7d2ac1cc2c8ed801f65c747dfddf2ec8d919a4920482141f7eab8220cc1dde435654c2d7035d18382f1b26c9f27cf3414d4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 e70932cd13d34cef5d1860519ad8f72c
SHA1 af71375b72cf409b93cd4a5eeaca3b6ec6927393
SHA256 024c9a433598ba6da029c38e0e886243f3ba9a8658db58aa6b4cd445aac6432b
SHA512 ceb105b5199db1a869fc541ad86b73de705b4263763292fbaf850d29ef16279e5cc0eb585bbabf120b3e44e598c1913251413f4debfe968674f95ca1ecd9415b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 cb462ea36a5f5cb0d268891444d88dfb
SHA1 7a30d7c635fd3ebafbd48ac0ea002642a7d9b8b7
SHA256 4c212344c94cff5f377f9741c9e6aa42a8bef3ce8b633328096753f66fba80c8
SHA512 39aef845e12396e030ac8352ff5549b92bd1131bdb0b67ba463bbd7c0bd3babb2363532408822169119039ac8154bd30fff655bb835b9505d18d5934c26dc6c1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023

MD5 081c4aa5292d279891a28a6520fdc047
SHA1 c3dbb6c15f3555487c7b327f4f62235ddb568b84
SHA256 12cc87773068d1cd7105463287447561740be1cf4caefd563d0664da1f5f995f
SHA512 9a78ec4c2709c9f1b7e12fd9105552b1b5a2b033507de0c876d9a55d31678e6b81cec20e01cf0a9e536b013cdb862816601a79ce0a2bb92cb860d267501c0b69

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3f0239fe3b8b3a720cbf848d43298041
SHA1 c8ba2ec74fda75232eb36c61d6a52eb1cea025ab
SHA256 9a2b34d8c56a7db1294da7b5ad2f462e3beca608205d7df316cb940f4e24a71c
SHA512 0e435aeb2a5069166f0ef0ed4eb06f887e3f9640314b281ff4dba1c62d21ccea6becc28748bcff62752672fd6ff60358e0f55b8747c51f5f5da8c2c92d97a3b3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 1783085e8a9524b46e7e42eafc30da65
SHA1 3f69ef1b6201333d89321b70a250d6176eac8347
SHA256 df9a3b4a0ae9a78a71142e465ee14b5810f8b776818c584e63faa8e2e8a7dcf0
SHA512 4a1bb2bcabd564492928720d02f844f028db48a6259fb609be9b1d800cab0a492f198410ba5fb127ab4b95954656f3eac5bcaef9d4056e0d650cde1314107528

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 662d660c6b200c8186f78054a27fe1ae
SHA1 c564be103f152d46c702d1efb84903679f15af9b
SHA256 7e2badf65194d990e60ce66cee18d6b3f81b5973ce2755faa912be9a2e6e8337
SHA512 5ea769d877ad1ef3b7d0ded7b6736f2ecd399d31fc5f6174373235314b1619db7af3eebebe877cbf6add2b2b6e857cf8a673f3e456f15ccfaf273bdcaae708a0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9fa3c7a60d07f375c9072cb177ef2743
SHA1 0cb0e99cbd3854c16bb9aed978fadbcd436a9cea
SHA256 333b79232b6e690aca2e3c6bae7b8470074c2d156fba0877f432e9f7ec4ea541
SHA512 447b1f27aa1212af995b91e9a2658a75cff4e195879fd3fbb9f9a3994d5d68824fc711dc7804c93bf163f8411e4b204885ca8fc97f794a522970c5aedcede9b2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 820b4455b726f5ba1ae816e1d9a481e4
SHA1 b1ce70ba9e86decf7e492b07aebae225274f8f3a
SHA256 8651d85822dbfa1925c783059999ae70bbf0f3920a00a8f3838699e332211401
SHA512 286a1b4684242210bfd8759b4efcd1143cd5c9c05a4e08b72a288f70beceb5943c03b1c584e7c1bddfc48c1bd77b3fb304ffa71f634254bf7186caf864991d4b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 b6dbbafba14b6f0dcb3ce69272a64ea0
SHA1 e034ad5870aab7da5993c61797402f362e022d1b
SHA256 1dacb025ac8bcad172b8ea0aa461f7080d8dd7afbdea9cd77260ae0630ea6eb2
SHA512 be7b5ed4d3dd62970ee775cce9b6a5074284fcd244b19cded7b968f04b6cf7447e04281ad4df3ed8a8fa18b9f9e5f6544049aca77c6509e099f5625f52ef2bcd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

MD5 caaa5222d179a24ca5540080c7018b99
SHA1 1f415a7a73a12a4c16f25709504f4e4e4beae9dd
SHA256 b729255f2e984a20fa0f0eb07e08368cf468fd17ff27a7d1dbb4042ec261d8cf
SHA512 71b4f878aa154ba4a8523c2e36faa8dbe3cfafa082b18796d8b69539dee9506253b9e55fc9b71cc2c9027d22ae08587b0e2ddadbc8d3395dbb73584d1ca1ebcc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 06e1a6678895eff7c81f969e9333a21d
SHA1 3ddbb85481bb9b46aaf5ceaed9663582ded873f7
SHA256 896ceb7149fa22827539e70d1c0a457ca1239bda157b4f86594293024dd0e8b1
SHA512 c155e9f5f884da815b880f3fe39f2048a2f73a82c10055522ec088ce3afe1f379f8c77a37a219a4fe70d2440747bd7cb6b0d2042ef7197e57826eaa99161af5a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 fcb625c2c2bee1fdedc58e86d8472994
SHA1 35ff81adec3f186c127437b39c7246ea26296aee
SHA256 57c18360e85be252af8700aceee3ac16f9249e45eb835ea8ac9c49e3c3b856bd
SHA512 2035334ba1d924d30dcd35c0123d9e9d37e4fc92a9eb48f7c7a163800abccf36523e7554a0c13f6e6329acf23f6cd93b272f462323abcac0a58b96ae7e932fd7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c0dcedeb4769ed6f3e866d8fdb0869f1
SHA1 5759709503563840df6a7f9e3d351b67ff884878
SHA256 e9590cebe7abaeeb7a2a54bcb1e1235341f317c188a74c456b1f8aff2570ecb4
SHA512 d05a7988f72ee47f7559cdef636728a9acaba9fc4906fe01313866c0e37bd76cd5269d5d0864e91779cd09c94702d2a58d34695512a0678bcee773ba3b804985

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 3560015ffccb9e535ff34e713d7e20ac
SHA1 13061343451725de1417fe4b76a18c60d7b7664a
SHA256 8041b4be3a9d1064a9e3b416cc743546370cc8f15bb652b7cb21c1b050061343
SHA512 0411573eb6bd75ce5bcb0ac431f48206daac8202f97735de45f5bd5d3ea8b2e3284263f30d140f6bb683e779d58348be793dbf7429c51fca63a4a6d9abb45213

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 029df4abcdb6509b085576281f7d7760
SHA1 e31b5eb4f98b1e7cc0fe66e0301f1013ddd73a2a
SHA256 523ad34e068137ad5a19a1769ea6c115c031a149419d04b1521928da2779e0a0
SHA512 7f174f080240ee9f7c9493f3ee44c84652075ac9f1ddb827aeda5d33d4efd9771b553682230d14f0390302ee7784f30bed6c79083d65ead297e606f721c5735c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 17a40a5de858ed448f45959b511aba7a
SHA1 8c182babc0d190549ec9aeafc2e553bb6d94f234
SHA256 0e03b4a75eb31ac7679cbdd849d484285f00661f9c748ad4f366c1fe6cee3c61
SHA512 5f37e2533acfacd2fa1e8ccc071a398bcc8d1d24b8ccaa44210c886983bb67e91d5aeeea0b0d1c55563f7af4f35e1ffb5cb655491fe596934d15b1647bbb1b79

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\9dcd94c1-105a-4516-80a0-474233cdb30e

MD5 347f9eaae5afa87c6d9f2df127ee726c
SHA1 dd4df2b21484d0f5e0a2483005acaa00dbac1f8d
SHA256 1ca178b4c00133cb88918935f266183fabc224959f154530d98822b8b54d1ff6
SHA512 7dbc13796c998cd15d1fa1299c0ca609cfa1c2d32fffac405cce9cfb78db3d2a6d417bc39168939137a37bc3cc9f8b141c58221b5ab808fae62ac0d9f43651c5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\efff7732-2bab-46df-af4e-281c831efcad

MD5 4d47d10556b3fbdf6cdda0665d1094af
SHA1 2ac5ed55c789283a8abc3b6844f8cd0b3c41a298
SHA256 811d078220358727e12150a376148c1531d862fadb0d79fcdde76f210f030578
SHA512 981e39359f578f92005f06e54bc9533466afc36856a668483ede6cda3c0cf4f406de0ec832ae2a8731edcec39db5a175f9a3f40b3ed47f2878fe458f297bf801

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

MD5 f25e5fa6ff00224d53ea223465f66da3
SHA1 d58f928b91b62f3598981decd69126ac5be10352
SHA256 91ceb6281da1dee51ccd2a2579a9c4aeafba8ef2bdc2a6bd3ea4432453ef0a1c
SHA512 ecabbfd2efaca590d1417575c2e80d553cd7ebceb4fa5229767ca1a849bfb3c214698a0f2062df6a588c2c8896bd756779df1690d22ca92949c9ac1082f4402b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 7f868e557b098795d645df9ea302427f
SHA1 001f3306144559b4049a8ab139b4139f51e59c0e
SHA256 b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5
SHA512 56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\1A46B60D72C2FC66DA7284DB961C95808BA84FAA

MD5 77c6714ebcc543303cee57d7831a56ce
SHA1 96cd823efb390d694ac418087bd913e127ba5fe9
SHA256 3f27ffc9a432e9dc63535061663cb0540c8295827d26e574fc77d1ef0f311b5d
SHA512 d3ccfbf40f7fafa2523deb03c912cca43a3da5f90e7a55a4ac5d99896c50487893536d65b1cf5dc4e695b3961a074b586f518e06680c29056cb9ba3e5a9e6b02

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

MD5 8a14c9623397f0181ab4b378cb179cec
SHA1 4cad02b719dba309b8576de4da158ee68eb11952
SHA256 139d3cbe45d48b0268666dbcf9c0cf5ad925be7b39a7720f8981d58b3527d53a
SHA512 f37aa2f5de0478baab51cc2d7ba4a5917728f1ba3d03617dcdc0ba06d2f691f00b9d5f99500f3e1f321cc26f4a48c5227cade16b02eb422d3c04f8692c570dea

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 75659d237671f5a6e9cf9578957acb04
SHA1 8142e7cd7eda8e5f877bce7577f4bb0618451f04
SHA256 0702fce3250882ca78710afc144da4ca27ba37f12e8925757b57235f5e6bda7b
SHA512 cdb484e5e6f60b7ef62d7978724680075ebef74cd430b3db2996ce23de0a1eabc7c81d1504e20f2468b1ad34ce41d2ae8018d7ad56f1480b9d1717fd0d9a987a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 77dd805b9d44f4bbd0f74d752cddab09
SHA1 7a47de8f9649aca6a3d988f75ea789dec1c1fe49
SHA256 f2edf99bd5f4b2a64a339213e444c302ef24a889ad438f654d65a77fbe8f6340
SHA512 5a8f528d8a58c03c2efdb31572fd589ce8a5b29f89b27a8c0b584c9c93aedb3269e463c0ec93bd20801011158268e58bdfd0029e7783463b4aa5180fa594d94a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\80BB96996C8133B0FE5E0D6E5EA21B26135E8EA2

MD5 4af193d40fa1db942ea96e58bf65a81d
SHA1 082540dac8a2197cea928b40d4bcb2d610b6d36b
SHA256 304b9f79ae864b05e2bc80769b37a36b5403f81ebd511a6877d6fa0a53a3b36f
SHA512 205e69ae434d08ae5f4bec4b28486ccc391153b284757530f8e6afcd1862d93a3a660190f769fca7f8ccb2d411347ca5ca4d588e3aeea77fb6eaf481a7976e1c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\5AE6D89F9E02E65CE57A707F37A56F985F9BE4BA

MD5 6c152c586048cd7b70fb142668b147a6
SHA1 dd642bfa41ec8acb5a51fdd5fd27f41b9de4b9b6
SHA256 cf331d2412f3210580c70c6dde58773607b0b9c01fb860a02e6680db67ffdf46
SHA512 f12d09c8c0c891f8b2ebea1ffb5ac948fec92407ac3513a82f80e8b6c774ba4fe350750a0f91a698f9fc7e9e3263f01dc214fb6abc8bd8dd645a5be6f9dfcc2c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E8254BFA330D5945BAF042EF8F887002F85E1017

MD5 ccc045deaf9b04246715c71e35797e13
SHA1 8a57222fc837920ab53c89e559adcec081d37e0e
SHA256 259de23b50ba24ed3b0465742eef85442b15c4226d34bfc790f3632b8188a82f
SHA512 f85391c56a799b17352ea5bfde3d5d857d9b457bd3853be89da401e5132fa388821f138fac379c3a92e1f8b621828ac94730bf9d59720288dae2beea88a2d97f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\46C625DB4964C00323A8EF4C60828B52A454EBB4

MD5 cdec039c79c76ac99ddb840b60a81c3b
SHA1 9397de4ae3fb56e72cacb7999bd0929d131de52a
SHA256 a21cda4b2676d0a30dbe27471452984a1f552b51428cb0a25dca2e21e0a05ce3
SHA512 594916a19c82e02095ee56d118cec7c9a67dbd2d4203cd7ea9917c4bcdcaf057bcc63aea79754bc037dad7ba561ab6bbb8cb944bfe591559252e642cccb210e1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\971254C7341460E85C93D0821B91E9985A0B32D6

MD5 30dcab3eaaa7921f8243bceee8a03de9
SHA1 48293fb1e23386ef44e0e12ceee3b616f63bb1b7
SHA256 e9973cde0a1ca78872a57d997a62b20b1f115dd8252ca3d6dace0c21ede1ebdc
SHA512 f20d2b1960de24353bc9ee06794e95e240b78e3210407005ac6ee0e48b1cb9f3cd5cfa0ca93f6f91043cd8c0bf5c045fca9bddcb1c5a7a68fc595b974a63e0d0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\9798

MD5 b674d880523b8b54f8c8e6215fe18ebf
SHA1 fa098067433284130327c13cd19a665d77983b0b
SHA256 f37604765f8468c4331a795d96eb907d5245b77ecb3fe7a045070cd3e5c83419
SHA512 173bbcc1f32021d686a367d442c3a20d57f4032ed9da41d75b2c087c7ca12756f5c5373dce681a9d08bd8a7899dbc025bc4892810dea6b048c3e53fe11bd0d1e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 6605876b882a038077c7e512a1f6e682
SHA1 bddf121af9af09a7e70e7dd0ff62c852ed01e8e3
SHA256 7a8ff8ecd1f7182c1e6d00e3f3e61810021d3a20a98a1f545bd1d206704ecd9f
SHA512 3d753680937488562bae5998bcdd399697619f4346734e6c327b5fa87198cb36af9e1eb7ce951849f19a8aa8214911bb3e7cf0b0900b7d54bf9b83b5eadd2758

C:\Users\Admin\Downloads\dwKXtq4l.zip.part

MD5 8ce8fc61248ec439225bdd3a71ad4be9
SHA1 881d4c3f400b74fdde172df440a2eddb22eb90f6
SHA256 15ef265d305f4a1eac11fc0e65515b94b115cf6cbb498597125fa3a8a1af44f5
SHA512 fe66db34bde67304091281872510354c8381f2d1cf053b91dcd2ff16839e6e58969b2c4cb8f70544f5ddef2e7898af18aaaacb074fb2d51883687034ec18cdd9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

MD5 fef9bfa49a4ee51b36f836fa5a1270e8
SHA1 d88b2d0a7be570d51f7b7e38f3ff63cfadf95b76
SHA256 3706362b0a3cf474d4bbeb217f5c3e8bfba13c2429d4c9db5bf59b5ed3bb9eca
SHA512 275664182c890cd8d416331e878773437c0760c488424e1a3e7b61325e2729826a498f1d44ee4b6825d3dbcac929c5dcd4908d895af2bc2d46a8e5b851ea9c96

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 3a29533446f4bc5dad219b395aa22409
SHA1 e142c47f20025ecec3a3ee39d2ce8a3727837a84
SHA256 357c5e21031b19f80ac0fb92b968ce28494f9ae4e398928243e27c2132a6de29
SHA512 98444c01342a63e390477fe92cbc016ab2f24eb2fb91f98fa053768e1e208bca4fed661afef8620372c52792ec5ca7e33904e1b17c75f72c780c065e5303471f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E2E20C73D6D4AEC5BF3EBB62DAC186EF0FF6E30A

MD5 9b81971cfe2fe5de5a4f71977566f962
SHA1 79d857edc9611d115302dfec738dfa763de755fa
SHA256 68b165a98e04b89d4d968b76fe12aa6a2f5720ac26615737b8ea91e078d66f72
SHA512 83b50dea4f85ea5c045be4de9778822965f6255712e1105ec23e3cd4c0b9338a1676c21e7522a9851cfa7b0cb3b1990b7baf025392f47064a32cfaf534c114bc

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\2050

MD5 f34500792860337f56efe95f22b017d3
SHA1 c33f38b070f0011d8db343565273123c36bde649
SHA256 27b2db2e576626b747ca2ef89e65274f221c5805191f5661f4e58917555078cb
SHA512 b04c615a95af63ffeb78bfbef0c1e1e0ae2402d2268ca0118ee24f2e02cd49155f421924773041f424800b89ec476fff82960d241b342c918a32c20704eccacf

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\22901

MD5 3572280c366a550d9affa9f94149c288
SHA1 a01c666c33067110f3c08385b1d39212975bf757
SHA256 9e3f7fb42d86446c846dcd0b8264b0bd1e7af15b0cf82f0dd0efa97625840725
SHA512 18b75efbfdc2e060f0bd113836af8c5576d588d6950c47b1c3955097ac01023a53a066325894bd9773350b3255ff8fb045123009fa8f311619d7d8c02bc285d5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 79c779bb2c337c31ecf0ddf7fff3c234
SHA1 5eb5a3e571059f1765839a1cabc9f8812bf3ed19
SHA256 8d9fc8425eaca2ca820b662d32c0ab823c4a1f1f80e2d9ece9fe72e45fb29b53
SHA512 399d0a45587a04dfe6821c8ddfc3585ac7dbe7aebec5fe67035fb8e051027cc1f3d78f9fb30098a05c89a4bae27341494693138b33d6ea947d7e2f57892f7f3a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\20604

MD5 6bbd92bcce66c66d4f3a1fd1ae068865
SHA1 45ba79d393a56b995e732dbee2cb56b745a256ea
SHA256 6e4fd0a72b418cb461c61fe846abf9b0ab57560e6b2b0bdb7472c139bc40a903
SHA512 7af29ac29d9e2205dac1e8ca5f3bd6161cfe240b19641f52c2163ace2b2ee61054b87f3ddd742c342be3f98227aca74090e7a75aa0546ff649c5e1bc9e06fc82

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 5ae8a060d9134ca863c4cdda2ca68e30
SHA1 2b169896d83091e46452d3f985f99a60aa2ac951
SHA256 6bcdb168fe7a64745e922e5cbbb4af6e341e30e76a01a1115c7493ed2a724c34
SHA512 934c9d5d1e01427db043b518c61ee5b303eb8a8097d310f4fc3a7f936e3d006e8632724f77919c80ea5ab85ef51b234d807bf2c22f10102703fed7cf76ca3303

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\815032008CC2DE0FB2140CB67E93D07F0E027B2E

MD5 447268c5eec62136c574333bdd86b74b
SHA1 e81b0bee07df11420c987abb621ca9f7ddb547e4
SHA256 e6a0903b3e45f0f88945da207b6c5dbebb3ba0f4b20933088a20153f0a767f4f
SHA512 0b39b1390dc46f2c4f440857b0e53b1595057fc00ba1fc3aacc5d7ad34dd8ff4a0f59d352f108a2402ef18742d0594fdbb201a32e209a88713937eeb070b2b73

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\25426

MD5 ad78da4a5a279530737983731505b525
SHA1 1580c4411b3a80975d63e730142a0fe693da0d83
SHA256 ac29f76c3233840b9f9c84ab5294374b2706238bea76fb70f4e2dd6261da332c
SHA512 2f7d592e9f97499aba56b4dd5adb751b624238b5d8f82fc149a192277ba2a66f638db039d4aaaff482d5697b85783be5d7797990d642099c34619771162e56f0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 c31a881bbdd5de90d13070fd88aafda1
SHA1 828de0e8f59c2a58f2f70718c3f718bcf85f2e24
SHA256 f8c5c7c99bbc5ddfc25cc4ea9c6b949f6d82f325bff9f6d021d31c4e0a8e57f9
SHA512 57f52507e859ab65e34662b0fa7070c6a2d37faa77f3fffbbf510230bb05dbf094acf45cd6807ba4c2526c69ecc88e3d595a93367f15aebd19489b857d74f77f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\10040

MD5 05af2093f93a60febbbf1a05df3857ce
SHA1 cb87f4a6108d4d46c34ee9e24c895bdc76df7720
SHA256 2892bff95b64db9be6d115c6c21595b16c852b8b238a9ff533174519479b139b
SHA512 74a2cff6b97383286fc13815f94d2fc60fb55aa37a25d34a79a531cb6184617dcd106590e64d04b7d2899bc930a95a25f049e9599f84ddc2a449cfc664682e62

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\549

MD5 6cdd2d8462c64c587180b793cd33a843
SHA1 cd6e594cea173013a7cdbbf6b2712e805e56026d
SHA256 712806c8b1b020d8ab8c5848d6b5794f052d418fc8ed1d17c8f8c5a7bcfa1b81
SHA512 7c7d8f3e98dc691d748c4616f187d2523ea53aa00b5ad675d980caf2a804043b514a0a0329628a65ef398b635d9442110a91c547b5673be7b34a0673d1f4a96b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\765D57250BEB53B4DA4F8C5BC2722666275C3A05

MD5 902c5d1c1d8ef32179d5297b94f45f68
SHA1 4dfebfa2f44bcf73bd04d66c41fed6c3951f5d8e
SHA256 4fe096e295b2197dc4ac6bcc96d1600ad1914f5d5527d06ea5c2d581d86e2c2b
SHA512 3dffd9e6c350d3e4b4c9a85a4725f44cb16d34b0cb0e97f66bce1d4a0b3e07be02f6d1cf7f10d33664842dafd9fa80d8bc931927335d311bf9d8d6c8020dc1e0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\15878

MD5 05132a29625163b149d3004f163709b6
SHA1 cd259c872b073c00d14bd89d0bcd26d8b7499544
SHA256 4163293e667f0255f5ca35a0f0368d6f9f68eae7a5a3c71539e3088eee4cac11
SHA512 774bc5380a5fad9c30539466db5d8b7d5351ce55fbb21926e60bf8985b1e4c594470d1a7bb796a861b6ec73436dcb1ad581a9b94781961a13d6b8ca430cc8c59

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\15766

MD5 7b045eb88dc838b1c66ad08e8ccea36e
SHA1 80985f5c93340e21677844e0246d1652733fe4fa
SHA256 1ef5458dde7fba6c85030ead00270e17b6a4f33c11e0eebce227522eac6a293e
SHA512 7913f845bdc94d51de8c4ce74884262818ab007d8c79f3f6c2dfb2e1017fff04ba8712138c6489b36c24d8cf72057f2d0c2084856c773fdeb7d2c6676ba81fbf

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 aeba159ace5276fd1342de7c3cae8242
SHA1 542d01387ec6fa421ba7b37862fac47652704158
SHA256 4e75e2fbad01c44e3e84b7ab91cf2972b74ae113accc1158e1bb0ea9a9cf1e71
SHA512 0857a863bc0624249ef8569b783a110dbf7ad6ae5f412fdc71a5b5d9ac2c85e43f72ac8ef21d7e022e95d984e944f12da08bffd3123902c6fd62366462d436a6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 d9eb8e5ca64f92a7ad6f5885e3749fb5
SHA1 d403d8b119ac10563258eca29decdd97c7ad4159
SHA256 466ac145ea2f8e6c70253d4ae9abb51ecff23ed4b264ec787c6949f10d4fa7b1
SHA512 669e5dff946e84ce2ce05544469cf5bdf6dbd52337a2c31bff5f4c28fc94dd6b4d772bb49ffb723f19c3e49d4a2e41bb2f7d3e011979aaf8c17c0e188a34ca59

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\393349E4A9EBA281467B2C666587FBF7031509C8

MD5 2b7eab06ae3bd4fda083c48d04431ca4
SHA1 3ff39d652d4551feeecbcb6fd47d0e746f0bdb83
SHA256 6b9efd1f587b757b649a861538f943813347327f3b84d11ba23c0398a891c354
SHA512 dca245ccc14c39fe00199f0db9762ffe4ec18a77e4aaa06e4cad1c95bcdeeba55f539e3ebc147486e9416c1ff9ab041a334af69aa6bc15f4f77aa4bc422b6ebe

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\ACC88C413B3874FCC9A7595D4FD3EFF93F58097F

MD5 bdef5ce79704b34176d04890b44484ff
SHA1 408f678d6ca482e21f63a589efc3319e28a1493f
SHA256 64eeb56a9c6820461e9bcc22ef939441241bfc79bcc5e2106f469b0ac59e280d
SHA512 75323b838cadcc95031011af500ca420ce1e28256461fcfd6b5994d01e48b5c99363f5e75db56e05ab4338527dd11b8a3f12cd75fa8d0d6ca0d7dbbe1a11b8ea

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D105AB5F954C0907C9073BF810F90A3C36C6D3E5

MD5 bef4bc0687f150a937f940e9cf3005be
SHA1 8bcc348382c58d4b038f4433ac3142bfa86b36b4
SHA256 0574b564fdc75b5614ed74ac7b47ef3d7c04af95aeb03127d958108b6a3166c3
SHA512 ad0f0d8b892d1361e9825e91e8944f373572b6b474289bde20a267deef0d357edd3aff38d3b7cfcfb09720515acfb48305383c4d4456f962e936bc2314ae4bce

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\23D185CF6E5C20331D637D3A6A6DB8C9099FC020

MD5 d3de33b233784e2d7e215d4a9b66d0ee
SHA1 e2678dc57b3d83b5686390541f5969a866edcc03
SHA256 5380fa5469408c66a84685f35d4b649546ac6718c9d6b92e0079cde314cf3366
SHA512 d0bdd6801efdf771313f1e97a82758eba89d12bd0d9fbe7537314e6a3033e111f81a1eb2f73da79c126346893b723a20272e57115e9bb6880bd8e54a123cae3d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E0C5DF121ECF3525D53C97FD85F4E7C455A8C7E6

MD5 b1b0708924885cfb0f55c75d0e6d52b3
SHA1 ee41e8a8cc245fdd4811e9f497779791ccf4247b
SHA256 621238282ac8e4b3d22307dd9b4fb16d98c6350d51f898cfdc437d8d40c307d2
SHA512 6c55afa57d13071f562bab35bd394dd98641f9600ea769689808a17cc8d642047d0ab7db59963498f24539593b77eb4fff309724d5833eed4e53abe45b4928d7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E2C670360AC183E8AE7BB834F8BAF925503AF8EA

MD5 570b83407482bb95b683678bfa5cd228
SHA1 fde9cb025a4ee973697e0f95b8f1b131b99b7bfe
SHA256 ae02c966386ceab473b8c4683c4933bb03d0eec23fa80cc501377b9b8466350d
SHA512 00d0191a95c1a8b65faa959e4936b3c53cc9a5afefc4d0d5ea5be7b65707f2d347fa1e3afd6423e9fbb6120b5c7e4bc4acf089791063a84dc0931f7ccb4f4761

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D6A712DFB6DB2312E41A3C1CB1A34A0EEDDECFB2

MD5 ba4d13bd62b7a9a872a2c09f8078470a
SHA1 1e819856a58bf727fe488d5d001f0b432cec2c24
SHA256 69c5d13c68dc653592cdbd6758470e9917eed1c54e127ac90618b46f65343f8e
SHA512 47cab776583826952bc705dcfcfeef4a7db0e50d0bf2ae362d041c70498847a1c2d5700e729fb21f0c37e1e4abcc8cb383335ec82ff3df550d06b792be3323fb

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\80285EC16EDB2FCB53FE4D6500B0396AC776DCD0

MD5 56e3c7a9b292e18c6757a8e88377c6fb
SHA1 d57f4b58cb0fa8ab26eaca2f9e6d95ad1a7ac222
SHA256 23253ad22c430bcba2ea9e7bbf7768c1263628f9d70fddfffdc2dca721bfea1f
SHA512 ed8613166cf18243a5ead70fa4f1fcb9794f85b64ad9274ad6f9678829f5eb298cc1228b890de2278e011ad9ae81174bd0ff67c7f94de37dc8daeced4bff59a9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\BD518506D48E5D9A2A1A812001B343D87149620C

MD5 ce7ca77936c271430119ccb89a370da0
SHA1 b4a8854056e626af0081eef00e5fe67591df50aa
SHA256 6867a48f2ec1f27c73e9f0ce73fa64a86c0c5d41b1b9121158427ece6f568ca5
SHA512 27b93cee2e320a6bb28e606fda828decd04c0a360fb94e26ed18c9f36c68cf4783eddebdfb9a42835db3cb0cb9d6001ad0cc90bb57cc7acf6a1b82fc6aac528e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E44D8EA2BB95FA202605B58E615B3400B72A14D2

MD5 f71df0acdc8b7a3f045e13abaf0d38b1
SHA1 39df9c85d831bad06b26afe884456dcf60743b61
SHA256 b95b23bb75ada3d4e7c73199563a9de638bb12d2f9bb64ed17641d8a2057a00a
SHA512 e3416d27a8887d372c601f1af51ba1375074e76d1dbaa7123cd12547adcd8f5646df0b7a1a343ee9862a7a089dc1b1c13d93222a8235a7e9ce89b78fe32417d7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D2764A516583A378D0BA2325F933EF3C538EF129

MD5 9dc1288de34231e1b259524e8515ff1f
SHA1 4765edee2575ef17c8138df9b6ca6e2e361fc9cd
SHA256 cde2cbdbd2be9749779748a19d8812a6ab9f5ccad258f0eceaea3cb26cbec947
SHA512 9b1774320d952d0cb168ed3f326e87d8c8d83a4d8bb842a7886e43d5437be1493041c376d2f8b92f09c0e74c4e741b94e8c670b4694c680824c1037d3539da8d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\DB5A0EBE1A53321ACF00C651D6975E2E297AC7A9

MD5 68aeef7bd92f13a8a2955d6bd808f3c5
SHA1 645767ca4494ae4bcf4e4a09722ce8fda14c7968
SHA256 75321c74d1059983acb9d7aecc78a7897a4fd380518ccec70818cad3683080a4
SHA512 51848eae593b21c7e83f893914387c29caa08dba48922af91c67f84667bdda94de2c599873fdf36672cf9f6f12e94584ac849559f3fa656dfb5a0eeb3b6fd95f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\20269

MD5 5592420ea220f36dfedf50181d654370
SHA1 4d52f44d1e79e2801ae6d16ed635900b3b0fc463
SHA256 c37bd1c24ba4bdf9ee096cbd97211db4eb1cb447d0329f36034e78e3b70de8df
SHA512 9a80bf2deb1b52e28fc6cbea6fefd4ebccf307072873f80fbdd69308da37a222f4cc48dd1c484afa1edcce31be18b8f337c1279f4f490b49f62398a20c6f0235

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\EE09E97DD8E0948021323C3347B34BAECD2949F4

MD5 f36979751a3fe9a60ea1597b7210b4ad
SHA1 fb9209f2cb7fa6fc0198c649e21a86ddadea483b
SHA256 2a53ee1eed5ef74737cef3084b09be963985c6d8f73d7e2fc9e4f72d79c6d0a5
SHA512 8ff1655c2fe56ae21b02339a58e53b0514ab29b28a8fb725f34233cc66b56d430a44ec57314b095e3fe0b6fa7be2cade25d95cb6789ee360d8c7b4c3ee9b4dfd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\45C13727B6DB444F70F2FAA20129C63BE433735D

MD5 274d08e7f30880584747ced2fcbdafac
SHA1 7fde5eb293f09b6d7c6d28c45fd7ec9f96ed9cac
SHA256 ebf4b91722f4bbb8a40cf6d089a177d43a69e963fcbf0eeca7d79c5dbc179a2e
SHA512 465fe32ea850bf887596a671d60b6fbbba08c3c2a3f51f7c8f252480044079eea9247ee4564019c409e19ee186c16eb14fe147e104f913d0fb2bced352708239

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\ADB77CF89BB7C3EACBA0400910D8956D4F8A5D23

MD5 ea8c2490ebcd7481d2b785c02731c86a
SHA1 d1f9a0887711eff7b47da418b0fce0bf7500655c
SHA256 ef68602985c8e1ad931c5b3d3edc5ec4bfc4f573f2b1144c8a5202b460b5c421
SHA512 5c505803d866a88d1a0e58a327cee39ac46da3bfc972dc265d83208366b4e035c7d4d33629a750606241b2b04034fcb4d2001fa9b034e629f89c2a33cfd23b1a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\CC781311EDB0FA207C7EA7AF0C720872F6DBEB95

MD5 b398befd57cc25885a897693f5dc730e
SHA1 b32afe71daf0af8565c66676249ebbb5632f2f80
SHA256 4f8a017aac61e1994389c913d3706296a499c7c894433edfddf6a12c4abbf0e1
SHA512 0fd3fdc6da709bda5838d97e8d20ff31a241fba3908381c96d06582fead93101f12f5b94cdb79ac6e4bd7b49871fba32aa142738297b1db4ed98a965e57c25b6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\BABA8E61C8FE92558A7F715D2DA535F3D69BF56A

MD5 ba3b1bd749cc90c6c11f995b87547353
SHA1 6db7681ecd765fbba690ba7a9c8e03f0c37aeeb4
SHA256 be0365471dc996ab507551089539c5b87faa3ad9bbacc6d7a4baee6cfe9bf885
SHA512 cc8f1a4606d1acf95027a28051ed5d5682f7f4c105bc8a43a7c5b56d428553adcd466553a81df549ff2b5270d285b5ef529c6b2dfa7a9a235d926927b7f4fe67

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\1BFCF30C19190141EA70968C6D0386B3A55376D2

MD5 eb85f972627a774a29238c9ce631a6a5
SHA1 bddec7ae6bec38d9ae8b4415f766f83229fe6063
SHA256 578d76cb0f2dbb13f8332654b950bd1e8c6efe82499a1496bf14df2c58d16408
SHA512 8f6b393cc3aa7b1294afb5c8ff93f60d4f4aefe21713368e2a11baa5dbcb184a5acffd0340d638f37dcea3ea46d3c4d88c45503b5086c0d01848dee5e2c2cc6f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\DC6086EC8F3DCECB5FDAB23100B46388E4B264AA

MD5 2cca2778ac671e0e551040156f80d5c1
SHA1 d8568a8ae0626207d242333a05c4046c8278eca9
SHA256 fe25b2683cd46ad8ebb25dc96e1255cb6a6ff88a4911d78318d2d0e4fc71e7d6
SHA512 79286c70049461d80a4f5f3c5d6b45d81341f51b2325950f22e73340a82d194f9aebda197715a60e38afdb72dd33c76c61eb2d9e409f02826a58bbadd3140b36

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\15029

MD5 bb1bd24e888b689321591aea080146c1
SHA1 12b0cabb085ecad59c11d1df081d77cbfbd23fcb
SHA256 86b3b3837045b40693ab1aa0a0a5fb0f5b9524122eb45309204fb207b2621cdf
SHA512 7e49fcb5c4ddae0af8f85261f9c9487d5ec2c600b0cdd3a2969da96f33bbe38c846e3d221e738c3a8281fc4b9bb8b2fa1feaa94ea1b898e685177ab59fbdb7e0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\6EFDA82A92369900C71C9CB1126BE8560563DEF6

MD5 6b6ef1eba194b55439aebb4be1f3297c
SHA1 419e64338e8db3660b57a721911008f1a21fa4a6
SHA256 169e46774ece78d3a4daaee331fc05112cd2ad1d9687e0b7633be9db32228494
SHA512 573d84e083ab7b486eff179d7a852823e7f653437a7cb1ee07925787aa6d33d7900534a0f7923f727f733a63ee12cad80c96fa7e5b05f6b62f491cc21d065bd0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\DFA4E2B5C773EDA329DD8B54C6F79039F2840C37

MD5 79921100640bf769e908a3b5f772493e
SHA1 b286eb5d2dcece3dda00377159ca713e4a66975d
SHA256 1417ee16f3ad29772949ad7758f5f7fff84373004cae243c218f204d1b2e6e5f
SHA512 32a7877fb6d947a0d41e729fb291bfc0bf9de27835db68191e78d366b125882754862778e982c156b1c1bd7a6b804adaeb9795fdb0e800e6578c55f818449f89

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\ADF2D5EF0C1BB874F4AE7D04803DFA0DD32D8049

MD5 708c17937e00cd6dbe3a59989b7f8b35
SHA1 4042b48e1212163f708e9a680890a515dc5b30ba
SHA256 9af976b6b979f7ed76c72a740f5b715eeeeae70f2e02ff04b9fd4542ae355786
SHA512 c37a115ded8b79958dba558da27c453435d23d4d9a3d3c29a15c559f22eec258f9c7b6ac60e2dd45ef638c6dd7fc5b9581945f9320049d8f87f118508319baa4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\332DAB7B42E4E5B5D349C24B9ACBFC244A613D69

MD5 ac26c950a40a6a678b83267432caaa20
SHA1 acf2763d4f58e25bb62c4b3f15a804ac44d6e21e
SHA256 446219ea81c98bb8a42234a7272bf7f819afd03ba1db7245ca26e26260e78fcb
SHA512 c531e55098adb7790b9578f68842d77c7c8d2795a44ed52fee7086d6276089f100f32e4897a81a2be4fb7b6b31dae6d3bd5ef82b77fa95f921331733fce95bbc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 80fee73051fb816af5fa46fb491028bc
SHA1 4fa58063db9e9df20b4a816b19275d88e8b00b0a
SHA256 488e5808390843a8831462612cfee4c7f2181b45d934b8812d4b172ba3c5a85c
SHA512 5de57e366b8768f9b11df34da8eea53b5911dc2d7c3a081bcb9056b39a08c2f4c60e6bb30fde1ddf786a4e9ac356e23d45535d726b426a0562253c46ffbaaca8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\B5F2F7ACFFF05E3D8938D7A9D81E8C781FF35A11

MD5 8fb2901754f8d4bbf9fb1b6b30433a4d
SHA1 82f70867a8673176455c59a463f2603d39973ab9
SHA256 08c20f8383ff04ddc63949c8dfab1a46abf9cd384a49572e4a00dd486b0cfbef
SHA512 4cf732423ace8736ed6e89a73ea75a3da60981fa580d29405e33888c092854b92c408c7638f21e1da83f30ff72add40e66e824cf68e8c0610a353198352bd34f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\ED0304F6D77364A15F9797560C1E80C8DAFBAA2B

MD5 ab34ad4fef3ad33eb0fde29b559e8e96
SHA1 2c131d364b10919f32fe305fb799a21ff3054309
SHA256 fb6f65d5d662d708c529564210355e10839c5043cde83769c57dcc820014277d
SHA512 23d4c837e8e53d2408847fbc110522518c48a2ec277a0f3e5d450e521812b7740b5ec778d30de21b630993ea38ce9d711d52c14705c63ec0f748d568dd4e0e44

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\8873CB7654FBA9A1281342851ADA8BE26BA50890

MD5 2e1aaf581ecc2e064e6ceb85feb625a9
SHA1 67e82ffb515d98ae6327ea51ac77e730495c198b
SHA256 e7f593ff8dc0b574a4dc851f45e2d83a3bd834aeb90294292fafd367c571ee08
SHA512 721b5ca2899f3c3a3805b366fdc64782303580be4f2a68ecd89069b087e43fbffa2c4a402d27a4459e45656cfefb200164d30f73c0c98dd82de3eaf7c2a93987

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\54A808C88ED49006703F385F9BDF45C040F5D7AB

MD5 60c985b19f821014bc9e3b65a3f23e5a
SHA1 d6b62c8acd6f39200da29e4f13dfa9f44751b66f
SHA256 764f3b3e7b26743495941a47c48d16d036b8525545eaccdbe2dccd1aca49627b
SHA512 5c2246ed74e94c3b03bf77f12784d432305160b9ae8564ab63cccb3d56338ea4d7b8f892f45492493e919ae1da0b79c023efed40cfa8b4e76cc0b0b46dec090f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E9019296F0247A6546BCB5CD821F718C6B0D63FF

MD5 de1b0a47e9fd580b0d722446430436b6
SHA1 136a50c872c976e61eae79fdaac0c86d612e7c22
SHA256 c83665b973c2895f586c11c5747ef64e59a93272dcde78c201e887bf188222c7
SHA512 4ed131b69d98ceca7b96252f5e62b25f5a1a830cbdcf3590ec155430cdbbcf56b1d2be30241e043a9f0edbc00d9979bab5bead3e29fc46b342e9172ed8c32d53

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D8444399D71F2E332C7BB879D54DFF31A4920DE1

MD5 bbf76d2b89a4333af17ec99f659d9744
SHA1 0a35fb9a62bb2d95c29e4f9385f0834be34f8838
SHA256 bc8e12f2c408546e883d4d0bae7db26fe342ee61ced90466ee4904f8d660a97c
SHA512 eefeca975600701e3bb2dc4fa0a64becfdf48fb910b1286b51d72a4dec42fea857282589339f259bb9d6010ba0830b357abe34bd765c9cbb5bc6045dcabc1b02

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\AECAED11AAED324575BC1E4523FFD8872AA0DB2B

MD5 b2b1c3334928c8762a893e9a02ee305c
SHA1 6eb6994cd8285a4fc63779ef8cfacb8038f7b196
SHA256 217738bc80ced2164b36e01821396f43d60310ade614d0c0ff58352715447314
SHA512 beefe7d6f14b974b3c08232de4bf4fb5cc15bfeaaaaf9baa462454f75424094a0e3eeae1553d9991d10b522892318a452d1eae52cc299b0b0c2e23a01211ed83

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\4D96F4B17859C6BA64F6BE1867B765FAA0AC5B19

MD5 f7f781fbbedb61cdd3f0404fe3170815
SHA1 4542249b2044ba2c600250200a0af8d1bba382bf
SHA256 cb6bccfa684734a1564004f6a86e645dd5f625cb727c7f5564a6413a3a709de7
SHA512 3012d9f018778f038fadc4c9d30597bfacf60d8e17d52f740db59b67117cd7adb9ec7e08f634f65778deaf544db02914cee34afa42bbea8b146ca5812c29b43c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\15F7446E5DD8DECD245306021574C42B915B764E

MD5 df8064833b5fcbcdf4bec57241445abd
SHA1 4085bac6ae934bee70142c216e1029a3f55bf11f
SHA256 1489d6970180e94ab57d311521f54bc203f566006dae6ac00eb5e872cf38af60
SHA512 1806212e69e1dcf78db8765c061b1fb7a75e57b8a6ca7f16e5850eec13efe3c606edbe498aab08f791f29156477849f34d307dfecd66afc4c5331d93b7f8b16c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\7191C8A86FD4657492664E0C549E01B8046FB6E2

MD5 f052ba06fcb152fac4ddeaac69a5091f
SHA1 38c8aeaf69bc165a4ddee155b28c64d116916ce7
SHA256 7a5974aca23ed1f9269c62bbd7e30420edce0460fcab65f72073dfd37e83dea1
SHA512 9930f4ef35eb3da7090b87e15f6e9bce1987fa693509ad82e3451c1677db0e446244b2c786ad62db23ba0f92ce55efdf9e043eccbc10d21cad0a5846af277ce1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\B6C71EAC180D412BF4235734535BDF1FD0298A61

MD5 2576c6003ab02bc449940ac5302334f7
SHA1 6656eaf669ae6a048c3000d39faf8f33071e88be
SHA256 82ae3252e810fb312e59d842c1bb3cfdf0a05895e16be3a6c008a3c8231d40bd
SHA512 3ccef6ce333b25938238264c44e2ef27a32a7a1fb18b5c9539937b51b186cb90ce4dfcfdb0a4724c34b6f68e425ac2a818c6b564000ac9a8aed5b2f57d25df37

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\ACBDD9F6105E81C99C7DE771E3750631625DE7C9

MD5 ada224ff9199830382764d98b393ceb0
SHA1 6bbf43ce24532bda0f72151c64b595905b2cb5e7
SHA256 790854fdc77e34b063ae632759b4c03e022ffacf8a6d516faacd309b414944f4
SHA512 0ce131c3a7c8ebf4230000ad0793cf9059d567993e8eb59381f227a9b7f3daa9189b92506dcee08f9f3cc581b42776d51ba4a79667bc94a566f6e9e04e125230

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\20482

MD5 d113653a87846bd76c9ef63c5e394804
SHA1 8ec4bc221d703dc87f829e51ed2a58b1fc822da5
SHA256 bfa6ea5f12f9d1dbddf6f442684cf185a8fd493307aaccabca988ba4fac04e77
SHA512 97412f6c12f14616c33b82487e3b8d88d9d33c732a4a5c563952448f126960bd5617e97fa4e3d1c593c971aea39d7f6e5389983df1da9ed7cfd57b53871e889b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\5A2C966AFB2121D15BE35DE6A080FA438ED71054

MD5 b9692fd3ba9223ccd3f900398db13680
SHA1 947505d88178cb4e1df3fc84c5c16b15befa33df
SHA256 306f88bf555bc3c9e81449c586f9bbe8698423b0997251a032e03e7c24457063
SHA512 99df857ac4f1ecc84dc64767e0cdb969c8fa96e537f7a2810ffa43aba8d2c03b0ab3c7fd37276e909876b9b06797d63949d27443965c9faa2e36224e4f4b80ce

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\7DCCAFC1365D206666565F856BE1D8C395E60E9A

MD5 e834b7d33f83d380c21b245793f77b32
SHA1 6c6c03da8d225eff903ec32f83db8a123e192b9e
SHA256 49e11988132da902ce9135255a5b26c266745e813f4d99c586b7b7487f17bf93
SHA512 88af46f8f9df7b50a1037225662fb863b40352cdf19dc051443b0d5a2fcab783d8fcf84d424598c14c7665ff026b06ace885c2bbe04bdea6567112ed940229c4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\1700543EFE3FDD8336AEDA53B92CF1F0341F07E1

MD5 d5be7be7db34cd03c3e8835a7b19f3a9
SHA1 86e2d3073718ad4ebbc0584936bf3a79ad190563
SHA256 7514a897f809c9526bf433e9e196e14b00228f19ac4cc2d088451d7899f6073f
SHA512 4b71c6cc96097eadbc8d6524ced67a93744761b09496d9414751660a51d392ed281ea313c8488e920fcd341df4b4c40fe7864e431d777ca9e58581387c2cb9bc

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\83F5A1C45CBF5DA2EC9AA394E3194AF37368CCD6

MD5 60c566508d65e91fb03a03848ff98ecb
SHA1 e12b34475a1074905c45a4805dc3846f26d982a3
SHA256 17d1c78eb16acd85db26fc19deb9c1cd3dab4f9dd3bf53cd719967dc3b51f847
SHA512 c783e095b66a9f0a067b6b7695ef053b6df7fddc1c7fc81f5ef92314830481e141195ccb4d10d257e7346c07445dbd026a3a8572520ac6ad9d640e758ee53d12

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\3249E04A85B9E546A403E3102056022135251F2D

MD5 4c85545526c2ee213ce46fd6cb57c859
SHA1 9fc269324d122c7885ea1f0baf6f795382ea67b8
SHA256 a1886d02f973c7034dc0d61c97cfda7679287fa08825a80c23e673861a32d629
SHA512 72136e41ff7681d1725e12dfdd95990c92a98a6efba44dd545df25fffe3a2e738826c8422e71387b5a1a38e28ba32847ad80df1ce219bf526b00f680d51f7720

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\events\events

MD5 eb278f8e4614a55c053e3640cbac2f24
SHA1 2e9d91466ac4a9bed532a6b2e11f242afc096928
SHA256 30272c181f77329fa2915a00e97a3e1fcdc4c0b9fd66e2fec1ee3823923e508a
SHA512 3400abe5117c5472a4e3e551f307e92530b1addb8aa9d670c2b1da6fb81f3585ba17421be150e043904bb75908c87e46f51944dcf8781e8ac791fd7382517ff7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D91DCBC75ACA3B74B9064DF4DA63D61C3C8C39F2

MD5 ab238017ce979dae5e9b8f2c5d44cd6d
SHA1 18f5b6f713dde7ed65a2060849b1e1b032b2fde1
SHA256 63dadf803fb25b22e8342a3200d038238a879b50c95654ac1b3512b3f8aa926c
SHA512 4c9ba5c35fb31ca264616887d00bcfabe417e873c22bc822c945f652c2d11193262f019fd7cc82dc5f1f3e3616fcb8982867c194bd4c5924f8f70c27344b858a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\BCACB8DBDBCD64F192807A78158BC9F7B07FA8C8

MD5 493b3774a6c858d2294e11c91cc6dcca
SHA1 3e205201d1b2156b5e9848b91782caee6a5265de
SHA256 f9f6a6659b9d459b5b5fbdc4c1cc7a681e81b2599d2d111afa5f7b8beed61e91
SHA512 67b210704f4abec22c32785216e5e324ce90eb17f3ac88aaf866e035c93d8f859ba2816da565d68220b296c55fa7e06717f82fc4a9804bd21bf315c96897c014

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\0EEFA6E8FD25053ABC063C8A23F8ABEC30074379

MD5 8bf4ce41b36e9246bf7d46b9a718e7a5
SHA1 3ceaa92d7b2cdc06f597062d6f546af90f27b4e7
SHA256 39f89cadbcd59f0b305f39afdb5e73de3e98ced1a2f396171bc18db1fb87571c
SHA512 2cad3a9944974f904c0ca6f17e60b8bd973fb93a9d215d965175b3ce4744d6f3fb28d64919e95363435c77fbf0c4dd7cb23121d52573dfd4681cf980871f2f9c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\C99EA98A5D9032D2FCAB011415C22D8C4B356154

MD5 b1ab36ad3cd8a3bce19cd55de0325862
SHA1 226d80ebacd5887179b714bb39e86fa0822d8383
SHA256 5fd6dd3e8f878933e188b5b2b096759000f8c5e16060eed4acb611f535939004
SHA512 ca7efd753d8d849980e1fd3fad88e8d4f1ba2353411c013f0421f0e2cf1767cad660ac67c6bb4f24fa45166f349acd7220dfd02c22d9f9be300ae03689b7d6ee

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\89751F14315B5A8187805B379FE4265E13BDF9F3

MD5 880bb7e941b056125819b399fe909aa8
SHA1 6aa67e6c7f327ba861a58b2f4fff0d12eff1a194
SHA256 52ee28c97d60f489c112741d9a1e5182ae9f9d559607abd205a8465fb304d1b9
SHA512 12d139f46493506357b61e7573898d2ef481ce6c2c10adab659a678779a66f52a46b12762cc7a69721373b4c6f7099e9d9f064324ab04ec2ee384e42386476ba

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\8087BC626735FD0593014406A37E70B9A7E52CE2

MD5 9c8450a299ec097bddf972494e31174a
SHA1 49228dc36581d858b255847fce94cde14e2637d8
SHA256 72544678dfb6893ed2c12364a011421c975a48de928760f873ea165af6bd03f5
SHA512 e6409f3d572e2371285229fe11e36555644544773a1941a594316f1f7161de02335b1e07fdd0cc3e8b4ee1c00205da24bec4e1c8a201d7b30c4174042363eb23

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\45B3C58F902E6DC4E91D2CD7FDC52DAB4CBEAA2A

MD5 ffa856decb87cd6a024316f8e7b3396b
SHA1 cad4592acc25a97395f64b1497c396732c1cb833
SHA256 6394cec3bc41b71872493197454a2ab623ec9e6a75001bd5b46902e354d45b84
SHA512 50396e704f1c70f3224987251d5d701fb42da16de254dc40c016b56b52b6f7f9f385c7931b552a3b279301664bbffa646ce9d3206140d2d53f4765e32e116f0b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\9C2F5D539018257D3AA809FF22F12E6D1086DE1D

MD5 be89d03405bc4e3daa87cf2138d87b40
SHA1 3053ade28fd319487fb417a23c96d4196b21423f
SHA256 0e2ec608b8fdf4b1fec18b7e308b4e56f79bd1f98107f0707e2315ff5b69c7bc
SHA512 aa210e0173ae7427bc76a0c05fec7b89524ed707b2bdc5b85c9c3741f112d46b0285561daedf5a3c31d751b256eb7eca851d067976ca448dd222a662a91f0698

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D9D17E89CACE3C58E7B0BAEA0F4A935474EB3FA5

MD5 74a9edf85f2e90fab711a6418ddf8241
SHA1 16392ef68b1b8d9f4ccec0068865129c0c6996f2
SHA256 7bd82c6befd07d121dfd3aadb5ee3f5244a2698f9b4f87e991cb948e651b20e1
SHA512 2488f3f5b00627bd9619b5ed63f5d67d842a01a53cc923b62b7f3d33cc55872ee908c0bb38ce2a7d881a64678e58cc38bca8a62f14d587feaa4251036a1afa1c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\A955C4DBAB0484FEB6B6510F1945CC6B13BC7ACA

MD5 43f2eced0f8a5bc5ca066432c14566c9
SHA1 3344ece0a6f2c599b4bfa097e77e9782f16cf612
SHA256 978462cebd2e275a8219c50ed2ed33f85de23f03bf1a73072c71ab50470b074f
SHA512 6f4adca5dd22cd3650234923086c4ddfaf17f95ba6d2a6a8ba48151d382962b0a4bcf2012d39fb07346965a35070d558515b7f13aaf05457376fe066666f7a70

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\CCE1C627D4C52CDAA0B852B84E77EA973DF81D73

MD5 96fde258764783f7ddf7900c10a92510
SHA1 d61e8058e811b1e727aaadf403f0f3a3ab722254
SHA256 dccf070886ce09e7359f6b38920cdf41e556a0d2ffc35dd7347ec4dc6c17dca7
SHA512 27151b2ed71ae4a5a4737081bbc6093133e48c63a55b2de49f668950b978d6b846499d8617c55392072b11e30df82240a345c4e6531ee5bb477debf7fcaa1d68

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\93628B06A5DFF74BD4A344CD558FA5F28618533C

MD5 eaa9e7ca6e2645c7c3aa0d734ae689c5
SHA1 9dd15540643548584f6074d83ae0ad04a42b60c5
SHA256 88643f4b168bbcc3539228e1ea3b0e5dfed71c3c63704b71051bf4bd4e95ac20
SHA512 c970717aca5db61d6e06e9c72ee5c53606d1d736898035be345f5a2382ccc78f398f8a25a0787a1956493aba6e2d271acdee9ad0138a18d2dce63df2ea9c49be

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E9FC0C2DCD87A95C50F94F06B94EA53549DF85D0

MD5 ccad224fc9a595b9f6deb6f3c30e41d9
SHA1 21b94f224b2b799d083d1940f854b892e5b7d612
SHA256 085b1e00dd33841e514995c795e94e8d63fc473fc73b4766185061e41c273749
SHA512 65be0d0b13257f64fb7e6f90c2a9c3217b39461f09f61e61eb7446ac79487f14ce735003ce40e484ebd54c4b18aa0f87199c659b04173007ffdd3548ac4f46c0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\47C337303E0865EA24B4F5FD62C57282D8FE23FF

MD5 e1b02d0480c1c5b5065af36895547f27
SHA1 9529bb43766fcaa551ce0d5b41d965bb70ab4b69
SHA256 67afad58383c30ba5ee6700e1161b7f5c82a66f25586725a5b7267cec8b8f28c
SHA512 4647242c25a76c2edf8bf90c16f2b227f08a54259306313079a32476e575eb7635896e145609c437b4c7e0c8cf70937129d4bee7861666dc2969cef9c84180d9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\5C541E3FC78A7BB6C7274068DB833F786359FF7F

MD5 27f9663ffa5cd17c68b2d574252184b6
SHA1 6929090742209b261a3d611bec478646ae8cbfe5
SHA256 647d013c7b525d92476b6dca9216749d80fa5fb1e4ecaf52c3b6a05ee15b8e13
SHA512 b3678d712ea09546cd1bf01e83fd1905be58a190e0f744f4ec1941750118ac2cf73c72bae348dc2c77b20c5e436226e417c06df070850dd4a5e9df5d2dfdca18

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\47A3FB15B3D55971630E8F674FB9BC2A78BB56C5

MD5 66f96769072b02262bb4f2fa571013a6
SHA1 65e718d89f1e6de985e88c06bcbe0b46338ac41e
SHA256 eae1f8ca66fcb41e2bb017e579d421f457dcd558d800cbc0481989ff04c3fdfc
SHA512 220bb217082745fbc1283259bf784a473a57d7e6ae018c3e19b744d349660174293d323746f2c72f7c4ab2fbf7eb0037822cb03c0d921722168b7a3e780d66bb

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\93A3F61C53110DFB2A449EAE79580128ABAB08D7

MD5 c77a5774a6deb7920f6d634adf6b9ddd
SHA1 e3196a62afe2c8e7272895943cfe663b93a95d97
SHA256 de55db41f59c3fa27d5644ae0b4da21a82e7cc6d2221de0317fabd1503c8cf32
SHA512 89c823b6e7a0b137c311aa8f682577339b9e89c4eb0c8ba100b3052f7f32a8f08915f2b78440f3d416b7db9a065bff016772b25bdbb042f90b2e87b848f88f90

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\BC892227EBB982466B272FC2F0056837623ACABF

MD5 babb8f580fbb062cf23768fd046126fe
SHA1 3e444dfe791ed8435732ddbda9e861b79704b0c9
SHA256 0f9bda061eab1231d39f743bec371617c95d77ddf8a899d9e1c71990639579be
SHA512 61e95a954eea111d6fefba9a27c9aa09c6a1947fb1823edae2023349be7f17229c67e228e3229183f56c843f84a566c4d28bc0517c8433c6179ecfb49ea7bf01

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 d5a5ba186e09e761c6ef04c841d59de2
SHA1 7a1d1b9475bacb6d8a98f20beb8942fec917e74e
SHA256 7c48f06424e79c379ee0efa8b85005a7bc6606b0b75162a00f426e4cf366ae25
SHA512 54a29f8f5114a9098684235f4915c1b636731f3323eaeff458594d571211f45ee0ba602bd8c17e5c8a6bf7431b1803ee22cbcae38c42caaa721a3f14ebf643f5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\10158

MD5 e48606d55bbc743053491da249a8f278
SHA1 c8f2bbcfdba138869e50da1ee3b97b6f83838c61
SHA256 f3349d10c98cc6f63c6a2e1e4ab17d766353a519e2efd353c298504efb43cd69
SHA512 1b3f1bbad17db16cda03d78f657f179b95b15e7a924acabc482edb53b9aa74437cdbd596402a1e0b88d77d4615877e004ec640bd84a283c0e59780ff506e1369

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\1995068FCC2F18290C959877CE6C5870F9D99980

MD5 8d526efceeba6070b6d847770ba3a6bc
SHA1 966c4dd6ea4aa21e9cf1735b4dc6a4d9dc806cbd
SHA256 1c6fbfe451815fb512591b790adc49783b487a56d8d5aad39dcbb79a96d79ec5
SHA512 9246941d86381935326444892b8b9bec2ce44c2ec362ba7ceeb2e9db934b1e7a5a326dff3a10e92b1f6e39383b06620cf80d597ae6d955bf7d0a0a0a3be8c5b8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\6892374BB272FCC776A8FA75D87ACF2F24428FFF

MD5 1205ed248bc3f4657b745d97c888bdb4
SHA1 c2a82c72c6f06cb628bf1a41f9423f2f8a4b2e77
SHA256 b14762cf628752728b438859565d83f28febc52d9405f8c7d0b27c3ae94ca10e
SHA512 254a75309129fce4e8864613adb2471f156911aa37af24ab101887ff06195fc9ccd13933967eab2fff7f867267996d249e3653d6d858869113e11b2380fe5d51

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\F63C822E7AAFC0ED25190A22B0F0D8103B08D6BD

MD5 e5acb70ceb2e4ff4a6acdf084cd456d8
SHA1 2b6ebd27e16315d6c155d97f35c55c397da683b2
SHA256 f32838966639544ecbfbe1a57f37625bde5eb281fd132df30afcb2d42e720c67
SHA512 e2af76ea64438f62becf1fbbd759aa672f54f9011afab41bf03b229df7d640d56ba3e193f93b212174f41df8efdd5be0af74d5696ab2b5d7eae5e41680c87119

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\14021B4F90C64F8926972A07525D347801137726

MD5 05c2b0b52adfac2f143f009af08c9a32
SHA1 29e039d82a6ce7ea994accaf30c55dabf8142596
SHA256 ed6bfd57d80280aeccd5ba5f1c6485d41910d7a20266528fe2577179bad74a0d
SHA512 08ae00f3d5c751d82c8269693baad2611cae807203462135d4d60b7cc611c59a20fd0d7da1ac5c6360c2c5ed36b535ac5da7d44f253fe43104268bd63d13b99a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D964636302D374DC68C4DCA2362B6B75D9DB1ADD

MD5 263918d49eb8bb02af54c33061af4bc4
SHA1 73d1c27fe9e09d8c1d3645d8e49f7c5801fdb889
SHA256 747c17988b57bf9170aebcb40d1b0016e9b7bcddcfb0a53cfa1394b3c1c4d5ec
SHA512 2e95e494a3d3d14796a2e663552097259aa697789816624988ecb2c11da47c6ef8a361dd5bdc2bb75be6cd901f8015d68e396dadff12a3e3ee4a8f0f6e5ba0e8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\91F31F756AA32DC0823EC30502996894D0DBC749

MD5 6fc5261b910b3677c753af8c2d514b4e
SHA1 087b16a4bdfb71e3cf40ae77bca1babcc4ce42f0
SHA256 bece9fceb8c16aa5c581c14534453cccfcd8db0faf0f54a073c5095cd48124d5
SHA512 9fd79a95b0171d98cfd2a95d31dcdfdcd3ea2de0b536a5e22cfb928ca1c8df3fb318bd415e902c4f39943250d10bdc5542ff93200270b7dbdf5718588d7267da

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\322C58D9FA1562D7FF036EDE528379DF7E825D4C

MD5 b0138768cf10adee1c8d5f0a7d4792a0
SHA1 5b89edb68389d45478550462d88f494d72ff557e
SHA256 64603359c5f10e467bdfbbacf567b5d8c6c6a5d71abb248c130443ec0bd15eba
SHA512 779a1a53412211fbced93c0045e7a85e764e2d445581d40e8e1994095c841b13434ab1dbeb81c60c8f496560d3f507bc82d05169a4ccffa786e1c4c90537df5a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\C344C03C89AE9A237FF65DE94E9583BF03F2322F

MD5 741ea1ce72dbc4d9e58a559dacee4595
SHA1 d92e39743359404d839ceff12916353119f0b935
SHA256 343416cceca30f47ec53a0ad29214563ffa86e4edee7107aafc85839bfd71e5c
SHA512 22891961f9a81f26120a75e61fd76bedde79ceb8b7d08443858b95c94d1cab4891bd5caaa696b815be1b2d4219f80a807666365625884d232648845b90a90500

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\A6C74BC2260EAFF823C7AED38BBA607C962CCB55

MD5 8a0357163c58a09feea97d9a26c4856f
SHA1 54c891ecf8403e5324ad79f307d7f2a87712a576
SHA256 1addc2a148945e62421a646de5f68fc5bbb0879cb2eba7676b829108ab6e42cc
SHA512 fca692e1442b0a1831f70ccc5684bc0b56246c9f8609cc561e733571e04cad2bed751c9368fd2b684c2ee6d637feb6a0a55e810c084a1645356022e1c2632e97

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\A95206317004A553F0B88A71BA88BF50754469AF

MD5 f4c8e105c0842eb10d22705e5a7d4d17
SHA1 106414ff84ae862d7a2f5e823fe3c971cf4d3ecd
SHA256 21c8f3c400f629debf20eb41f4279974feb96cb79dd842876a26cf8f6d874e68
SHA512 012afb10be42880c25178576e89825c630a3f7b92801bc9d8e9652faa2c483059e4f50e1dcd929dee96b9deefd55a9a0376abf7101cb27fcd9d05a42c46dd8f7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\BF27C7E3DEA6587FF55C5286DD19C819E5D73D43

MD5 80160ef4724d153bb95a8f1ccb7c56a6
SHA1 6db7718364544758d0041d998eb32f3e68a0f8f7
SHA256 7e7f8434e528a7facdb08809e2097c19055a5238d720f2005c667a7c9842d458
SHA512 77507988e94c094615d678f829dfb0c9c198b02a863b9af904289d55dfd2855dde928e1ef02665a044caa11f9f33318277019c262a84179cb9010c33865ae153

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\5B92A2A9BF63187E9AF447D8985DCABB17D8BC84

MD5 1b6d8a637edeebd6bb341a095656fbba
SHA1 fde96d08b08180ba533c5c5e5a7c1c11c3fe39d2
SHA256 74095995ae452dc864c3e0fb6b04488dcf405f8ea0c5a06cfa90db1fca1dc7bf
SHA512 899c150a3d5c593baf76a7804055b5d13c1fd905aa07b55554fca0833c13815c7772c8cfbe56c3d3074b593e38802e9c4673efda1f2f2773d8fc18f2ed0a8c36

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\998D735EF9EE803039B62430D297F570047A8584

MD5 95d333bc836cd204cee5315386b00b2d
SHA1 53b0f89f50f463d5b407d045708a87da004cfc7f
SHA256 aeaf34a817b3fbcb28eb858d5e5448f4a8692123b32e0a9debb11b47c9c55184
SHA512 9d0768c0336da885e840faa040ee7f827ea99febef847e31e1b423e3b50e5f5af16cc38f6906b2940c53ce8a135eca72390df8e4f6ae88be0224e386b6460ba6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\BD8D87D76514649A5183FEE4A5207C7949024802

MD5 28265998bd2bc364e2046407737c2927
SHA1 8022fea48e1b3350283951236bfcd116416fd303
SHA256 57c914b8996a702c7d32bd2227de6bbb414e97075a794634aa48b151c4b3b5c9
SHA512 2962c6a1d1c5260bbc02861fa9c36ab5865f4540811cda16048ac1a5d6b4b59be932336ec5a587294c7ac9ef4d050e6e9602993ee883364cafae8f2e9a392ef4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\44836238049E96471D6554497813EF38374771D5

MD5 bab22ce5b61506af3c802121696244b3
SHA1 490e6708eaa6ff3c95a3c28fe469af0804698d8f
SHA256 c6beb6f5bf64181cbbd570b766884ca223a3a4c14d0ed7d59e98fb24f52fd6c8
SHA512 f29a6b04d2f015cf3531f4b61c409073d49a7c2d77bc38ae0db37353fe675bd3b6643b358a6325e655fa0b97f9a1f39c628c6cd52071be4a1f2b6c3b66f82501

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\8107661E821032A9B67FC2BF2B10824A0EC8E0CE

MD5 3918e39a6e3121211fd8df90f51bb7ea
SHA1 3af285feaf3649eaefd6960d81d1fce41062e6b2
SHA256 6b776cdcf6381688ce5c21b2a73469348580219b5f562ad975aab2d99dab3d39
SHA512 2e936e179aa0bbee0c628d40c95b1f0968ce823259bfa548d7fa919236596f1be35f2e2cbf1a88170738641fb553c7b8363b5aee72c2ad2e6b8cf6e346998874

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D4B85DDA6A34535BA112F801AAF04B7288D88769

MD5 44c5b61b322df5ba0eaf890389151d6b
SHA1 ec88929306756cb381306f911b712423c916d0c7
SHA256 8463c399bb717e61495f804a1fe73f261627fbe16541e59c67525926d871afff
SHA512 5fc5a30121af9e6bbf9ebc4ab6ca698d0252603a6c2a91325198577594ba22a6063797cf057b9048d38daa45ee01deb371482aed90d71e10eb8dda2f855e34e1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\40CC905C745109B0E136DAAB2CE1FB167775B38D

MD5 e67ccf298ea4763297c123337de745d4
SHA1 90cb2b46bcec7a9b4983956eae9fb892fe9510bc
SHA256 7aeb6008feafe0014108b75596fb9206e464dc1c4e54a29dd1ae35d7ebe73e7a
SHA512 44dd98c46f74ef66fde3cb6aee7de76400d944d1403d87fc49fa24c9027de5fe0deda360f1d1ca8203ad27c94ec58659293d5f86e0b7408b94868c254534b797

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\7F7F8A063E61AA519E28A38A25F8244B903F8815

MD5 a047d93ac5f6e2859b658e82ebe30c75
SHA1 9ed2a0ca75c4a645548c9848d1886cd709ca782b
SHA256 d7820284add669e1fcfe2da3c66bca4be0d553562bd161c9f13c8714ec245748
SHA512 1c511e8d1ba16dd287f8e40ec0e71e0bf82d6026fb5b79357a43cb26d10f50c901992c56ae49eb722143a11a207b8c2e0b861d18b93b7317060e4211fe33353c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\6DD2D95B4CA2DFE7BF3A7008BD2E99BA6C6E7C52

MD5 179f92fc0d173359f194aea676ed6fd5
SHA1 f5a40d59a20464811dc83c36997e009c59fef7ca
SHA256 e56ab8b037ccefd9b8df350b28723d3b802f150dd8792ccc5a442016590cb48e
SHA512 4bd507bc77cb4bcb7bd788eba1e83e11a3376e25e913c4fb39700b9c43b800df40aac42c6c3dee3257145a841f5a52525ec5c7d6bbf560f4da6954bd70a73a79

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\EDDF96A8C55BC9E231D510A1EE12DC42BD1BC7E9

MD5 9deef2ca1e6bd0c3ffd03dd9910c1a8c
SHA1 24389b490303bc05646dd1e3ba6dbc76774d7ae8
SHA256 8154e4e04a7c931618d4737721c8309d106f698c9038603de936c186b792210a
SHA512 652841fc47e9658dc64806ea67909d6489c71bf916c56ef708895cc10fdcd25d625a309796300aea3397d81f41722c4bb04afbee304002bbb41945a4aee73eca

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\A0D91930D3248D88263AC1A5FE6FAC60DE487747

MD5 432de9d4fe607861a6ff30d51dc047fe
SHA1 3ffe5e17311939600077a4a57b297e0e0e00621b
SHA256 1a91c7685c1ce65d9fca3aef4294aa66d1b47753cc35ee58215b60a229a8cafa
SHA512 ab42d4485a35191ba558063f1f80a01c719cb9f902584795feb090debcd8ec33bd91d776ae11f7cc7f5a1de16cf440214f66de385f3035dfa069791359cb1cda

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D35C09500437DD22D7C72D16F29F6C78D8E3C45D

MD5 4920a15f8252b4196036cd66fc78f7a8
SHA1 1369fc869581adf5d02f63bc61fa948ca9b5d3bf
SHA256 b19957c51df52139403b384ec86cf5058e1e7898ea192ee7dc0fe2cf72fb0666
SHA512 370ed99fa6a68d2548f2f8752f9e799d40a2a0a8ee5803eb29342073adde93029b6ea90c1f2dd740ee9c2f6f258551c2ace2fae6ee5962528e8dc970cde855d9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\88D2DD145122466A8C6F39785D5A392BF5E86A0D

MD5 57d7b76be470e1b73ab16c3cd8d68116
SHA1 b2b9d4a08f0b5893a7a12a3f39bcf25222a8a63e
SHA256 8ed23cc568e27ceb722c8e8266634bd589c51fbc469d776d11e13c4b22aadc8a
SHA512 ee8f28ab9757ecad40107a37c73025973510c244a46ec8e3edcdac9dd27f62672a4e686f109176516ddb93ab340522332dea841e5d32952fe69969157859afec

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E9BEC073147047EA8C760B036BF12413005CB4C3

MD5 34f6ceedc87c95dad16fef9b2b8d7900
SHA1 ce5d8a7a42ae1c1d31420f664824ec7220a711e0
SHA256 61fd37137cd2f44f440ddd6ac08d7b933697dedbac74c9ebeaffa36d383c746d
SHA512 e6f44a32f9713408c6d769749be89cc3d568d2aaba462e25b77c2f251f4a2cee3b9c0c543953aab74c2c17bd967fb9321884881ea3699891ecf0b15c11a744c0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\38FEF432E2719526BAC11936166D573415EB08B3

MD5 79a57975c0a5592822c1bec84ea385b5
SHA1 e775ab26c5c6dfb4cfc758167fa35fd92ebbb384
SHA256 1ba93dfd9ed977fd66d80e4f6e7a0ba885f524daee22093533d1d58cdd86a68d
SHA512 b956d4f5686077eda886795ba019ad50419c95713a468ecfc260e51d7cf1e982da232664552a36b65a1ba0b43b62b38455c73cf2a0cf10168ed60bb5993b3be0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\B45CA4C223E7554F32D850766A29D9A2F7D872A3

MD5 39ed29ff808bea08e1656c1a5042c893
SHA1 eca75e739925dcd103fa4970a8e6fa8fab420240
SHA256 8497b4536a895b3bf80dba12670ba372c605edd9d526a4955a0c7f634d05e671
SHA512 7785eef799af2b5a9db73784ae9abc11f07289596001b790b42a4b8c1d9b25595a6138c9e794507b09ea4132f90ae83de60f2a2020acf648455bc453c2ecab81

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\1E73FCC056F779B2B89FD9F4DFE9F8C24C1B85E1

MD5 6bccbf8e851f13cc9c3d2d2aa0e64299
SHA1 287fd73cf7549a8f6c2183ac35ef1fad2a296d97
SHA256 420db44d2f3bb2a60bda80fb902ca3df3d99ab2760d70c687156082e32922d72
SHA512 9a289a5113e097345ad0e8abd122b8a3d5bcd298b6fcb0e514020766dc3bd55dd6e02daedb0b6ec2d6277f65c41d7d88b6b3c69d6c1a1d921621e26c08766314

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\A18AB3FBE5FC5E1A527BA36FF698DF26A7C382BB

MD5 0d60918d069919d6ad27828ea24cd459
SHA1 4cbcb2eb61ca84effa38e994fc29830f9cbf80cc
SHA256 cbcddcaf33fc5677c7d50af275f956fa7e24afd78563840fc2ae4190aef83df0
SHA512 3afe7f4f6ffb6b2e49f808b1b0abc66bd42293b3c2c7398f11928bbe86488a817dc9e8030cde23bc30ea794384661b087fef038bd68aeb1aac3cff764cbc4622

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E37F0C9F306DC48775447C1CB63D24537A2B4D38

MD5 324a07ea0683ac27d015a20c91832c7c
SHA1 54b205b4cb7feb7511e8c14ffe43d3a263eae1c5
SHA256 219c29a7bc5431f80a52a616a079185967771ed8b3d35be6221b5b7c6ea89618
SHA512 ab5c1aada9d93608282fc4636b118721728ee701ac9b9e71f0635ec8cf0ef117f89097e0a15f6f3dba38f9e7b8436f8992b7eb9cbf3af1e031ae7d082abe9d52

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D33DDE5D55488267CFF5B43AED62277BB733BCCF

MD5 8476643b92546980b131921abe74f1dd
SHA1 d4d702379d7fd2b1fa9053cc1fdcb844efd8a4d4
SHA256 61877c684d3cdfc4d4dea88cdc37ff934cdc3cf3564b57de2a8c652515d90379
SHA512 54727bb8a0c362541cf5eac16f71fe2b8ebc4a08e13f12f6bee4f62aca68af3cebbc485f33ba7397b16f5382748a41f1d5fc51b52d01deb3f6942e8798057852

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\0F8A7FFCFDD27BBB160E676477BB4A35C5F94496

MD5 1ca8096048ac22c67025d970271e50ab
SHA1 2d94b480b9a893c42060e15587b007ed073d210a
SHA256 9938c8802ed66d2bb257c6e67d0bb6b48f639b54c874280496c7f089bb41bc56
SHA512 567452bc932b139d5db17732c45fbe333ccad8f6d8fb47d9ec84d92b1dc254a90f8574cba40a5c3cb479cc497f450c6c61b0b25c05c4228cc0fc2546be975951

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E023456A23477BC8816E43FAF08B541C0EDB959B

MD5 497af2f5638e7fef861769d63b90ee0f
SHA1 10e07a258af761806d8994e28ba1fb68cb4c3e4c
SHA256 b5b56d19d6a31a8cb1ef9ec6e0fdf36861cad4b3ef4236645e0540e7694550cd
SHA512 f785d2df999ba0f7bc981b9238920388e8ffe93122d758f944cb568c57f448d38b988975f630ca47475d030bac4de1d4ec9e2611fd81aaa0e9bae885e8ad3758

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\FA1B9D3C1A25373DF42557B3B89A2060E0EC94DA

MD5 050b4c171ffd08d4f178a52c455040b0
SHA1 7ddfc27a313158df9adf1d8cc84aeb7ead6cc235
SHA256 8cc1182ec68b6fda6ba9906bba77e307511830316d5a7ebc9918adfea870e102
SHA512 3b1ceaaccc5485de14c61273ef95db10d84d5f03d871f95080f1d1bced732b4664d6150803d4d26f82d35bcc293588866c7e78cd9d1c0e0d0d707bf3f2f1f22b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\028C0894AD87F10A73B973631F70818724BAD700

MD5 1cd1396151ceddc0c9248beec41514dd
SHA1 9cab04b45233b8f29049eea02351ead4580cf12a
SHA256 8a07ef91598f057b97491b8a85b2194d27d2128b0b9228ecde21ebfecaf457e6
SHA512 c4bbb57d4d9a74d618b8d8c7cf5a4aa74dd103956a22a08b8b50f4b6634d20d27dfda0c7636fad24d19a873be5373e2801346b291973bec8cc8a24fc871d8b24

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\0DE2403E40606B9197622D9499699DCABEF1EE41

MD5 6ff2770b56eb2d2159c70bb5a21172db
SHA1 b374237f0b47edf26c451cb0dc31525f4b9e0244
SHA256 179415b6711c2bd0e489d267f3dc0eb87b817429cd2a28ed3345b5c1b79808b1
SHA512 550b422594532327a9ad9ea0d9e1b3eab6e5adc2ff5294adeefaa0df94704afe13a0be9730176a15405fc1cf9de2dff9763eedb32a4e65fa26ad34752d2b67fa

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\00706E58FAD6F5BD6FBB8052CDF9A0A961E67F8D

MD5 08b46403a85080813b301523d99260dc
SHA1 8e578df9179e5404362fa0d348541458ccd27427
SHA256 498262f95ee93a621e01ee05ed35bd09c082e5a82a124b33a303f3e829c3ee73
SHA512 eb4e7c617e02d351db6e99bb2996554a877f87c1f50dbd233998ac83b7ee6b592094b7e7f1af3df8deb800011d12ce068e4f5721fcf301b505c8d176c689d705

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\9C96235CAD726D63F60DE1389F02007E7CBA3632

MD5 4e8138a6d789adfa8eb690b0ea095068
SHA1 acfec8bd0f215a8dfaa5625f4eeb54d6ec7756c2
SHA256 34091c0a48af139f5488f96fecd35346e2c091093da72368fb407b1916df0c23
SHA512 47edb56989487fc965284817c8ff494ea58795984a48187681c7f9ed9ac8693e46602f85ffb802f289d3d286a58907c6c5e27ebf9543c95af3e66889d5614438

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\22F2BE6046DE71FCC15A701DE0FCDEC5259AE136

MD5 44c37aa4c4c63a26b855f1b493b4f044
SHA1 b5663c7fb0452093534acfd2034a6c19f10663df
SHA256 75406d560791802fe6385bc2c9126ba6bfa01136c2a8068d903fd67e816de437
SHA512 2941f1dff3b206f96a160c751d58bf704729c96838cb4296b812b0c71d20a2a92281fcab49ec663ae17bb1e9886cf8c21ed85744d73dbdd88a56c74ed25f3574

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\6018DCCE8EFCE22F8F648A32D28EA223F80C84C9

MD5 e11407decd6544ee616f83040dba1bf7
SHA1 750ff31bfabe50e1c13f2d4df02c4e1f41c365cd
SHA256 436d5683e4d6d1737971287b5e4b8b87b300c4de46112761d086017cde00e55b
SHA512 471f49b1dca69fe57df82a743437d7cbc1f2bb8202d2bf676dd0ddffb0f6017f379f48ddb2559d98af2c8e43aea3637d36b9ccc1baf6c6f3ac2a64186103027e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D221128EFC811F033D8D88CCCFA6A7F7B5A532E9

MD5 a0cf2ba0e38923619aad3d82937f79c0
SHA1 47760c56a89ea29537ecaf29ff39ac21c467aab7
SHA256 a1d6a143714771e953d4236bf533247fe2707b7b1667cac4978342c1a2e946de
SHA512 ad510d45e4e04abde5e60e599bd413167b9d6ddac45c77ee25f3d123039c368af80cfc2f7bc0fcb78a7fc857efa1ceb003db9873e052fe1c2acfe6bd00e69927

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\1BDE2F4B9B72992196641171E44287D84F1AB41B

MD5 57cfef3b5ffb96615c40931fd2c56349
SHA1 7640f13127adf1aec81eb322c5cacf12b97d4a91
SHA256 b880fec31988bda806a573bad0688def54adea720871e49ac83d566d8d7956a8
SHA512 374e1c4d78c911aad6d57e20eb08ba5c02ea7392c76f6de3fc7c7dda05acdbc7e986dd89ae9dce6ce1dcc64ea69502e2d5725f6220098ce30652906e8e8b020c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\1F94A3B019E2B2B47E2356E16C996C9287E700CD

MD5 802090101ff98ce10eff2f875abf77ac
SHA1 2402fae1c7411fb22cb968ecf36a032d4eb959ab
SHA256 7f9a31c58e04edc7cf266bb176230d7f73b386d38a243cab5b618803b6d377ed
SHA512 d360363b6a0f78d9637dd86cad9a8d40fb83629408d471a873137f43a6bfde92054fac6ee4cd0133d2e5e5bfb9fc3c279f62d43353d07306729c6d87395e44a1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D373F3E40C3DFE08FB4090E26F384A581E524CA2

MD5 d85afd4e07e576fa57d0440c6d5819cb
SHA1 612b2f7ce1f3afb536dfab9da872c54d1dc83b39
SHA256 51a86b563056b0bde6a740a73639ad015837096e9321593f589bf5fbf31b1747
SHA512 9e5cb9a3a5f9d3903a94026e1d4764acf98b64eb1fcead54acd07fc31be1b087fa50c9db8ca171dd190a11d9a7ab8c1ab18c475761df1832b1cd77352b7507d7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D1D59FB4C558CE2A8474DECF1A3849FF49942A48

MD5 989ecf0f4fc51229704780cd5a59d3e0
SHA1 515739c0ffe5f776d1b8602d496a31d16deaabe9
SHA256 c50d02c542e1a6f56c98f9eac442a5ad22f1010fe88e93d4bc56b16d6d54656b
SHA512 4b83684eca3d08c1ad158a79bec703ad2dcc165d306bdcd95b428d0e970181f268db1dee9a42581b03df4a17bc76c8a3e9fa81e9d5e326d94b47558235fc63f7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\A6CF8300FDFCAEBC0A5D87AB8478DC83A640E049

MD5 cbacd263e3b9957c560f1009be436b5c
SHA1 525f02718152274d3f3713dcf0a6d3f8612ecb9f
SHA256 182ee0d88778c4f88d6ee0b454ad018df340a14df6930ffd1dcbd7b2ae890f96
SHA512 ef8bf3c629ae2c7d5c248f8ccc1c2aace5b0fd4dcf8432535c12abe3171a2bc87fec060b69dbdd2e7bbb846a6339ee064258f75d4bfacd6106b6e9f75340d773

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\3A763E8309D53223505DEBC9BC338F9AA7D8E484

MD5 049595e99023bdff70dad67ea09845bd
SHA1 d09bc4a8db55447c13ce3b251b653504ee27a359
SHA256 c3ef8d1a7f5fdfbd79f3b7ea2c9bd4da84c3e110f37b9ca644a79646d7d3a3db
SHA512 feddd93e6e38e4934f7d6544400aa43f94fdfc86c647c3a33b6a39019909397e61b473f7fbdd9c82f05b5f7f35aa41f89a781d370cc033cc7b2928b7338113e6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\15B93BC621B274AC627F930BBC2A3DC1A7CF1BB3

MD5 ee60ac7a67fd963b713a1dfadedcc23a
SHA1 b924aefe22f0655bf22397e5395175d6007a8a91
SHA256 c8835c817a3cf43ba41277d5dbbdac316c75f612e1751ee2238d8a78bd2e092b
SHA512 1d43658350d93713863eab528c628df8a13e2db6d6dbf406e633bb6092cb012e6a9e7e7d0555236e76fd2be0036bcad868e49449838569f01556b4f1dab92631

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\9DBD0CB93F6D81B7296C8286DEEF996F8E90BB71

MD5 8943af3177e07c9a53a1373a8f7c8164
SHA1 06b51c209ec43552c456e4d9ee40e4d862450c69
SHA256 259711725228ddbef02f008b50c881d26c1ab3c52e12f87b1d554a4d7c917feb
SHA512 00588948c396224aa158411c510d6152b4450789a812ed9f1198eb689d34d3b22ba7e1ebba13ae182fc28e4d05af0e69293bde0eb2f03bb6acc35d53ff655afe

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\9175B8F360E26067AD8F2B5D83AE3291C282C1DF

MD5 18ece17cd5e6d55de8c3382effacdfc9
SHA1 9cb68bb7fd81a30108260d0608f35966b6dedd49
SHA256 2fcb419e94f9a49d496605369f823f9d88b906aa5a9e11dd372b4c419c16117b
SHA512 17172fb6f9ca43fec4ddfdfac4a60c5ee8fc7438979619695bb182e722ec24e49ee56f34b397e222013c3e994ef7fc9a415a67bf63c10d6213a3a0b5b90f6975

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\106255F85732BF5B2773034329203974AC4D7C59

MD5 df5733f9ead1e11c1155cca1ad5fca73
SHA1 44b8169a229dbde2a0013dfb31f30d741f179876
SHA256 02f6bbf85b0cb0109e71f7186387699fbc0f758bba3d841864c5fa837dad56c5
SHA512 fb171cf9d3562e5b378e47f9efb1cac5fdce3ae17c9632476cdcb934889de1c796d1562f20372855fce569190c6d383b7821a5db8bd1235515c6343834d49378

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\5293

MD5 80223e18c62d3c6256ccfde5dcf6150e
SHA1 c469eaf2f9de71fe4b8293e11fe168abb0900bc5
SHA256 3a23eb4c7fbb55a1b1c694d973da968a8cc41acb23ad79e344cef9d7c2d4d6d5
SHA512 ae1d702e80f3181d0a885922fab0003aa1a18e940e595e5369962170aa3de1e73a60d16f6d2b7b694ffdc350042ad1859b9f01d9870f6733255b0d59b59dcd1f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\046D2D498B9C8CFD44EC87393860CA4A7BCB27AD

MD5 496ab30f03696af8448211d844e3adcf
SHA1 3df32b9bd5c11c097684cddbcbcd69de3a0c1c30
SHA256 81f297975260be3af2c0a59ecf51f4c23d598dc4b3470e5f9aadb6d31a4760cf
SHA512 4c76856c76f71c62ba47d114fac5bbe20b47151ad466888c633a324355fe5ae0ada7c081ab701f2483a116efe61e8384ea492f29e184987e9572acdcf598e4ae

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\7691703DB8367920C9883B7520E6067A0C83A62F

MD5 ba8d1d00475d54a1a24a63ac2211b06b
SHA1 87538fa86946e5a8dc9e3f22f11d8e99eaf5e3f5
SHA256 ee9c03f76d4d32fe7cde38b8c92f2d104dba1badfc1f246a4a238030a39421e2
SHA512 2e695f4652d2f6c414e9dd23521e2925849855c3c017d5b9719a6c285f321eb4b5747b5b571c8ddab27a6426ea2ca05f708370f30ac9901ea5d04c9b4bb22a26

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\15140

MD5 ef03f743573d204981c9157824afb60c
SHA1 abf830bbb94427b5b6dd31d8bcc84d4715873ff3
SHA256 c63a0c83c61fe0d5dff41a4b7621f84049eb2cb7503d7c8347357cb4c9619236
SHA512 cabacb0fbe361258577d3a02db494d95e73a6cccc7288cf995fba97d1bbd875c3b13aa0ef7a538753b94517ee29d2d381d70c035d6c872ac29d5392d3fec9d2f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 b58fb1a7a9a12304e2c23b4f75c9df1c
SHA1 20e79e127169ea79a0f5e4b1148366788289a703
SHA256 f0ced2a828f27a3aaccbcbce23f475edfb70ab5018e1435872ab98e33f945a35
SHA512 77f579e3473b6122dd161245cde515ba38c81ed09241b6fc8f38ac4289882960d463e88af57a67855b3044e68afed17c553bf652259fac534532221c751211ef

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\22207

MD5 6eb4eb6406754dff3f02c35431b70884
SHA1 518ecf4f0c2982c9abd01ccba8d89dafaa8987db
SHA256 1db619b286b8758248fb252c38d3d67f32f3de175c79a85f37105e8db5a43b0d
SHA512 779be9518f2b3599df5112fe9b24e3211187e419a78d8598fcbe6afa0f0d2fefae3df4ffb3aa1bb85a1c0abeb0ba73718d53be5bfdb3d22eb487d0580fc0c060

C:\Users\Admin\Downloads\memz-trojan.6s8Ctavx.zip.part

MD5 c31e52bf196d6936910fa3dff6b6031e
SHA1 405a89972d416d292b247fd70bbc080c3003b5e6
SHA256 8b47e773a782361209f8adacc8d6aeefb595e1c13ae6813df7de01c20a15c91e
SHA512 a5335c7d3beafdefa6cb1a459736615ca0151fa2e64dafb78de65aa4b924068ad0dc55c70a5317be19edeb899f94ea02e2e54279933b87828ebe86ef95f13291

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\7e6eb741-da3c-45db-9b62-0b0e9f2f1e5f

MD5 ca63c987623665488e9de0d467ef10aa
SHA1 5adf8f42627bf56f9876df43c7bb0f97e4321a55
SHA256 923a9cc7ff55760e38f0c2eb2f71f0b3c7e379fe4359cacaa296b0a1d7310d6f
SHA512 3dc01deac3d26b2de0d3cff2c6bc65cceedf14d7e27704d94ac89cf3a188cd9df7c4de2e54ccd1c6d09a9b56ea9030269cd01acc6879705d8f05fc2521c37f4f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\063b5541-8be0-425e-ba91-d9d02eb0bbc2

MD5 14741ff6459215194435cd9f1c1f2d60
SHA1 b01c56d3ceaf2bd0c353053b08edaade3c4db22b
SHA256 ded23902388aeb7dd85322aa4c5f48fa2cf4777a3e3fcf0be9b631bb36625726
SHA512 e4454a1c7b0ef8197f444f2208351b8a59b51ebcf991432d9a1a0ee45f946f3ef745e42d7398d9721108dac6cfbebd01076dda4bfd6baaf9eb052c8351456994

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 875443a4b6cbc39752324d7f01069c64
SHA1 3fc2a6f3a1e8f283d6d2fc4ce2368da6601bc767
SHA256 e2bf2ddb7c15721bc1ecdc71b55fe45c07210096bc9e235e08d114ce22472fea
SHA512 1d1a48e6edf55f84c076bf576f9a13b548fa10a6e327ac3e61c04bcb6e6a5897e7e0d6a0ee4c069b010072cbc33ff581d4061b03543ae09506629eebc2f948ac

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 45a53f4f35a0b17ab978562fd0aa8b3e
SHA1 452bdcd3d8838979f2afb6453091b459fbec2a8a
SHA256 0c09e536d7a6848223f6fd388001f39eedd43f43618a04e10d202d24c1b2c89d
SHA512 25e2d3c820891878da486bab56211688209a1d3afb2ea741e3e8cef821c9864115fc3fc1c17dd3439602d61539a7db0d81f034fc5aa7f64197a0d48d6fa5a6a1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\27010

MD5 5550c00e7d1681e57d9a5b0e68240bbe
SHA1 d89b6357d9788d90643640b7c210109ed5a2c9fe
SHA256 33d46ba6e7b1253cf59ee5ab79131e0c19cfeecb64d00c416b0728de6b5c59ad
SHA512 30dbfc85a07ddc061f222e7b49730efa66ae1fc34f85a6de8e15849dbc4937877a7d3ae1b9ad05aa38a9e882e3c3063f816fe2c6fd8b77f6106ac7115e30d6ab

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\8438

MD5 46f72f09f48bcdad6e6e9544bace29c3
SHA1 6f91bdec8e219b6b98962ce89602b7e24f23f7da
SHA256 a572650aa2310cc8b89b3ebc6b1d380c515dcc144db7f8734f5b55f0b504eb86
SHA512 3fada3f599e9518c92b025494c36eab669ffd868ac43e343ebfa0327332ee9d30916e426f367da01b2ce0d0e45f7d031721a7dde31fca492e0c7964148395d78

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\27470

MD5 8c19a1ca42de96f26c384a180dfe0871
SHA1 87a2bbe2b7f4a0d4671a7058be627323e5affb10
SHA256 3477d3279dfc59cda336ef904b49b100df41ffcb85285196ffdc4ce3d79871a5
SHA512 56f1433b3b52237752f441db5e34f1c2453aa7cbe1a4b42f32e2f4fc22b295b101838f2e09505c96db93f00331ef73f590609cc50ee91e78aa07d8562c697a7a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\1C9E553566B84126A5A73025E675C1017F9F6AC4

MD5 0777d22b76bd39e414737a2c449e039a
SHA1 3749132b058644b140ab6115f618ef785871a1b8
SHA256 6a203c8239dd99fcccd70fc4e7a7e102ababf06335d8511da923eb153b4c3c80
SHA512 1978a35b6c3bd40009c6e82ec47638f8dc3267c2f5eec2d46ae4cbfdc6c58d5a44dd8185ecc17125778e267a554307d38f454cc3cfebd7bb192018ab96bb5494

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 759367f1a9c3aef1e5917862eee88398
SHA1 5444477b4930dbea5e5f1fc9afe18d037c957132
SHA256 1a95a3fe11dcfc69a9f9216d9478579d9b7047efb4d7d0260e39395e3c81493c
SHA512 64702a1e9c7c408a5b00ad7d712a2dcb36ffc5891e128caaa27424f99a02f913809fcf06fcd38a2f8dfced8c82f4eafec47a02f0d88fabc05e65cd4501a05078

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\10994

MD5 ec4bca52819ae1295a995b63204e73d0
SHA1 3786bc004e2bb8ac91567e1dcf4eb6cc25f40dce
SHA256 30f98929da77602621e838d4904abcc2c7ee1d09b967b5f5210a5500296e43a0
SHA512 7d4a3a822a1124515a2b7f96ca24c9c35a6cf312c7ad57d6fb5790facf04f3f52fb3d532a761eb4d99da3af31573cdfa4bb79eb752227f2058501ade29aff4cf

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\29914

MD5 4a6e00f3f202407c23a8c2eca92d0a48
SHA1 0cc458d99e655771e80d359bc82180ad56103582
SHA256 522bd8355c705c7416ad069d80d7d25ae18314c8e57ec80e7732e37ce54c1ca5
SHA512 4c6cf203a5bbb3a746ac2734f20b15c52a3ab925f9b0d22e46bc26ad4529c0bea88724f4998fa45675153d0b321c50939953ddb9e6399f2196268e9c17238536

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\979F4381316268FCAA5B334C6152C9E42B3C6081

MD5 8c4a36c42814acc488e8f9bcb19619bf
SHA1 52a4cd55a5687708b37c1c2938e8093bb1eb1b0d
SHA256 ae90b547244786114268065e71ad9b4752aa09e3800c59893f37a42b9f47a5bd
SHA512 0c171d134caa11fb3fd1adb1cbec287f140947c59ccdd02c76d33bd3a518d1fff8e4154888179436d35e49227da8a6533ceaca1f895191382042a18f8d98e3c1

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\ABF611A3B99A805DC4029055FDEB09F7F8CF50D9

MD5 a4b1893c07c8ef6fe281c9cdc567e0a1
SHA1 486783263f52933e282714ba11e87938b8ecca9b
SHA256 fc553925f46a03c6c86f97110491150cf50b3ed11c7cb3941cfa51e53aab0d70
SHA512 c02ae36c2461e05760ac577bd0dff44cb00415abdf0697dffcc7806cc6cad6b6a75fc9963948435831ab631b2f555306a7b9a3120aa7acccf7d73a29a1f40c61

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\436041BE8DB5B98ECBAC247109F85F41C7DEEB09

MD5 e5e59e28ac824c149b3bebb7ac3734a2
SHA1 bf33dc96fc11f123e055ab18e4d5e84be36ed895
SHA256 8d3e9ca84fb71cc98629a4031a80692a808665288f2b3db22d04aca76ccd8155
SHA512 db0ee8d957ab55399b8c654bc9c6a614e32076df01fdd1ebd8c1eff1e381a4c972af71dfa1df796a4a4eef9acfdd4d139ab80c1b69a0737ff65af208db32d8b2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\CF78B7361CBAD0A315347D35FEC4BA05A6ADA0F1

MD5 cd68bbf21c7dcf0c34540c90c5839de3
SHA1 c3026a6d0804b7d411d3d93e77af3efcd1d388f9
SHA256 12e4331facf5b834e6e1fa1ee6be4cbecc662a6b81b9f9ca7171f4b6ad685b45
SHA512 149127e90075e1878e1885c5c630f2a95f18a59004b63b645420215207f53c6acc93188539ce5ffe42913bf9d6c12028b323296cf5ed5047b5a76289767a9856

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 3b77a472b9045110db121d3aa5a1317f
SHA1 ba74b9c5bfb5c042616773afda2f2d2be527934d
SHA256 1f6aacf2053728f9e44ccfead24681c3be8677fe1aca4cdd8e9de9bec1d6b4c2
SHA512 0dbb97ed364bbed715bc96d3fe978fbc163beaf374542d138d35a4bb3d3f30edcdd69a01ff15bff719f20774df7624b69f303189aa7fd302c099243774006874

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 0ccd4796991dcf1146819edb12dc7119
SHA1 e07a042f9483323bc8679f4ded51fc6256776a51
SHA256 dad9b01f4db9cd3c1b8793702533e638cbc063e8297accdd08ffa451c69d099e
SHA512 5b355819247179617669bb70e884d85df0852eb50736d5c3672e4d7b7da49c0f82e3b9457ed70f3ab3f063ce44498342548c79cc6701d74dd5c801c4061b40a0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 6e416f341ea661fd64038ac8b13deeaa
SHA1 953dcf9829a40c4ddbfd2b1a424fad451903f3c2
SHA256 355c543584d379abf2f54c77b54aabee5d9c6a09e2285083000af5cdef64beff
SHA512 3e54988559fed5539b81b00c67f63710b80d77f9c807dfdb1aa6b7dfec40ceaa54d002c168c3ffda17b801ad8b3389c76d958fa54bb6af77e2f35519763dadf8

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

MD5 2fbb4fba892510b5a012cb92674ab7ce
SHA1 209dbdb1d98e0abc9ad4d9099601ed6f3a4c4e21
SHA256 5c681aed292f90d6bb528b76eae004cd8625b16cbe51f9252cadcee51486f652
SHA512 e3309140b54f0262252f9981dfb3055cf38220644d46eeff1e112d43856bceb3e63a10698de24cd47cbc6f8c96b2f5643de2dfec101ca47c179e4a920c4f7518

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 811b42cd2dcf16e074f58766a819dd7b
SHA1 5b076b604488ab0282e94017d88e00caee56cea5
SHA256 1bc5b6a94f68a5d44382cf324686c3e89137365edd9e24b53ac5ae6ff1242b3d
SHA512 45dddc9231def2ab3942fd105daca2102b3d3eb56858f5152e0a82d1f0197c2e1a4f368e7bdedc37a50f6a4d76a6d0110825d8d780efd4ca5e5779535967b2fa

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp

MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4

MD5 4ae7c90afee71463a4b66e8da52b7ca5
SHA1 2d78232dd7dc19dfd2bce0483c6e96319a20354e
SHA256 b848eccb9681ed65beb928c06d75e616a3fd6c54d44a13522e953feab2808ef7
SHA512 8a912d8ae69a2557dd0b8310aad935653698a109de3da29a369589474be4934b8f2c8de7841997599b7d1aa0e2884e93b6ee3059a1f521a363dde769d63e22cf

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

MD5 545b2d7e4fa7b801a2d7ccb7278f93b3
SHA1 cd61356d43b54e73d378097927146272f6d5c8c1
SHA256 50d57ce719a32aa7f256c4c1e9ebba528976cec767ce66388844a7a84df2ef84
SHA512 38ca2a8ca4dab2765885bb08846c96475a372bef62ffe6ef83bd78b8461ea183c177030a2110f5135d1dec734a1f2a6b5af1cc6db90db8b75897a9811fc22948

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\startupCache\scriptCache.bin

MD5 f0832224967733af8f5b9beb0daef776
SHA1 8efc7c92fb7bf2e0e33a718a8d6f2b34bc44f2ae
SHA256 ecd1224278eec0e3ae4faf1a03e01716c28891873057afdd840424ecee333677
SHA512 3460ccb889d72b7aac5f9904fe05f1616d482742ee3281eb6edf12af5f728a4c3b49ddea405bb5e845c5accd4b33980863380ed7db46d063057ad7dee0ff0108

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\addonStartup.json.lz4

MD5 240ba8559eb2129c9de23ef68fb49e6d
SHA1 bc37cc5e3dbe368918d503e4304aa90006fd99d7
SHA256 b3fd0ee397e7e3214cf9076f4fc07e22ac7c89c1f15e3dbf2fdfb4f9e697b1ec
SHA512 ca97992adceb23b333c4c8fa57c28177fafe69a2472a774907a2119111c906f2b97552308c572e78abace3e1f7a61cf402f46010d8664f68b3554b2792aac7ab

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\xulstore.json

MD5 ad41971499a828841dba70e2377168cb
SHA1 68f1474ef7579b749b145f6a4efc5f10fab1f2b4
SHA256 846950690a8f49d40cb4a7288f8935df51e240fcd6f0960feb230b404ae8b7e4
SHA512 28ceab0ac0221f944ea7631e33de8ca208f222868fcfac451c3d5724f4a5896968e6da696ae641fa80d0befc16c3be159301ecda2cd057d3017d6efb734553e7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\startupCache\urlCache.bin

MD5 fa7717c30226b22964a956170efd4ce4
SHA1 eccdc9c53757cb3b6fec814605250d59aef8174e
SHA256 1770f6f02d6382d8949c68bf6ed7ae2a6d772dc9fe590b65db5b05ba8e3bd5eb
SHA512 76010ce78a31ec0f534af5ab0d0d311517ec46d0cf27a89866813bc46a19d33cd29fcb7474e03882db05490719a63dd0c3602b3d4387a13ee869c7b3c12ebcdc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\permissions.sqlite

MD5 7d69aef7b05ad0b5072a41735b993f73
SHA1 977c5d01e1aa91d3d850715f4cba4b62620f2d20
SHA256 86dbc12ba72d493368a1cd878d127d36e53e3be36849408ee04596c032aaa52e
SHA512 bc47544eab046e146de3e891c07071c3031acda6a5d7b66e7ede79125a421218c1bea47f12b7e961162ea6aa4cab9a4b2a0424cc3377ab692d09977b92e6d07d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cookies.sqlite

MD5 33b4dd3c419da38eb3246e9b784a7583
SHA1 80129370f2a627ebbd6af5ece4b07e00eb559f89
SHA256 0727623b1f9c4b60d042b10ffad66c2eaee70eb82cde10076fd988e2e8147419
SHA512 6368e5351e841a7992e22e2f2b72d90cf5cc977873e48d19b836b100ee1fa9c700320dc56287a03ce442d82bf451291c1616ba5e23a22e075c958b812e697b2f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json

MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp

MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\index

MD5 688b713a20221b804f667371b56923a1
SHA1 f1e6f71922165836635838871551d41717cec89b
SHA256 7b4b689662dc53b7fabbc15c3dd9b71eef25dd4c6313a637f63bcd4d07664869
SHA512 3606e7116f76888476045462d056f34c9f843420826ee35560dd2ab9ba90c8d695ce2cb96f683b258cb010144c835901082b4c34527a646e9295551ddab83636

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\index.log

MD5 0265aa9de8860d6736f374933b75490b
SHA1 27fbe2f3f7da910296a56f96274aac49b9588768
SHA256 fb535b67cbd8994a6b78b996016830d2e813113781796d1931717f78525ac6a1
SHA512 efce9347b1f319932de6c22a66a5aa5f43dbb68db705591abd815240dd852b484a0a15a21659e772420f867ae472d0965f4dc3e7ce1390e91be0cb7c186048cc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage.sqlite

MD5 3da9024bdad494ff05fdd0154b506046
SHA1 852c7ac6381f15f0cd737b7b9f2ca42371409ad8
SHA256 39d3eb8c4f092a7cd88fb06d9cd46a371d36b2c71ac9b7b7a5f60e1fbf14ba9a
SHA512 29c922ef500509b010851314a5648244bd2dcd98172568829d2b228129b7e46c0c33caa58dad4c6dbe3447eb67630be48887d5d509bdd13f3ce3dd0ea9b4d9ca

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp

MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

MD5 229a870eb2c46ccf4cd0b19c5dd1a3e9
SHA1 d84c2e4af93b6b9bd41d0fe37477349ed5eef535
SHA256 128effdb8bbd82250f26aea68545610b1ec7b3c84eba2a3a6b1d723dcc02ddfc
SHA512 520f4c4d8b720b26231e4121c489b4d0b12bdf53c54a9c66ebdfe1dc872665b14d4bbfafea1109cbc1bd41480b54f61190da0152aedafe763b53f09e93f07e03

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

MD5 4535fa9d887b474ab88288d88d0d9166
SHA1 1d7b5fd0714b038c7003b305b7081d4467eb1d0f
SHA256 b6f735c87c493060cefebf48840179a8e6c36bbf3b77ca03bb0977bc507f70a5
SHA512 280693c2185868c2f39c06183f6ef23b082cb4cc4d572ed5ad59ed0391102ea16c28da8f1660999721cc1fa73584f601acad5ae94f541f9b6bc55ec6527b7479

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\favicons.sqlite

MD5 c873593eac6bff53eabac79a11eed427
SHA1 22c1b3aa6014cace3d0b0610eddea0632bd737a9
SHA256 d211dff2faaf551d22d4fe827139f853d76ff95ccc47f7d71008d19b5ef13ebf
SHA512 de682d7337f6d8536bf7daf5c2ed12146e66a069b9e8bf2d0c5f58f1a0ffdbc498b11dac08cf91c7467aae5a32dc75af98f85135b3794f4a1539c3390d670e95

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\places.sqlite

MD5 2dc2665728925f4ee8704715ecc50e45
SHA1 732574078442bf963d9fc2dc3200633419e4fe16
SHA256 5ca159e567d41816e06da1ea7cbb81a3795c05951b9fc010096f8630173cc0db
SHA512 5d28c6f747e484f2b0afc8cdc66be9eb7ed1f6767739d1bbcc05bda0a781f306a2ad44cf2e959cd02d39065936b78f80e1e8b7cf6f160f7fa744238e64d1e7cf

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\AlternateServices.txt

MD5 4ea2a000c0e3f9a052dfa83739b1a51c
SHA1 a8f5992b2934b18662be82843c8a27a02ebd0f78
SHA256 9c8d893990f0d6ed32c78f26345678087f09b689508e58cac40431e3c8628577
SHA512 60136d7f67c3a206776452c0a24ee7b247f9d0325ad037195e410ac64259858145c5c2a9ae797cc40239558f1d4a8734687800190a36e4e1188daafae4393992

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\SiteSecurityServiceState.txt

MD5 4eedc48817e818622605e93d9fd5a53e
SHA1 24b6bafe30a5be84ea7d67e802c769a154f12104
SHA256 a2efbc35671044c7cb426dc12a912e6f56070d9a996a957ba31a099fb9ef4b7a
SHA512 b51db917f5cdb0ca48f866a7bb828694fc2c4f02f0a9387f0e53350d83d58d5b97d0d73574d888bd06cc4dbb499ef5c862f9a44bcace392d45229f95b9e7e3cc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cert9.db

MD5 94d509f5072556e569f3d1de453f359c
SHA1 629172d9c6c29bd77f53220b83e0fb3977f4d1de
SHA256 5a7cbbe24ccef01399c2711002052c5773734c6e680168e09e911184a83bac36
SHA512 92919e6c7091bbb25419d6769c3703059ad4d415f87998ca644fa07b7c0ddd7e8f02149d06283c46ab004a85d47ae8299161e497b194650e4da3a1bd06b69aae

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\88cb06ef-f8d9-4051-8041-16bfb853ddf3

MD5 31a06621e95f48b9d278979ea6619076
SHA1 f902aebd1e593989757a508ef0f80bde78d5f497
SHA256 6f296693a317145226ffee853e899aa7086a27f76a0f056ee50fc4baca120d41
SHA512 82fee917527cf04806f29b91ab6f26acae2c9857efa98254cd01a8fa69d29ed09eb5614334785a4e3d5c7c25bced9072c0c43471b717f4786f01f9267ba440a3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\5da96bea-dfa5-4dd1-9dd3-076526599004

MD5 a51515904b9447063b49b1f37b85bd6b
SHA1 1511c5ebca375d933cb8442c3934c3ca03e41581
SHA256 8b5f2b9c3dc2aa8c3e84118d74fb14ca05d89f2b4e5875695bad368858309b63
SHA512 894aa096064352326c6fc4e14c30ff54dee1955163e8ee0f8663df4dbfc62af938cc783d94ac374ed1e27d670510bf52498d6c186ecff473f954fab01b29f844

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

MD5 48f515f2347c821a886cf5d80b1cd706
SHA1 68cd06cd6e9e7cf090d61b31f9d8fedef44ad215
SHA256 8854ad1e60f613c734fa5b7d36aa145e0461e85659d14a32b1b201332cd41e48
SHA512 bc56170804e634460582f6dda111d4d5077b97e86571c4cafc0201c3e3179fca503be07fbd0478f3dc2686903a27d130e97eacc55fa09193aa767576c5c731b3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\events\events

MD5 8c3e41e2f9fc171fd50e5bd1c270fc04
SHA1 a0827fff0090fd102a2afbd2714659c49a1d708a
SHA256 3bc48b98f621a7f080a31393b408e06f7c248d788ebd5d2843b6a5825f0d84de
SHA512 0a83f08e8fe8d550d4c48338da0e4d039ea3b7edc061fc116aa5dca4e8b9028abf8b3e7d0ac6de0f2c6f50e2eb0c643e6468795318b3858a09192d3c0d9f91c0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5 f70cb7546e6828ffef78aef1aa9c85e0
SHA1 a5ddbbc147e8db8d1a67b9d2f6970a6ae33725f1
SHA256 3baf0cca6210c1e004b8f7f63ebdbb89e5c6e5b4c463258d6627511bb3d41104
SHA512 4ecc212dd06f49d5ef1ab07ca9c8e048ad39a17b3a691236ddc405c606bdf72fd385ab4d78601f3e6572743ca21313d0fc46af5ef8f5a01eae65cd1d8bf0a4f5

memory/5776-5248-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1544-5271-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/1544-5274-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/1544-5275-0x000002732AB90000-0x000002732AB91000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

MD5 5e3d16c352f9a58d88c1ead4d98e75c6
SHA1 ee0768757bcdd4a8daa3a7f28d62176f9c9a4a15
SHA256 a0e6a4a43bc1b2e67ee1d95da40bbc3ae917ce39643415594b12efc6dfa2d3dc
SHA512 30cb2d359b4ba616c09a6f73933b417de6177d674eaaefb9ba55b14b591bda52b6d3f5b0c7f17eb1f44eee892581bdc64b230e151b75c4068429883e98b92a0b

memory/1544-5295-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/836-5304-0x0000000000F20000-0x0000000000F2E000-memory.dmp

memory/3572-5305-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3388-5307-0x0000000000700000-0x00000000007F4000-memory.dmp

memory/1544-5308-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/1544-5311-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/3572-5312-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5313-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5315-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5316-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/1544-5344-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/3572-5349-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5350-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/1544-5355-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/1544-5356-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/3572-5357-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/1544-5377-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/1544-5387-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/3572-5388-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5389-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5391-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/1544-5412-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/1544-5422-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/3572-5423-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5424-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5426-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/1544-5446-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/1544-5456-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/3572-5457-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5458-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5460-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/1544-5501-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/3572-5502-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5503-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5505-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/1544-5523-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/1544-5530-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/1544-5540-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/3572-5541-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5542-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5544-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/1544-5574-0x000002732AB90000-0x000002732AB91000-memory.dmp

memory/3572-5575-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5576-0x0000000000C90000-0x00000000012CD000-memory.dmp

memory/3572-5578-0x0000000000C90000-0x00000000012CD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 22:55

Reported

2024-06-20 23:42

Platform

win7-20240611-en

Max time kernel

2612s

Max time network

2519s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\engineer-taunt.gif

Signatures

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A9BDDD1-2F58-11EF-A155-FAD28091DCF5} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007369f55e9106191beed168a3a0984e3765d5a4bd08bc1a46838b706804f99f66000000000e8000000002000020000000b47b2187c9e308044ae635f51d16211d12c0e840e7990e86e5625115cf4622ac2000000070f3365e62169be60741da1727e8bc6561ebbc94a82af34b9e2d51f4e58840c940000000f77c9cc98931c4ac2164bc749e992b1415ebad9a953c89670c38349e70acbd5407ac9c32a939098bddd336ae805a2f63341dedf59d4746c15ab8d934a531dd7c C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000b2a1d335ea37b0dfe4ffe58a3785d89adb34a2d8bef8d943c5842be8b7c14d99000000000e8000000002000020000000d5577a93a038a5bd5b552f4198cb50bf754e187d1f2e345f1c6b23ec7edbaf3a90000000b824661672bb8c9a86adb4d9dda339acb19490a62e9fc06aa75f2982fc02f2ced361db247e5668f6af189c8da311db35e5fccda3435713a6dc4a1725f571af4f950fcdc2f4d1bb0ed8b62e6a225e3986c5f0a76e93597cedab2614ac4fdd6e18e65fc0a6ada5496770c78533fa24a2809835acaedfe8f141773f7351a28cd40266a7f47df0e616a209d52b334a46c55440000000206b296d616a9c93855b3fc75b0405ce20c3633803fcf6036aad611bcd01297c6df81fa30c25de9d6474314e0d7820293ee044b24bc8c75273a6ee62d56b1a5c C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1033b34065c3da01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2392 wrote to memory of 2128 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2392 wrote to memory of 2128 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2392 wrote to memory of 2128 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2392 wrote to memory of 2128 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1036 wrote to memory of 1784 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 1784 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 1784 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 880 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2452 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2452 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2452 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1036 wrote to memory of 2372 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\engineer-taunt.gif

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:2

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef73f9758,0x7fef73f9768,0x7fef73f9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2292 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1084 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3308 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3468 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3576 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3868 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=580 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2848 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1424 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1988 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1064 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2040 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2540 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Windows\System32\Notepad.exe

"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\New Text Document.vbs

C:\Windows\System32\NOTEPAD.EXE

"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.bat

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.0.1161171996\621379962" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebfa9c3f-ba36-4def-8a5d-0927f968810d} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 1300 11ec1d58 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.1.1758319658\1234398664" -parentBuildID 20221007134813 -prefsHandle 1476 -prefMapHandle 1472 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8280a7cd-8da3-4d00-9a88-c2edfc42be50} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 1488 e71958 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.2.1402479694\72594014" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21031 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e674126a-7b60-4e6b-8ded-efa1a979f094} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 2108 19a86e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.3.1359607899\1131702114" -childID 2 -isForBrowser -prefsHandle 2844 -prefMapHandle 2840 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb73632d-027e-4974-9ab3-6a41c582be69} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 2856 e68458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.4.797924293\77762396" -childID 3 -isForBrowser -prefsHandle 3000 -prefMapHandle 2992 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfb5ef7a-2893-4a34-b345-25cb51fc878c} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3012 1bc6ed58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.5.930399214\530584060" -childID 4 -isForBrowser -prefsHandle 3828 -prefMapHandle 3812 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {185925d1-bd73-4a9d-8fd2-a8c4f5fac1a9} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3836 e64458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.6.1894321466\41368387" -childID 5 -isForBrowser -prefsHandle 3960 -prefMapHandle 3964 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {00982908-f971-4907-87ea-f8e8ace5085e} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3948 1e971b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.7.280027063\734369054" -childID 6 -isForBrowser -prefsHandle 4136 -prefMapHandle 4140 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c48de2f1-1576-419d-99f2-6e73ba4e7e64} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4124 1e972458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.8.451475193\496802201" -childID 7 -isForBrowser -prefsHandle 4492 -prefMapHandle 4480 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a2bb730-0ae8-40e4-a4c0-424ca202b090} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4504 21c7d158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.9.221849559\101998776" -childID 8 -isForBrowser -prefsHandle 2600 -prefMapHandle 2604 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac3120a9-073f-4174-a9cf-a9fe287fe9fb} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3932 17b7d458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.10.73603051\497334885" -childID 9 -isForBrowser -prefsHandle 4032 -prefMapHandle 3972 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {921c83e1-b698-4441-a80b-785df84b1791} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4252 221b4d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.11.957811709\692858503" -childID 10 -isForBrowser -prefsHandle 4340 -prefMapHandle 8448 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db6e6953-990d-4a35-8bf2-cd04e36f5c4f} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4132 221b5358 tab

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\Desktop\New Text Document.bat" "

C:\Windows\system32\cmd.exe

cmd.exe

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\Desktop\New Text Document.bat" "

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\Desktop\New Text Document.bat" "

C:\Windows\System32\NOTEPAD.EXE

"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.bat

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\Desktop\New Text Document.bat" "

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

C:\Windows\system32\tree.com

tree

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 ogs.google.com udp
GB 142.250.187.238:443 ogs.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 142.250.179.238:443 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.179.238:443 play.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 consent.google.com udp
US 8.8.8.8:53 encrypted-tbn0.gstatic.com udp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com udp
US 8.8.8.8:53 waa-pa.clients6.google.com udp
US 8.8.8.8:53 encrypted-vtbn0.gstatic.com udp
GB 142.250.180.14:443 encrypted-vtbn0.gstatic.com tcp
GB 142.250.179.234:443 waa-pa.clients6.google.com tcp
GB 142.250.179.234:443 waa-pa.clients6.google.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
FR 216.58.215.35:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.238:443 clients2.google.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
US 8.8.8.8:53 bing.com udp
US 204.79.197.200:443 bing.com tcp
US 204.79.197.200:443 bing.com tcp
US 204.79.197.200:80 bing.com tcp
US 204.79.197.200:80 bing.com tcp
NL 23.62.61.97:80 www.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
GB 216.58.212.227:80 www.gstatic.com tcp
NL 23.62.61.97:443 www.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 r.bing.com udp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
FR 216.58.215.35:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.187.206:443 redirector.gvt1.com tcp
US 8.8.8.8:53 r2---sn-aigl6nsk.gvt1.com udp
GB 74.125.105.103:443 r2---sn-aigl6nsk.gvt1.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 34.117.188.166:443 spocs.getpocket.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 52.42.69.239:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 bing.com udp
US 13.107.21.200:80 bing.com tcp
US 8.8.8.8:53 bing.com udp
US 13.107.21.200:80 bing.com tcp
US 8.8.8.8:53 bing.com udp
NL 23.62.61.194:80 www.bing.com tcp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
US 8.8.8.8:53 e86303.dscx.akamaiedge.net udp
NL 23.62.61.194:80 e86303.dscx.akamaiedge.net tcp
US 8.8.8.8:53 r.bing.com udp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com udp
NL 23.62.61.194:80 r.bing.com tcp
NL 23.62.61.194:80 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com udp
US 8.8.8.8:53 www.start.gg udp
US 8.8.8.8:53 www.takelessons.com udp
US 8.8.8.8:53 www.msn.com udp
US 8.8.8.8:53 s-part-0036.t-0009.t-msedge.net udp
US 8.8.8.8:53 a-0016.a-msedge.net udp
US 8.8.8.8:53 a-0003.a-msedge.net udp
US 8.8.8.8:53 s-part-0036.t-0009.t-msedge.net udp
US 8.8.8.8:53 a-0016.a-msedge.net udp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 www.onenote.com udp
US 8.8.8.8:53 microsoft365.com udp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 microsoft365.com udp
US 8.8.8.8:53 sway.office.com udp
US 8.8.8.8:53 microsoft365.com udp
US 8.8.8.8:53 sway.com udp
US 8.8.8.8:53 calendar.live.com udp
US 8.8.8.8:53 onedrive.live.com udp
US 8.8.8.8:53 sway.com udp
US 8.8.8.8:53 calendar.live.com udp
US 8.8.8.8:53 dual-spov-0006.spov-msedge.net udp
US 8.8.8.8:53 outlook.live.com udp
US 8.8.8.8:53 dual-spov-0006.spov-msedge.net udp
US 8.8.8.8:53 calendar.live.com udp
US 8.8.8.8:53 LHR-efz.ms-acdc.office.com udp
US 8.8.8.8:53 e11290.dspg.akamaiedge.net udp
US 8.8.8.8:53 LHR-efz.ms-acdc.office.com udp
US 8.8.8.8:53 e11290.dspg.akamaiedge.net udp
NL 23.62.61.194:80 r.bing.com tcp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 a4.bing.com udp
SE 92.123.135.87:443 assets.msn.com tcp
NL 23.62.61.194:80 a4.bing.com tcp
NL 23.62.61.194:80 a4.bing.com tcp
NL 23.62.61.194:80 a4.bing.com tcp
US 8.8.8.8:53 e28578.d.akamaiedge.net udp
NL 23.62.61.194:80 a4.bing.com tcp
NL 23.62.61.194:80 a4.bing.com tcp
NL 23.62.61.194:80 a4.bing.com tcp
NL 23.62.61.194:80 a4.bing.com tcp
US 8.8.8.8:53 e86303.dsca.akamaiedge.net udp
US 8.8.8.8:53 e86303.dsca.akamaiedge.net udp
US 8.8.8.8:53 e28578.d.akamaiedge.net udp
US 8.8.8.8:53 platform.bing.com udp
US 204.79.197.237:80 platform.bing.com tcp
US 8.8.8.8:53 dual-a-0034.a-msedge.net udp
US 8.8.8.8:53 dual-a-0034.a-msedge.net udp
US 8.8.8.8:53 login.microsoftonline.com udp
NL 20.190.160.14:443 login.microsoftonline.com tcp
US 8.8.8.8:53 www.tm.ak.prd.aadg.trafficmanager.net udp
US 8.8.8.8:53 www.tm.ak.prd.aadg.trafficmanager.net udp
US 8.8.8.8:53 support.microsoft.com udp
US 8.8.8.8:53 help.bing.microsoft.com udp
US 8.8.8.8:53 e3843.dscb.akamaiedge.net udp
NL 23.62.61.194:443 e86303.dsca.akamaiedge.net tcp
US 8.8.8.8:53 waws-prod-bay-231-5e23.westus.cloudapp.azure.com udp
US 8.8.8.8:53 e3843.dscb.akamaiedge.net udp
US 8.8.8.8:53 www.tm.v4.a.prd.aadg.akadns.net udp
US 172.64.154.167:80 www2.bing.com tcp
US 8.8.8.8:53 waws-prod-bay-231-5e23.westus.cloudapp.azure.com udp
US 8.8.8.8:53 www.tm.v4.a.prd.aadg.akadns.net udp
US 8.8.8.8:53 www.bing.com.cdn.cloudflare.net udp
US 8.8.8.8:53 www.bing.com.cdn.cloudflare.net udp
NL 23.62.61.194:443 e86303.dsca.akamaiedge.net udp
US 8.8.8.8:53 support.mozilla.org udp
US 8.8.8.8:53 us-west1.prod.sumo.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 us-west1.prod.sumo.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 th.bing.com udp
NL 23.62.61.194:80 th.bing.com tcp
NL 23.62.61.194:80 th.bing.com tcp
NL 23.62.61.194:80 th.bing.com tcp
NL 23.62.61.194:80 th.bing.com tcp
NL 23.62.61.194:80 th.bing.com tcp
NL 23.62.61.194:80 th.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:80 tse1.mm.bing.net tcp
US 150.171.27.10:80 tse1.mm.bing.net tcp
US 150.171.27.10:80 tse1.mm.bing.net tcp
US 150.171.27.10:80 tse1.mm.bing.net tcp
US 150.171.27.10:80 tse1.mm.bing.net tcp
US 8.8.8.8:53 ax-0001.ax-msedge.net udp
US 8.8.8.8:53 ax-0001.ax-msedge.net udp
US 8.8.8.8:53 services.bingapis.com udp
US 13.107.5.80:443 services.bingapis.com tcp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 e-0001.e-msedge.net udp
US 8.8.8.8:53 e-0001.e-msedge.net udp
NL 23.62.61.194:80 th.bing.com tcp
US 8.8.8.8:53 c40753709a155bf6f0a881b79769939a.clo.footprintdns.com udp
US 13.107.3.254:80 c40753709a155bf6f0a881b79769939a.clo.footprintdns.com tcp
US 8.8.8.8:53 s-9999.s-msedge.net udp
US 8.8.8.8:53 s-9999.s-msedge.net udp
US 8.8.8.8:53 b5fccd0cc4e8e6be394d0a9dd407d872.clo.footprintdns.com udp
AU 20.190.97.11:80 b5fccd0cc4e8e6be394d0a9dd407d872.clo.footprintdns.com tcp
US 8.8.8.8:53 ml1prdapp01-canary.australiasoutheast.cloudapp.azure.com udp
US 8.8.8.8:53 ml1prdapp01-canary.australiasoutheast.cloudapp.azure.com udp
AU 20.190.97.11:80 ml1prdapp01-canary.australiasoutheast.cloudapp.azure.com tcp
US 8.8.8.8:53 1160ae589d9ae217ed914e78cb95b272.clo.footprintdns.com udp
US 204.79.197.222:80 1160ae589d9ae217ed914e78cb95b272.clo.footprintdns.com tcp
US 8.8.8.8:53 a-0019.standard.a-msedge.net udp
US 8.8.8.8:53 a-0019.standard.a-msedge.net udp
AU 20.190.97.11:80 ml1prdapp01-canary.australiasoutheast.cloudapp.azure.com tcp
AU 20.190.97.11:80 ml1prdapp01-canary.australiasoutheast.cloudapp.azure.com tcp
US 204.79.197.222:80 fp.msedge.net tcp
NL 23.62.61.194:80 th.bing.com tcp
AU 20.190.97.11:80 ml1prdapp01-canary.australiasoutheast.cloudapp.azure.com tcp
US 8.8.8.8:53 b5fccd0cc4e8e6be394d0a9dd407d872.clo.footprintdns.com udp
US 8.8.8.8:53 ml1prdapp01-canary.australiasoutheast.cloudapp.azure.com udp
US 8.8.8.8:53 ml1prdapp01-canary.australiasoutheast.cloudapp.azure.com udp
AU 20.190.97.11:80 ml1prdapp01-canary.australiasoutheast.cloudapp.azure.com tcp
US 8.8.8.8:53 b5fccd0cc4e8e6be394d0a9dd407d872.clo.footprintdns.com udp
US 8.8.8.8:53 b5fccd0cc4e8e6be394d0a9dd407d872.clo.footprintdns.com udp
AU 20.190.97.11:80 b5fccd0cc4e8e6be394d0a9dd407d872.clo.footprintdns.com tcp
US 8.8.8.8:53 b5fccd0cc4e8e6be394d0a9dd407d872.clo.footprintdns.com udp
US 8.8.8.8:53 ml1prdapp01-canary.australiasoutheast.cloudapp.azure.com udp
US 8.8.8.8:53 ml1prdapp01-canary.australiasoutheast.cloudapp.azure.com udp
US 8.8.8.8:53 b5fccd0cc4e8e6be394d0a9dd407d872.clo.footprintdns.com udp
AU 20.190.97.11:80 b5fccd0cc4e8e6be394d0a9dd407d872.clo.footprintdns.com tcp
US 8.8.8.8:53 aus5.mozilla.org udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 35.244.181.201:443 prod.balrog.prod.cloudops.mozgcp.net tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
NL 2.18.121.73:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.187.206:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.187.206:443 redirector.gvt1.com udp
US 8.8.8.8:53 r1---sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1---sn-aigl6ney.gvt1.com tcp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 aus5.mozilla.org udp
US 8.8.8.8:53 aus5.mozilla.org udp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 8.8.8.8:53 aus5.mozilla.org udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
N/A 127.0.0.1:50335 tcp
N/A 127.0.0.1:50343 tcp
US 8.8.8.8:53 location.services.mozilla.com udp
US 35.190.72.216:443 location.services.mozilla.com tcp
US 8.8.8.8:53 prod.classify-client.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.classify-client.prod.webservices.mozgcp.net udp
US 35.190.72.216:443 prod.classify-client.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp

Files

C:\Users\Admin\AppData\Local\Temp\Cab8C7A.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar8CBB.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 26ba3e16f45141c38ddeeb934aa98899
SHA1 a970eb606b6f893b1c733236bf6b1c215642db35
SHA256 a01c1aedf0d8ec1353ddab9062ea477bb5df202b59f5a308f2b375758d20050a
SHA512 fb9fe3ec0da24c5defef2680d7ab85ebfd2209d69216780b8c5bffe8ef5200495ecbd1c315b5e47c34e97f7f257ad7f41bfd98bbb23a324f3d3c9332b8b00c64

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ca94c4051c8064871f4558b9af91a30
SHA1 7cdaea6cb9c11847c13115e803c913903989a77f
SHA256 9995fbceed414760deec2ca2f249ec4477cfd10881fe35c384f73284f7ff8407
SHA512 d8d67c1692b82b767fb77a251754d1d32a3836cc377cd83923a30739ef18d0f0ab90be969187f93b7d85fddfeb4a3856223fdc244df675fb96dea7016e3802ae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 40dc53cb56e8f00028807430d6c23fdb
SHA1 612ff253db524f64e09f5678336dc8a5d7036cee
SHA256 8c39b4a10df453c29b433955cc34b6906270ebbff307c962bbb92f49e4938756
SHA512 1dda544cf047dcf0fd93b158280cc195c9e19740fe5554492c210a43d3a3e98a78be6e775dc3e7e7d5c98ae1eec1d09ffc5f1e4386d4fea083ee11f7a5c08966

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d33c4112df94f24fc9b947b0a1b55d98
SHA1 7a0a0aa641998efd3d9db220d9ad1eafb6ae808e
SHA256 a40e4c89589b2c36b165f5a81d8279c7fa49107a1fe245fb36e142fdac487dea
SHA512 e72182be2b3d4ecdc8ca0a9d4e59e1fcbf3f17f2bdd24aa51dd7333d6663f82f7fb4a07a5593dd2b1c3469b96c83e2616cf2465de0e593f615f65fa00e244359

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 297f89af768227ad7ef1c55acb174481
SHA1 46d00a1be4eeecf1a5dad16179a29ed89f723b8b
SHA256 5720d46bb48585692e95a0ed23c1c994b7eacbb1a79c92581289bdc2d4baa1ca
SHA512 16b0010d236482cebba29243262cdbcff6bab9997fa509940ab87715f8cbc76650213dd3cd42591153ebbd7c5d03c34e1c60becbb10890361e7a006e9b2e422b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e46312fa12e05318b9bddd9944fbb6e
SHA1 005e137702aa8c7fcc327dbe096ebf47dbad6589
SHA256 63ad8483eaa8450510b4588e7fbcc100219370da4436b45716d1c541e091a99e
SHA512 a12aa2b689817987dbc74f488d32b110cbe8d505303f9f0fbd8739ff4ab8c621e718864b27f6717bff02075ecbb5ac77fa6bd5b0aca9ea3b46ae49f36ea701f3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ac697e2995ac625b0f89f29f0af3de8
SHA1 548ec7690e83cbdd82a68e4508aaa6ee05824e2d
SHA256 e0148f4404be092a71c6466387284013ecc0cd091dc8e15e1f1d9f481f7954e8
SHA512 ddb2e40432f50d4a0a99ad77e58ef11d7ebbc7fae783f115f2832ff46478ada159e16aa11b6efa8a2e97be2b522df087bf88f4a44942ae9dc11c41800fcb2b92

memory/2888-435-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2888-436-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2888-441-0x0000000140000000-0x00000001405E8000-memory.dmp

\??\pipe\crashpad_1036_XMBZBQRLTDPSGSYH

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e77e0a3466271091d708b1da896db182
SHA1 132d2a183b9867dfec01b001a06a295981baf5d7
SHA256 e23416043c28adc97a3e1972ed385b5aedb91b0478f3aa8b8a4e8a7992316cad
SHA512 a2200bf50b369aef423e2a1735bd437db1d196987991368db694379c03b5ddb73dabea5d4416cbd13d7defd4ba2e2db841c822ba160cc6a3dabe42790a75fec2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c58af53522d65f146f45aa52091ca239
SHA1 a15cdadbe38c3683056e94ed999f49b7aeff22b9
SHA256 030d940241a32cfcb7a938e33642c38fed273d84fc4d35d3d8010a69fb38cb6b
SHA512 f6c7103d8686dfaa5b4b727d74505273f795e8e41e07772dda46ebb7a05378d1b680247230a1da4aa46e1cf02e7007bf61536ca73359d86c71f8f05c2d5fb2d0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 d9f16b350b9c8c9d1f7f50b1d5c0fd1f
SHA1 d9f2e3f559946510bc1e0f0a38f5473662c4a596
SHA256 07e8f46339b0da2071d326fd746b4f4214e88424cfd7b25d81965b46136778e0
SHA512 3d6036d3828a6df70699eec1cb99dd63d8ad489e6c1c01e1d7fc63615ce61b08dd92ef75db6bb7d4fb8af0201f33a9aad241b19300f45724640c7c7401b3ecfa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 bc1ee4d2997bb12b010c7c8f71c7d629
SHA1 0415bd58dc24c0db52291e22e0d5d83d22c9ac7c
SHA256 9e187ca8c8cd280570556fe6e027c4430657d885375456f9f6c15d8608e95029
SHA512 6133b61f71c9cfb194a3a8e11b8f19dc24101186dc6e9b3b63c7a09b4c27c87e439d025980b0a2927b3642160064ad9665d6b654953aa33172936fa26aeb8ec4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fa5c483684a183baf6af3b99e09c67ec
SHA1 4c86f0cafcf5a8e4d484479b6ccbda917d10c753
SHA256 7d899261180358111708e0b34abf95417882d924883fa88cc293476ecaadd4ad
SHA512 8dfdc235f7f88cee5e73dbc455829e9553bbd3aa99ccb826b573b842e8db3a69a64c9cb278654cf523f2caef5263a73be911cdc088297c25d4ebce875e3c61d8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 46948943c9067914f35ca6e697380ae2
SHA1 956600d1f7d8c28db2bc58671fc721e015f05032
SHA256 1d5085d6c3f5efecaaee2e8b1b661275b5cfda28875a3d54b7d71362043dd840
SHA512 1c82061e06bedcdee2ac6c2e628a2a5998affbbbf6193697f894e8079f2b1ea1f8cda3752e60c23fe980b0ede2b5cd61a59c54d5a772de8183c70d1150629742

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 9d3c22f27b456510decdefa89150d9ee
SHA1 10931ae82bfe49175f05ce04e820c2718710b8a7
SHA256 9234797d10c448868398b1ade03a6da0cdfbac3be6d735f0a01c320237ee3e46
SHA512 bcdfd54551457b5a02aece599ec59e6673da4ccbda8db01c4e3ee36a6a4509d0f2056ab7dc71f5d3d29060fc84d2cd95c09b86d911d04b2de502c5ce58d743cd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

MD5 081c4aa5292d279891a28a6520fdc047
SHA1 c3dbb6c15f3555487c7b327f4f62235ddb568b84
SHA256 12cc87773068d1cd7105463287447561740be1cf4caefd563d0664da1f5f995f
SHA512 9a78ec4c2709c9f1b7e12fd9105552b1b5a2b033507de0c876d9a55d31678e6b81cec20e01cf0a9e536b013cdb862816601a79ce0a2bb92cb860d267501c0b69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53aeb77e38096551732fe69a713d2a74
SHA1 459d026d0cd3a2469537bbc3bed1d376e7dd07b4
SHA256 f2b849af62727ee528969cfa86b8e402293b21d545b4ed89fad57ef0c0efbc3f
SHA512 6e32989f5c42f29ba9c9ad5002f48e995fa5ee14ce7063afc12ddddf97fb5c7587c408c79b003452d3901c23afd8d3273aaaa17a33b75bc398eeaf237c46c795

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 f4b8545a0afc59b115d14df9fbca86b3
SHA1 1220195d0aaf3a81e230616debc98a5889dfdc1f
SHA256 90d82b2d8258e0a32b986e5466861697a8ddd6dce1791ff15fcaa7fb983f44b5
SHA512 602f2928f3c7ef5ab4da9b37a05acc14607d6402d227cb96352df9486e5bea8d00a362c02a41e9c5f60b6af024ca69d42db576299b4bdd574c5a19868a4163aa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 25356724abe2b5bf927726928bacacc4
SHA1 6ae0654782b3aa58c84c4a6187a591908633e4ae
SHA256 87b2cbaa9141a5a7cbe8d3df930be04913dbded87843a951698ca24ec0775a72
SHA512 6b13bf7b3b1fb67ec949a053c79a3fc92131ae8189af342686fd04a58183173986a29becd0af58b1d7f703a62f56eddcc7c6fcf042a7f07e0e52ba10c18c00f7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5d05bac2b0ad8d35f9e74ddedca8ac07
SHA1 93558f437eae7e585fc0ba3bb5395a160e96108a
SHA256 737fd7a049a030657b6daf33e1756ee9689458bc741e077c897a10f2cfd04d27
SHA512 0aabced51ec22dba5cf619fe7e20b1858afc94b2b9e1475214acac09df2d30f26e29f8aa8f616ed3830cad774b549a9d6854bc1b4fab1da7cffb69608518e657

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 f41c97500de412238a51be13dd568d72
SHA1 c4fcd6eb81e591afb998c6841bb1d48ae2fbc9ed
SHA256 a895a642e7665ff05a9caeb7e797e1962f7e2e72bcf7b632918a0aa1b6620cb5
SHA512 afbdf82183f8bdd799ae10c2d95c76d87ae3ab680b48b9a88c5a6bd633fc0cbee404f4aeaeab105112017f596844f2290398c0dda0a5983c17aa0cb11f4616cf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0b45fd5f1ee03208ad2067f34f76e129
SHA1 a2c7575219f1a3db47e73ea50c03818828bdd154
SHA256 69bc8601d7a7c29f6f11ed916a38f83292e94f1cda48ba66d93558f0626b97ae
SHA512 abd88070a2d808dd7811241ee81533978b0e2c5e64a4af536e688fcfc78ca4948a94986083ed108b68ca9025d82e6ea99827a874d8b6b52378802f2f37f8dcc3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9487129234a16f14ae6da5561d3a8bcf
SHA1 dd20b2531ad6c4d5abad9aee656176cf901a8ab0
SHA256 cd2194d5ada97da7aa7467323c0ffc17382bf5ed3d01bc5abc5c10360b43a8ad
SHA512 35d1c16f1d4c04bd3309fa6177a2cadffeab9f4ae509717f48920ced9de5a50f1f3f9f25cadc83f6ffb12323d12a1af8428fbe1daae256256e81fe88db686568

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 2cfd94a1f08c961523d4b1d44564c06b
SHA1 2f12be707a9c4afb23670540e95201bdd7c7f1b3
SHA256 0f953d3e6f47c8d48d65e6bd90462ea0644ca43bc9b05e3f92a7f8bd8eb3b52a
SHA512 0511172c89fe6c6c1fc839a9436081367ef85d379cc074d3c5dd2b56572207f5d74326774f896f259170c1981d0db193da5f1c9019c401ffcf36f1cdd0f19231

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 0acdd62d761753aae4078a277000e947
SHA1 76bdfb27881376bb0a54169b7b850eaf85891f46
SHA256 d15e55f7809dd6afbaac917b0bbbe43ee8e5bf2b7b32779632ddb363a54bde26
SHA512 1e5f6508561c79a3e6328cd9dae8b3e162b6b62d6bfb284fdf13902a2a6fc17fb376f527b62c15446339e789d357a0da3b7d8861da1b57246bae947c8936f4c5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\782a64c2-a213-4156-b74a-939a8fbc0773.tmp

MD5 8852d2180a82a1a46522daf31b9ee39b
SHA1 e18963dfa4ca91ca6b40f62796e7baab07bd8605
SHA256 c13eabfa2f4f0a25ef31b71dbb378ef1446d44b9b1e977ecdcd58a1c101f6eb3
SHA512 5d6686b1e3b13edf1dd088cf027bcb056d931b0e2794697b6a3e9e5750da4b1c2861818ff0e5c0158492b35a39c1d9a77a132fed863c3e2151689932f1bbbd1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 a207c3ae6d9ac2505ce46790528f9ebc
SHA1 cdf9d39652dba44d8fad377b41eaf156103af431
SHA256 d263eb56be670398dfb7b520b579aa53ecd013ac8aad72d11c41d442fa648717
SHA512 6a417f4e085342f627435382bcfc380ca6a02fd18f31f5cc432d8ec2304fa35ce41c871f5a85217293f79931b73190d950122356422c7fa292e34e60763853a7

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-10-1.bdic

MD5 4604e676a0a7d18770853919e24ec465
SHA1 415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f
SHA256 a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100
SHA512 3d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 3de66b442bc5edae498371ccfa58f0ea
SHA1 2ed57acea3ceb5fb1bdf1904c3563c9440ca4f42
SHA256 dccf2a249946c64d677fb71b1796db20fab8afe032a040a36993341380d44ec7
SHA512 5a0adcfc50e4b19acdc12a99949743dbc46b5fe8bdd9ff0c45388c5cafdd4bf205e7b91f8f24bfb4937d52c2f045a3dc5f1e50b83395bcaf4c3d17ee80b2f76d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\80e081e1-0812-44a1-a475-76a5859a18cf.tmp

MD5 5daa522c9e904c090ad1d121690c812b
SHA1 102d2f38d5dd7d848274ad222a30a5634b75920e
SHA256 1126a279d2b3f57f5b88d242b1fab1b380ab4b92a5b2a97e970377ed346458be
SHA512 7c1af817ba610fe568678a0244ba27ebec7abb69e8eb15da5516e96141d43150fcfab37338f76d869cea48182ea3bc9e945cd68e692b066b61f5203ea0cd6632

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cf3330e0e76aee4f6ef9d9f29086d649
SHA1 b6f6b8c0e283c11fa536605c1ef592d2fadeeab5
SHA256 75e251d3a8d0bc882b3d4471e7957520a882cf24eb003b5e211b06c8c75e733f
SHA512 5ab66c04102ee3d08c020446d7d3eab274b3fdf44985f55080c2208ced4e186a34e579974945720fbb3d41c433dcd5c2d5235121060d814fa4fd2fbbec253ef9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\datareporting\glean\db\data.safe.bin

MD5 2a4c0433a38a427e6d30fb3ebc47db1a
SHA1 871dd42458eda28558848a4301a09671037b73de
SHA256 6bd099117268ed685405cd8d4a76f1ed8a8c3704f32efe5054f758294e93f538
SHA512 72f036f76927799a0cc6424706ccc9286e004de28dc5c25491b6abfac722afab6c3df946f392229670c18189a009498e244f9cae6ff1f09e04703d0ecc0ee870

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\datareporting\glean\pending_pings\9ccfc122-4d1c-4f08-bc4b-64ad872bfa67

MD5 c5c466a9f809698f61677cf6c1e23c8a
SHA1 cda40684ee833bd9690281906cb39bc1edf48658
SHA256 4d04addafdd1a57c016cdcea953f0dae5fe973d62906b113e37fec31b7a789b4
SHA512 861b7988e7f19a0cf337e16fe6a86d59e56fd68e7b5864b33814e177cd6f47fcc908e52f48b7cc25f30753ee8b8059e38a408a385931ef95f7df0b94154c7ec4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\datareporting\glean\pending_pings\3cf4e0ee-dd9b-4a35-89d4-e3db8fb25774

MD5 b5be6c181666797c82449f9d724e9ee6
SHA1 e17be08db940f3b35bae8cfbd971732df02327de
SHA256 970ea2e07395e856726d5688f86bc58ea6b15a63d4617dad40f277bf1fea7504
SHA512 f038bc28da774d5f322fe361fee3e44560732af412f9c7ccfb5c48dae8f2eb52e701ffb094a265e4e90310690bab310f90804160e5b505b12fa35581604a971e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\activity-stream.discovery_stream.json.tmp

MD5 40662c887e51c225200fc72e8520949c
SHA1 1cd77362a5fff776eda94a1978015c403e302fba
SHA256 7c1053b9d5ca54781fad9115367731feb2379d161d3313c3628ac77237b71eec
SHA512 4ed39869c872d1d0ac01d2bca44f39e6ba6f00ec9b9a6f7c513b4525ef11cc35d9240ad7e11ff4c180a819476d279b214bfb125e40814905af77cb376d22617a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\prefs.js

MD5 2930233070627191f79e710396edf70e
SHA1 d70355bb4af16c02cf4af404668f27b4b0d6d971
SHA256 d6086d0c8d8800f9271ee8265b2c86dec409c50942eb98949937c0e2bd83cb14
SHA512 e051320c3b517aca527927a0c65290028953cb89d2c550d077fe43a62623e1139fe2df0d9285b600d1cb4eb43ed97219d793580403cf3d9128210ee534ac0ed9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\entries\1A46B60D72C2FC66DA7284DB961C95808BA84FAA

MD5 4453d371c1d2b3e199f01a68a673a404
SHA1 574a353cf84e5863f403245d37483d6730f274e5
SHA256 470b24a5e1cca5df4bb45575447f75d7b2d650b4a879d3739c0bfcde09a783b7
SHA512 b80444238f8507c4d1ac9fb5e7dddb619f18b3d3a0e06d2cc2e19e7e229a01c87d39be62bb7bc4c678ed5f7e976763c1bd8d92a2fbc40bca290c6fc09c7e9349

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\prefs-1.js

MD5 b9e145234e1b3346609717f375ae5c48
SHA1 d1e67b0e30c1a67f5b0218ffe6c5807af2985d1d
SHA256 758e55d9f6fd9fbc8f4f76a40d7ab713d39968b6c9bc94899d2ab1d7f6e777ba
SHA512 9e53969d595381de50e808b103d819b99ef911cbc700d8aea32ea3cd5300a786e721df2947c8423a8e068ecc3a9815982ce62162748694a0a081f4463023e164

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\sessionstore-backups\recovery.jsonlz4

MD5 5eb03b3a6f3bee48fb1e5c7fa4791601
SHA1 b95ba05e9537f9cc437a7d49c41743341774fd92
SHA256 209eb59f845c5440f5c412617166b65080cf78d852ad2c2f446975d76d03abe2
SHA512 500f060fc2ab385f40e20034b9d4349f677cc50d8f587674b0d75f543dae1ce8c1925e8583a9cda001164245e98e4924835de032d77e9803d0cb63d260cd5081

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\doomed\18958

MD5 e199b9c1ce89464c764a127845607ce5
SHA1 5df49f5ccbcbfa2dd21886f496440233fa85d05b
SHA256 173c74bd3e4f313c7c8cd21c21cef1027d235b05c3e566177e4b09be0d4fca0a
SHA512 86abcc1f0d0c0727dfb73c163cb325639e01f1a7bc9906d1d8fd6e23780454e413a8b4755863ea6e12119a9b6b0abf2b1f537547c73d077cfb14564c5c75f711

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\entries\5AE6D89F9E02E65CE57A707F37A56F985F9BE4BA

MD5 8aee4afcfe485795eb9a366149e7450f
SHA1 8b43de4062c9bd253b7d0bacd9a661cc9debda5a
SHA256 14497904a5ee9955ddc99ba92c8f1db21b6d024890d7643b2ffd48d122fdd8c2
SHA512 52fd51e1ccd4046c2a15991ad784adc9443c7d810e5dcacf4abc4da1ebc0917390f9bd2980ef0ddc3bfc7bd255f405edfa65c2a65df66dd8a88708f235c40cb3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\entries\80BB96996C8133B0FE5E0D6E5EA21B26135E8EA2

MD5 b95e3200269472cc1742c1283968b414
SHA1 7e7149f1a0a9db74c64109aef2327019ce75eeae
SHA256 003603f4f9fa9ba44513c84dc964c3d873422d3c00748aabbec8606cc8fe433b
SHA512 07ed5f2785a9b9ca63beb929ad68d5ca5904afbc4e2b34566ec5f2c7b9a5b289b504158b67649c2853ae73342f5ef21ebf07c62b2939bc20b8aef3354b5f3ae2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\entries\E8254BFA330D5945BAF042EF8F887002F85E1017

MD5 e963ee7d918d7f1e18d1d059627f38b7
SHA1 bc2d24d8c9f131db5eb09851d9d7c9a25a95bf5b
SHA256 ac85349d96cdba57580052edfe9603195bef44646fcd869427e6bf3f9cf6cf57
SHA512 a8b1ccda0071ec945aa56bd49c9dffe30ada2dcf737991c769834f3ca4ffd73f12aa824f30c78d9ece7a37e880444927fd146a9033b5eaa778f4277cc903ecb0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\entries\46C625DB4964C00323A8EF4C60828B52A454EBB4

MD5 1a088dde07d6f147bbec3fdba93dc422
SHA1 7d657c118829f4ffbfccb5a1f046cb1ce4b8d414
SHA256 e973e1f3ac3940d60f8f348629d60aa0bbeac22d4b81b2507cdf8ba74be216a4
SHA512 571e22c64a1277009fc5e8efaff44107b7d2d76ad98a2f36ae33c9fcea902bdacf6eba9963e83587934c3450736ef716e6040ef05053ecb46fae2c37b1d4d54d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\sessionstore-backups\recovery.jsonlz4

MD5 69f214d10c2f619524272a3cce070f2f
SHA1 1646a383e73137e51a8c7a33a369fddc04ff6a19
SHA256 53e528c7d0d8e369aa35534b2028923461179714f75a17490cb1b14d7b535c60
SHA512 65c4399f113c83642d98659d440c0e047ff068256b852bd5d9344918eeb4accce400bfd1c7aaf0975f4b0f3deecdb14d6203c0ea062d9cf3ff2c3f4ee410ae61

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\entries\971254C7341460E85C93D0821B91E9985A0B32D6

MD5 f23c5d52cf9baa3ae7700b4352f05d4d
SHA1 ec884fb0a00b2e3fdc917647c2730578a9809584
SHA256 2d1e239c73b20182fe6052d868965f13f5f89013064ee48e7d9ee4d330b122eb
SHA512 df27164bb23bbb315c81b223834a2cb7be3bc356dcbf92eaa51c5bed0299abbd342acbfbbbe553b4031c4a1c4d80dcf17ade26403a7f3838cdb6b506e1d45495

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\prefs-1.js

MD5 5410793601f005cbbff46983d70908aa
SHA1 57cc6fbd5bd4728144217c05bccd31a626e1767d
SHA256 658ad5b84ca45b6ba46a74f36c763cee1a570005c511bb73a7b6e06ac9693248
SHA512 3f0038f4aeb003965712639635f72184365dcd340d0168c973ce83b8e918c0ac6b75197e3fe066ff7b4d75288e5e4882a21c9bc433b3aa71af0b57e30d8780e2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\sessionstore-backups\recovery.jsonlz4

MD5 211b0f43a23c21dc264e51b73a44d205
SHA1 fae1a7928a629421fb1698e1821da1d152953396
SHA256 d106c7de9efd5dc8fc2799763170a92d228866c6e5d609729008b44ca72f098e
SHA512 06cfdabc66d8143a1687402e17bb566eadbd63271bf0e0a9fa7ea85b894c09022c8923cb8085c6be28e65428dd822424d72dcc7f082dd14b9cfa7336a88416c5

C:\Users\Admin\Desktop\New Text Document.bat

MD5 b2216b693a11c88ff52f02d5f97375e9
SHA1 a6a16522e0aa12908ee7746e9241978f605a896e
SHA256 2608304a5b49deaacc53a467694e567ca766029f43f2bc920ad8fe994ae218e6
SHA512 911a99cfa74878f055ae15eef8fac2dd044929f49057868e80e86c3e1756335b84b94ec3b2257b5b84aaee0148a94d3775c2e867a4038e3262bb7ac8d974145a

C:\Users\Admin\Desktop\New Text Document.bat

MD5 ffb1c2a8d44d9616c6b3a46d75fc48fa
SHA1 d2b895ca340a13a760b8a4a164646cc228e4bbbb
SHA256 a2d25886dde92a86d03e5a3dbd155d9677f78da5cf5a3e8692b912158b1be45e
SHA512 20eeec74e10c4c2e371863dae546574f8a32a16520c0f40d7f729e9fd169c485343b0b1d7c4017727e11a91db00bb11aaf1ec667a38f926a4af14d563e09a73e

C:\Users\Admin\Desktop\New Text Document.bat

MD5 3c0ab63ad9f630b18725498421e1aa42
SHA1 e47d29ff4a03f2048d6f182c9e5839477ca09f45
SHA256 094fda3c78d62f7ebd7d479244ae563646b1d62de6012f3fcf23bd258874a504
SHA512 f7634b876d404b2b74c8292fc3bffb36cfe7bf13f024b52f1deeafef4f9ec45b4ac7b71547d68cc37fd68ebdb44d649c17aef35e1d36caf002bc3f80bc6e6fd3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\prefs-1.js

MD5 516c4c20d83128295df363db926be5cd
SHA1 80bdbb0476d9bdbef2f398c83cf3f7601ca55352
SHA256 dd7909b124a0c1757e2abc708fa12e74273fabc6ab7f970b9854d2b82f00f1b7
SHA512 fd6ab1d9ea3017c32db26dc3fb5a484267fdb962f4207e9f790857781c2b664ebde2007ce249650a2088e8f618f10b904f931a402c6931cf869f966c4577b5a9

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 dc279d305cb9dd125ce7e9b48dce2405
SHA1 61e31d4917192e5869029d29efea3447e1691acb
SHA256 956f7520a63e3af31c1e4d1e6c9c36045c2736cabf692d588217b4826f269ba9
SHA512 698579b9d1d2d83763b528dacbda88adfc90d65892108c791ee006121a32e7a6afb3883177ff1a2f62f4b1fcc6a639d22c6e76a3642593771714713625590199

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 55c0e19a8ab7a92dfc1d327f827462d4
SHA1 44552f79734c951d7902e4d10c60e8110b8e3a52
SHA256 40bb026b18657f007f41b763b7e2de1bdff710faa15a959120119ef3382c0a82
SHA512 1267f07c871964c670a7c8e0c77bb3b32c242231fb44529668192e74e12dcbfd3ddc8a22a7ddcb4c995ec77d47287a638de6ec1cab367e1b8023670258cef525

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\prefs-1.js

MD5 e0cb1b1d6bc13bb16d2a9a5af8aac922
SHA1 84ff67b2ae9ef4731eee40a82fbe0a5194c46a18
SHA256 96e838642609272a380a57e148e4107f0bd697f11eae4fb634851a4c71c099da
SHA512 639d14a136e5ad747aa6bc5a7c406d327d7d38032cd668ae1a1fbbdd197adbe5f62c00547aae2df0d58f1248d3d9aab66ce54602c817ebfab933088b3b29b158

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\broadcast-listeners.json

MD5 72c95709e1a3b27919e13d28bbe8e8a2
SHA1 00892decbee63d627057730bfc0c6a4f13099ee4
SHA256 9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa
SHA512 613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\entries\A316A67D82F673191BAD9C75885EB5E7557D7EFD

MD5 fe032120f910d3e2df4016a9864d79de
SHA1 fb1886551fe38dff871b6e835fa0dd9ef013804b
SHA256 5b3c45cb1d999fbd261a5052b4443522f47348bdc07d7d2d9701e6d919538234
SHA512 f73918d3196eebcd79b3c88f75e30c0a6947626da843d41ba0e24452ae918372ef0d4b5b85dc977ff9d45a284f4cd2c7d7ee36168ac9e7c57c429a1794ec1623

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263

MD5 cc935c277c52fcef03741e011ba3389a
SHA1 7965f42a2a81cd13fe91449962ae32568d707d75
SHA256 7df7ba50147b995d60496b53f3729dd5060636e9045e0e288d44d78295899997
SHA512 e3a41a5c5bd3a88a33ba85442f25a63e05ce688721adb1eb577c0d078e232f873482716c2f82d2142c59f3dc1bc5bfdaaf185c06891027da1bd978414eaa8977

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\entries\B289785F5E5E9565C7453D41EBD6CD1574DF1B08

MD5 f5e4e9fd9690d8861cbde96fea508605
SHA1 d98e4860d870e7bbab6eb73566adab329f3337c7
SHA256 d2d08f2a5147e389ac39646922e2cc24de927f135375a789d26410d297e81848
SHA512 786d5b8aabd5f0d4286d39cb49f52d705a4ff9cffcce756256d5c47fd4766634b531fa10f85e2e9f63173e6b5ac0648c4af2c3305e9b0854cba28889e872b902

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\entries\973EC1ABA74425B23D81A0730A6BBDD8943D8FF9

MD5 be71208970da10f3f717c15e1e92e012
SHA1 733e18314f0d55f7a9f153081b624abf6876e570
SHA256 6b33b6525df73cc7a3cd280aa3f9d8058a8f893b3781057f69858ff99c6d3b17
SHA512 34b36e70e6de1d9575763f1a0bb5add1d686faa3e6134cd68370c898d8502dc486a1997a8a844994b9c2a608933406033bc4d187f0a38c9eeeafb584a23c870d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\entries\5B815D11B2718FBF96FC5216B47566631B023F1D

MD5 a87a2c01ec5e7c358dcb3fe44530613d
SHA1 d86e16fba8b5052041f8dba873472422fda680c7
SHA256 c0c801f471083c753c59ea67b50920cd60768d2119af80c5f9d806315eaf0dcc
SHA512 e319f87144d62a19fb116f7822ac3523296fbda55ce6dbb276eccc8ad768665c082a0ad39b9a0625a454042c961ca75082d0abc541891ad923f248bb93a51c50

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\addonStartup.json.lz4

MD5 35860b7440797fdf92b6b343858fae39
SHA1 62c24f43eedf6e71b226f0159dbbfeecc152f47f
SHA256 fa8d0fffa1b53a2ef40a65da9e28fe04dd91f053f4784f542714e60b4290f498
SHA512 5ae3d1a8279ae0fdf7954c3cf2279ea9c525e36547c4ed92049f741be6bd46bfef82b40763c7d01e0620dcf356fc9fc45b12be4dce319d4d9b354f6fa15d1a69

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\bookmarkbackups\bookmarks-2024-06-20_11_GKSWjyU1WZEFP9fETbs03w==.jsonlz4

MD5 521f0f23620762871cbfbf97e272813b
SHA1 09cef825bb8a42b467f0da3b6f3b0d9f855236c7
SHA256 3e2aa637053c641ffd42dafc71f436cd2ad8522d16ca9c5a60e67c55d5f50fcc
SHA512 aa6c475d7a838f8c173b02e0d9cd76cbfae84200d18519cccfc88437c74e1b797ac0a0229197a48cfbb01726ca4508fa9288cd02c3283cd77812e363b76b8738

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\AlternateServices.txt

MD5 9e3e7800230180b866c902cc78ef1115
SHA1 5363c9e7a6fbaacbea3f7cd926154f9e926f6485
SHA256 9dcf844afeb4df7f228d7c68b9878940db3a538ca132feca8afdc33faa7524af
SHA512 ed40c385ecebf2faa8ef38c8df5574e2ba8c5875fecd50f8c32aec5efbccf14acf9ef43f36a70826aae681d417ecbc64c7f9ca8202223c271942f7051eed57bd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\doomed\31973

MD5 0c7e4708fc0a52e342ae41515cd425c0
SHA1 617ce1c5df9a473510e8b9e0a8000f9954d9b086
SHA256 3e136975a5dd6aba022794b104df6f69480da0780a3562adf81ffbc646e063bd
SHA512 e8c26da5cfab4a448b9755d89f15e936544c47848683d0789fd9bad0376f3a9fd73907b6d55aa4bbc33894f2437cf639b07db9d424e1fd2ccc18e64e390e31d7