Description	Indicator	Process	Target
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\AutoPico.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	C:\Program Files\KMSpico\AutoPico.exe	N/A
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\AutoPico.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Possible privilege escalation attempt

exploit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\icacls.exe	N/A
N/A	N/A	C:\Windows\System32\icacls.exe	N/A
N/A	N/A	C:\Windows\System32\icacls.exe	N/A
N/A	N/A	C:\Windows\System32\icacls.exe	N/A
N/A	N/A	C:\Windows\System32\icacls.exe	N/A
N/A	N/A	C:\Windows\System32\icacls.exe	N/A
N/A	N/A	C:\Windows\System32\takeown.exe	N/A
N/A	N/A	C:\Windows\System32\takeown.exe	N/A
N/A	N/A	C:\Windows\System32\takeown.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-0LHQ7.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-9KDKH.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-K6P76.tmp\_setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
N/A	N/A	C:\Program Files\KMSpico\UninsHs.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\AutoPico.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-0LHQ7.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-9KDKH.tmp\KMSpico-setup.tmp	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\takeown.exe	N/A
N/A	N/A	C:\Windows\System32\icacls.exe	N/A
N/A	N/A	C:\Windows\System32\icacls.exe	N/A
N/A	N/A	C:\Windows\System32\icacls.exe	N/A
N/A	N/A	C:\Windows\System32\takeown.exe	N/A
N/A	N/A	C:\Windows\System32\icacls.exe	N/A
N/A	N/A	C:\Windows\System32\takeown.exe	N/A
N/A	N/A	C:\Windows\System32\icacls.exe	N/A
N/A	N/A	C:\Windows\System32\icacls.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks installed software on the system

discovery

Checks system information in the registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	C:\Users\Admin\AppData\Local\Temp\is-9KDKH.tmp\KMSpico-setup.tmp	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\System32\spp\store\2.0\data.dat	C:\Program Files\KMSpico\KMSELDI.exe	N/A
File opened for modification	C:\Windows\System32\spp\store\2.0\data.dat	C:\Program Files\KMSpico\KMSELDI.exe	N/A
File created	C:\Windows\System32\spp\store\2.0\tokens.dat	C:\Program Files\KMSpico\KMSELDI.exe	N/A
File created	C:\Windows\System32\spp\store\2.0\cache\cache.dat	C:\Program Files\KMSpico\KMSELDI.exe	N/A
File opened for modification	C:\Windows\System32\Vestris.ResourceLib.dll	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Windows\system32\is-R77OO.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Windows\system32\is-8F3GN.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Windows\system32\is-EN54O.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-FH4MH.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-J1AFV.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-3RO13.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-AQ7QI.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-LVGTJ.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-VD3U9.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-BGVLR.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-4N462.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-O6F65.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File opened for modification	C:\Program Files\KMSpico\KMSELDI.exe	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-HUUPK.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-U4RCF.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Word\is-L90BR.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\Access\is-9GEG5.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-OSFK0.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Access\is-GG05K.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-RJ064.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-E4I8I.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-7CB8Q.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-AGPT2.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-E3B3I.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-ENA4N.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-V8MSG.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-39A9Q.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-GC9BH.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-5PSJ9.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File opened for modification	C:\Program Files\KMSpico\AutoPico.exe	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-89BPR.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-SBQLC.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-4DON0.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\is-K0970.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-FNHGT.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW6\Business\is-0I02C.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Access\is-82PO7.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\is-DO06V.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-6LTJ9.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-NE09I.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-BM8OF.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-OTB7G.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW81\is-7M030.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW10\Core\is-DK60D.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-R9TRL.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-06RDR.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File opened for modification	C:\Program Files\KMSpico\UninsHs.exe	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-01BA5.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Word\is-FNU2P.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-C00CQ.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-F05NO.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\Access\is-E2566.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW6\Business\is-FEJ06.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-KNKIC.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-BFL1F.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-HSNNE.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\is-07J91.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\driver\is-BR619.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-M2CMR.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-DGION.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Word\is-9Q1OL.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\scripts\is-FPHR8.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\scripts\is-0BMES.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-19T10.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-FRHPF.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-47M71.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\sounds\is-3RUHV.tmp	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\SECOH-QAD.dll	C:\Program Files\KMSpico\KMSELDI.exe	N/A
File created	C:\Windows\SECOH-QAD.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Launches sc.exe

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\sc.exe	N/A

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies Control Panel

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	C:\Program Files\KMSpico\AutoPico.exe	N/A

Modifies Internet Explorer Phishing Filter

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	C:\Windows\regedit.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter	C:\Windows\regedit.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion	C:\Windows\system32\SppExtComObj.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588\DiscoveredKeyManagementServiceIpAddress	C:\Program Files\KMSpico\AutoPico.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\d450596f-894d-49e0-966a-fd39ed4c4c64\DiscoveredKeyManagementServiceIpAddress = "10.234.249.27"	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f	C:\Windows\system32\SppExtComObj.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588\DiscoveredKeyManagementServiceIpAddress = "10.23.89.51"	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\d450596f-894d-49e0-966a-fd39ed4c4c64	C:\Windows\system32\SppExtComObj.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\d450596f-894d-49e0-966a-fd39ed4c4c64\DiscoveredKeyManagementServiceIpAddress	C:\Program Files\KMSpico\AutoPico.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE	C:\Windows\system32\SppExtComObj.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\85dd8b5f-eaa4-4af3-a628-cce9e77c9a03\DiscoveredKeyManagementServiceIpAddress = "10.23.89.51"	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588	C:\Windows\system32\SppExtComObj.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588\DiscoveredKeyManagementServiceIpAddress	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\d450596f-894d-49e0-966a-fd39ed4c4c64\DiscoveredKeyManagementServiceIpAddress = "fe80::80f5:42c:6f45:436d%3"	C:\Windows\system32\SppExtComObj.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588\DiscoveredKeyManagementServiceIpAddress = "fe80::80f5:42c:6f45:436d%3"	C:\Windows\system32\SppExtComObj.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\d450596f-894d-49e0-966a-fd39ed4c4c64\DiscoveredKeyManagementServiceIpAddress	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588\DiscoveredKeyManagementServiceIpAddress	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\85dd8b5f-eaa4-4af3-a628-cce9e77c9a03	C:\Windows\system32\SppExtComObj.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	C:\Windows\explorer.exe	N/A

NTFS ADS

Description	Indicator	Process	Target
File created	C:\Users\Admin\Downloads\getkmspico.com-KMSpico-setup.zip:Zone.Identifier	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Runs .reg file with regedit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\regedit.exe	N/A

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\system32\schtasks.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-9KDKH.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-9KDKH.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\AutoPico.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\AutoPico.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Program Files\KMSpico\AutoPico.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\KMSpico\AutoPico.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Token: 33	N/A	C:\Windows\system32\AUDIODG.EXE	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\system32\AUDIODG.EXE	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-9KDKH.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://file.fan/3813e1da0f904a05"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://file.fan/3813e1da0f904a05

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.0.1419847738\717649152" -parentBuildID 20221007134813 -prefsHandle 1704 -prefMapHandle 1696 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a1bc6cb-1274-4b03-9da0-570253439a06} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 1780 1e35f8d5a58 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.1.442147505\1325226584" -parentBuildID 20221007134813 -prefsHandle 2128 -prefMapHandle 2124 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a2b2da9-6698-47f5-8796-f858b0b3bf7d} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 2152 1e34d470458 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.2.1299122977\1714534198" -childID 1 -isForBrowser -prefsHandle 2956 -prefMapHandle 2748 -prefsLen 21646 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab359c2d-e38e-4b0e-80c4-23ff91e1b457} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 2972 1e3638d1b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.3.483994952\453401531" -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3556 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77d9ba0a-d85e-4a45-962f-8ea3f878b653} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 3572 1e364c86c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.4.589103644\379386642" -childID 3 -isForBrowser -prefsHandle 4700 -prefMapHandle 4924 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ba85151-a3ec-4fdc-8434-0bf5dbd73c28} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 4932 1e366ca9c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.5.1242323487\1939207693" -childID 4 -isForBrowser -prefsHandle 4968 -prefMapHandle 4960 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed7dd1b2-1626-4ea2-bb51-6c54ef301f21} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 4964 1e366c75258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.6.178811190\1368355501" -childID 5 -isForBrowser -prefsHandle 5268 -prefMapHandle 5276 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9901339d-d959-4c5f-98bb-0d8f6ad87223} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5260 1e366c76158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.7.397130266\1599200035" -childID 6 -isForBrowser -prefsHandle 7796 -prefMapHandle 5800 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7f60925-f9b9-4675-8936-46d727de2b5b} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9804 1e366c59b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.8.233682181\591651213" -childID 7 -isForBrowser -prefsHandle 5608 -prefMapHandle 5628 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfefff71-f762-4c6f-85e8-0ac055f474c8} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5632 1e34d42f658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.9.1216404139\1029452400" -childID 8 -isForBrowser -prefsHandle 2676 -prefMapHandle 2684 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce8233e5-a6ef-431c-96b2-5e21458a6bea} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5488 1e364ef4658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.10.1386872552\419578242" -childID 9 -isForBrowser -prefsHandle 3956 -prefMapHandle 2676 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e971d61-cb10-447d-9abf-816e3014d9c3} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9632 1e367824b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.11.1806312760\1915664993" -childID 10 -isForBrowser -prefsHandle 1492 -prefMapHandle 5680 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {29162e50-782f-4a28-b81f-7af4d779f52b} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5760 1e367821558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.12.1961363653\79096881" -childID 11 -isForBrowser -prefsHandle 9620 -prefMapHandle 5620 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04c7f7e3-411e-4554-9838-7a37b4c7551c} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 4604 1e365f8f658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.13.1363531995\2023634502" -childID 12 -isForBrowser -prefsHandle 7628 -prefMapHandle 4784 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51289ca3-d77b-4475-b681-ea483759dea1} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5068 1e365fafe58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.14.370862358\1146620299" -childID 13 -isForBrowser -prefsHandle 5648 -prefMapHandle 5124 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {015c7fd2-60cb-4fee-97bc-40f99d0b704a} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5776 1e364a77658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.15.2037505385\478801752" -childID 14 -isForBrowser -prefsHandle 9588 -prefMapHandle 9584 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d76ced1-8c2f-4e38-9452-cb77b7e98c28} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9596 1e3688f3258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.16.351815434\112953341" -childID 15 -isForBrowser -prefsHandle 5144 -prefMapHandle 5264 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c028ba51-d244-4e75-a1a8-2bf967165976} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 3964 1e368c66358 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.17.828870967\272358357" -childID 16 -isForBrowser -prefsHandle 4548 -prefMapHandle 4296 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56970eb1-212a-4bc1-b774-2032055a2111} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9648 1e368c64e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.18.1410538437\1191632708" -childID 17 -isForBrowser -prefsHandle 9664 -prefMapHandle 7696 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40473eb8-5eee-4aaa-9399-3fcb39626d8b} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 2616 1e368b74a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.19.864546081\1359054480" -childID 18 -isForBrowser -prefsHandle 5072 -prefMapHandle 3960 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96348d9c-561b-4d79-b931-dc44a2eeaf4d} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9592 1e368b75c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.20.750052495\438358531" -childID 19 -isForBrowser -prefsHandle 7748 -prefMapHandle 4692 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dd9f0ea-3574-4a2f-a6f7-5c372cfec22a} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5704 1e364cddb58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.21.2097225215\1486915556" -childID 20 -isForBrowser -prefsHandle 3956 -prefMapHandle 7144 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2aa07cbc-83e2-4d2c-89d3-26dbf55d80cb} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 7152 1e35fdcc458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.22.738579522\283277511" -childID 21 -isForBrowser -prefsHandle 2624 -prefMapHandle 5728 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {667248f7-dfda-4935-9921-36ef1675ebee} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5700 1e35fd19c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.23.187126207\1329167648" -childID 22 -isForBrowser -prefsHandle 5020 -prefMapHandle 9680 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b5c944b-4fdc-4853-8141-ae11f54c5534} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9696 1e35fd1a558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.24.1651061058\936623803" -childID 23 -isForBrowser -prefsHandle 3028 -prefMapHandle 4284 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f78b03d-b08e-4417-bce6-39d5a82a7721} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5720 1e366c5ce58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.25.281247064\1188343678" -childID 24 -isForBrowser -prefsHandle 6992 -prefMapHandle 4680 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be7a6c68-0437-40e3-a850-d93d0eeb253f} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 6988 1e366c76458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.26.2099107867\249707525" -childID 25 -isForBrowser -prefsHandle 9672 -prefMapHandle 5040 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a580533a-61aa-46fb-82fa-c31a5c2f9a1d} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5172 1e367024f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.27.2033036722\1551225809" -childID 26 -isForBrowser -prefsHandle 7544 -prefMapHandle 7548 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a19d44de-3fda-4f65-bfa0-a9d4ac73d610} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 4692 1e367815c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.28.1788334363\70359923" -childID 27 -isForBrowser -prefsHandle 5316 -prefMapHandle 3520 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7708f90a-2826-431a-8d64-e756926e4a9c} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5744 1e368260b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.29.195902429\834869583" -childID 28 -isForBrowser -prefsHandle 7012 -prefMapHandle 9660 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {74a57a59-03a1-403a-9101-fbdd5b4c26de} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 7004 1e368f21058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.30.159631774\1656172855" -childID 29 -isForBrowser -prefsHandle 3028 -prefMapHandle 5248 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f67e79c-bad4-4097-bd9b-f57d296d29ef} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5284 1e3670a3e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.31.465488459\278487315" -childID 30 -isForBrowser -prefsHandle 9436 -prefMapHandle 9612 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a84688f2-2daf-4d45-a7a7-30eb679ea7fb} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9592 1e35fd84b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.32.1032201404\1236631552" -childID 31 -isForBrowser -prefsHandle 9344 -prefMapHandle 9340 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a77a596a-ea83-4807-8322-d8a77bbeac63} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9352 1e35fd81558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.33.730298427\417968097" -childID 32 -isForBrowser -prefsHandle 9516 -prefMapHandle 5232 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1970283-6414-446b-bc78-a9cbf39e18cd} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 6992 1e364cdd258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.34.733742180\1541416467" -childID 33 -isForBrowser -prefsHandle 3120 -prefMapHandle 2684 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {183cd490-121e-4a2a-ab0f-e96f5a1934a2} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 7608 1e364ef2558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.35.972617543\1267685159" -childID 34 -isForBrowser -prefsHandle 6960 -prefMapHandle 5704 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b23ccf4b-edf6-406c-b317-95f6d00a8cb7} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 7560 1e35fd17258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.36.1512240803\821695456" -childID 35 -isForBrowser -prefsHandle 8964 -prefMapHandle 8960 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e0992ce-8333-485a-bf34-17f01b029914} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 8972 1e3675c2558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.37.1501833711\986280708" -childID 36 -isForBrowser -prefsHandle 7608 -prefMapHandle 9080 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bf8d9ac-c457-41af-b188-a0f28e7a3568} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9084 1e364ef3d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.38.542745267\572798633" -childID 37 -isForBrowser -prefsHandle 5060 -prefMapHandle 9272 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4cd829a-efa4-4f7d-b8f5-27025450ecde} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5092 1e364ef2858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.39.71417763\1240912335" -childID 38 -isForBrowser -prefsHandle 4640 -prefMapHandle 3908 -prefsLen 27477 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14c4899d-7295-43b8-bdd6-2c43b94f18eb} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9524 1e34d42f658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.40.2079158488\1441485843" -childID 39 -isForBrowser -prefsHandle 5720 -prefMapHandle 5692 -prefsLen 27517 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4079a695-46f7-4ad4-a241-c4bbfb77774f} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9284 1e367213b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.41.180701637\2035038802" -childID 40 -isForBrowser -prefsHandle 4760 -prefMapHandle 5644 -prefsLen 27517 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {338d26c5-ed50-43cd-8807-03af1d479be3} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 5592 1e3682bd858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.42.461336898\901727308" -childID 41 -isForBrowser -prefsHandle 9064 -prefMapHandle 7468 -prefsLen 27517 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0539e452-5648-4711-b4e8-2703f98fa00f} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9312 1e3682bf058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.43.1630568262\1600195754" -childID 42 -isForBrowser -prefsHandle 7736 -prefMapHandle 9408 -prefsLen 27517 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {34e448a9-b65c-4c9e-af21-f7e8428c4e02} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 9392 1e3682d7c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4644.44.1825908859\611584200" -childID 43 -isForBrowser -prefsHandle 6884 -prefMapHandle 3512 -prefsLen 27517 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66106989-d05b-40a6-834d-f566b92cb7c7} 4644 "\\.\pipe\gecko-crash-server-pipe.4644" 6912 1e367216558 tab

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-0LHQ7.tmp\KMSpico-setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-0LHQ7.tmp\KMSpico-setup.tmp" /SL5="$302C8,3424323,122880,C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe"

C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe" /VERYSILENT

C:\Users\Admin\AppData\Local\Temp\is-9KDKH.tmp\KMSpico-setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-9KDKH.tmp\KMSpico-setup.tmp" /SL5="$402C8,3424323,122880,C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe" /VERYSILENT

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\system32\taskkill.exe" /f /im "kmsupd.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /F /SC ONLOGON /RL HIGHEST /TN "KMSpico Auto Update Scheduler" /TR "\"C:\Program Files (x86)\Common Files\KMSpico\Update\kmsupd.exe\"

C:\Users\Admin\AppData\Local\Temp\is-K6P76.tmp\_setup.exe

"C:\Users\Admin\AppData\Local\Temp\is-K6P76.tmp\_setup.exe"

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy

C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp" /SL5="$7018E,2952592,69120,C:\Users\Admin\AppData\Local\Temp\is-K6P76.tmp\_setup.exe"

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=ActiveSync

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=CortanaListenUIApp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=DesktopLearning_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=DesktopView_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=EnvironmentsApp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=HoloCamera_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=HoloItemPlayerApp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=HoloShell_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.AccountsControl_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.BioEnrollment_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.CredDialogHost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.LockApp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.PPIProjection_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.Cortana_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.ParentalControls_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.SecHealthUI_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.WindowPicker_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.WindowsStore_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.XboxGameCallableUI_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Windows.ContactSupport_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=windows.immersivecontrolpanel_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Windows.MiracastView_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Windows.PrintDialog_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=windows_ie_ac_001

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""

C:\Program Files\KMSpico\UninsHs.exe

"C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\Admin\AppData\Local\Temp\is-K6P76.tmp\_setup.exe

C:\Program Files\KMSpico\KMSELDI.exe

"C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup

C:\Windows\system32\schtasks.exe

SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F

C:\Windows\system32\sc.exe

sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"

C:\Windows\SECOH-QAD.exe

C:\Windows\SECOH-QAD.exe C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SLUI.exe

"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent

C:\Program Files\KMSpico\AutoPico.exe

"C:\Program Files\KMSpico\AutoPico.exe" /silent

C:\Windows\System32\SLUI.exe

"C:\Windows\System32\SLUI.exe" RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;Trigger=TimerEvent

C:\Program Files\KMSpico\KMSELDI.exe

"C:\Program Files\KMSpico\KMSELDI.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x2f4

C:\Windows\regedit.exe

"regedit.exe" "C:\Program Files\KMSpico\scripts\DisableSmartScreen.reg"

C:\Windows\System32\NOTEPAD.EXE

"C:\Windows\System32\NOTEPAD.EXE" C:\Program Files\KMSpico\scripts\Install_Service.cmd

C:\Windows\System32\NOTEPAD.EXE

"C:\Windows\System32\NOTEPAD.EXE" C:\Program Files\KMSpico\scripts\Restore_Watermark.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files\KMSpico\scripts\Restore_Watermark.cmd" "

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\System32\NOTEPAD.EXE

"C:\Windows\System32\NOTEPAD.EXE" C:\Program Files\KMSpico\scripts\AddExceptions_Defender.cmd

C:\Program Files\KMSpico\KMSELDI.exe

"C:\Program Files\KMSpico\KMSELDI.exe"

C:\Windows\System32\takeown.exe

"C:\Windows\System32\takeown.exe" /f C:\Windows\System32\spp\store\2.0\data.dat

C:\Windows\System32\icacls.exe

"C:\Windows\System32\icacls.exe" C:\Windows\System32\spp\store\2.0\data.dat /grant :r administrators:(d,f)

C:\Windows\System32\icacls.exe

"C:\Windows\System32\icacls.exe" C:\Windows\System32\spp\store\2.0\data.dat /grant :r *S-1-1-0:(d,f)

C:\Windows\System32\takeown.exe

"C:\Windows\System32\takeown.exe" /f C:\Windows\System32\spp\store\2.0\tokens.dat

C:\Windows\System32\icacls.exe

"C:\Windows\System32\icacls.exe" C:\Windows\System32\spp\store\2.0\tokens.dat /grant :r administrators:(d,f)

C:\Windows\System32\icacls.exe

"C:\Windows\System32\icacls.exe" C:\Windows\System32\spp\store\2.0\tokens.dat /grant :r *S-1-1-0:(d,f)

C:\Windows\System32\takeown.exe

"C:\Windows\System32\takeown.exe" /f C:\Windows\System32\spp\store\2.0\cache\cache.dat

C:\Windows\System32\icacls.exe

"C:\Windows\System32\icacls.exe" C:\Windows\System32\spp\store\2.0\cache\cache.dat /grant :r administrators:(d,f)

C:\Windows\System32\icacls.exe

"C:\Windows\System32\icacls.exe" C:\Windows\System32\spp\store\2.0\cache\cache.dat /grant :r *S-1-1-0:(d,f)

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

Network

Country	Destination	Domain	Proto
N/A	127.0.0.1:49756		tcp
US	8.8.8.8:53	file.fan	udp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	8.8.8.8:53	content-signature-2.cdn.mozilla.net	udp
US	8.8.8.8:53	shavar.services.mozilla.com	udp
US	8.8.8.8:53	push.services.mozilla.com	udp
US	8.8.8.8:53	firefox.settings.services.mozilla.com	udp
US	34.117.188.166:443	contile.services.mozilla.com	tcp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	104.21.82.142:443	file.fan	tcp
US	8.8.8.8:53	file.fan	udp
US	34.160.144.191:443	content-signature-2.cdn.mozilla.net	tcp
US	8.8.8.8:53	prod.content-signature-chains.prod.webservices.mozgcp.net	udp
US	52.25.179.107:443	shavar.services.mozilla.com	tcp
US	34.107.243.93:443	push.services.mozilla.com	tcp
US	34.149.100.209:443	firefox.settings.services.mozilla.com	tcp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	8.8.8.8:53	prod.content-signature-chains.prod.webservices.mozgcp.net	udp
US	8.8.8.8:53	file.fan	udp
US	8.8.8.8:53	shavar.prod.mozaws.net	udp
US	8.8.8.8:53	autopush.prod.mozaws.net	udp
US	8.8.8.8:53	prod.remote-settings.prod.webservices.mozgcp.net	udp
US	8.8.8.8:53	shavar.prod.mozaws.net	udp
US	8.8.8.8:53	autopush.prod.mozaws.net	udp
US	8.8.8.8:53	prod.remote-settings.prod.webservices.mozgcp.net	udp
US	8.8.8.8:53	166.188.117.34.in-addr.arpa	udp
US	8.8.8.8:53	142.82.21.104.in-addr.arpa	udp
US	34.117.188.166:443	contile.services.mozilla.com	udp
US	104.21.82.142:443	file.fan	udp
US	8.8.8.8:53	pl22904797.profitablegatecpm.com	udp
US	8.8.8.8:53	pl22905469.profitablegatecpm.com	udp
US	8.8.8.8:53	alwingulla.com	udp
US	34.149.100.209:443	prod.remote-settings.prod.webservices.mozgcp.net	tcp
US	8.8.8.8:53	alwingulla.com	udp
US	172.67.152.114:443	alwingulla.com	tcp
US	8.8.8.8:53	alwingulla.com	udp
US	172.67.152.114:443	alwingulla.com	udp
US	172.240.108.84:443	pl22905469.profitablegatecpm.com	tcp
US	8.8.8.8:53	pl22905469.profitablegatecpm.com	udp
US	192.243.59.20:443	pl22905469.profitablegatecpm.com	tcp
US	8.8.8.8:53	pl22904797.profitablegatecpm.com	udp
US	8.8.8.8:53	www.topcreativeformat.com	udp
US	8.8.8.8:53	www.topcreativeformat.com	udp
US	172.240.127.234:443	www.topcreativeformat.com	tcp
US	8.8.8.8:53	www.topcreativeformat.com	udp
US	8.8.8.8:53	107.179.25.52.in-addr.arpa	udp
US	8.8.8.8:53	114.152.67.172.in-addr.arpa	udp
US	8.8.8.8:53	74.204.58.216.in-addr.arpa	udp
US	8.8.8.8:53	99.201.58.216.in-addr.arpa	udp
US	8.8.8.8:53	20.59.243.192.in-addr.arpa	udp
US	8.8.8.8:53	84.108.240.172.in-addr.arpa	udp
US	8.8.8.8:53	234.127.240.172.in-addr.arpa	udp
US	8.8.8.8:53	pl22905469.profitablegatecpm.com	udp
US	8.8.8.8:53	pl22904797.profitablegatecpm.com	udp
N/A	127.0.0.1:49763		tcp
US	8.8.8.8:53	veepteero.com	udp
NL	139.45.197.242:443	veepteero.com	tcp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	242.197.45.139.in-addr.arpa	udp
US	8.8.8.8:53	my.rtmark.net	udp
US	8.8.8.8:53	moonoafy.net	udp
US	8.8.8.8:53	shoordaird.com	udp
US	8.8.8.8:53	soathoth.com	udp
US	8.8.8.8:53	kukidsaidree.com	udp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	8.8.8.8:53	my.rtmark.net	udp
NL	139.45.197.244:443	shoordaird.com	tcp
US	8.8.8.8:53	shoordaird.com	udp
NL	139.45.197.250:443	moonoafy.net	tcp
US	8.8.8.8:53	moonoafy.net	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
US	8.8.8.8:53	my.rtmark.net	udp
US	8.8.8.8:53	shoordaird.com	udp
US	8.8.8.8:53	moonoafy.net	udp
US	8.8.8.8:53	soathoth.com	udp
US	8.8.8.8:53	kukidsaidree.com	udp
US	8.8.8.8:53	soathoth.com	udp
US	8.8.8.8:53	kukidsaidree.com	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.250:443	moonoafy.net	tcp
US	8.8.8.8:53	tzegilo.com	udp
US	104.21.11.245:443	tzegilo.com	tcp
US	8.8.8.8:53	tzegilo.com	udp
US	8.8.8.8:53	tzegilo.com	udp
US	104.21.11.245:443	tzegilo.com	udp
US	8.8.8.8:53	fleraprt.com	udp
NL	139.45.197.244:443	shoordaird.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.195.254:443	fleraprt.com	tcp
US	8.8.8.8:53	fleraprt.com	udp
US	8.8.8.8:53	interstitial-08.com	udp
US	8.8.8.8:53	fleraprt.com	udp
US	8.8.8.8:53	interstitial-08.com	udp
NL	139.45.197.151:443	interstitial-08.com	tcp
US	8.8.8.8:53	interstitial-08.com	udp
US	8.8.8.8:53	offerimage.com	udp
US	8.8.8.8:53	250.197.45.139.in-addr.arpa	udp
US	8.8.8.8:53	8.195.45.139.in-addr.arpa	udp
US	8.8.8.8:53	244.197.45.139.in-addr.arpa	udp
US	8.8.8.8:53	245.11.21.104.in-addr.arpa	udp
US	8.8.8.8:53	254.195.45.139.in-addr.arpa	udp
US	8.8.8.8:53	151.197.45.139.in-addr.arpa	udp
US	172.67.22.216:443	offerimage.com	tcp
US	8.8.8.8:53	offerimage.com	udp
US	8.8.8.8:53	offerimage.com	udp
US	8.8.8.8:53	littlecdn.com	udp
US	104.22.25.116:443	littlecdn.com	tcp
US	104.22.25.116:443	littlecdn.com	tcp
US	104.22.25.116:443	littlecdn.com	tcp
US	104.22.25.116:443	littlecdn.com	tcp
US	8.8.8.8:53	littlecdn.com	udp
US	8.8.8.8:53	littlecdn.com	udp
US	8.8.8.8:53	216.22.67.172.in-addr.arpa	udp
US	8.8.8.8:53	116.25.22.104.in-addr.arpa	udp
US	8.8.8.8:53	c.adskeeper.com	udp
US	104.18.35.150:443	c.adskeeper.com	tcp
US	8.8.8.8:53	c.adskeeper.com	udp
US	8.8.8.8:53	c.adskeeper.com	udp
US	8.8.8.8:53	150.35.18.104.in-addr.arpa	udp
US	104.18.35.150:443	c.adskeeper.com	udp
US	8.8.8.8:53	shoordaird.com	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
US	8.8.8.8:53	veepteero.com	udp
NL	139.45.197.250:443	moonoafy.net	tcp
US	8.8.8.8:53	www.google.com	udp
GB	142.250.187.196:443	www.google.com	tcp
US	8.8.8.8:53	www.google.com	udp
US	8.8.8.8:53	www.google.com	udp
US	8.8.8.8:53	196.187.250.142.in-addr.arpa	udp
US	104.21.82.142:443	file.fan	udp
US	8.8.8.8:53	boltepse.com	udp
NL	139.45.197.250:443	boltepse.com	tcp
US	8.8.8.8:53	boltepse.com	udp
US	8.8.8.8:53	boltepse.com	udp
US	8.8.8.8:53	amunfezanttor.com	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	8.8.8.8:53	amunfezanttor.com	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	8.8.8.8:53	amunfezanttor.com	udp
US	8.8.8.8:53	shoordaird.com	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	8.8.8.8:53	boltepse.com	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	8.8.8.8:53	shoordaird.com	udp
US	104.18.35.150:443	c.adskeeper.com	udp
US	8.8.8.8:53	soathoth.com	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
US	8.8.8.8:53	ak.itponytaa.com	udp
BE	2.17.107.243:443	ak.itponytaa.com	tcp
US	8.8.8.8:53	a1410.b.akamai.net	udp
US	8.8.8.8:53	a1410.b.akamai.net	udp
US	8.8.8.8:53	s.go-mpulse.net	udp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	8.8.8.8:53	my.rtmark.net	udp
BE	23.55.96.141:443	s.go-mpulse.net	tcp
US	8.8.8.8:53	e4518.dscx.akamaiedge.net	udp
US	8.8.8.8:53	e4518.dscx.akamaiedge.net	udp
US	8.8.8.8:53	243.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	141.96.55.23.in-addr.arpa	udp
US	8.8.8.8:53	c.go-mpulse.net	udp
BE	23.55.96.141:443	c.go-mpulse.net	tcp
US	8.8.8.8:53	e4518.dscapi7.akamaiedge.net	udp
US	8.8.8.8:53	adxproofcheck.com	udp
US	8.8.8.8:53	e4518.dscapi7.akamaiedge.net	udp
US	8.8.8.8:53	adxproofcheck.com	udp
US	104.21.63.16:443	adxproofcheck.com	tcp
US	8.8.8.8:53	adxproofcheck.com	udp
US	104.21.63.16:443	adxproofcheck.com	udp
US	8.8.8.8:53	mc.yandex.ru	udp
US	8.8.8.8:53	mc.yandex.ru	udp
US	8.8.8.8:53	16.63.21.104.in-addr.arpa	udp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
GB	142.250.187.196:443	www.google.com	udp
US	8.8.8.8:53	195.212.58.216.in-addr.arpa	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
GB	142.250.187.196:443	www.google.com	tcp
US	192.243.59.20:443	www.topcreativeformat.com	tcp
US	172.240.108.84:443	www.topcreativeformat.com	tcp
US	172.67.152.114:443	alwingulla.com	udp
US	172.240.127.234:443	www.topcreativeformat.com	tcp
GB	142.250.187.196:443	www.google.com	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.250:443	amunfezanttor.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
US	104.21.11.245:443	tzegilo.com	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	8.8.8.8:53	kukidsaidree.com	udp
US	8.8.8.8:53	fleraprt.com	udp
NL	139.45.195.254:443	fleraprt.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.151:443	interstitial-08.com	tcp
US	8.8.8.8:53	interstitial-08.com	udp
US	8.8.8.8:53	csp.withgoogle.com	udp
GB	172.217.169.81:443	csp.withgoogle.com	tcp
GB	172.217.169.81:443	csp.withgoogle.com	tcp
GB	172.217.169.81:443	csp.withgoogle.com	tcp
GB	172.217.169.81:443	csp.withgoogle.com	tcp
GB	172.217.169.81:443	csp.withgoogle.com	tcp
GB	172.217.169.81:443	csp.withgoogle.com	tcp
US	8.8.8.8:53	csp.withgoogle.com	udp
US	8.8.8.8:53	csp.withgoogle.com	udp
GB	172.217.169.81:443	csp.withgoogle.com	udp
US	8.8.8.8:53	81.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	play.google.com	udp
GB	142.250.179.238:443	play.google.com	tcp
US	8.8.8.8:53	play.google.com	udp
US	8.8.8.8:53	play.google.com	udp
GB	142.250.179.238:443	play.google.com	udp
US	8.8.8.8:53	238.179.250.142.in-addr.arpa	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
NL	139.45.195.8:443	my.rtmark.net	tcp
GB	172.217.169.81:443	csp.withgoogle.com	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	8.8.8.8:53	kukidsaidree.com	udp
US	8.8.8.8:53	kukidsaidree.com	udp
US	8.8.8.8:53	kukidsaidree.com	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	8.8.8.8:53	my.rtmark.net	udp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	s.click.aliexpress.com	udp
BE	104.68.85.7:443	s.click.aliexpress.com	tcp
US	8.8.8.8:53	e11956.x.akamaiedge.net	udp
US	8.8.8.8:53	e11956.x.akamaiedge.net	udp
US	8.8.8.8:53	campaign.aliexpress.com	udp
BE	104.68.85.7:443	campaign.aliexpress.com	tcp
US	8.8.8.8:53	assets.alicdn.com	udp
US	8.8.8.8:53	www.aliexpress.com	udp
BE	104.68.85.7:443	www.aliexpress.com	tcp
BE	104.68.85.7:443	www.aliexpress.com	tcp
BE	104.68.85.7:443	www.aliexpress.com	tcp
BE	104.68.85.7:443	www.aliexpress.com	tcp
BE	104.68.85.7:443	www.aliexpress.com	tcp
US	8.8.8.8:53	7.85.68.104.in-addr.arpa	udp
US	8.8.8.8:53	1.173.189.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	veepteero.com	udp
US	104.21.63.16:443	adxproofcheck.com	udp
US	8.8.8.8:53	mc.yandex.ru	udp
US	8.8.8.8:53	mc.yandex.ru	udp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	8.8.8.8:53	arleavannya.com	udp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
US	8.8.8.8:53	arleavannya.com	udp
US	8.8.8.8:53	arleavannya.com	udp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.250:443	amunfezanttor.com	tcp
RU	87.250.250.119:443	mc.yandex.ru	tcp
US	8.8.8.8:53	mc.yandex.com	udp
RU	93.158.134.119:443	mc.yandex.com	tcp
RU	93.158.134.119:443	mc.yandex.com	tcp
US	8.8.8.8:53	248.197.45.139.in-addr.arpa	udp
US	8.8.8.8:53	119.250.250.87.in-addr.arpa	udp
US	8.8.8.8:53	119.134.158.93.in-addr.arpa	udp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	arleavannya.com	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	arleavannya.com	udp
US	192.243.59.20:443	www.topcreativeformat.com	tcp
US	172.67.152.114:443	alwingulla.com	udp
US	172.240.108.84:443	www.topcreativeformat.com	tcp
US	172.240.127.234:443	www.topcreativeformat.com	tcp
NL	139.45.197.250:443	amunfezanttor.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.250:443	amunfezanttor.com	tcp
NL	139.45.197.250:443	amunfezanttor.com	tcp
NL	139.45.197.244:443	shoordaird.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	104.21.11.245:443	tzegilo.com	udp
US	8.8.8.8:53	fleraprt.com	udp
NL	139.45.195.254:443	fleraprt.com	tcp
US	8.8.8.8:53	fleraprt.com	udp
US	8.8.8.8:53	interstitial-08.com	udp
NL	139.45.197.151:443	interstitial-08.com	tcp
US	8.8.8.8:53	interstitial-08.com	udp
US	104.18.35.150:443	c.adskeeper.com	udp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	arleavannya.com	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
NL	139.45.197.250:443	amunfezanttor.com	tcp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	mc.yandex.ru	udp
US	8.8.8.8:53	arleavannya.com	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	172.67.22.216:443	offerimage.com	tcp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	arleavannya.com	udp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	arleavannya.com	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	8.8.8.8:53	aus5.mozilla.org	udp
US	35.244.181.201:443	aus5.mozilla.org	tcp
US	8.8.8.8:53	prod.balrog.prod.cloudops.mozgcp.net	udp
US	8.8.8.8:53	prod.balrog.prod.cloudops.mozgcp.net	udp
US	34.149.100.209:443	prod.remote-settings.prod.webservices.mozgcp.net	tcp
US	8.8.8.8:53	content-signature-2.cdn.mozilla.net	udp
US	8.8.8.8:53	prod.content-signature-chains.prod.webservices.mozgcp.net	udp
US	34.160.144.191:443	content-signature-2.cdn.mozilla.net	tcp
US	8.8.8.8:53	ciscobinary.openh264.org	udp
US	8.8.8.8:53	201.181.244.35.in-addr.arpa	udp
NL	2.18.121.73:80	ciscobinary.openh264.org	tcp
US	8.8.8.8:53	a19.dscg10.akamai.net	udp
US	8.8.8.8:53	a19.dscg10.akamai.net	udp
US	8.8.8.8:53	redirector.gvt1.com	udp
GB	142.250.187.206:443	redirector.gvt1.com	tcp
US	8.8.8.8:53	redirector.gvt1.com	udp
US	8.8.8.8:53	redirector.gvt1.com	udp
GB	142.250.187.206:443	redirector.gvt1.com	udp
US	8.8.8.8:53	r2---sn-5hne6nz6.gvt1.com	udp
US	8.8.8.8:53	r2.sn-5hne6nz6.gvt1.com	udp
NL	74.125.100.199:443	r2.sn-5hne6nz6.gvt1.com	tcp
US	8.8.8.8:53	r2.sn-5hne6nz6.gvt1.com	udp
NL	74.125.100.199:443	r2.sn-5hne6nz6.gvt1.com	udp
US	8.8.8.8:53	73.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	206.187.250.142.in-addr.arpa	udp
US	8.8.8.8:53	199.100.125.74.in-addr.arpa	udp
US	8.8.8.8:53	shorturl.at	udp
US	172.67.69.88:80	shorturl.at	tcp
US	172.67.69.88:80	shorturl.at	tcp
US	8.8.8.8:53	shorturl.at	udp
US	8.8.8.8:53	shorturl.at	udp
US	172.67.69.88:443	shorturl.at	tcp
US	8.8.8.8:53	www.shorturl.at	udp
US	104.26.8.129:443	www.shorturl.at	tcp
US	8.8.8.8:53	www.shorturl.at	udp
US	8.8.8.8:53	www.shorturl.at	udp
US	104.21.82.142:443	file.fan	udp
US	8.8.8.8:53	88.69.67.172.in-addr.arpa	udp
US	8.8.8.8:53	129.8.26.104.in-addr.arpa	udp
NL	139.45.197.250:443	amunfezanttor.com	tcp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	34.117.188.166:443	contile.services.mozilla.com	udp
US	8.8.8.8:53	veepteero.com	udp
NL	139.45.197.242:443	veepteero.com	tcp
US	8.8.8.8:53	contile.services.mozilla.com	udp
NL	139.45.197.242:443	veepteero.com	tcp
US	8.8.8.8:53	my.rtmark.net	udp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	8.8.8.8:53	my.rtmark.net	udp
US	104.21.63.16:443	adxproofcheck.com	tcp
US	8.8.8.8:53	adxproofcheck.com	udp
US	104.21.63.16:443	adxproofcheck.com	udp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	104.21.63.16:443	adxproofcheck.com	udp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
US	8.8.8.8:53	arleavannya.com	udp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	8.8.8.8:53	3.pool.ntp.org	udp
US	8.8.8.8:53	19.179.253.148.in-addr.arpa	udp
N/A	10.23.89.51:1688		tcp
N/A	10.23.89.51:1688		tcp
N/A	127.0.0.1:1688		tcp
N/A	127.0.0.1:1688		tcp
N/A	127.0.0.1:1688		tcp
N/A	127.0.0.1:1688		tcp
N/A	127.0.0.1:1688		tcp
N/A	127.0.0.1:1688		tcp
US	8.8.8.8:53	2.34.150.193.in-addr.arpa	udp
N/A	127.0.0.1:1688		tcp
NL	52.142.223.178:80		tcp
US	8.8.8.8:53	76.234.34.23.in-addr.arpa	udp
US	8.8.8.8:53	1.pool.ntp.org	udp
US	8.8.8.8:53	10.43.171.195.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\d7744d42-f6b6-4bde-8e24-65fd541028d0

MD5	9383dd93dcdfeaba9ab31477f5ef147a
SHA1	4b6057d019bc8015e147aff565872623c47e8074
SHA256	de5713a0c69691cd43ac29248bb51b1ef49cbf06e4c6a3738400eedf7fb19a6e
SHA512	f5b6d1cba9d0053440d52e1621b84025c2fd601a49ff2997a7a73bfa11ec37aef1bfc4dd24999055163a91f41cdd44f4fbfa3a9f3298b71cf76005bf7478adff

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\7096fb77-e18e-4111-8c4c-d7357754079d

MD5	c5b0478226944d10b30be3bf7c78397e
SHA1	9ded1eca5705d9b8db8d5b8ad0f678dd91522762
SHA256	db98a5539e97c5bd0752b3fd5d4ced34f8a46ab5dfdf2a4996bf923085283cca
SHA512	49907985b9560707507bf731a6b7aff0f70c7fb025403c7cd365230185a374fdde2c4c500db8658a2370878ac829cfb3e5c14431a69be6b03646d168c913c0e7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

MD5	bc633d4092ccf469a55f74ae2a807854
SHA1	cf3c387892951e4bdbca7f985256c8e5a5d61a3f
SHA256	db715787c5734b8ce1a00be84472009e7bdb3407e30aa248d68373d832d7fae8
SHA512	9b0e36afbb874a542a937ced686485402459e7d8fa0a098cbc21635e3f16fe404437e1af44eb06c0b0777f36fc38bcc6c79f49592f699836fad65a9f718eed2a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5	1fdc13de64cfdb8ba3fcd71aad9d33d3
SHA1	b7649cfd66d751435fa56a4b4b20daace452c692
SHA256	fa890605b23aecfebe4300d159f10096cfaba982a942c8ce829617b3de36a783
SHA512	3c9dc261a1f0a96d4433d60de03423d58f0bd63dbf5db48962372658103f16991f6da06c1670deea1e51efd2a15aae699d1d287ee377e0a457299a7dd9f691a7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\10938

MD5	62cbfa36f057338fa406e813bd71574a
SHA1	9a60cd6d8a0c5108b378d5cdce518a6edf7942c2
SHA256	074d8b160ffcc5466649877f2ffe68d5f4314644bfc8b745f38c2c1b0714f912
SHA512	77e8b2d2ebbf2e0d1027706ab1e70e85ea0dcc0b0674ac1d649040f8a13bb6e52cc5a64418c73118fe1e2173584689eb5adc9fb9a85b28fd84fc397be865228f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

MD5	d5fe20ca6100411abe72c2b1f5c131fc
SHA1	bba809711d41dc85cdf607a9baf440fe26a30018
SHA256	3865af32f41a2a05b49718a6a6e45b22f4d528d4edff06e1bf53c80026a3e7c7
SHA512	12f23d0b2cce2ace77d77849a19d365c96eaa542885bfbafb66866c0611cf5c45b4e7c92afd045aae553c8f895b1affb4a1065712b568e95ae1e427eff81b57c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++file.fan\idb\3793352433bblDokc.sqlite

MD5	59d4767c90980f60e4f0a6b8c266ef98
SHA1	cda9b144760a15b2920cb08ca2db8f8fd523ec57
SHA256	181c24e09b342b1793867dd955ba824c0fd064efc3b807087fd3f1aa447181cb
SHA512	001132c78a4832c221db0cfbb73b997820271a31fb07a21a2cd9a04ae48ec1b13a5c85e1f56ed72f0ef8b3579005d2896ce19662627d10f7a16897f42b2916ba

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	743bb71102dd21b909c91abb02e4b1f7
SHA1	904496270cacfdaedac0efff59ed59cf9579f39e
SHA256	4bec668c05a4d93f4649d13e57e15572c4b6e3abda80d9364f524880a92c0387
SHA512	71fe5ef86dbe530983c98271a9272d19ed68e1cd97dea4bbda5e2bd790fb88bb44967878c7ec848fb85d8015bbe0b34159aecd0de7b2cfa5a36fee7225244117

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\5518

MD5	633d1839c4650ca9ae323a90b73a2085
SHA1	86e7252afbeb7270d778379cff964b588640ba74
SHA256	cf58cfc92c53104e286f1e88e9778aa207e254b026a307df83f14daa0d928bf7
SHA512	581fadea19424c4395ee360a66f1657e9ae1d152087f72b001c4e792f1b413fb705ee6ace58ef5f8f3037199f586e37bd934060e25f609c8b290ce7e2dd62186

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\5087

MD5	65ed91db48634d93daf1f88f84e58a41
SHA1	64f40eccd3b97c765a4f1d46371154e2729ee991
SHA256	ab1b9ceaa83e248601fcc618d0f80f2278e53e6e6fbccbe627a5a1fb5bba6a88
SHA512	3e804f2fc292624e585ebd11c65fc8975c7ec02d01af20ca5345896ec5b22eae15488614f43a6306ddd227b8469528bd39fa0d7e0b9ee3f3d5fdc234f566b82d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

MD5	51504fa67b844014dad231c761bf4a2d
SHA1	e92e6712dd8127e3cddeb384dead52ea8ca29d53
SHA256	061cccb0dde13598d488ed202d1a40242c18757907aef24f4e7bf2051ef2a5f5
SHA512	babdc4df22399b9f0e8f8fd615333fa7e2994b44f74240815817b55cea8aa84148bd60cb88bcb7d32fd784efde30a4f138743fdadb438ed3fdebaa82cdabc083

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	123eda0691b23f2c654593210d09b3a4
SHA1	8021de6a1f0e7fc3f2df92edf958cf5228816ae2
SHA256	91926731f069882dfe0be0dc258ab930653d94c2e9a8f2679cce32071a3d42ab
SHA512	6b3578ba46c3249b51cfc563310b96f735549b0bf412977463c5cb5bec71621b1f0654e933d3f7de1789c182aafff97433c39fc4ddcb7fe1eed1e6c505fbc149

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++file.fan\cache\morgue\213\{fcb6fa5e-45d1-4f41-8304-e3cfce36b4d5}.final

MD5	d15008dc9e77c00aa05df1b1ea54659e
SHA1	32f420e7c41813e27d73ad4f3024128303152635
SHA256	166d029480f6c150fe44933c68d37ab04c63138bbf32d9d1440f54ab19e66872
SHA512	650ca283a15047b98384203dbdab7cc973176e35f3ae77e816047a3b3aba98ce3e6072c66660a285410cf75a13e7475d9d16fbe51c270dd672f1b896c645c4cb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	c02b944af3476746e2c2f0a46d02d778
SHA1	b80ed3c1edce82beabeda029013688f49884bafa
SHA256	2c9648cf7e554cb049ebfeddcd2167aeecd42eabe7f08961162279e36dd14de3
SHA512	d88d5f1b33ef4f9eade404cdfcd297b72e0dd589a438d72f7b840062c3741156909e17dd0349eb6901c0a6e9ccc7c449dab822da00bb2e44222c3f2f2a6f5690

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++file.fan\cache\morgue\212\{6fa6b684-d51b-4199-9feb-ba8f3792bed4}.final

MD5	6129dec2116765ceb4a9728db2ed0d6e
SHA1	7df1be3fcf3572606f37ba98a7e2887c543d67ba
SHA256	ccfd07a314fb9fc5057616f3c8fc2c3a3c179fe05497be66f9727e77169556ab
SHA512	e343515feaee7dd348c39b51db5c88aa2fdd1849da0393c7cc55289d57cf1b5d6dae1ef3f83ab1e477a04f40748b2be741d5d3eb96f5a551c3a90e67c5921aa0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\23861

MD5	c751a6b463a77878e0b7fce980b737aa
SHA1	87d2398cfaf9ca7b2d54fdaa26b1bf430ca0765f
SHA256	de9135f34abd1f66d6c163ef5b7541d0cd7b3a3d077b812ff22194e9c522907a
SHA512	22de1e09be9dcb30efb81e37ecce47b540ebd7b0871be2e58d902a814f7d48563bc03ca47307fa7d16571aabbfb86b5e1b9c1cc0ad3569c9b6e17267c09f91f2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	ab1b8dbaf8de2ba07b3c485cdf697a8a
SHA1	b436ad1e32ea1e3ca775b0667fa09008d90e1548
SHA256	80c60a9617aba873926f3445b4a8cc686fd0909554764e3c262d6febd56079ab
SHA512	6413d2506f38fc67f766d18ec587619d57e747b55c0b93052bbd7b51a211de44ee05ce463653bf15e8af488ddc749d3949efc4929cc4fde45fea9310173386df

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	919bd13d5395993673dd72736a3542a4
SHA1	c5706b8c063a07ebbd10c09b5a9686b3eafdd394
SHA256	0a1fcba80dc47d3b947c01dd76ce4c504d2ad3054e465a9a0eacf6bbb7775dfd
SHA512	314ad29a0d418785373aa93a13c643f4f8cd85d8714bc6506aa7e577c447204d32249508c0200ba6b690b05f7e601dd8337cccfb5ea96d40192fef3777f10e2c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\30840

MD5	eb1e4e9aff6567c660decf7c6c59fb53
SHA1	83fc0b019f80cc7372f71840477249bd92cecde4
SHA256	9655c0739932210380fb8f2eb7c126a62ad6f43a1eee9f8ed4cae0e773f062f2
SHA512	96a0206e61bff3d9fe7b21276d811d6c63cee30f04c6455146ab85a41f01b93a40cb24e5bd91fac6fd7230c38478d27dc1c83ee6a8778fa854c490ab258a2792

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\4491

MD5	5495dc894451f198327e246aff9e67e8
SHA1	b4562b472fa788ecf5c5d66c0b1d55f04ca7f4bb
SHA256	1d9626c1d7c47e91d2bcc8c55cb1b7224bc3b7cb464cae544dd26d02a27a201b
SHA512	c20f69d4c7341c31bc56f0e148fed2641eb54d85841ae19cd5fd43a8978bba4763e2a42c112c00877e627b00a5330d475ad265aeab7ebb0806f430173df22139

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\17104

MD5	7a2dc70d3e3593a29f41f85eb41510ed
SHA1	2cdfebc77297ce820cb964b7a5bef67a982529ea
SHA256	772601aafbf80aeab290b1acd5173c75bf85556a7d5dd3c1cf9026e13e7e93f6
SHA512	bcad3724f07a82190754ce37825e6a96d55b36c21a370ce338f4175642dca7bc824b7b07e7674f832be4191257a1f82690e251683b84d9d98e0febd7fbe85e69

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\16662671513A179D6E86F6DCBF766FC5A26681A0

MD5	1c4af91397eb6ab18f5769164bf71a56
SHA1	00ba609923956c314f0fb334b35484a0a8c79f77
SHA256	b3bec15ebf8cd5fb6e534f0874e297e077ac8094b50a4aedb412eefc9b929f9f
SHA512	7ff57ff54890e2388cf6abf00b957107febf30e0739bfce786142eeb3c5cab2ff6e4f789ac33d7392987a9b697ff7d11ab84fad218dd423df375f0b4a6287f6b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\A49ABBB5A0B758691EBD4F5B7B9C787576C23657

MD5	ab2d45f2617d18e2f0aa4eb1922b06c8
SHA1	cd327f378483f083f58b04c59d2b596c17802982
SHA256	61a50d5c172fb4402341d039181a1c1a5fe929332e78f2b4703bf5bece743520
SHA512	453d517d4daf90f615eb850b98d575b9f77f6ad2c563760e56afdd203730855d2c0c7c9d67b8134214bb7e3753dc783039ebde5deee3dfa9448d57f0b83f38b8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\1484

MD5	23cbdfd887515d70d810432e47c0a7a7
SHA1	1464a5e47325c3e82f1a935d75a9fe024fa81263
SHA256	161507f03189a5d09d9604d496f05e65e67655cf6e7948dc85d5bbb6db03c90c
SHA512	c1278c4cafba08cdb5dda746c8c3229f997002f9d95ef212b66e43931bfebdf9960b1811fac0b5ac882d3c2c643ab934fc4f6b251cb416b9ab981fb0aea23779

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\17711

MD5	d92bb28ae8ee4a7cb1289a686bfd3e65
SHA1	ebc944bf5b5558efc2084dcdbbfc3f92bae1e575
SHA256	0923a725d2b7c873e5b71ec57068e450cd7cd7cd3737005c824e1f66cd071ab2
SHA512	77359d5c7f8bfee43488f59f9280f2a39c146d45980483fe5d07868d2d78018f1c51fea6175d7e67e07e08c091dcdf3050188f2a1bfbe296bd1b85dfa44b0770

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\64E23250D56F6C7260FF93D0B8A982F75F5E9FD4

MD5	6e9853a951838890dc77ba5d9ed678bb
SHA1	02970f5380eced19786aadcce92d7b3e69fb433e
SHA256	7536c7dd118f09050e5c6556add1982cee91556d696035d849c41ff88c4ad179
SHA512	1264dacb9218bbec3e2d1eca13fe9569b5a556576e63c4fed10d5e01448ff5c047deafcd5fe9720dbffe744dc828f92c513f5fdb6c662d6046e05d1d8b0852c6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\1979

MD5	5a64e58ea3920bb5c3b49122ec984fcd
SHA1	faf79049b859520c39d42acffcbe6b4c359e3876
SHA256	357bdc70431529773bc3364b41be11bf3dddffda45145b0420aee776985ee4c3
SHA512	0eca92ec4f60c06c83358ebfcafc3077fe66ef2cc3e27558c4fbd8e5b2bbc3e95c60f64153c4f7652d10a58f571bdbf808ad121e708b65501e1bb79c7e175c34

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	5ae7a341274fbc9e4214a015d2d877a6
SHA1	dfa8b4108237a5d2a14892e743a096cd495027f6
SHA256	609cd69dc69571c9e22a31dda186a2b21897a5fefd8fa51d0e942fea5ad88493
SHA512	484b124ec13b903daaa994711e93443115ae87463adccda0a6f2f2a82dac624438315bd6861d132acf26d469b3d2c77dd90030a41d5cb9df87d8361f491d1ab3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	8b283942376dc6a05e36feee65e51201
SHA1	fcc8d948d001962abc414d5e680e57479cf46f0e
SHA256	fa554c59fea4b777737606719b8d99005b51657170d54b87ebb6eedd7d1fee9b
SHA512	c55395c228db490b6f16316c0ee87ce41cae2c120bf566bdb388ff58ca61ad53bdda287179e64fca47806726ec930ef6e6bcd045a80adb12d9b3bef2c547e737

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++file.fan\ls\usage

MD5	801e4d5cb720cd2bd0e80ade1d01fb65
SHA1	a9a0b209734229f812f974b4d6e1dfbe30dedabb
SHA256	f4a75d8d3d017b1c3cb29ceed2652d52943c870da6878d1c178646b84a95b83b
SHA512	0842e9539ffd71023c064431a98112bd898774038c3c67468a7f1114ae72b9e6d5b1857804b8bdc1846cb617b03c07d7b2241ef926cf627d6df9afdad06307ad

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	8493e61283dd5899f07eb85850f541fb
SHA1	0e95e35cbc5104db32c7fad44f3ede38df2323b2
SHA256	1970ab1a291d5a9a2800a2e2be94af2cbe0cf259e95b603c5b4c6d50326ad939
SHA512	6992b32999705ba0136a854a4c50f3f6f4d66dca1c2548fe6890e4514cc55ba9a686c0fe7558b225ba3cc76b2505ad0c396a3596bbcd91ab3c77f1440de3e7a2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	7c3a8483333dfe34b1dd9485a862d4bd
SHA1	b733ddea0c23a6224711636361e6515bd238722e
SHA256	48dd91d8153ef29f204ffb23f59f08789d510ee14fc2a4b5f2ed33e154f0703f
SHA512	ef09af4f260662e60b30daa4a51acc599ac6b6ba1fe1ff79122e687728adcb3bce46d1a9f5b4591cd2292a58c16d495f742a653178f76f677cb45805e9a99126

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\4795

MD5	9e13bc0f5f53789e590be1f16376ad65
SHA1	dbb2e8fd7985d5ac03a5696cacb43b893b7f4a64
SHA256	744226910fdfcad641cce61a7e8c81af994beefbf0a359115c5205e87ea8d52a
SHA512	9bc06a3b6e32cbc8ef7e3c8c97b045eecd97074a3938f09f050ce5e99adcf60a4b5ff4d3402331d2c522fc3010646723c87098f7ee688439df5cc11ad5cdc297

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\10540

MD5	1f5fa5d4ef6ba67cb5bbe0ee09ae7323
SHA1	5a84d78382ac808fac06c488c92cccaac14db901
SHA256	468b195c4b93f3a6e4ab0c6bc3f3c0750e6c218dc64f0e6f82184ff40ff1e0d1
SHA512	eca12fe69834c4c35219b525ffabe9cb978304a8bc292d4f0ccf2c7e6bc305588b0db97589efdc86a36a7d2f69253ec89ed9c8294c59f6273bcecbe90c84fd30

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\FF5DC24382838A707A2595095CBF110675EF0785

MD5	5412ffacd1266063133f8fd04a11800d
SHA1	ddc5b23d79066bd05705e1937f9c1b94ca349b5e
SHA256	0a3fe6fd404d67030bad09888cf95e255dbec4425acaf4a3f6ee2a3bc3a9002a
SHA512	2149b10c635bf3a9b3297d4a25f0efcd49b86973b27b431f4065478672c173f9ac257c3890c45cfb83a738d9612a9652299dbfe8ff6071cb36c4f2fa749b2a0e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	a6cb3652c78a94a4a75af952fe21da90
SHA1	83b3ddec7b7025d51895bf8ce25b9e954721fd49
SHA256	0d5316fefb8627569beead77aa57f7367e901b72e98729b2ca9a73ec3c920dbd
SHA512	c477095173a52fa9974b5029031bd56e25df387ecfe7f225672528420160430b7d936a61fd5a6c732988e3ad9dd59b5baeaa60441934d5dba8b073f1e3ca8ed9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\86B985BE1D9399BE7A53DE93EA762F949A90127B

MD5	2e3aa109e3eb3d392f8b9f77625a151f
SHA1	d3a3951121769e41178018605c2dbfd7f8953020
SHA256	ad6d9b794cf3dd18ea9aca31ff37bded2b658c9a12e11bc75ad0a2b479bcb6f0
SHA512	54496bb12ac6b0906f956577bd703cc4061da98be1b43dc2176cf806f0cfb5496b884a5378f418442d9478890bc70869d56aeae14f88a266578fd95131007140

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\22032

MD5	1479d8ea0229c1d1f8205359288b76e6
SHA1	7eb18b7cea8d4f549ef51987234d28ebb14c466a
SHA256	ac745ed17a707052e639483be887a808beca96c19f1e01b2fb3051c5e0f42f2d
SHA512	6fa918e28ee2b254797db9f62f78a5544da96010d9ed213f9b0b699d2951d4798cc5fff7b905220fea6c88a41a56e25d8e977832d23e970a26d3874eaeeabdcf

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\A907980C7D7C52BA5C268F40D7F9DA63906ECC9B

MD5	5fe4d47f0996bb8a14d32043f90f820e
SHA1	8baa32a9ea6504d7f36f26df7458997965a8f98f
SHA256	f0a62cd8d2d7bffab2c9321d11fd942038398974dbee92906ccfe8727bd19ac0
SHA512	6f1b369d081214dece390eda987a2179489b50e622ac5f6b279c08b20d48eeb9410a302726810c42e3192e3bd47c31c95e3769af4bb830433e3ce0063334082d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\675B00B937266D368D8380A3DA7B3FA7F69F93DE

MD5	77638f62c85fd4da6816e5a34b2917f1
SHA1	5a14aedd79dfe2117eaf0553c4d4b67e10fde768
SHA256	e33954a26bb746772e47dba8e302e8822523f1a64708260129116247d7fdf515
SHA512	001227b981928f0b7bb7d1c622cfcf88a3927900b5a4a442654e061b94072835abc597c973dbfb58f401631100e0d999c83e57bfdbf1d4ca6f0fe91cf4db17a3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\FE830DAF56E2878AF2F9F4D72B345F55887E0129

MD5	191f2727d6ceba61bae2106cb5c4faab
SHA1	58163dff958ced760bb5234d47bfb556b579fdba
SHA256	df50861f361b57489a5e3419fbc0ee8680051cc0089344809cd75c60723ace2e
SHA512	1a4379ba0c7948566c68dbd24c1e02850c311501612e1211194af959c259ac4cb721fa3d87a18eff69d7101937967d7b7e44fe8706dce0a6bdecb5347dd375d3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\C5B94ADABBE719A56F98A52B62E44BAFB4C28266

MD5	38ee5c2bc406fa5bcbc7b0e5e371c55d
SHA1	4995d52eaf8b5ea1122d771514402762645f7152
SHA256	894094588fbd535c243196d049713efecba766fad5c75c3973f42b11c3f77ba4
SHA512	6f8a458ec8ab080c5e34fb980a59968d99dfa410dfab09ba7f0153b7b5f1606c0b983fe9f801c40e4700c354017f4017c683b7dfceeded28d480aa0faaacae0f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\BDF6979196B703C7D88D34607464602F28972524

MD5	15d3726b0f69526aa4c33525fe0e3658
SHA1	cf8ef3a09a7ccf0d3d7de33486908bb05d0cfb5b
SHA256	d7afba4693eade229216ef023797fd9bb68f43dbe9324b1788c71f18351301cf
SHA512	bfe8fe26c728feab9edb30d33dae7e3243096e33b726c5b13652282448fcec9222bdc482d6280f6a65bf065c5e9089ebd68fa0602307ca7fb7b12e4f121ef289

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D0AD4E9EE43D2E5580960766B69630DDD97DDF81

MD5	c749c5f5f2e1a0cc208ea97b2dad6f4c
SHA1	fc4d34bae456ee590a6626dbb05e92aaa3b66792
SHA256	ca9a05a1804e25273a53dba73d0afa0eef85945cd9b9606660ea686748d6b141
SHA512	c006c66035715766d28612961ce1a6996167a67f284351ce6557b37868595f23d14416ab288b5123ff96556122b8059b8ee3bdb3fc09bd538ee0a85bd19a5c56

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\3E572184EC97B06BC209D2C83FDA7B5059C91188

MD5	630267aab27ffe529f51eb98619456c0
SHA1	8970fc7c67d2dfe6bc8df3cd0fe764ae91a3d7ca
SHA256	6ba5c9c22a4b9268e86da55e2bae697fb4f55fdde96d5e346a72867db7f5caaf
SHA512	062bcebd56930c6781214c0c5a52d9aa7dd6c100429383947c6c3130eab0bd14a81fb2d5c8f2e8ac596c71c6f1cef6f59f525332d0c8b0259af6d03771db2cd9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\13283

MD5	08bf31af51667083aa5c2c810bbfb0ca
SHA1	ca1b994fc3157bac5afbdece5329e87ee8fd3ca0
SHA256	f61c41ed8d74fb22af1976d4069af37fd25fa917a4637fe57f48af4a19167428
SHA512	281cbca3bd246702eb3b1b3ef136a2337c87739dc30c5e3fc80f558a7e48a91e59c7cbcbfbb336a927d71fc73303840fe354a90c917ccc07ac3d7612cfadb4dd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\26346

MD5	4b41000257ca3c93115d254ba958a006
SHA1	00a9eff9b61edb2944e644389b6277812f2ade50
SHA256	c79bea4b4728015b1b63bcd7d859ffdd7f44a820a14e04a17d45c60344ed6cd4
SHA512	3a4ef94af16fbf3fa357a16c12eaef507bebc7faf086499d86f2411828a601ddc0ff5ce3dcb2874a376797436532b26546e729e9793087c6dd677d36b188c465

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\25897

MD5	f11fb91452175a8c5922f83abdedbe00
SHA1	c41267f744cceadeb17e3dae8ee47bc8df2ff5b0
SHA256	74f2ce3663bd89de0ae842d776473a96e81de6180bebb71ab176fd75bb5dbba2
SHA512	cd92355c56887c39fa4e2d6d472278b0da611ad235a3db7e2c035ba23a7e35a463ae38ee57d32787b72917b6aabb8171c8790a546627a5d64f9d46d6e3d9acff

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\6551

MD5	95d2b613d44cf32b188025751273086e
SHA1	3f84ae69879927f0478ee464d8026d2c1fc89afa
SHA256	932498e010e6fc0bd46acba892a89f1125276888508f9e1b67608cce398feba0
SHA512	6a9814062b74f4a4b9dc879bffbad66752c7615fb29d493427423fe6ae8048d4b51e4f09135470ec67afeec3fb60067ec20279ddcfab91481e0a8956611a4de7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\519DAC5E66BACDBEA82B34453D8B7BD5C02D23A4

MD5	994272c5ccf9c65b27fdc6aac6f5a124
SHA1	04465530b9e8a9b936659e90330c3248b493e7ae
SHA256	922583457d9683df5efbbfa7abbe9e14a0a227f9655a75e62485987bf4ff99e1
SHA512	45022ceb2f323ffafca2e70df5fafa056b2c4ae54b7a6a516f423b4e6601c6b3312a0bb7eab5c472d079ae7419c91958407fe54f4834aa5c5ba8a7e7776be618

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\20422

MD5	9b9d2e93a82ad51821afe5a0851ae65f
SHA1	e2a974e7be91c66091499f6a7cd08921efd1852c
SHA256	3265efb41298dcea560f802b8fb9fd49ae6e49e427ea7f0ec9a6e32cb206f000
SHA512	eeb3321538b5999a114d38ac431012e648effee7c95078d07b08e46f65e29c704f595a174ec2b57f549f4eeef1c2f4af4e33023b8e7b71f7f915daabf062ed21

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\2097

MD5	2024bacc0a2278f69f18fa12b455f831
SHA1	d04ce76d187907a68edfaae57aa0e1041b1a1226
SHA256	e2c1dbf492e23a864a13b2489d25d5c98e9ea012c39c22a67396f313af37a70a
SHA512	19d8532acdc73b8d621d796f931e51434824cd71c30f2784d12b1da98e867e8c793f7399917cc526fc170dbda355b095ebd99efd6f1534ba28a433935fc55a7d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	69a7217655b771f0f789872f50a65641
SHA1	e5e622a71c469fd3403982d53d6870ee30734db9
SHA256	e1ecc15be0aa68537f63ee8e85002d86d68e4496e8119d0943e109989176a3fc
SHA512	633f240d10abebe17d31538718a448a0b4d220ccf6831501bf083dadd5b39c09d6bac405bc6199a0042c6551c07e0213e6ca990aa090243b9130828c0677049f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\594E5507EBD4B669B365CE1BB0918C3D06D6E651

MD5	7aeebbeaae971652e51112bef8ec2e70
SHA1	c9e822a7b0306d8ff5b63d86144aa40bf116bf48
SHA256	20ac4221fa5d01bcffe4e2a8e9d603d9339323f6e0270f7eb2ebfe4c9f690e1f
SHA512	4e778aca45eefd371d6348a5e397550dacf857e89f20e5d536a56cd0664c3738acc0a8980622dddc97621176023edf85d68cc3a8903a8228ca222dde5b509466

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\78F4CF7BAD4B31FA8AAE8FD99A36C5181F0EF68A

MD5	75ef534edcc767b168b6bd8ba4bc394d
SHA1	f58b4f8723662eff851c40e06ee2246ba95e1f4c
SHA256	a3712525552cb53e2c43f90e46d908a0d8046f7032f178f8bb9c89fed8b21ea2
SHA512	85af17110e573bf129289d1167299c510bc08b4fa65ccf467c1d2024bee4e3222f668fbc41a37140b0023d10e0c6aa1a68bb0299c40e99ea7ed0063f38fd3f51

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E0B2EFAF006D6F86BA6C41BB457CA3E96A84949C

MD5	0df5a60abff0f173bf02f8b10e4b347b
SHA1	88bda8dfbf2be81d2d10178cf6a4079052ad6eb3
SHA256	dbb9157558e0bf5774031db0f79b6f73103639a1dd12e620ead22bc3d553fe3b
SHA512	854782c74251df92d7889c0e326698f0102bdf12bf6ee2113120d1ebcce0e620b77ede930ae2feed177af27a890bf07498eda06a61e2ab7fa1fd5141be7da14b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\12338

MD5	bb9f762596f49a30c7368141a6c7b663
SHA1	88ad9404d7d2c60c8e437db1647e39b9a24c7db5
SHA256	e4fcc55e6f904d1483f8b4885280a93fbd00bd740cea1dbeed660ed35c15780f
SHA512	cba92a14d662ea7240a619c1a45f495f02bb4aa33d420a494806824b059e14d78feec35faca0ea98dcbaf908425535b0ebb41cf5534385fc86084a2435b3d888

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\28341

MD5	6704d2561fdb863590051f53b2739618
SHA1	7c955abe461fc53e5c423bda2cbb247bb66525d0
SHA256	a6e81a17cc55e0cbf72166e87f7e49a4aa1321d28dc8d4dfd9af807c0be22148
SHA512	72009fc5be820211efc448028e28fe66797c8eca6817d794eea91a6b5c803c67d8187416ae343500b0ebc73133b9c824c9af6c462373c79e70b3f447f86df976

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\32223

MD5	6053def8e0d8440a154c2ecc3e2531ea
SHA1	f764fe1f600236e70e9dc6fb7696908a353397ba
SHA256	fc96284836f01aed6caa335a19480a1dfb175aff638211312b023cb4b267ad53
SHA512	b417af511c5b62e3d5245becd16819ed099aaebb30d67c6255227c085cfd309b9865a927ff83e30e780f777072a9b8ebda500ff2a323d5c4922219dbda3e8f61

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\2497

MD5	cb2a8cd756262bbfd2af7abd97cde3c7
SHA1	adba93ec3709667d46bfb58c2a39b2728ff5322e
SHA256	c342fe3d8eb05ba1d78f9a1520577b64d9e5bfa6f60abae41449d8c5eb2c8481
SHA512	fd6bab73c370802c07f8a1b1529dc25d7ca3f0c88a61b101eb3f5f308b9b1c653f36d190e3bb45f0dc2962ff22a1953020f3b1f6f367cfa29dfa52860d5f446a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	257221b5c1bbd023973e1c1c7c2e796c
SHA1	205785936ae29aa959c6822d2970c8fec9923f69
SHA256	759cec7b54348f3be48773156b51a168b0fe45d07d1c762a596536033a75fa75
SHA512	f8464f64f076032db7195edfa87a8bf4fdfec515f62eb855d2f85c7100fb3c4f59490e3d22736197bbe5bbbfe09e60d7e2cd32d7974dd1fbae5a158c67044cad

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\10505

MD5	61e4881a7603b99330fa9002644eab9b
SHA1	60bd7da2445e0327653f9c2516a4b14f1d403264
SHA256	c11c54087b81aafc3ce2fca2b2c1a116997f4980f8cf1c6f8d1333fa07ac7d54
SHA512	b4837190d8cd10ef71c3e7e5881fecd4b4dc9e9cc9cdf52bfb81b4777ddcbf51d619a46fb28470fb2d4bc743084760388cdc2e7bea295acbb4bbbbbf7156fcbf

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	5c4ebc645a8752929dd0c1451577540f
SHA1	c7e9dafd990095fb6cddbd8eec0e2ac0c028742d
SHA256	bf93d2ace5e12c1e51fcf95fcffc83dabbaf13009e4ca77f6c49426a22146a5d
SHA512	988d26e65e5e219ca120ad41bd8a103b751ca559da917af97d25c52b2359c9d4f6c13d4f07660cadd0db92244f4eef5e242a2fa77cc11336914d681d986656dd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\95158FBA1BFBB6DBF1A0EA7611B14EFFBBFB6913

MD5	f4c54d7a859ef1643f07976993d8f5fe
SHA1	e2d595180202196b252d012771576f14045a9e75
SHA256	2b6e8ded5ef54fc4dbf1e4b245881c1b087dd5a52228e0a91881719680b29c6d
SHA512	f3ef87cd563241bf6fec508f10bb2b1034bbb8d5f3bf93a463737b190034ba5b7124d89cc31e56c0bad3f9278fbd35fbde51762f7c184582dc6175c16c8858eb

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\C27E4BBEBE9DD077DDCF979173EACF4B95F38862

MD5	57d9c65abedb7c478c42413d99ce54d1
SHA1	0b5dea36ef03bc4c8e2c22e27b7131a688e38e30
SHA256	474d7b7a2b10f2376457818ac27822b5570a7a385d3a055b07e3de4b069f495a
SHA512	02d294de3b1152fb2467aa897ebb8b9c565c8a30c7deb3747e4b655416e095bcf689768abbbba1a295ae3efe02641b9b27ab2c262897a3f9d3ed8145b0ed4444

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\CB7CA7AD1D64E667AE15CD2DC65392F3D347C713

MD5	cb87b14fe347d903cbd1e6eeb3e6cd0b
SHA1	525002739789ce6e191ac57edf83b949709290cb
SHA256	80f6a49ea80d51f69ffa959862ec23b1efc28cd5887a40897c303fbe79e5f69b
SHA512	58e70ca40c2f1c9a0016d256170720d2e16be2f3c3a2066e62e96cdba1a1da527f61219e940fe070eb2dfdd2c56c78fc8e1f325326fbc7a029e4b31048cc58a1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++adxproofcheck.com\ls\usage

MD5	2d82219afa6158f67b599cd260c2118b
SHA1	d34bbdcac207a7329e76f7c3c8bc1eca1508867d
SHA256	c58e9a3dad419dee7b10382d0bd96c913f6bbd26886f2b093a916d937bbcdc9f
SHA512	8ce6364231dc3bc8199cd9bc495198104bb595c235d39a1b2f3d1de2fc441c4a78d84480c7540a1fd44bc1b3fa5a96262913af97ae753c6189dbc61c823ac112

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	e4d4eb268e76cc4a4fb17f7bc35f5f71
SHA1	b4e3f14741f7e9a91f3356b1029ce0ebc4d89199
SHA256	e0f56f0e03e264a944827e520d97ab44de1e2f3427108f1cadb3289fd86fd83d
SHA512	2851c1c490d044a7704a6e9cf5fb7b5195af857eb8e32b1f8acd1185276a46a383f637dba1dc23a5e07751e3b97fde3a445a42ac99ba9b33f19752ae7aba2689

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5	85430baed3398695717b0263807cf97c
SHA1	fffbee923cea216f50fce5d54219a188a5100f41
SHA256	a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512	06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5	fe3355639648c417e8307c6d051e3e37
SHA1	f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256	1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512	8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5	3d33cdc0b3d281e67dd52e14435dd04f
SHA1	4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256	f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512	a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

MD5	d73eda441d9e61911617884a5e7fdc81
SHA1	b6a0b32bb873b649b79a7b6d8c95aab5d3cab64e
SHA256	bd4f9ed3c9b72c5e9984fbeec8324df70a9bdaa84056206a97fd75090849d81b
SHA512	1357e6b69bdc93ffcf3903ea7f01e0ee7b2dbb5b38cf11e7dab51a70c1dcf96f1e8032697652a426e3a87a71508606548cecc48d841a6620525276e5b7f2c082

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5	a01c5ecd6108350ae23d2cddf0e77c17
SHA1	c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256	345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512	b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5	49ddb419d96dceb9069018535fb2e2fc
SHA1	62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256	2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512	48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5	8be33af717bb1b67fbd61c3f4b807e9e
SHA1	7cf17656d174d951957ff36810e874a134dd49e0
SHA256	e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512	6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	04045210f7d0198a95ff0a9aee0100f1
SHA1	39b5153fa21ced2154e0ef8d1741b93d78dd48ad
SHA256	0497c54aa9cecb119594a13808dd1ffe1eb1dcba3f7800c6a75e4bd9935eecf1
SHA512	52bc93a395421bc76292d3d6dca098183048799e728e876a3d595550090ae34e5e32fdf8ffe7b67601d0611e185125741126999ef38f2897bdb7b217f7c5ec67

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5	33bf7b0439480effb9fb212efce87b13
SHA1	cee50f2745edc6dc291887b6075ca64d716f495a
SHA256	8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512	d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5	688bed3676d2104e7f17ae1cd2c59404
SHA1	952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256	33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512	7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5	937326fead5fd401f6cca9118bd9ade9
SHA1	4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256	68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512	b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XV24CXD5B0VA9P3MO4DE.temp

MD5	6348eaca2a3015ad56bc63b858094d59
SHA1	bd7f3de36ffa8de72da5dbca507620da7dde46da
SHA256	727b629416aceaabd8142c59f276c404b33c49f959996c9c70c2b0c0b74d6523
SHA512	1ca39f2ecfcb114b518b83a0845a5eb2f40c646f21797530b36ad2eca8ee7f1932d07218715b002e10d35b5054f32af526434be46c376813b6ac1007b7198322

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

MD5	81c71b7ad6f7579cb5f97b0389444f5d
SHA1	b94cd5c3e15b54397a244dfbced86d298dd071bd
SHA256	2fefa7d97220a9734ed78303addfcf4bbd7d3bd2a0886690d7657c83a175312b
SHA512	35138217e5c465fe34cb72182a68daf0324bda4c4b4ffeeb77857dcdc2d9c85df393268d3742dc146e2bbcf6fb95debfb4a9e3b2920c01b64e95c915ecbd6cf5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	1c4823b15dfaa4f1b6ae298f3612038a
SHA1	5996919b9568856bcbfca006853b08b60aecc20f
SHA256	f31244b89b9d1985c26bed156771fbdc18cb4680b44cf21f52c4828aa52d7d85
SHA512	d48862f94918a4c6ae7c817f3842661fad39891df9451f33b89dac784cee86693c8278669a06bb135f0d7b20fbacdfb5d668943258ef0b842c90fa2b93a0f07b

C:\Users\Admin\Downloads\getkmspico.LeHU2dfR.com-KMSpico-setup.zip.part

MD5	2f2754b1c7b4477e6b3a8f470e6637b7
SHA1	146b1ad6b6e66742c01583d589a8fb00ea1b9c3d
SHA256	b99d50435e38788b64ba79a8aecb39ce2f1b3e513305d243cddee8a3f44cadeb
SHA512	f9fdfe8e758fa08f5fa6927a984c881e5651fab702047f25df6b13e0db5335fa587528401fe3313cf4c1c2acaae45db9dad958db60e07e513b560ee82a74876e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

MD5	5b8673588a06b97a75252f8ff9a0785d
SHA1	f56f61f3532e4cfb0db8eef017f2d03d9502e5b8
SHA256	02ca543c13372ec40abe1be5bd21e6c290fb4bcfd44891bb04708c63d8b9dddb
SHA512	d95918dee3fb7ef8c1264883cd482b869f267112b051c9e815cab856be45db34b3a076066af5ee348244db1042ca6a1d216ff50f057d234449e0cb55d87131ad

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5	f235a8b700205c5994ab7e7df247f0e1
SHA1	5412e4164df789bdd4aa4c12e31cccdaeae66357
SHA256	9bb791e58586b452054405a7edca2ca64bc9d907213c59c6ed3e5b2e7c28564a
SHA512	d92d271a798ef2b68595793cdb2ee62023c0569906910077b54c426624d45813b18f813f9cc1c2fb94d43403f7da3b604eec94220af43a690545d9e3cb122ae3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\thumbnails\4131ef6eac3f872d5e58fdb24aa7cd79.png

MD5	0454521843ada1a63331e957a22e67d2
SHA1	bcb3d9eba165a8f053c5940e497d4610e6b2ef32
SHA256	9fd5578bd2b4c611237d75f7f5d678ef7abb5fb1c444d277958eb213c09a4b89
SHA512	631fa999fd78ee566983ea2ec7c8178bf46c419ef3f65c587442d8f69404305eeb004b8a4b7ff15f1eacae9eaabe01c5212217f51868067b1fc4f7fb412968a9

memory/316-2089-0x0000000000400000-0x0000000000425000-memory.dmp

memory/316-2091-0x0000000000401000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-0LHQ7.tmp\KMSpico-setup.tmp

MD5	9220aabfa74a0d9accfec48f5b668a41
SHA1	145101840a58e1e776fd61efb40b2dae54b1eeaa
SHA256	305c3d26326bfc3582b4056c20f31819e6f4b95a54a3bc5a7971ecbb86f00bd7
SHA512	eaef78760b2bafd57bbdc524c05279c26518ed4e573c5717fae21b378fd652962b820b14de72d5c8546c547471464285ea818aca0e3b5570f49ff98710155f49

\Users\Admin\AppData\Local\Temp\is-52RJB.tmp\idp.dll

MD5	8f995688085bced38ba7795f60a5e1d3
SHA1	5b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256	203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512	043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

memory/3572-2102-0x0000000000400000-0x0000000000425000-memory.dmp

memory/4152-2104-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/316-2107-0x0000000000400000-0x0000000000425000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-K6P76.tmp\_setup.exe

MD5	a02164371a50c5ff9fa2870ef6e8cfa3
SHA1	060614723f8375ecaad8b249ff07e3be082d7f25
SHA256	64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
SHA512	6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

memory/4840-2122-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-RFQP3.tmp\_setup.tmp

MD5	1778c1f66ff205875a6435a33229ab3c
SHA1	5b6189159b16c6f85feed66834af3e06c0277a19
SHA256	95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6
SHA512	8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

memory/4148-2144-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/3572-2146-0x0000000000400000-0x0000000000425000-memory.dmp

C:\Windows\System32\Vestris.ResourceLib.dll

MD5	3d733144477cadcf77009ef614413630
SHA1	0a530a2524084f1d2a85b419f033e1892174ab31
SHA256	392d73617fd0a55218261572ece2f50301e0cfa29b5ed24c3f692130aa406af3
SHA512	be6b524d67d69385a02874a2d96d4270335846bece7b528308e136428fd67af66a4216d90da4f288aeefd00a0ba5d5f3b5493824fcb352b919ab25e7ef50b81c

memory/4840-2165-0x0000000000400000-0x0000000000417000-memory.dmp

memory/1624-2166-0x0000000000400000-0x00000000004C0000-memory.dmp

C:\Program Files\KMSpico\UninsHs.exe

MD5	245824502aefe21b01e42f61955aa7f4
SHA1	a58682a8aae6302f1c934709c5aa1f6c86b2be99
SHA256	0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d
SHA512	204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

memory/5876-2931-0x0000000000400000-0x0000000000417000-memory.dmp

memory/5876-2933-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Program Files\KMSpico\KMSELDI.exe

MD5	f0280de3880ef581bf14f9cc72ec1c16
SHA1	43d348e164c35f9e02370f6f66186fbfb15ae2a3
SHA256	50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc
SHA512	ac31a972e9e93e6671f44d403139b0db89d950097c848fbaf6b9965b722215f74e9ed9bb9e083d31328101e6fcfe7f960a08b3bea0813900f11d5c1bb40539a6

memory/5868-2939-0x00000000002E0000-0x00000000003CA000-memory.dmp

C:\Program Files\KMSpico\scripts\Install_Task.cmd

MD5	ade709ca6a00370a4a6fea2425f948c1
SHA1	5919c95ef78bd4ab200f8071b98970ff9541a24a
SHA256	5b067073b968361fe489017d173040655f21890605d39cdb012a030dd75b52a8
SHA512	860f9f12bc4995fae7c74481c2b24a346e763e32a782b3826c0f0772ad90be48377faefd883c9a28b221f8476fd203782932fee859b079fb7d4b1b152cce7b53

C:\Program Files\KMSpico\scripts\Install_Service.cmd

MD5	9107cd31951f2cf90e0892740b9087c9
SHA1	efac5c2e59ddef2f0a7782ad1dea8f6b25a07395
SHA256	11578521b14c17fbbb070c13887161586d57196f4d408c41a0f02ed07ee32f2c
SHA512	f6b66dcbbb8aa55793b63f20fc3718038d7c35f94570cf487b6e8393f67be6bd004dd64f3b8fc8345b7e02e2e8ec2d48ceed2494d9f1282ca020dbbaa621f457

C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll

MD5	1397b23f30681f97049df61f94f54d05
SHA1	5cb1ce6966e3d6d8b8c398cbd537c814312f194d
SHA256	fa76151a783250014ac8fa55d4c833100a623fcad1d6e2ddadcde259f5709609
SHA512	7d001b5942dad8ce1a83831b5a87f2fa6a1571bc133ce3c1ebe9988a43a7fcefc5cdb7870a6e692ef89fb815cfcff0e9c4b41f24ba0716c6808f190ea3c53535

memory/5868-2941-0x000000001B860000-0x000000001BDA0000-memory.dmp

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	c980c725b95b5462b15d13fd8f5db674
SHA1	124680dd698a44178d16bea1c8a2eed25e5c094c
SHA256	18a668f361058946437548e61319d9fc0b5876aaf129b382e02c0c95ac93206f
SHA512	fdf1995579818ffd5e33b7cf354faf3b4e3e254abec2d116690994bb17b9a235b5e47fa1789a8f4b488fae7df0ece8e33afa764ad3c0a5af67fb5a52dccfed6f

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-bridge-office.xrm-ms

MD5	33c1695d278f5917f28067d27b4868ee
SHA1	55137aa9a24d6a622f05315dfbb65fb1a0c74e03
SHA256	65bccc008f5b44d2dbd880c0c33afcfff27c07dd24dc0cc7dda2b3bfa7e9ae74
SHA512	84389ef315ff2f9d86062470ea6033dcb409a3061b898ab677987aa881e2f6d4be1dacc4fad0c606dde6a301f04dfa2f1ff54af86e3a3767ab9bcf6ac368e2f2

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root-bridge-test.xrm-ms

MD5	c8a546ad00a2f81bd39f23ac1d70b24a
SHA1	cfbb628b1c014d0264536d908f6557dd6a01f4a9
SHA256	f050e6022511f0f16661f82809ba65ab8d912bd9971d3747f6b58f2042a4a921
SHA512	5b5cab22e808835a37fc1f1e17718baca95c03f1659022d51deca23685503cd4313fbf1363385e3f5c404c9958f6b6bd6b4b0efa7c1548113dd46f13f9ba33b0

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root.xrm-ms

MD5	aee8dc4536129edc9c1df17cb288e3e9
SHA1	13c872ac505add867c944da550e96bc69c8a4165
SHA256	6e058fd0c8a4c2aafac6502de3ea739340917c6e75e6ec26ee60298c01baa826
SHA512	a27811053173d30b56ce85837017305cc2d58a673498e4ef7e562e23147a22ed416e0e4dae9d062064bec77b3cf89e46302807cb2f0022189b88fcc8e31f0124

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-stil.xrm-ms

MD5	072b400f6cbb1123397d1c452740da04
SHA1	5f5615f5840252f4998c1c07ea717dfd7da970cc
SHA256	afe8c45943567e747425f87e43f774c783c07392888078693188882bde1339e3
SHA512	e7b8481e37f5ecc775b1e0e946c22051ff7c2b320c7deecd2fe6ae33b69abb230782ca397e5d799d8863026eee62f331000f7bf5b6f4f5b6614195c78dd2142f

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul-oob.xrm-ms

MD5	582e03b41356083d04ce6191f560092a
SHA1	607b41ac3d642b91655e0af54556f441682acacf
SHA256	d40dbfddc97849f246a397e59187a3f97f70fa1687d578b3dacb92044fd51bea
SHA512	c28f7d286369d8d4f9a9f79ed67912d2390030013ac4e3b549176cff8378ab0c34db37f2bf6712b5d9eb9b06cb7fe72203e85340889e38b85623e1dbb7d33887

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul.xrm-ms

MD5	90642c5fd30ae5a2a34d4c217b4cab7f
SHA1	b89cf6d9033a7bb52b4eb9e98c97b8978d91af43
SHA256	08e15263cdd59b78c18c21777fd67579d14e65dfac15531312bed2c9c5497c0d
SHA512	8ceadd13adafe4a582d64481dd357c9906e5a082629e4ebf576a9cb84c30b8bc9bd17f28b186594aae164415e4c42ffe78dcf83048a1f8377b97a4c24fa422dd

C:\Program Files\KMSpico\cert\kmscert2016\pkeyconfig-office.xrm-ms

MD5	6a46a4977e1b2780b9907de0530f5ee7
SHA1	22b19e90035112dd43d6c6dc100ebbbd2b57676c
SHA256	90ba4e3c11f7a8260ae8fb93a73ab5af5fcfbb45b9fb2b15800c38485d3384f4
SHA512	34a54f48dda9d1422c2949b4add88ec03f77f4f7c6b83386e395c1764cf9eedb5c75ed04119fbf6f53ee3670abefec60af1fbff49f54ba4854e4354f44ea1c6c

C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ppd.xrm-ms

MD5	6ba22dbe6a7804b7d2e6f2a416d5235e
SHA1	5e5eb958d16a18f5be2437b8ee0397edcf3e850c
SHA256	7f13c766991b4f23618844f83cb659cf7b3d5321da8925a82ea5357d8f7364d7
SHA512	341fc408e00b97d81a1d0b1aa75520f238ed24f4a3b68006b7967c75ea80cb089b5722e081a3668a083dd7e016e4af94a004f39221eb9093d9bce174a1570904

C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul-oob.xrm-ms

MD5	f24231ee95d34878b9e88d2647a61861
SHA1	3ce6bb335d12db05fa604fbd13cea6616ebdaadd
SHA256	37a1eeb50f69f20a4bf0bafb63b13308d51dbdc8f992832ffa64b87ffed84e2e
SHA512	e4ee5f4feaaa7a730be00754416f98fef52803d6343a642102d9c020ff8ea4452320c0d18b1e4872589e410b795c295b82d7f422f8892a06a1181c063fb3e1f0

C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul.xrm-ms

MD5	a08a813759a501db6500133ededcd0fe
SHA1	399c186e5c00cba369aaeece635f9ad319f30b01
SHA256	3aecba9f064a51d12785341fec10f7ac57ec156019dd71711ca1a8e0d844470e
SHA512	8f96292c2bf483f55d08a55bc94eb2afa2fdbc2db60de68369becdb4eecd117dc4f4d86876b98d56ba4c1dcdc5ba4c9e99d24e8cd770d52b8bf1ffd77805d890

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	ae2bf0417b0132104098c32242fa1394
SHA1	cbfe421cb98fd2004fa70e32ef781f715698967b
SHA256	0a04b26896cf30173190c278d1fc069272d6badfa13c8f0741054cfb6561ae6d
SHA512	8f23dd1850bc5b2855339965b45e6f071cdd0f0c7e039c8adcd808862b7b0cffbe208a9a144a5945fc6ea3b6cc933083999fa457cfee04f4b2b9472113529d89

C:\Windows\SECOH-QAD.exe

MD5	38de5b216c33833af710e88f7f64fc98
SHA1	66c72019eafa41bbf3e708cc3824c7c4447bdab6
SHA256	9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
SHA512	99b9a9d5970eb10a903bde703c638f7dc639eb4894dfd84d8d94ce1326087c09fa415ef5bc0db7fd0248827045de24b78a680f301a59395215e50051056d1490

C:\Windows\SECOH-QAD.dll

MD5	6d7fdbf9ceac51a76750fd38cf801f30
SHA1	6ef8310627537b1d24409574bc3c398cd97c474c
SHA256	0398221231cff97e1fdc03d357ac4610afb8f3cdde4c90a9ec4d7823b405699e
SHA512	b48d7eb268f8b46ff6a4782070bf6f2109ccc43166b8c64beb73348533b98f69aab5630386f4b5966b6e706f906b599fec5ff885d3e4572ed24acb6c6691fec8

memory/1624-3164-0x0000000000400000-0x00000000004C0000-memory.dmp

C:\Program Files\KMSpico\AutoPico.exe

MD5	cfe1c391464c446099a5eb33276f6d57
SHA1	9999bfcded2c953e025eabaa66b4971dab122c24
SHA256	4a714d98ce40f5f3577c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa
SHA512	4119a1722202bbc33339747ea02fd35b327890d55bb472cd1e2146ca446d8ba6fddb1e8cf8bbfaeb08aec8ed2a9d5c0fa71b73510d409ffacd3908fa72bb53b4

memory/4928-3321-0x0000000000250000-0x000000000030A000-memory.dmp

C:\Program Files\KMSpico\logs\AutoPico.log

MD5	ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1	57218c316b6921e2cd61027a2387edc31a2d9471
SHA256	f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
SHA512	37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

C:\Program Files\KMSpico\logs\AutoPico.log

MD5	2c6f944bbcc3b859087531c5f49b9419
SHA1	9d5a4a757c7facf1a8e9f05180effbe8face6d92
SHA256	d0cd63907c894d497cab9b593adc4978b64e74bcfe2376038ecb95b33aa75bbe
SHA512	ab53f29437cb0251baa3c0a298c20cb69af011e6aac6a7278548465f199889c3f68e0819ba2df16ad908f11f09d52711aba632c93d4e652f9fe088b022be6055

memory/1624-3397-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/4840-3398-0x0000000000400000-0x0000000000417000-memory.dmp

memory/5564-3399-0x00007FFD6FB80000-0x00007FFD6FB85000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\KMSELDI.exe.log

MD5	ecdb6f75531fa6175d22dcae6bceb715
SHA1	2ccfc5a6ec700850173c9fd35053ac7747c72cb1
SHA256	2ef8838c28aef4bf6348d584890dcaf04cf8a909ec220794c3f254b3f6f25deb
SHA512	eb8adeae72cea84dc31ab14eef52ec640aea18d99527d81c1c74dc7bc1297d83a2612f310d3070d995ad2476a5ac86a72693ea7a47f490aa4e65eccbe156628d

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	716df68a5e6beb08b6c1c0eb7764dc7a
SHA1	38b525903b75a08449b0dad883f777a141d27129
SHA256	d2b0d68bed2d29185781fc1950bb52e0cbf2feffc397f11c517263605fbe422c
SHA512	e2111850e6eb6eeb4556cec5397fba7cf4c03fbad552c9b5341e62bd13abc618397b69dcd5dd72014223e4d1ef5c11eb3a20d3f137e05b6ccec2b1c836c9153d

C:\Program Files\KMSpico\sounds\begin.mp3

MD5	f33f2a16a46920b5c8227ffd558060b2
SHA1	a8f7192d34d585a981b5a2ea92b04a21a17b67a8
SHA256	443d23bd2705246cd64ff39d61b999ab74be6d60db1703d6782bb0d36a20eef3
SHA512	9cf3f48adfae4c7ff8bf60f313939c956b331373bd262f5b4a25fbb04d79b86abc5d73204d5c21a8e6f8f3fd51e503016a1f930e1dc2ea6696c3c7e056af7361

memory/5552-3413-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3415-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3414-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3412-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3416-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3420-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3434-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3433-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3443-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3442-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3441-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3440-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3439-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3438-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3437-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	6cf19f1d31229794b27ecbc94b5a48d7
SHA1	8a93f0b46296163e5bc0d3981981dc055f418e10
SHA256	4cae34ced277b27e698e0a32ae1ba3f9bbe41728392a3c441d46c25a81c6fbe0
SHA512	e1aeae921a91f8d051b89ce038db13bf6bfbcda21bacbab4eff21e1f900bbe9f42232101a623fc8229434924034d0bd7594e0140024774c7ee99977c2520d937

memory/5552-3436-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

C:\Program Files\KMSpico\sounds\diagnostic.mp3

MD5	06c9a7d36b9b6390faa90ca9c0650bee
SHA1	a27a0fdc48c678a9bd34b379d4f4e2c0e9776a9c
SHA256	2445c403447490dd7227617f7e8017da429ad65985fe013c6662906af15da4b0
SHA512	00aec80c11219c86f52c1984f8f40f992e24b6aeda1a953b20891ecd8976cdd767aa78c066924ee5c732e10149449dadc4dc7425e5ba3be9c8ca0fc150498bc9

memory/5552-3432-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3431-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3430-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3429-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3428-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3427-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3426-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3425-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

C:\Program Files\KMSpico\sounds\processing.mp3

MD5	fa3dfa3bd735d73281f10a91d593d52a
SHA1	4e859fc874b61d09f0c63714385cb73843fb07e7
SHA256	9390c99249423929fb82c2aad89e19249e493e4845d0c8babc99e1b594643f34
SHA512	bb3908c9458e1494a83a33532e6e165a05acacfe44820cda5c82d70e3662e7b9571c7020d9720a694f8b91e41284779b5df09d300193a46e70656d449310aa4f

memory/5552-3424-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3422-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3423-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3421-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

C:\Program Files\KMSpico\sounds\inputok.mp3

MD5	28a23b81aefec1336a1046671dc5af30
SHA1	5c89b9b708d26cd44af9635fce8c0abd1fb71433
SHA256	0131a883e4b66e77becc17594a386bcd69e04f1e5185e4ae8a554fc3a39bb81a
SHA512	bc300f57b91a13ec31c9722c87004ea560fee7c6bedb12703281827163734819edaf3a22e322dd7f39c192ac0c319b34171a36dd9190985be33d106fa19a30bb

memory/5552-3470-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3474-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3473-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3471-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3472-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3486-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3488-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3490-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3489-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3487-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3496-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3498-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3499-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3497-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

memory/5552-3500-0x000000001EBD0000-0x000000001EBE0000-memory.dmp

C:\Program Files\KMSpico\sounds\affirmative.mp3

MD5	249dca86cbb375d84b52ed4eb5cefdc6
SHA1	244c2ce65343dcfa613c26c94fa8255c7e6789fe
SHA256	e7fc9406c360d22ed281fb415a2eec396b6a7d0c733c828b2a8c106a30753de5
SHA512	84cb0128518618b3142276e7f84f0fdf42b4e662699d822b96957f7ee31630d55eb432148c7f204bd3be46efedc2eea5ea703f3795ffd9edb7181a1e748fb947

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	ccbe8d5c0b5ebfb2e8099df1ab66f16f
SHA1	7a378afcc9f00ad969f7bd786a8c436e2f0fc3af
SHA256	039cd09e82d9a55a7a59595a0c930221fbe91c93f55dbf6e9129bfa7e8047921
SHA512	69d77edae24c8b7c8d40698580598d58f3754a172d718e593591d29ba07f65f17211a4cac86cf71dad1501d5ef1d0267d287a4151b6da4c323c1b97e47149e1c

C:\Program Files\KMSpico\sounds\complete.mp3

MD5	0d0e8e30d6007cf99f3951424e1d88e6
SHA1	56a6a3a39a5c9210e97a27190464cd25014db68c
SHA256	4d73c58c680396759508b34b169d1fd9c6aa292141c7c58634842a92d68d3c7b
SHA512	8c2ad7488e52af3aabcbbfddefe0e82c594401e279b07f5f4096b695e6f365e932085a8b4b01c91b3e29cba0fa3b0f160537d4962daed70a74854b55e67f8541

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4

MD5	7ed200e85566a878fbce7d72041fcac1
SHA1	1d28a9b0e7b5f0a68592d25ece1eaa8a92b966d6
SHA256	d727d290dbac2a22372c39989ebf9d78ae0fb515808fc778dcff69ed4db0074f
SHA512	09da7324dd3021934b1da8d83bcc8e56c3edd48fb4cc5047bc6d1a4584274d78b3b1985496f3a098d0e3715072bc0a1861d61c81470b967ca21cefc4abd1fdf5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

MD5	ec7c772ee11172ef547895c381c63c2a
SHA1	32b225feb70b1972185072d0614dbae99f1027d1
SHA256	157f460e8aa7b6fe2d3a4c7e14f96473c1a200ff54daaf81bc774c1e95b7779d
SHA512	a0d6a0dbe8b497a2adc34e704a0bbd294947086834d9df3c8608a68e25da24149b8b205476941b9608deb9853ab76925f5fe2bb64ef56f04d98cadacd24493e3

C:\Program Files\KMSpico\scripts\DisableSmartScreen.reg

MD5	98726cf4e77c2a5159801d4e888833da
SHA1	6b8db3b6a736a985d7c0c0ac8d2e4e18414d6fdf
SHA256	20aee3a1b0ecd68e642a5c8ff550d1525df1c3f2fda22b7db51010947153feba
SHA512	ff6a707496b35c1e42b2fc6d26e02c2bfb065600d28b62810076d194f75d0a1af93a48976892910b47f9ec2aec3d777a6b498b7abf034a9ee4ec075633840d04

C:\Program Files\KMSpico\scripts\Restore_Watermark.cmd

MD5	050833ff4d356ea0a04e197c18845796
SHA1	8ab9e3d510ce7db0e9f58b9bbb252194abde0326
SHA256	16b4c96db1fa9ba2fdcfb91972d537a7346f1c80daa164bfd9295d45f1c0b520
SHA512	9298fffc1ea621c013b55fd752b61bb2443d93fd9c107428f82cfbbaee1d13c8c557cd8663fe60fa92cabb9e7210fe71c7258c4b34d86d962d79a15d21a5e558

C:\Program Files\KMSpico\scripts\AddExceptions_Defender.cmd

MD5	e83a3e2620df6ab8027c483a6de2af86
SHA1	adba99a496b7e8babeb6a4b80319742d107001a1
SHA256	c71dfafe753f564d69e2e5f7223d85ec478b6b33b8e2ef02da4fd92912335bfd
SHA512	77c6a4c9e766c9dc3164290d2fe0098a8045ce395c17885d127066a0c0fa8ad91acfda9101619a1bc06d7f0b67b262608b011a2ecee2e4555fe7c0732698cd88

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	f951de118935bf1b1db035624ea0b4d7
SHA1	51f148bafecbce24af353ec83c073a598ef5d0ce
SHA256	39f3a963a6c5c81590e6147a85651e8383e30639fd7899e64b625fd79a0c3e10
SHA512	0c73a1bfbde19c2716200546468b3756caf26c4b47b5e7aaa3978904d87c6daff579be341acc3eadd0a8e662e4fa55736b3dcd5543c3fab67c129599a563b70f

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	f360778cf4381e70c11730a32d24187d
SHA1	40d81170639d69d4bd3626e56600853595095586
SHA256	4ad12e440eca18384e24cc08b654e15dd44ba802d5a176f58ace0f86f377e4f4
SHA512	a811f15373ec834c3d0527cf0a09ed6500bbba88d70350fe50dceeb8301b870fdb37852d813d15598b9f8b00857b3502653f4ecd31febf56c04c4906b28102bc

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	be6874e1245438ef1771450eabf631de
SHA1	b27025ff87fad3dbbcd0212a3ffd6e84b11a7694
SHA256	0c7cb8aa46a88e24b1ce5be4dd75ed1a94b23b37e3f5a64c9bcdf067a440ede9
SHA512	bfceb39fdc139306afce4f3053755671de082493f0e8b5b1e0400fb42333b35a728c98ae191dd9068afb4bed7d859aa9085d4810ac0d568bec5d939b789bcb29

C:\Program Files\KMSpico\TokensBackup\Windows\data.dat

MD5	9023fb59a98c1d234951ffff8a86b563
SHA1	f535f910f81cabca78beafab0bd00673ff4bcfa7
SHA256	88857419d103bbb874624f1d8b2cba1ec60590befceb38e1663e0962d9401cdc
SHA512	d1c10874edc501c9622bc2f334184dff26631bff1251426189516a9b53e5ca73b2213c7dd581304c08f35b46c74bbe93cb5cf9cb150eaaa6ac11de86cd013a6e

C:\Program Files\KMSpico\TokensBackup\Windows\tokens.dat

MD5	c04c51439d2a2854a558972bcc5f9027
SHA1	314fd71c1b48f734304faa74991ee907d2f6d96d
SHA256	0c167492c2de39157b131aa86c57e768f4a16229526dd98d362c8ff4d7fc40b2
SHA512	8a0fbb17b16bbbd7902654ee19db9f04618f80e593705b87f665dc6f5b3d658432b76d054866f3d78b14ea258f91bbe817aed988b3930283bbf02588ce90627d

C:\Program Files\KMSpico\TokensBackup\Windows\cache\cache.dat

MD5	868771c9a0fd3d36628c821b227b9494
SHA1	a01e97f26995db7391c1572672144f094df5f869
SHA256	38b4bfeed54a1e2f15616d663a5cfb6a9be996294792602ec6ccd40283a91101
SHA512	8736d2d73064a3249dd10fdcd64a4e9b5f53d12bcfc31c30a11cbd2fe6121829ebfcfdf7d2e2f76a48a5b4a872c18b71a7bac729db361a0158c2610c1a5d07de

C:\Program Files\KMSpico\sounds\transfer.mp3

MD5	0edd9455457490198c59d78246c5324a
SHA1	5120d61b527d2be4fc21e0524d9b56159e142e3f
SHA256	7c82082ef04cb2f4cd7cfb86f84ff5ddb931b39438d605d5b650adc0c1078ddf
SHA512	d938382b03824c6717f0b22a1fe505d42826fc9280737cb1081f1a919e1d6e3712de605da1803de566dfda8ba3ddb26d7e4ba4032478d4cf22424f15cc44342f

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	6ac2761531252144b71aabed77342dae
SHA1	2d9bdc917b7e0d108276ffba22c84a229836c2ca
SHA256	9fd4516bfa51d97d92d837b02882b01714900e08076a510a5d03da7d6b7e1e02
SHA512	d029f3879db54bdfd27dd201daa2d301162d980f3388ef366195ff06673130229fa023032bd5b72ce9487821a5fe2b8364e375f9c5db248207623cd5707d7044

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-27 22:07

Reported

2024-06-27 22:12

Platform

win10v2004-20240508-en

Max time kernel

33s

Max time network

41s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://file.fan/3813e1da0f904a05"

Signatures

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://file.fan/3813e1da0f904a05"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://file.fan/3813e1da0f904a05

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.0.682786240\510659355" -parentBuildID 20230214051806 -prefsHandle 1804 -prefMapHandle 1796 -prefsLen 22244 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2290b839-b3a5-4af2-ac3a-354c5adf94ca} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 1884 1b294109458 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.1.221732853\530715529" -parentBuildID 20230214051806 -prefsHandle 2464 -prefMapHandle 2452 -prefsLen 23095 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1197561a-ab29-4f52-a610-0c227ebca786} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 2476 1b292f26458 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.2.1652269646\858206728" -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 2980 -prefsLen 23198 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbca7e9c-b5ac-4916-9418-90d72bb81310} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 2996 1b29704ae58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.3.967268780\1699561394" -childID 2 -isForBrowser -prefsHandle 3632 -prefMapHandle 3628 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb950b45-6587-4994-9ce3-3881f6608f55} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 3640 1b29897c258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.4.1925684972\351315000" -childID 3 -isForBrowser -prefsHandle 5036 -prefMapHandle 5032 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbf19f55-7d22-4db2-a1cd-6fbea66904bb} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 5044 1b29a5b4f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.5.1886613803\1709568698" -childID 4 -isForBrowser -prefsHandle 5168 -prefMapHandle 5024 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {681f24e5-98ad-4f04-8375-3bb0ee059024} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 5156 1b29a5b3a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2360.6.1652776758\35952079" -childID 5 -isForBrowser -prefsHandle 5436 -prefMapHandle 5432 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9683344b-58ad-46cd-995a-accc3ee950cc} 2360 "\\.\pipe\gecko-crash-server-pipe.2360" 5448 1b29a5b5b58 tab

Network

Country	Destination	Domain	Proto
N/A	127.0.0.1:50199		tcp
US	8.8.8.8:53	file.fan	udp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	8.8.8.8:53	spocs.getpocket.com	udp
US	8.8.8.8:53	getpocket.cdn.mozilla.net	udp
US	8.8.8.8:53	content-signature-2.cdn.mozilla.net	udp
US	8.8.8.8:53	shavar.services.mozilla.com	udp
US	8.8.8.8:53	push.services.mozilla.com	udp
US	8.8.8.8:53	firefox.settings.services.mozilla.com	udp
N/A	127.0.0.1:50207		tcp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	8.8.8.8:53	file.fan	udp
US	8.8.8.8:53	getpocket.cdn.mozilla.net	udp
US	8.8.8.8:53	spocs.getpocket.com	udp
US	8.8.8.8:53	content-signature-2.cdn.mozilla.net	udp
US	8.8.8.8:53	push.services.mozilla.com	udp
US	8.8.8.8:53	aus5.mozilla.org	udp
US	8.8.8.8:53	spocs.getpocket.com	udp
US	8.8.8.8:53	push.services.mozilla.com	udp
US	8.8.8.8:53	file.fan	udp

Files

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs.js

MD5	ba6b4a1b282edb382f0826f55d6c9708
SHA1	c5d0603e51ec1265c63eb23a115b2fbc609a6825
SHA256	74a57b2de4d90c742be31730fac0ed61b4dd876905063cde36c0fd081a244ae4
SHA512	c6e71d585ca72d887edbc93006c0801dd73278098f611be6e7048edcfb3233ae7a7e566fa9ee1c0711cb14c1a4de8a54859b20bf2fefb9caf4a38a6fd7455b54

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs-1.js

MD5	4cbd6412db42a4be82dd538226c48e69
SHA1	144628f766c332173c3d734e80c8318a7138f056
SHA256	7b4a503a1a22db5e8d10b4d371cc488fddc2e5bb56d103eb58034d5ca4b9039c
SHA512	19fe66d17608ffa91dd9e2ebd5a36c8dd76446a75e5eab162700d3a626203bcd76bcb8554daa7e995bc8b588416144f6dfe0dc46991f026d9d1458d8b39794b0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

MD5	77e4a8e2fbd146be9e435703f4deac61
SHA1	f75c777c59b851a9675e01e50b13b44d98f4aef4
SHA256	4d3182dcde6c93d4a400c4f939f46ef7479d3d7acd28d40b5f02d69b2822ce95
SHA512	cfc6e95239afa7476b4bc7c2f073db8f5264d2f0e8bbeb7daa75ed1c9307bee058880aa2be0c6831061cf16bccc555f9bb9ede1a445b08ac11fc4de630c0e3fd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\activity-stream.discovery_stream.json.tmp

MD5	003473f5b1310023c548a6f38d1e2483
SHA1	c5c8bcbf9acc2629039b95aa5f076b7dcee2dca5
SHA256	7b5344691fa369a19fe21fad4755c11e09c8823f7deed6528f30597fecbc9b93
SHA512	a47a7dbd4670c5ba88d875c74e8ef2050c7cf0580bcbf80ae91fbb69a109312088d4fb8b12a616d48eaa6bef3a50245bc59c4de16fa51373c4ef7d25665d9963

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs-1.js

MD5	e32e61d91a5eb24e26ced19d27ad2533
SHA1	964a4e49f806fc583f1205420c70fe09eb504f86
SHA256	55a7769a8a91b843f7d86f910c681d907729f1e9691ef7ca95c25c5b2925cca5
SHA512	dcbb8232a1ebc1a495e66efabc483ccc66d1b5fb8e4d6c9e9dcbb6c68803d4762066bb7027dd2566b736e63bd561740687547e99e8c0be44547e8c6f63b05682

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-27 22:07

Reported

2024-06-27 22:19

Platform

win11-20240611-en

Max time kernel

368s

Max time network

374s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://file.fan/3813e1da0f904a05"

Signatures

Creates new service(s)

persistence execution

Event Triggered Execution: Image File Execution Options Injection

persistence

Description	Indicator	Process	Target
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\AutoPico.exe	N/A
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\AutoPico.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	C:\Program Files\KMSpico\AutoPico.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-DO9OK.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-53DF1.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-4BPMS.tmp\_setup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
N/A	N/A	C:\Program Files\KMSpico\UninsHs.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\AutoPico.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-DO9OK.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-53DF1.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Windows\system32\SppExtComObj.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks installed software on the system

discovery

Checks system information in the registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	C:\Users\Admin\AppData\Local\Temp\is-53DF1.tmp\KMSpico-setup.tmp	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\system32\is-GJG3L.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File opened for modification	C:\Windows\system32\Vestris.ResourceLib.dll	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Windows\system32\is-4OUS8.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files\KMSpico\cert\kmscert2013\Access\is-9B8FA.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-TCMQT.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW6\Business\is-QP84M.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-PJ7GF.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-3TI3T.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-JGAG9.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-00T86.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-G118K.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\scripts\is-3BG11.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-NB9QJ.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\scripts\is-849LJ.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\DM.bin	C:\Program Files\KMSpico\KMSELDI.exe	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-2QBPA.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-009RH.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-B4MC8.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-B3M7K.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-19HVU.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\sounds\is-IGHC5.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-6R7GJ.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-681S1.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-O86SO.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-3UEAQ.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-GQKE8.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW10\Education\is-77JJ2.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-CS73J.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-3LK9V.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-LKNU6.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-43CTQ.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\scripts\is-58S5G.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\sounds\is-4B56A.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-4AEAC.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-IICUN.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-HV6N2.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-3I056.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\Word\is-Q03TT.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-9LD15.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-P9QH0.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-3V6VG.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File opened for modification	C:\Program Files\KMSpico\AutoPico.exe	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Access\is-7LIRK.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-H6VG3.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-MPOD9.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\Word\is-4GBPS.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-2CBQS.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-K0EE3.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-93RRL.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-4477R.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-E3HDA.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-BJL7V.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2013\Access\is-K4ABK.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File opened for modification	C:\Program Files\KMSpico\TokensBackup\Keys.txt	C:\Program Files\KMSpico\KMSELDI.exe	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\Access\is-N4B19.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-3PJS2.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-NFK6S.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-I9BE3.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\driver\is-JBPFT.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\unins000.dat	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-18R10.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-0GST9.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-NOUF0.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-59BI6.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File opened for modification	C:\Program Files\KMSpico\KMSELDI.exe	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-40OA8.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
File created	C:\Program Files\KMSpico\icons\is-M6783.tmp	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\SECOH-QAD.dll	C:\Program Files\KMSpico\KMSELDI.exe	N/A
File created	C:\Windows\SECOH-QAD.exe	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Launches sc.exe

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\sc.exe	N/A

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies Control Panel

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	C:\Program Files\KMSpico\AutoPico.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Modifies Internet Explorer Phishing Filter

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform	C:\Windows\system32\SppExtComObj.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588\DiscoveredKeyManagementServiceIpAddress = "10.51.185.250"	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f	C:\Windows\system32\SppExtComObj.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588	C:\Windows\system32\SppExtComObj.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588\DiscoveredKeyManagementServiceIpAddress	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft	C:\Windows\system32\SppExtComObj.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

NTFS ADS

Description	Indicator	Process	Target
File created	C:\Users\Admin\Downloads\getkmspico.com-KMSpico-setup.zip:Zone.Identifier	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\system32\schtasks.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-53DF1.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-53DF1.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Windows\SECOH-QAD.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\AutoPico.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\AutoPico.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Program Files\KMSpico\AutoPico.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\KMSpico\AutoPico.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A
Token: 33	N/A	C:\Windows\system32\AUDIODG.EXE	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\system32\AUDIODG.EXE	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Program Files\KMSpico\KMSELDI.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-53DF1.tmp\KMSpico-setup.tmp	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A
N/A	N/A	C:\Program Files\Mozilla Firefox\firefox.exe	N/A

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://file.fan/3813e1da0f904a05"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://file.fan/3813e1da0f904a05

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.0.1043695377\1994455641" -parentBuildID 20230214051806 -prefsHandle 1768 -prefMapHandle 1760 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b6e934d-a615-4828-8ecc-c6eee8ff4c67} 448 "\\.\pipe\gecko-crash-server-pipe.448" 1860 2789230ef58 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.1.58480666\1519080410" -parentBuildID 20230214051806 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac849b88-4dbb-482d-abd2-20b1d1947033} 448 "\\.\pipe\gecko-crash-server-pipe.448" 2416 27885689958 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.2.1802343662\993329061" -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 3060 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29561a38-e645-46fd-b489-21ce38793efd} 448 "\\.\pipe\gecko-crash-server-pipe.448" 3076 27895439e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.3.60674837\809351180" -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3560 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7933a46e-85e9-42d0-9825-7e354cc11cd4} 448 "\\.\pipe\gecko-crash-server-pipe.448" 3576 2788567f558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.4.2017479868\535560245" -childID 3 -isForBrowser -prefsHandle 5304 -prefMapHandle 5300 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7716f61f-cfe1-4bff-9e41-f6ce46d2fb58} 448 "\\.\pipe\gecko-crash-server-pipe.448" 5316 2789a4f0058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.5.663472221\409003256" -childID 4 -isForBrowser -prefsHandle 5460 -prefMapHandle 5464 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f07005bb-a916-45a8-bae2-1225acc66bc1} 448 "\\.\pipe\gecko-crash-server-pipe.448" 5448 2789a4f1558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.6.1991814703\902989485" -childID 5 -isForBrowser -prefsHandle 5644 -prefMapHandle 5648 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bf6b258-dcce-49b5-abaa-733af011dcf5} 448 "\\.\pipe\gecko-crash-server-pipe.448" 5728 2789a4f0958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.7.552580754\1316627609" -childID 6 -isForBrowser -prefsHandle 10308 -prefMapHandle 10360 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c84ea2f-1a1d-4f8e-84ef-ffc17de23b89} 448 "\\.\pipe\gecko-crash-server-pipe.448" 10344 2789a652258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.8.1662069053\739831508" -childID 7 -isForBrowser -prefsHandle 4900 -prefMapHandle 4896 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d849f55d-2331-42b7-a373-3f5de54af3c0} 448 "\\.\pipe\gecko-crash-server-pipe.448" 10308 2789960f258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.9.1212427960\506310499" -childID 8 -isForBrowser -prefsHandle 9852 -prefMapHandle 9856 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95edb808-1f50-451e-abcf-fc5709891196} 448 "\\.\pipe\gecko-crash-server-pipe.448" 9840 2789960e058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.10.510091431\45580888" -childID 9 -isForBrowser -prefsHandle 5432 -prefMapHandle 5452 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48682d10-3261-44c2-87c7-df54c633bb12} 448 "\\.\pipe\gecko-crash-server-pipe.448" 5844 27899b68858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.11.1737083948\2066742019" -childID 10 -isForBrowser -prefsHandle 9692 -prefMapHandle 10108 -prefsLen 31220 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a99d33a-957d-403c-914b-2c000e2dbda9} 448 "\\.\pipe\gecko-crash-server-pipe.448" 9684 27885677e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.12.96864143\805740608" -childID 11 -isForBrowser -prefsHandle 9944 -prefMapHandle 9764 -prefsLen 31220 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6f79eb9-bd9c-4f23-a317-7e15c0756dd5} 448 "\\.\pipe\gecko-crash-server-pipe.448" 7796 2789ab7ea58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.13.292226580\1760622696" -childID 12 -isForBrowser -prefsHandle 7692 -prefMapHandle 7696 -prefsLen 31220 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f52ac171-7762-4cd0-b5df-5398eb4cfcf9} 448 "\\.\pipe\gecko-crash-server-pipe.448" 7680 2789a4ef758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.14.1579913835\1957422518" -childID 13 -isForBrowser -prefsHandle 7604 -prefMapHandle 7572 -prefsLen 31220 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96e2a7f8-aff2-49ab-b5d4-336ebb384ed4} 448 "\\.\pipe\gecko-crash-server-pipe.448" 9772 278a12b2258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.15.612734212\1761900131" -childID 14 -isForBrowser -prefsHandle 7720 -prefMapHandle 9944 -prefsLen 31220 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3123ceab-2166-4e73-b82b-a310ec474aad} 448 "\\.\pipe\gecko-crash-server-pipe.448" 7468 278a39c0c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.16.1181774851\1250134232" -childID 15 -isForBrowser -prefsHandle 9816 -prefMapHandle 4960 -prefsLen 31229 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15626e43-63d7-4d82-b9ed-683af4dad645} 448 "\\.\pipe\gecko-crash-server-pipe.448" 5784 2789b8d0358 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.17.1926426923\2049002829" -childID 16 -isForBrowser -prefsHandle 9860 -prefMapHandle 5852 -prefsLen 31229 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac05a1d9-e964-4e70-90c9-46ae708a2c9f} 448 "\\.\pipe\gecko-crash-server-pipe.448" 10080 2789b8d0658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.18.1914817897\1573776360" -childID 17 -isForBrowser -prefsHandle 7828 -prefMapHandle 7824 -prefsLen 31229 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba48aed1-c8d2-4aa9-bd4b-c480818f6f0e} 448 "\\.\pipe\gecko-crash-server-pipe.448" 7896 278996c3758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.19.1683118656\477651494" -childID 18 -isForBrowser -prefsHandle 4936 -prefMapHandle 5948 -prefsLen 31229 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {375f624e-9684-450e-b014-b0dcedeb4ec6} 448 "\\.\pipe\gecko-crash-server-pipe.448" 1600 278996c4658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.20.745412847\313474883" -childID 19 -isForBrowser -prefsHandle 7396 -prefMapHandle 7300 -prefsLen 31229 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9dc595b-e52d-4e48-88d4-05811a2ec1f0} 448 "\\.\pipe\gecko-crash-server-pipe.448" 5692 2789b98e258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.21.531596954\588145297" -childID 20 -isForBrowser -prefsHandle 7084 -prefMapHandle 7080 -prefsLen 31229 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b18ae07-8696-401e-849c-2d794ec5a649} 448 "\\.\pipe\gecko-crash-server-pipe.448" 7092 2789b98cd58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.22.1568982384\1723758955" -childID 21 -isForBrowser -prefsHandle 7516 -prefMapHandle 7288 -prefsLen 31229 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9505fbf-4acb-479a-8c2d-968f2004c4a5} 448 "\\.\pipe\gecko-crash-server-pipe.448" 7264 278a4a06858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.23.828690628\322671563" -childID 22 -isForBrowser -prefsHandle 7220 -prefMapHandle 9700 -prefsLen 31229 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41648805-4d7d-4aa8-94f0-25949f2d8f2b} 448 "\\.\pipe\gecko-crash-server-pipe.448" 10308 278a4a06e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.24.1125274073\1972393222" -childID 23 -isForBrowser -prefsHandle 5560 -prefMapHandle 5872 -prefsLen 31229 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {147133e2-1d82-439b-b515-4cfb922033d0} 448 "\\.\pipe\gecko-crash-server-pipe.448" 7240 2789a4f0f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.25.2084639091\917885668" -childID 24 -isForBrowser -prefsHandle 7524 -prefMapHandle 5608 -prefsLen 31229 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce25834e-ca8f-4aa2-91d4-e66e4236d1ff} 448 "\\.\pipe\gecko-crash-server-pipe.448" 7560 2789a4f1b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.26.713400949\104386948" -childID 25 -isForBrowser -prefsHandle 7344 -prefMapHandle 7308 -prefsLen 31229 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9985a6fc-e922-44a1-b915-4f2bb68d066b} 448 "\\.\pipe\gecko-crash-server-pipe.448" 5732 2789a652858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.27.1147484613\1450978641" -childID 26 -isForBrowser -prefsHandle 5760 -prefMapHandle 7684 -prefsLen 31348 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ea2dfc0-dcdc-48df-90dd-450d1ccab4d2} 448 "\\.\pipe\gecko-crash-server-pipe.448" 9716 278a4404158 tab

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-DO9OK.tmp\KMSpico-setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-DO9OK.tmp\KMSpico-setup.tmp" /SL5="$402B4,3424323,122880,C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe"

C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe" /VERYSILENT

C:\Users\Admin\AppData\Local\Temp\is-53DF1.tmp\KMSpico-setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-53DF1.tmp\KMSpico-setup.tmp" /SL5="$502B4,3424323,122880,C:\Users\Admin\AppData\Local\Temp\Temp1_getkmspico.com-KMSpico-setup.zip\KMSpico-setup.exe" /VERYSILENT

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\system32\taskkill.exe" /f /im "kmsupd.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /F /SC ONLOGON /RL HIGHEST /TN "KMSpico Auto Update Scheduler" /TR "\"C:\Program Files (x86)\Common Files\KMSpico\Update\kmsupd.exe\"

C:\Users\Admin\AppData\Local\Temp\is-4BPMS.tmp\_setup.exe

"C:\Users\Admin\AppData\Local\Temp\is-4BPMS.tmp\_setup.exe"

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy

C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp" /SL5="$3030C,2952592,69120,C:\Users\Admin\AppData\Local\Temp\is-4BPMS.tmp\_setup.exe"

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=ActiveSync

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.AccountsControl_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.AsyncTextService_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.BioEnrollment_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.CredDialogHost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.DesktopAppInstaller_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.ECApp_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.LockApp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.OneDriveSync_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.VCLibs.140.00_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Win32WebViewHost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.CallingShellApp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.CapturePicker_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.ParentalControls_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.Search_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.XboxGameCallableUI_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=MicrosoftWindows.Client.CBS_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=NcsiUwpApp_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Windows.CBSPreview_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=windows.immersivecontrolpanel_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Windows.PrintDialog_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=windows_ie_ac_001

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""

C:\Program Files\KMSpico\UninsHs.exe

"C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\Admin\AppData\Local\Temp\is-4BPMS.tmp\_setup.exe

C:\Program Files\KMSpico\KMSELDI.exe

"C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup

C:\Windows\system32\sc.exe

sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"

C:\Windows\system32\schtasks.exe

SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.28.802134991\134529738" -childID 27 -isForBrowser -prefsHandle 7116 -prefMapHandle 7912 -prefsLen 31413 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28930064-9852-40f0-afbb-1eb00e7e66f7} 448 "\\.\pipe\gecko-crash-server-pipe.448" 4936 278994fbb58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.29.84708297\306066859" -childID 28 -isForBrowser -prefsHandle 5880 -prefMapHandle 4948 -prefsLen 31413 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb9a04b4-e1c9-46fd-a674-c3a155b3627f} 448 "\\.\pipe\gecko-crash-server-pipe.448" 5348 278994fbe58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.30.1051591293\1419742287" -childID 29 -isForBrowser -prefsHandle 6368 -prefMapHandle 4396 -prefsLen 31413 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a184a9e-a768-432f-88c1-5f6c2bfac7a7} 448 "\\.\pipe\gecko-crash-server-pipe.448" 7256 278994fe258 tab

C:\Windows\SECOH-QAD.exe

C:\Windows\SECOH-QAD.exe C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SLUI.exe

C:\Program Files\KMSpico\AutoPico.exe

"C:\Program Files\KMSpico\AutoPico.exe" /silent

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.31.729765403\1567220027" -childID 30 -isForBrowser -prefsHandle 5400 -prefMapHandle 10176 -prefsLen 31413 -prefMapSize 235121 -jsInitHandle 1100 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb90f63a-5721-41d0-9cf5-8b5a9868b3bb} 448 "\\.\pipe\gecko-crash-server-pipe.448" 7772 2788563eb58 tab

C:\Program Files\KMSpico\KMSELDI.exe

"C:\Program Files\KMSpico\KMSELDI.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004E4

C:\Windows\System32\SLUI.exe

"C:\Windows\System32\SLUI.exe" RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;Trigger=TimerEvent

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	8.8.8.8:53	file.fan	udp
US	8.8.8.8:53	spocs.getpocket.com	udp
US	8.8.8.8:53	getpocket.cdn.mozilla.net	udp
US	8.8.8.8:53	content-signature-2.cdn.mozilla.net	udp
US	8.8.8.8:53	shavar.services.mozilla.com	udp
US	8.8.8.8:53	push.services.mozilla.com	udp
US	8.8.8.8:53	firefox.settings.services.mozilla.com	udp
US	34.160.144.191:443	prod.content-signature-chains.prod.webservices.mozgcp.net	tcp
US	34.149.100.209:443	prod.remote-settings.prod.webservices.mozgcp.net	tcp
US	34.120.5.221:443	prod.pocket.prod.cloudops.mozgcp.net	tcp
US	172.67.158.89:443	file.fan	tcp
US	44.241.14.171:443	shavar.services.mozilla.com	tcp
US	34.117.188.166:443	contile.services.mozilla.com	udp
US	34.117.188.166:443	contile.services.mozilla.com	udp
US	34.107.243.93:443	push.services.mozilla.com	tcp
US	34.117.188.166:443	contile.services.mozilla.com	tcp
US	34.117.188.166:443	contile.services.mozilla.com	tcp
US	34.107.243.93:443	push.services.mozilla.com	tcp
US	172.67.158.89:443	file.fan	udp
US	34.149.100.209:443	prod.remote-settings.prod.webservices.mozgcp.net	tcp
US	192.243.61.225:443	pl22905469.profitablegatecpm.com	tcp
US	172.67.152.114:443	alwingulla.com	tcp
N/A	127.0.0.1:49740		tcp
US	172.67.152.114:443	alwingulla.com	udp
US	172.240.108.76:443	pl22905469.profitablegatecpm.com	tcp
US	192.243.61.227:443	pl22905469.profitablegatecpm.com	tcp
US	8.8.8.8:53	76.108.240.172.in-addr.arpa	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.195.8:443	my.rtmark.net	tcp
NL	139.45.197.250:443	boltepse.com	tcp
NL	139.45.197.244:443	shoordaird.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.250:443	boltepse.com	tcp
US	104.21.11.245:443	tzegilo.com	tcp
N/A	127.0.0.1:49748		tcp
US	104.21.11.245:443	tzegilo.com	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.244:443	shoordaird.com	tcp
NL	139.45.195.254:443	fleraprt.com	tcp
NL	139.45.197.151:443	interstitial-08.com	tcp
US	104.22.32.172:443	offerimage.com	tcp
US	172.67.10.98:443	littlecdn.com	tcp
US	172.67.10.98:443	littlecdn.com	tcp
US	172.67.10.98:443	littlecdn.com	tcp
US	172.67.10.98:443	littlecdn.com	tcp
US	172.64.152.106:443	c.adskeeper.com	tcp
US	172.64.152.106:443	c.adskeeper.com	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.250:443	boltepse.com	tcp
NL	139.45.195.8:443	my.rtmark.net	tcp
NL	139.45.197.250:443	boltepse.com	tcp
GB	142.250.187.196:443	www.google.com	tcp
NL	139.45.197.250:443	boltepse.com	tcp
GB	142.250.187.196:443	www.google.com	udp
NL	139.45.197.250:443	boltepse.com	tcp
NL	139.45.197.250:443	boltepse.com	tcp
NL	139.45.197.250:443	boltepse.com	tcp
US	35.244.181.201:443	prod.balrog.prod.cloudops.mozgcp.net	tcp
NL	2.18.121.79:80	a19.dscg10.akamai.net	tcp
GB	142.250.187.206:443	redirector.gvt1.com	tcp
GB	142.250.187.206:443	redirector.gvt1.com	udp
NL	74.125.100.199:443	r2.sn-5hne6nz6.gvt1.com	tcp
NL	74.125.100.199:443	r2.sn-5hne6nz6.gvt1.com	udp
US	34.117.121.53:443	firefox-settings-attachments.cdn.mozilla.net	tcp
US	34.117.121.53:443	firefox-settings-attachments.cdn.mozilla.net	tcp
US	34.117.121.53:443	firefox-settings-attachments.cdn.mozilla.net	tcp
US	34.117.121.53:443	firefox-settings-attachments.cdn.mozilla.net	tcp
US	34.117.121.53:443	firefox-settings-attachments.cdn.mozilla.net	tcp
US	34.117.121.53:443	firefox-settings-attachments.cdn.mozilla.net	tcp
NL	139.45.197.244:443	shoordaird.com	tcp
US	172.67.158.89:443	file.fan	udp
NL	139.45.197.250:443	boltepse.com	tcp
US	172.64.152.106:443	c.adskeeper.com	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	172.67.142.102:443	adxproofcheck.com	tcp
US	172.67.142.102:443	adxproofcheck.com	udp
NL	139.45.195.8:443	my.rtmark.net	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
RU	77.88.21.119:443	mc.yandex.com	tcp
GB	142.250.187.196:443	www.google.com	tcp
US	192.243.61.225:443	pl22905469.profitablegatecpm.com	tcp
US	172.240.108.76:443	pl22905469.profitablegatecpm.com	tcp
US	172.67.152.114:443	alwingulla.com	udp
US	192.243.61.227:443	pl22905469.profitablegatecpm.com	tcp
GB	142.250.187.196:443	www.google.com	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.250:443	boltepse.com	tcp
NL	139.45.197.244:443	shoordaird.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.250:443	boltepse.com	tcp
NL	139.45.197.244:443	shoordaird.com	tcp
US	104.21.11.245:443	tzegilo.com	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.197.250:443	boltepse.com	tcp
NL	139.45.195.254:443	fleraprt.com	tcp
NL	139.45.197.151:443	interstitial-08.com	tcp
NL	139.45.197.250:443	boltepse.com	tcp
US	172.64.152.106:443	c.adskeeper.com	udp
NL	139.45.197.250:443	boltepse.com	tcp
US	172.67.158.89:443	file.fan	udp
NL	139.45.197.242:443	kukidsaidree.com	tcp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	172.67.142.102:443	adxproofcheck.com	udp
RU	87.250.250.119:443	mc.yandex.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.195.8:443	my.rtmark.net	tcp
GB	142.250.187.196:443	www.google.com	udp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	8.8.8.8:53	arleavannya.com	udp
US	8.8.8.8:53	www.google.com	udp
US	8.8.8.8:53	veepteero.com	udp
NL	139.45.197.250:443	boltepse.com	tcp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	arleavannya.com	udp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	arleavannya.com	udp
NL	139.45.197.250:443	boltepse.com	tcp
US	8.8.8.8:53	shorturl.at	udp
US	172.67.69.88:80	shorturl.at	tcp
US	172.67.69.88:80	shorturl.at	tcp
US	172.67.69.88:443	shorturl.at	tcp
US	8.8.8.8:53	www.shorturl.at	udp
US	8.8.8.8:53	www.shorturl.at	udp
US	172.67.69.88:443	www.shorturl.at	tcp
US	8.8.8.8:53	www.shorturl.at	udp
US	8.8.8.8:53	88.69.67.172.in-addr.arpa	udp
NL	139.45.197.250:443	boltepse.com	tcp
NL	139.45.197.242:443	veepteero.com	tcp
US	8.8.8.8:53	240.160.215.129.in-addr.arpa	udp
US	8.8.8.8:53	contile.services.mozilla.com	udp
NL	139.45.197.242:443	veepteero.com	tcp
US	8.8.8.8:53	veepteero.com	udp
US	8.8.8.8:53	contile.services.mozilla.com	udp
US	34.117.188.166:443	contile.services.mozilla.com	udp
US	8.8.8.8:53	contile.services.mozilla.com	udp
NL	139.45.197.242:443	veepteero.com	tcp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	8.8.8.8:53	my.rtmark.net	udp
US	172.67.142.102:443	adxproofcheck.com	tcp
US	8.8.8.8:53	adxproofcheck.com	udp
US	172.67.142.102:443	adxproofcheck.com	udp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	172.67.142.102:443	adxproofcheck.com	udp
US	8.8.8.8:53	arleavannya.com	udp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
US	8.8.8.8:53	arleavannya.com	udp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.197.248:443	arleavannya.com	tcp
NL	139.45.195.8:443	my.rtmark.net	tcp
US	8.8.8.8:53	18.179.253.148.in-addr.arpa	udp
N/A	127.0.0.1:1688		tcp
GB	2.18.66.75:443		tcp
US	8.8.8.8:53	r.bing.com	udp
BE	88.221.83.240:443	r.bing.com	tcp
BE	88.221.83.240:443	r.bing.com	tcp
BE	88.221.83.240:443	r.bing.com	tcp
BE	88.221.83.240:443	r.bing.com	tcp
BE	88.221.83.240:443	r.bing.com	tcp
BE	88.221.83.240:443	r.bing.com	tcp
US	8.8.8.8:53	browser.pipe.aria.microsoft.com	udp
IE	13.69.239.72:443	browser.pipe.aria.microsoft.com	tcp
US	8.8.8.8:53	240.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	72.239.69.13.in-addr.arpa	udp
US	8.8.8.8:53	2.pool.ntp.org	udp
US	8.8.8.8:53	222.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	183.151.89.51.in-addr.arpa	udp
N/A	127.0.0.1:1688		tcp

Files

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\activity-stream.discovery_stream.json.tmp

MD5	7176a27b6283ec1a6c17e24f9d19cb3e
SHA1	556c5dd0cb1e5829c0a410333dfaa5800dc066dc
SHA256	0bce5035464cc248a7299e268830799c7e3babbdb3cad4067de98234a799731f
SHA512	6e64a51265f1fb249673a8dc2bded1e06acf528dfe1516c518eb28034b7073932f7d1672a778cbf22ba7c00fc6a4c5e974103055062f9823275fa6220ad6aaa0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\prefs.js

MD5	26618f51cd50bd37a095568180952a58
SHA1	d0ad772233c278cd395d67a891f87b2ceb3287dc
SHA256	956acc8e119e3fd3559ded370ac5a6de070d59ddf04ca232acfd0ba60491efd2
SHA512	be39dc8bbe06577e64579653abef75f31425cc36ee8ea32d703f54eacaad6ea7f763722b5cd0b771e4af3bb428b58abaed6439cd2705072d1c35e7133266ccf3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\storage\default\https+++file.fan\idb\3793352433bblDokc.sqlite

MD5	7f6921c95949ec7f44571d18a7525594
SHA1	1550e0d4f1ab053201590b0bb4c63c497fe347d3
SHA256	6670e7214f07235e28892e8ca89ea6387fef6440e6c3e73021af5c1282b84431
SHA512	f474f685bd186190c1872e2905dd90514dd80423631601162067f6ac918e2ca42b0585529a723b43a4c73ea7041a407ed2696e8f7cdae9ea07e6e1367f41be52

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\storage\default\https+++file.fan\idb\2323548853sewsDaabta.sqlite-wal

MD5	b1bce48b149daa409e7d01ea9d3e253a
SHA1	f6b6a265ed9543c0f9c8848ac17f1d2c71fd8f93
SHA256	774d91e617f44171ab300a75f583408081c2a9718ab45526405f12d4799c07a5
SHA512	60abb2adbe532e3bc752a3f4d505a26c8276b6a80a8b811fec791c4b31bda9ee5100952684836072226dfa4a8f4ffe5f1c25a6f8407e716a9c5b2cd5727b16d7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\storage\default\https+++file.fan\cache\morgue\31\{395f6395-f001-4d31-b664-2960feba651f}.final

MD5	d15008dc9e77c00aa05df1b1ea54659e
SHA1	32f420e7c41813e27d73ad4f3024128303152635
SHA256	166d029480f6c150fe44933c68d37ab04c63138bbf32d9d1440f54ab19e66872
SHA512	650ca283a15047b98384203dbdab7cc973176e35f3ae77e816047a3b3aba98ce3e6072c66660a285410cf75a13e7475d9d16fbe51c270dd672f1b896c645c4cb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	9ad7ca0f1dcbb5c546ff9846b304fd94
SHA1	ea62d1ee729d1fc1f7fb0a74c0b506b0476ec4e4
SHA256	91b9ffb70a435221e9c502e403ec7841583aa707e4e154c368e04fd547ea7bb6
SHA512	386f470f9aa11c0ae05284a8a78e549e22d14aec113df0d13ecc4901dbb7b8ad1b740449780c47d11aab60eb5047e37feb0c310372e2c0004c3e2a585b1121cb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\storage\default\https+++file.fan\cache\morgue\88\{7fc43409-1c75-4ffe-9b2f-01b9820cdb58}.final

MD5	6129dec2116765ceb4a9728db2ed0d6e
SHA1	7df1be3fcf3572606f37ba98a7e2887c543d67ba
SHA256	ccfd07a314fb9fc5057616f3c8fc2c3a3c179fe05497be66f9727e77169556ab
SHA512	e343515feaee7dd348c39b51db5c88aa2fdd1849da0393c7cc55289d57cf1b5d6dae1ef3f83ab1e477a04f40748b2be741d5d3eb96f5a551c3a90e67c5921aa0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\19666

MD5	a6b5d813368114c5106df8921c404289
SHA1	a0d62b9e07b13b73828ed779f04c16b0c404ddf8
SHA256	0161f2d263235f92049aab72059ba3692cf105725b8aa3b32c321fb725614170
SHA512	53e21896094187e1ee922b5d9501a4bdd33bb4258bfec2889c831c2ea3eeeaedeffab6858878d5f273595ab7e68953248ed3222f43b674d9532db71823fe07b3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	a34078671ca72036b2a1ffef33b6f9af
SHA1	9dc5992982f2c4a01960130a2540e9cd1ae71183
SHA256	01bec4c48ea48d6276ee21f0b765cf803f085d844e8b2e35de51a47e9f1a1922
SHA512	7c4131be76fd5da967e3761fd028f4b7b5bf62cfbd55cdc6745771bfa18ff9fa05d4bad126e44d962f8bf1ed47a7786edef836c15be2b21ddf51aae7041b5439

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\6169

MD5	9d00231a3e7cd1640acae680170beeec
SHA1	76caad0c4824931fee254c8d95f59a95f6d921ec
SHA256	e443af5bd4088b9b77376644f50e15e1038ac8cb8e2068fd9bf93621f0584020
SHA512	ed0bae0b3494dd6bdb2586e4b0cffb9bf7db719501bea76461fa777bdea421fc73d33e3ffb6f66691c0c28eddb979d203bf6105f8d3caffb08d7d1601e5d2d06

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\prefs.js

MD5	1631518b849b0e2a229e88672d50a5e6
SHA1	0bb5d4b64962f8a9606e1b807b70971399115010
SHA256	f7ccb438e1ab41aff8ea47b6f1b4fb8c3d0d22025db5353350f309c735508c64
SHA512	4047019a343250b6d0de36bbf04d174b613105ecce42736db24dc7c5699d606555c9e913dc29faf0d74cfe3520248679e135e0b353116c46fe881d1e15bb976a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\prefs-1.js

MD5	166dc4e75fb9883d0a0053bbd4817ac7
SHA1	5f32e5f6f0164fd408c43e57993e53e1bba4d872
SHA256	76fd65601a05ebb2d976a1de39dec376b6593d2a8f3920c22c60c2bc79d180ca
SHA512	8e3f53cea2cf97305fe8b6bf12ccbc40e3c23be116afb6ec441c05c233111f034bbb0cff97694a13aa1bcca2e6919b7dc1fb7a08e04e609007cbfe84130d8ca7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	c16865d556f8ea75febfd2bb83a9669b
SHA1	f5b85f88ca96b04605bea6eaf332ab0ab2a78878
SHA256	991c7490916428781e0d53441c8dbf1357413cf30cd39153e739b554da71bd79
SHA512	721785e25681ba75cf44fcc87de8faee7ffa78d0c804590938202547a34c406044503da7eb4bf565097508d111fc147e1df13a5a531ea4d9152ec0d6a9490078

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

MD5	71167fedb02a4b752e1ed3943b277713
SHA1	9e3d1988a0a35969d9e66835b8c374bc646ccf87
SHA256	0c7dc81ba29572964b55a07e07fba9bde8ba015e7e68af8a04549660576205c0
SHA512	6f8cb64eb3a906534109f1a02f04fc4370985b3e7a0b085703e3f43b626a16e02976bd5e303aca0f4be4a966a21c0d2560deda101fa2f796be3b0549fcb0b382

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5	85430baed3398695717b0263807cf97c
SHA1	fffbee923cea216f50fce5d54219a188a5100f41
SHA256	a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512	06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5	fe3355639648c417e8307c6d051e3e37
SHA1	f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256	1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512	8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5	3d33cdc0b3d281e67dd52e14435dd04f
SHA1	4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256	f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512	a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\prefs-1.js

MD5	8c41e65290fefb5e2733fc9ba2c11ef8
SHA1	5acc4d6b174a0e7dd2b3d5fad7a5f4da5cc9d646
SHA256	6eb9650e7f7e77a413122f9e60606fff5fa1a0740be4052b20c588b2d26cdee8
SHA512	12e21765a5f55273831fb34cdd0db9af41fa929daae449811d4a1c407976d4bbf3f5bee915e074e7c267b79e2852fe40be51a0aba085014c896593b70526ca91

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5	a01c5ecd6108350ae23d2cddf0e77c17
SHA1	c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256	345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512	b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5	49ddb419d96dceb9069018535fb2e2fc
SHA1	62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256	2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512	48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5	8be33af717bb1b67fbd61c3f4b807e9e
SHA1	7cf17656d174d951957ff36810e874a134dd49e0
SHA256	e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512	6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5	33bf7b0439480effb9fb212efce87b13
SHA1	cee50f2745edc6dc291887b6075ca64d716f495a
SHA256	8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512	d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5	688bed3676d2104e7f17ae1cd2c59404
SHA1	952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256	33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512	7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5	937326fead5fd401f6cca9118bd9ade9
SHA1	4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256	68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512	b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	3ff780ce6a966085426e65b246a2cbe6
SHA1	ff97a59ad1ebf50ba5640bacc9a65f37d07dfcc1
SHA256	a4590f9ea14db08fd72f5482dd4a8f1e55ef4f336e830a67f7a28a0fda311edc
SHA512	74a19467fec8cf5db9d92d4fd95f14146a5ebef62fb64726ae0a3f2cc41af160dcfa173e02053e07653940041660a45683495a21c5e3057e0a39febfadcaaa79

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\storage\default\https+++file.fan\ls\usage

MD5	a7603d87fbe11bced9b0ea01f59e1b43
SHA1	13342df6a8f49343df70cb31567fedf90704d034
SHA256	1c53aa3b4acfeed71aa203e95f564eee36e3a49d78c1d6ca672827b111e6bd88
SHA512	e3ac97465dacf2e2d37a30e171c0511164b4026058a2e68dee751a805fac8ae2e4d9b4d44acf6890d9add0ca4d05761e0359e9152af271c632d46ae07937d34c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\16662671513A179D6E86F6DCBF766FC5A26681A0

MD5	8d4b0e0498ce8e32180138952446f301
SHA1	9cb3dcfaeb9421499c5857eef027fdc7ef3500f6
SHA256	28f7ac619573c213d3afeed0b6844bbe9ccea843017bd03de913e7ea623fa1ef
SHA512	eb724d082a861e5e076e95f756a44031ad864e9bd0180567f5f54d6da86de9ec2a82fd55c12c5260342eba9bb32e9c7cf0e8ba7ecb7a160fec66605057569d4b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\24862

MD5	dc68eab9127c0977efdc6c495963f61e
SHA1	4427d9700dda550a4345f038600f7a0464f6b1a3
SHA256	6cb8f5f8ffe035b5eac588dcd41f75d12b7d0458e419d2fb9bf6658b99c78bd2
SHA512	5f0ac71a728ef707d496b6304abf50b688b686fd5876696c5d0df949e1bfc3c8de8f9de07752c14e10ea75739a8175952d9b9ffaeb6e7c2c0e47c4e40d83421e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	b126ba2a04599964c0d34a8466f17a36
SHA1	fcd2c9784294738ad003032172e2ca7de565aa7d
SHA256	3c96f862928b6cbab87311ae4b1a83c836f8342be9bd067a1ef99b80d96b12bb
SHA512	c4c7c84fb6963783e837d6ea8abb1df41917f3584f1188f4f979068e379bfb93c32a00a7c71f59b2b224ecd96ec953144625bfe3b4104db3cefcbec03bbce279

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\32274

MD5	7fed84bd7dbcb133ab3be0969c2924b7
SHA1	6470ab7bf16f74c229edde44d60ec66b50a8423c
SHA256	82a5211ff7ecd6f1900d5ea3dcd83ce221899b67cb4d8ba2f456635ff703c77c
SHA512	09fd49852a97305a52abddd82d3d19282da24bc4aa201768c69c35363432356e37663f3b23dfa944c804ae6d90aea01be6cbbdcea4241c5a98a11d88d85f00ee

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\25631

MD5	4c9d6d74da81ea9e0329d670e564688c
SHA1	39bb8f060c641d3f90d6271654e36ace9e7c0b88
SHA256	3e38228710ad727e5a5439d31968cec2b91fb4baa6c75946aea9089f53a70c99
SHA512	9bd743cca92963a46f48eda232c8547a660654ca4adbc33696fe522db4e2866a475a3344390a7e1a287bebfe272c322897ba565a58ce56f9db8cf73cb1d13e8d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\31825

MD5	6e4eaaa2d44364072aa753d718ddf3f5
SHA1	2e10912a230fe06ab02cfad37f18fdead437d9d1
SHA256	d070f5c15db2bee4c3ef7bb32e7ed0543c41817c391a2c0ba905a99efb86f7ac
SHA512	d52f025f9b9c99a7045425cc8c16ec15193c9ce104b6fd5df1077d23d083648e1eba60e00ce5757c11382cfc4f1fabef3d9fe61a161d857a5c0ab4c619902564

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\A49ABBB5A0B758691EBD4F5B7B9C787576C23657

MD5	aeaa9c14be45fc69a804a25dd11cf0cb
SHA1	a7aa28f6d29f059d68f0182f813c3ff59d036c51
SHA256	69d6a83586a5f7c97ac51893923a0e56f0ca86384c9037bb3c8eb68791b5154d
SHA512	685c9ddf07e5232b670407af28dd048db7dae91ff9646dbb23be6996eeec4a5449e77b85e81c3eab09f911fedf6802de486c125f0f7cb8b762176a02da268da3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\13064

MD5	fa4cdc7304824c4bf4ded71db068c159
SHA1	7d11f2381d813ffb4b2a9878104cdf382eacb25a
SHA256	b6bb973f151b2298fd446141e18d92d7136686a362624a61e58710cecef734c6
SHA512	3c72462cc126976fcc1d95801a4e1c2409547fc8a4bf858d05640a349792c2fee354cf1cb775b41295ff91a574f3cfa7f7866f13dc87374ecb8b098b46448348

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\64E23250D56F6C7260FF93D0B8A982F75F5E9FD4

MD5	e22603360a4b30b8a67d7e86d5c6a567
SHA1	450bb0fa14dd38628f5c93347ca118018f41678a
SHA256	0287fb7489681c4292c06a40907f9434ef8cd02d30459373aaaa33d663670141
SHA512	aff230ea5c9747b8c64808da2da7d39f0656c9bed57c01c1d8e089e38c8224d82e3afd25928ce228af689059704e16410c0acc2077e61cf5c9195a5e7cbf2558

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\21413

MD5	6c06afd57cda3e9cc9ace5a0cf8dfedd
SHA1	2775ed296db75945fd36327f302b69a0fd75c8af
SHA256	e46324c77fd74a14340b9d9c857be89bc3b5d3fa8d1f66dbc5d9588c755ba1b1
SHA512	89dc6cb3853cb6f305ccc29b6bff9a90943d258da613ceaf2231ac2620ce31fa16ae5eea5cabeb5b5c7a2aa3ee3196ea90347eba6e3f7faa2825858a9726d38d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	1ba5ac76b673865165f4ac5c5bf5cb22
SHA1	5f724d5d57a25181d15f0b2d0f544cf8a428706b
SHA256	13f2c036a0dc9d3f84b0044e6b81195d7d14b29a562d5887c7d2c44900a935eb
SHA512	dd0429eed6c12fb939672d39e5184c26b50fd85d6ebe5645cdbc62b770504cb6f78e0c904602dd21ee4b56376eb01ac105906cdad23682b6fc32ccefbb47b069

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\storage\default\https+++file.fan\ls\usage

MD5	b1188dfe78f543679ae9686c9090081f
SHA1	78a81c6d8772c92346517a680db20b9324c1e0fa
SHA256	67c39a86c63c80d1d538cae0c491a23e697d0d7ac5f36737443d9fe8391363be
SHA512	dded1d65813721836a2894c486264a8186c9a6382dba94e58b529a5b907b59eafbbbb2ce57656bb9dd2636446e19d50cd040119e3ab55dba07b95694b0cbae5b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	2056cc095ed9bc7ee003d046ebc50a8d
SHA1	5b6d37dc4c3288ee1650a8aff731030fd3325316
SHA256	6906e2afc0f09020eea15acc4621ffb0b3323f1f1c34fda294beca9bd8599435
SHA512	552309420f95be441581cc6c43c44f0fa32aab8d0e23652cac46fa51dd7e0b65ac884ecdc7b4c0b3313f56530192ed078bac42e488b95dc2112aee9112be30eb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	4b390e97c2bcfb76d4b4f60f5d8d3030
SHA1	24527f4a984ba00cdefffcc04e09eac0d4b8081d
SHA256	5cecd3993336547738622876d59eaee0dc5b8feb9746e4b88490d7f438ce2017
SHA512	7e8f1c07e7362879cdaa9479f9ff20969e97b616a876b9e6fba0bea86f65e3f68abea12e3a528c875dfb4c84ddc7fbc1dbd11aa15247e20e381a180a16d15667

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\21076

MD5	352970b6db3aff79f9bb165b9df3ff22
SHA1	15b6a3b1eb9283f5f4c7462a4ccb7eebb03c64eb
SHA256	c7ad88b9c9b1fd8d1018a88ce7eb606faef1d40f1ec5c3659fae1a86667024e9
SHA512	cbb2527bd455ed936a493138311fc2455c18826de3c0a4aca12d77dfc1572dffae65cf86f5c4678c166d3e36ebc39e4e00721de11d5c3b8a27c4581e4d3824ab

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\1327

MD5	68d54fab6ea5a3aedff6aacb4bd8bbf8
SHA1	f8700129974157e070b0d76f4d64280cadb9d3f1
SHA256	fbd5d6f08b71476eca34dd0fa6d2ef0579dff2a34b19a67f47b6bbf6b14d2503
SHA512	8716a6c744240bfc2e22abc122b31bee441124efb8a5f6d6aa38f83bed4a6b06720dc05310b74479f5525e82ba4845caf59d1f89d9db8fb9a387b739d3dde103

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\20808

MD5	052d70bdf933d206b4253ec9290a4f8a
SHA1	a66630ee5f12ab73c1782b50436f0526d8561367
SHA256	264e1443025407c3184a8923e9f00524ec9c8b7adcbb356b4a3912bfb19f6fac
SHA512	8e0c3b1ecbd3eff4fbfa17d57485f4d125f5b296f88d2cf7015e631094a5590f77fa18895a0b6ac6c11e3911782ea2293254a54cba8e5a7bbe11c9629fff0437

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\22095

MD5	fb097fad92b5f16bb5afaae4491989c0
SHA1	b828a520b039f6153239906dea5d212252cf9c98
SHA256	b69e7a6f36f6e6ce38fa5462095bc7c2ab54e808d6c73826b822b7b0c2f80d33
SHA512	d9e4be81012c9b8884ca2139bdbaf74f853518007781adde8be373aad27c9c57dc680529ba46530ebf6598ee60807af51cbfb1688624215600beecacc963a185

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\4003

MD5	ac5691675fa8a2292e640d1857710551
SHA1	3ae8fc7c87dafe6b2ce20028a79b11022775029b
SHA256	1c03232e335d2bee8cd2b9dc8a44fecfe71dc2ed3221608b962f926af2edbf3c
SHA512	3c8a25c384772be1f42d3dab6bae96da08753c74464916d2bf6f704f1109dc3fd6958f6ed16cd9555e80d589593e3115239f6bb34e32c41ea36d0dbfc9651e4e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\27452

MD5	dc79d6bd4f8f0c906c0fd82beae977f7
SHA1	fb925a3fbf1098958e983c772126e8da3b1fa762
SHA256	c65710efb966033bead107a352748b067d75901422f578e090d374f0390becc9
SHA512	448956e1fcecf35280268c072e0c08be90a34fabbc820694d5b55d8f6fafbafa83b7f90470ef05de8f3f66b3431e20231b199ba88230eaf61ec51d4b7e27abc4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\32300

MD5	c342ad29b1f692468263b8556c287204
SHA1	780c0edd5470ad1177a56763149d49b0757f5984
SHA256	2cd21a8bd3adb92aa8c23f94095122bf859e90f5a9b6ae016f80820233372429
SHA512	4427464494ac945fd7a04247a6bc165da2afbbc64fdbcec328258c9b8c9df0f6943d5d04bc7bcf17fcbbfaf0bd56054c336f2afc577fe6f75f64d3c022487a5d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\37106C9BCF415CF7F8B5D3163D91CD2A5D967D0F

MD5	b4d67f345137d5ae34c2f0971b6d242b
SHA1	c5fb0d069e6ae61fe639c8f0772ebb3ce2e6d86f
SHA256	4f65ccadaccf6fa0dd2a3fb89a3b74a20127aabef1c4a5a5ae3400d0d11a1f82
SHA512	a054eb3ced314be4d82857fbd6a889ac08771b2205bc05e5114f58edef9b6e0644fd297b2e448763f1f8a1d814b47aaeaba6ce5e465e81c53ad8c11cb7b646d0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\19237

MD5	057de6c587024fda7297033c7f732047
SHA1	6479ac32568ebb3038d555362da7c26dbedbd8d6
SHA256	b170dddc929172f87c5a223277259848e876f3342f5c1e9f362e1963529172a6
SHA512	4b51f1afbd7c769053c697da9f2d813ad5ebf264648fa274f0ab024f6245c591b0d81848ab12794dc144a666223d0383f15c6419356b5d18f072d61ce0a751b2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	d5be884cc0c0a243c1a9011de1bdec70
SHA1	22ad808753414a20c4d8f1e2c94be151f246eab3
SHA256	efb7192dd160da4fa2d991e68aa9f584e10ac1c83e3ca9277fc2c858f2f61d32
SHA512	78222bcd2a3a0750565ad675cd8ae49a23cc4e1457fda5312d53ad5a4d7d9a744eeb6d96e960f8b11633afb7a22a7cab42d8e8fa86c3d88ef22061696301e511

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\382

MD5	ebd8634f9cb508aa077e2ef1ecb83434
SHA1	9f95817f4ab8840d20179fd3fa6a258a7db448c6
SHA256	edd35959e98e2b5742341131466dde47e17c5946585cc97a3d26946cb6fb3b84
SHA512	f10f5444934ea4e7fc7ff09aed3f4bca1035f09270462f242ee05f187ab32d42218dfe8eb578213e08d901b8df2a679cfb4f2fbf10fe694252b6c3c901a75af8

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\storage\default\https+++file.fan\idb\2323548853sewsDaabta.sqlite-wal

MD5	d93a0bd9ae35d0a27f9bdcf671408439
SHA1	b35fef86b343684b764255f5c8b4cf3980324202
SHA256	7d53be216fc12d38dbe40a6c2abb6a7f4fc39a32ec0a6378684fa20b8ee50423
SHA512	7fb30643cfc4ecfaeb37445204b4b97764f7b74cc4ad64af7a0410eaa36fcc955b3d3bc7fcb2176d12a2ad5b759d3477d8397f374ba1f299eeac983db65f5d99

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\D0AD4E9EE43D2E5580960766B69630DDD97DDF81

MD5	13f7e9675b06b6e0f0c45b8736a98937
SHA1	c21f122af92dd3b365a2ab7f713fe5d73fdc3723
SHA256	39968f5ee2f2109ebfe22a87ad6e2d0dbfb51e32e4f057cd3ae015491302488a
SHA512	b1d78fbfec4c88a32fe994c094191dcde669a01902bce6b3b431c931e5e6fe8a9a83cc600570c8afd02921f446a090d1d0d38345a9083ebe1790e27da604ec65

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\BDF6979196B703C7D88D34607464602F28972524

MD5	6891b92ffa0a0a1a8dd4ab512dba3fbf
SHA1	bafb020b29ffedcc3ba4e7c763ef50e19b253797
SHA256	0906e8d6eb73c7ce5dd3d6ad1a3b6a4ee9c2006e8606b6f15de7acad39bf3f01
SHA512	6248b8015b9e2491ed4ab4399a95e7a0e8c5e833477228d8b928a66fdd434bee5cbab53be2b105cc21745633c3a070db1494fdee379df9aa8cfbfddd4bc35bbb

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\FE830DAF56E2878AF2F9F4D72B345F55887E0129

MD5	991f95c36fff4b3ac549cef55ef02051
SHA1	95ff155667af016c754aa51dec517b834d820267
SHA256	87cd5241529175525e57b08648f5983abb5db91347549c19fa33e7721019e3f7
SHA512	3a75408ebfc5561d50f35d6abca875abc4709c240f39f91ebbab58ed83ad5a06632b95fc3e71b0916ce4ecc14baea7327e880f4ca21c31541341b65005451779

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\675B00B937266D368D8380A3DA7B3FA7F69F93DE

MD5	9398ae5bc603fe64de52be90612975d4
SHA1	951bd636daaf476ab9b5255b6020550dfd65e06b
SHA256	d9d2e0103090ec494c674b1033863c6255dfc48b078f814bbed656d194bc851b
SHA512	88e10849c2f8f81a2d259cc731ecc5a04a110e6eb10ec6b93ae6bc70991b324cc411db5ee116ab8cff4f12cf906cd183cb26ed8c83d1fa4d814bf365d46511a5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\78F4CF7BAD4B31FA8AAE8FD99A36C5181F0EF68A

MD5	a688857ec6ae167fb3224b2f973c432e
SHA1	37da78cbd7a68fc0101f09de314b14428fbca241
SHA256	a75e814432aed23f5c5216f28a8bc900468df7e4736433eb891bb82a26e30e27
SHA512	c549954a34a1af61796b813638d7369b5e8fe12999582ab85660f37ecffdb7d5edc1a9e4d101e5d2f66aec813bbd1c1962d7c6ecee5947eaa0d042ee541a7754

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\E0B2EFAF006D6F86BA6C41BB457CA3E96A84949C

MD5	d3bc9f48cde8c70e9fd84894824f7bed
SHA1	ac208d9e2e154f4543e7aa4efbaaf7e2428e0f9a
SHA256	b060f9ab7d9411af7a8bb0fc9ae2a444b63ee5667d555cd8a77b7a229d6ba83d
SHA512	624c24cad545e6fa3a11d7cd05a3add66d0f104b734d3b352214aafcb7e167ad5cd81be20b1a8b4a4b1163fb3ff560c78f13df7bba4d2d5adf1f1f0ce2d3e986

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\C5B94ADABBE719A56F98A52B62E44BAFB4C28266

MD5	0389a9befd4f481fed9e278bc00501dd
SHA1	a98b88aec2b021e43592782cb43aaf280ea0de8b
SHA256	6fffb69dce8b72ff59faab29398609686a7e5f87cf71cce5d1f1152476e98cfb
SHA512	57996c040029b854d36b2c9346bdff5c850289f1c1544fece70d13710fd1de6e6a3aa714601865bfce4fff216b1387d323230395b3daa0e2f028bd5ddd175ded

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\A907980C7D7C52BA5C268F40D7F9DA63906ECC9B

MD5	f0058443a06698c9c8f4838c4e928225
SHA1	0fd4685f9c5fe0b19d60d430428e83de9860d641
SHA256	46a3335b05b6fca3fd8f5902b2e56c925d012b294b901f8d1c3851066e1ef624
SHA512	706ba48ee5a44af3b9ace846cc3055f8dd4cac102f522872395ad1cf9ac86dbaeff408d66fbe1f5b3535a09c0004cff09a6741b6f2de35912ef474798b8283a7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\32458

MD5	8d52933543b3d6479a93d6e4f6e8699b
SHA1	daf9e9689748fcb425e73bf49cf86d34fbc0dc22
SHA256	9625b3c990997b934d42f25d3c95cd1a7f33a0684b4f4cfefb7bc32699823950
SHA512	ddd2276f1a10e0c02c79a57e8d3a420b74d93aea92d7a7f69570fead6faa3033748ba0faae7e328fe3037b3826e6744658927f9b96211c12490ea5fde3321329

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	1824c3a8eb7b20d6af5f71e99e6eeca2
SHA1	e95608072fc2f6fcbd8aa13d8527f79375a259ff
SHA256	14b8938eb4334f1a55945746ddbdd6561b278b147d58b5ebab4a997b9348acd4
SHA512	3b084337574d1483f0f392be4aae4fc28274f9b0383e83c9ee7055d9c1efc9436ab0de9cd03c4819fd0267ff255c2bc59ede7b7c4db10c92ce2317e6c543d84f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\86B985BE1D9399BE7A53DE93EA762F949A90127B

MD5	6258b0d0baa82c257cf107ee5fafd05a
SHA1	23e71d68cb36623c91b4521a4c69348f4186770c
SHA256	49473327830acd55de488b6f3fccd2a7aaafad27b950e85417e844e35f7487fd
SHA512	1623fbbcd584bf854e045349264fcad01f93673016e0c8478973c71762c694ad7c8179b55a09e2ab0efc7cb34994152489959ed537efbf21360375f9a5e176a5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\8870

MD5	e756891308a74343ca1904a8845b3108
SHA1	89863fb8a776e012275e80915c5f1544cb0254ff
SHA256	d267ae7575081922bd5f5962d6a594d073a572c4c22074275d678d3bd627ccf7
SHA512	40d10fbb5f604a77aa9413f5aec31f6076c6f03659e9913c51f824da07ff8808769dd274f714913b7d357ac1adfc33c0c789ad04c2fc33fd364921462910b3f9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\13942

MD5	f5e14688bc8ed1fd539b2622de165030
SHA1	68cc05325fecdd16134e1b091494d64a07d0e217
SHA256	89c3f683e346f2701d00ab62a3133d391f4d36119e9711469a1b3e29e4a8afa8
SHA512	277edb1cddfe6925f9033c872b284a806461ff7385a9684898ec0c404b9c1799b4f468021e750ffdb991358550612183a5441ca4963fce1e3f56e09a31b995d3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	be015ee718d22590774d3aee12b5ceab
SHA1	724a7c94b0489b9894c54b931dd614922897f90d
SHA256	7bb05af97ea2b06f3ae65b78c0d7ff96f9848c5b34710b7cde1d6b05e0ad99dc
SHA512	0f4b98ea42d21e4bd34fd1a89ef1a46c5163cd31a0f82f8ae572cdffdf588074b6e111bbc1963e2f0b04131436c2456d4e58ab511f1946c347dbe20aa8e09225

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\doomed\16951

MD5	71a08de27fc894b18d1882a516ffeb83
SHA1	7484307ae601e84659b9cc5e33b011693e1a2b94
SHA256	f3ed207d2c4b83ffd203da3022f920598d50e5f4a9cc1fa335b54051e919bfcd
SHA512	02ffec27bfbae9da0c46efe4b7806a74e73db69ecf3ea7dcf9c78aa450ac4ab8416c8cf19314f1a024d6cbfcf56f36dd6702f28f3d55024e4462a7ce1ab39036

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\prefs-1.js

MD5	1aa0b466358f8a1be1aca7bdbd6b1f50
SHA1	e75cc81a79a418b8e22da4ecd83e7e9d617aea63
SHA256	0206ee9709bc04f7c194c846669886cab95e475efd267afb477a59252d8ded28
SHA512	6fecd821390edada0b55125f1435f5f10024ae700351b2178a7961c9e863b262a5c5d5621e73a627b7dd22b81c1a356fe4cd3ee67926c7a312c432e313f7e8d3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	74a64f63ece3808d727ddde929c6452f
SHA1	d0880a0a71bee770eab12eaaad0196dbb802c13e
SHA256	dd00f967ac348b397f5e267f9b36cde95a57689adb9dfed594799fe8e2d61aae
SHA512	5995a4f522821829594800dd81b9d2860661745237a3feee3108aaaa5f010a27af2f6d79d414c22f9ca457ff73e093f06f96cfc1f4450b94825d19b5948cdd4c

C:\Users\Admin\Downloads\getkmspico.h198IlFZ.com-KMSpico-setup.zip.part

MD5	8b117c96512672fcdd93b59763f8cd70
SHA1	da6674d92036e642f4a9ea5dc3287e33f481c9c8
SHA256	58eef2380498f0e1a1c16ae9cb8bcc60ea81c404f713938bfb75e3384d07da82
SHA512	de6d569146204f980ee6616058a31f191666ee821ce17ec54ed12dc2175797c8c1cc84391cf79f95c31e78f33129c372403a2f23d1b5bde782a320a52c1c1de3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	a230317e4a4329dca50f47777d79d042
SHA1	cb06be856508b9f567f734a7ff7f4b53e14e0988
SHA256	8c832d6c601b8298bbf7347b5614aef4fa274f9331911d4afc6cf4676ccba3d8
SHA512	fe85518bffccd6d448dcf0250c92e988d86658c9cddceb6a2a4fe585bdc5c164f8c7cfcdefdbb17d9fe67cbf2fe1a875094bab08349f946ae45c144496952329

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\datareporting\glean\db\data.safe.bin

MD5	63b1bb87284efe954e1c3ae390e7ee44
SHA1	75b297779e1e2a8009276dd8df4507eb57e4e179
SHA256	b017ee25a7f5c09eb4bf359ca721d67e6e9d9f95f8ce6f741d47f33bde6ef73a
SHA512	f7768cbd7dd80408bd270e5a0dc47df588850203546bbc405adb0b096d00d45010d0fb64d8a6c050c83d81bd313094036f3d3af2916f1328f3899d76fad04895

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5	3bdbd2fa06a079843143381d8139f429
SHA1	c3990fb414a85ef25f14bb7b3a4002d12d24395a
SHA256	37da082d23d81d9cf184fdba3beb5f6e934a1a8f752af627ba34c438804de289
SHA512	4092fc99234b022b2f00600c3d8d8afed9c363c627761cdc4455b96bd2c0eba1638fbb3f7b15a8b627285d7073d05e50ed5070b647e9692e401345fb89e3fd42

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5	6924213e44e1171628634ca7f8e4a300
SHA1	b6a75fbecaea4bc7d6b9d170bdd0bc1243780fe6
SHA256	242c1e3bcf0dc5baed3f8d6e27993fc1cc9a013412967880e0cc4d8984b347d8
SHA512	a08a52701deb327f1c3511f874a671b47d6a75b10b748676a12d85854c77fe54e62ac887c764df20fb2fa31b028d0c0fdef510f6ef3f3c2e51dae1c0f6e7200d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\jumpListCache\qLKCOB9_eIfkGZTUUBT7+g==.ico

MD5	3bf54c1009420193ebff1eee86bd2dba
SHA1	020d4abe147e948f5299c8bdf92b17c3f965b273
SHA256	708edb971068e7390e7a797f947535f54fc8e474332f97cb97ae96eab5b7b522
SHA512	d77c4e1e0f6149e2e511dd16352a1a0f5eadca90e45e4d45e006b0d72a123cdcd22e50c6fb1b04d3f092cefc18a178dac4e41be48b10d34db303f364a334b8db

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	7384a2a22a44aae0c5c204757abbab4f
SHA1	3febb137af93cd6a9766781620ed77c4b0ff5f58
SHA256	a2142e2d5c362fc6151d85b2225ae2f9783f3b71af75898a1afcd3ef735b350b
SHA512	912235e4ece96ff51242b57cbad2b691fc9f80de9de8fc65b2dbb397641a15f54709ca56fe88381be97075f245cf0ff7f4505e82440ac2af5d99ef335561091c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4

MD5	76908b214f3cac54cf87fecd776904a1
SHA1	5f1b19b401addeeafe2e767e77aa6a0ef583dfef
SHA256	fe5fc6883b516f9b5c2fd98222c9015762aa6d994838bbf78d6540d62e0cdfc3
SHA512	cfc5ff481d9deb5c07d93d0a54e7158febe3f77ce1f7bddec2d646acdcf58e5d9477d45e2e593106c5b738a17bf8f9addaea35497d271ba2edd3a80d22a5c433

memory/2464-3512-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2464-3514-0x0000000000401000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-DO9OK.tmp\KMSpico-setup.tmp

MD5	9220aabfa74a0d9accfec48f5b668a41
SHA1	145101840a58e1e776fd61efb40b2dae54b1eeaa
SHA256	305c3d26326bfc3582b4056c20f31819e6f4b95a54a3bc5a7971ecbb86f00bd7
SHA512	eaef78760b2bafd57bbdc524c05279c26518ed4e573c5717fae21b378fd652962b820b14de72d5c8546c547471464285ea818aca0e3b5570f49ff98710155f49

memory/2020-3519-0x0000000000400000-0x00000000004CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-D4U8G.tmp\idp.dll

MD5	8f995688085bced38ba7795f60a5e1d3
SHA1	5b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256	203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512	043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

memory/3012-3532-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2464-3533-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2020-3531-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/3012-3528-0x0000000000400000-0x0000000000425000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-4BPMS.tmp\_setup.exe

MD5	a02164371a50c5ff9fa2870ef6e8cfa3
SHA1	060614723f8375ecaad8b249ff07e3be082d7f25
SHA256	64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
SHA512	6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

memory/3568-3551-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-ERQPI.tmp\_setup.tmp

MD5	1778c1f66ff205875a6435a33229ab3c
SHA1	5b6189159b16c6f85feed66834af3e06c0277a19
SHA256	95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6
SHA512	8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

memory/2296-3563-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/3012-3564-0x0000000000400000-0x0000000000425000-memory.dmp

C:\Windows\System32\Vestris.ResourceLib.dll

MD5	3d733144477cadcf77009ef614413630
SHA1	0a530a2524084f1d2a85b419f033e1892174ab31
SHA256	392d73617fd0a55218261572ece2f50301e0cfa29b5ed24c3f692130aa406af3
SHA512	be6b524d67d69385a02874a2d96d4270335846bece7b528308e136428fd67af66a4216d90da4f288aeefd00a0ba5d5f3b5493824fcb352b919ab25e7ef50b81c

C:\Program Files\KMSpico\UninsHs.exe

MD5	245824502aefe21b01e42f61955aa7f4
SHA1	a58682a8aae6302f1c934709c5aa1f6c86b2be99
SHA256	0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d
SHA512	204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

memory/5036-4340-0x0000000000400000-0x0000000000417000-memory.dmp

memory/5036-4343-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Program Files\KMSpico\KMSELDI.exe

MD5	f0280de3880ef581bf14f9cc72ec1c16
SHA1	43d348e164c35f9e02370f6f66186fbfb15ae2a3
SHA256	50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc
SHA512	ac31a972e9e93e6671f44d403139b0db89d950097c848fbaf6b9965b722215f74e9ed9bb9e083d31328101e6fcfe7f960a08b3bea0813900f11d5c1bb40539a6

C:\Program Files\KMSpico\scripts\Install_Service.cmd

MD5	9107cd31951f2cf90e0892740b9087c9
SHA1	efac5c2e59ddef2f0a7782ad1dea8f6b25a07395
SHA256	11578521b14c17fbbb070c13887161586d57196f4d408c41a0f02ed07ee32f2c
SHA512	f6b66dcbbb8aa55793b63f20fc3718038d7c35f94570cf487b6e8393f67be6bd004dd64f3b8fc8345b7e02e2e8ec2d48ceed2494d9f1282ca020dbbaa621f457

C:\Program Files\KMSpico\scripts\Install_Task.cmd

MD5	ade709ca6a00370a4a6fea2425f948c1
SHA1	5919c95ef78bd4ab200f8071b98970ff9541a24a
SHA256	5b067073b968361fe489017d173040655f21890605d39cdb012a030dd75b52a8
SHA512	860f9f12bc4995fae7c74481c2b24a346e763e32a782b3826c0f0772ad90be48377faefd883c9a28b221f8476fd203782932fee859b079fb7d4b1b152cce7b53

memory/3052-4349-0x00000000000E0000-0x00000000001CA000-memory.dmp

C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll

MD5	1397b23f30681f97049df61f94f54d05
SHA1	5cb1ce6966e3d6d8b8c398cbd537c814312f194d
SHA256	fa76151a783250014ac8fa55d4c833100a623fcad1d6e2ddadcde259f5709609
SHA512	7d001b5942dad8ce1a83831b5a87f2fa6a1571bc133ce3c1ebe9988a43a7fcefc5cdb7870a6e692ef89fb815cfcff0e9c4b41f24ba0716c6808f190ea3c53535

memory/3052-4351-0x000000001B580000-0x000000001BAC0000-memory.dmp

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	536cffbc4e9a46e8bb146e186b0fdb40
SHA1	472fca663130892a8b01ad09fc010f8c7b8f7529
SHA256	e0d0a1b18a34ee7a9c54538f5ccc9e3bff6bb390801f5a847681841afbffd851
SHA512	23d218de048d106ed7f0dd6ec125869e5deac6d2dde03589c0bb93fa127d40f8d4be31f9935e9c9e0dae808f6fa4bc1cc88f45ad4b1977cd6b58384a7b20c6b4

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	7b11734b8b733d7267c883ca4530805c
SHA1	00033eb89b864d52b9e70b963b8533643a240c94
SHA256	5568307cbb6f5008d6058265e9e36cfd719f32a0e1b20db7e3d88536047e3f5c
SHA512	9b58cded787be87f8d70fbcf630161616989deb6040cc85036df2b5aaaf3424891b387b0bd3b91e7b22642b35b8417c2573fde9b4a96c6812e711b0f9f325ebd

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	6a260afa3b3877f6954696d8141742af
SHA1	0af6b501c215007d99fdca45947b626e22bd9d23
SHA256	8245d0f7ede58bcf9bf89bec505d668f50cdf47ec1c75cddf8c174af6aeabfae
SHA512	c78d162bb733482aff7d81f68466cee5946d44e30db05e416ca93c86603589bcab30596a7b759aecd3ed7d219bf4bad5c494cd258d1b6c3ff96b7854dbefd2f6

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-bridge-office.xrm-ms

MD5	33c1695d278f5917f28067d27b4868ee
SHA1	55137aa9a24d6a622f05315dfbb65fb1a0c74e03
SHA256	65bccc008f5b44d2dbd880c0c33afcfff27c07dd24dc0cc7dda2b3bfa7e9ae74
SHA512	84389ef315ff2f9d86062470ea6033dcb409a3061b898ab677987aa881e2f6d4be1dacc4fad0c606dde6a301f04dfa2f1ff54af86e3a3767ab9bcf6ac368e2f2

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root-bridge-test.xrm-ms

MD5	c8a546ad00a2f81bd39f23ac1d70b24a
SHA1	cfbb628b1c014d0264536d908f6557dd6a01f4a9
SHA256	f050e6022511f0f16661f82809ba65ab8d912bd9971d3747f6b58f2042a4a921
SHA512	5b5cab22e808835a37fc1f1e17718baca95c03f1659022d51deca23685503cd4313fbf1363385e3f5c404c9958f6b6bd6b4b0efa7c1548113dd46f13f9ba33b0

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root.xrm-ms

MD5	aee8dc4536129edc9c1df17cb288e3e9
SHA1	13c872ac505add867c944da550e96bc69c8a4165
SHA256	6e058fd0c8a4c2aafac6502de3ea739340917c6e75e6ec26ee60298c01baa826
SHA512	a27811053173d30b56ce85837017305cc2d58a673498e4ef7e562e23147a22ed416e0e4dae9d062064bec77b3cf89e46302807cb2f0022189b88fcc8e31f0124

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-stil.xrm-ms

MD5	072b400f6cbb1123397d1c452740da04
SHA1	5f5615f5840252f4998c1c07ea717dfd7da970cc
SHA256	afe8c45943567e747425f87e43f774c783c07392888078693188882bde1339e3
SHA512	e7b8481e37f5ecc775b1e0e946c22051ff7c2b320c7deecd2fe6ae33b69abb230782ca397e5d799d8863026eee62f331000f7bf5b6f4f5b6614195c78dd2142f

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul-oob.xrm-ms

MD5	582e03b41356083d04ce6191f560092a
SHA1	607b41ac3d642b91655e0af54556f441682acacf
SHA256	d40dbfddc97849f246a397e59187a3f97f70fa1687d578b3dacb92044fd51bea
SHA512	c28f7d286369d8d4f9a9f79ed67912d2390030013ac4e3b549176cff8378ab0c34db37f2bf6712b5d9eb9b06cb7fe72203e85340889e38b85623e1dbb7d33887

C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul.xrm-ms

MD5	90642c5fd30ae5a2a34d4c217b4cab7f
SHA1	b89cf6d9033a7bb52b4eb9e98c97b8978d91af43
SHA256	08e15263cdd59b78c18c21777fd67579d14e65dfac15531312bed2c9c5497c0d
SHA512	8ceadd13adafe4a582d64481dd357c9906e5a082629e4ebf576a9cb84c30b8bc9bd17f28b186594aae164415e4c42ffe78dcf83048a1f8377b97a4c24fa422dd

C:\Program Files\KMSpico\cert\kmscert2016\pkeyconfig-office.xrm-ms

MD5	6a46a4977e1b2780b9907de0530f5ee7
SHA1	22b19e90035112dd43d6c6dc100ebbbd2b57676c
SHA256	90ba4e3c11f7a8260ae8fb93a73ab5af5fcfbb45b9fb2b15800c38485d3384f4
SHA512	34a54f48dda9d1422c2949b4add88ec03f77f4f7c6b83386e395c1764cf9eedb5c75ed04119fbf6f53ee3670abefec60af1fbff49f54ba4854e4354f44ea1c6c

memory/3568-4421-0x0000000000400000-0x0000000000417000-memory.dmp

memory/3256-4422-0x0000000000400000-0x00000000004C0000-memory.dmp

C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ppd.xrm-ms

MD5	6ba22dbe6a7804b7d2e6f2a416d5235e
SHA1	5e5eb958d16a18f5be2437b8ee0397edcf3e850c
SHA256	7f13c766991b4f23618844f83cb659cf7b3d5321da8925a82ea5357d8f7364d7
SHA512	341fc408e00b97d81a1d0b1aa75520f238ed24f4a3b68006b7967c75ea80cb089b5722e081a3668a083dd7e016e4af94a004f39221eb9093d9bce174a1570904

C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul-oob.xrm-ms

MD5	f24231ee95d34878b9e88d2647a61861
SHA1	3ce6bb335d12db05fa604fbd13cea6616ebdaadd
SHA256	37a1eeb50f69f20a4bf0bafb63b13308d51dbdc8f992832ffa64b87ffed84e2e
SHA512	e4ee5f4feaaa7a730be00754416f98fef52803d6343a642102d9c020ff8ea4452320c0d18b1e4872589e410b795c295b82d7f422f8892a06a1181c063fb3e1f0

C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul.xrm-ms

MD5	a08a813759a501db6500133ededcd0fe
SHA1	399c186e5c00cba369aaeece635f9ad319f30b01
SHA256	3aecba9f064a51d12785341fec10f7ac57ec156019dd71711ca1a8e0d844470e
SHA512	8f96292c2bf483f55d08a55bc94eb2afa2fdbc2db60de68369becdb4eecd117dc4f4d86876b98d56ba4c1dcdc5ba4c9e99d24e8cd770d52b8bf1ffd77805d890

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	180ed228fe32c1cea1437c144170905b
SHA1	00735cc6a48995693cee2068d1dc4b22ef8c1dad
SHA256	958730e53828bce0e985139bf1dcd996d38319de7a8161734c8894a0b0968dce
SHA512	62e81ff64e58b2f114af56068c0939a0bd6fab19f3df7d7aed809e4e3b998166478af2572d55d820a59c1d734c8f87182c9836b3dbb1b5cc7ea6baa72bbfcaf2

C:\Windows\SECOH-QAD.exe

MD5	38de5b216c33833af710e88f7f64fc98
SHA1	66c72019eafa41bbf3e708cc3824c7c4447bdab6
SHA256	9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
SHA512	99b9a9d5970eb10a903bde703c638f7dc639eb4894dfd84d8d94ce1326087c09fa415ef5bc0db7fd0248827045de24b78a680f301a59395215e50051056d1490

C:\Windows\SECOH-QAD.dll

MD5	6d7fdbf9ceac51a76750fd38cf801f30
SHA1	6ef8310627537b1d24409574bc3c398cd97c474c
SHA256	0398221231cff97e1fdc03d357ac4610afb8f3cdde4c90a9ec4d7823b405699e
SHA512	b48d7eb268f8b46ff6a4782070bf6f2109ccc43166b8c64beb73348533b98f69aab5630386f4b5966b6e706f906b599fec5ff885d3e4572ed24acb6c6691fec8

C:\Program Files\KMSpico\AutoPico.exe

MD5	cfe1c391464c446099a5eb33276f6d57
SHA1	9999bfcded2c953e025eabaa66b4971dab122c24
SHA256	4a714d98ce40f5f3577c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa
SHA512	4119a1722202bbc33339747ea02fd35b327890d55bb472cd1e2146ca446d8ba6fddb1e8cf8bbfaeb08aec8ed2a9d5c0fa71b73510d409ffacd3908fa72bb53b4

memory/1636-4715-0x00000000001E0000-0x000000000029A000-memory.dmp

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\thumbnails\dfbdcc162877d33350f4ed62ab3fdd2b.png

MD5	0454521843ada1a63331e957a22e67d2
SHA1	bcb3d9eba165a8f053c5940e497d4610e6b2ef32
SHA256	9fd5578bd2b4c611237d75f7f5d678ef7abb5fb1c444d277958eb213c09a4b89
SHA512	631fa999fd78ee566983ea2ec7c8178bf46c419ef3f65c587442d8f69404305eeb004b8a4b7ff15f1eacae9eaabe01c5212217f51868067b1fc4f7fb412968a9

C:\Program Files\KMSpico\logs\AutoPico.log

MD5	ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1	57218c316b6921e2cd61027a2387edc31a2d9471
SHA256	f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
SHA512	37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

memory/3256-4781-0x0000000000400000-0x00000000004C0000-memory.dmp

C:\Program Files\KMSpico\logs\AutoPico.log

MD5	f94855b5a8f7a4702d2152349cf65fd5
SHA1	0cc7e39fa38693bf75f38b4542ae210028d73f59
SHA256	457a7c5e4890bddb67d1472125dd4b9eddda95ae78aad5256636fe20488d5df5
SHA512	d43d26e687a1820e4508367d969698ba03c6b373f188b4a2d6c5c52c13799bafa92d4e6be41bdc5ff0ce700ab630ca2bce3c700e80a39c02000d82c12fae4786

memory/3256-5043-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/3568-5044-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	b735e7c9a31022eb5ce457764de5415d
SHA1	d3c835035685435c7873b860fdae3e1dacc1ab94
SHA256	0cd115fa8b29087c6bb4b7550dcca5624e820636fedb74172fbe6ad5fe7aca96
SHA512	6071c169232f2928d3fccd27b3618077774d2ccdadd726b45ef8425d0bee7a936ec2f46901c87048fcff577f0639e1dc1736e214ae66c26c88321223561f07eb

C:\Program Files\KMSpico\sounds\begin.mp3

MD5	f33f2a16a46920b5c8227ffd558060b2
SHA1	a8f7192d34d585a981b5a2ea92b04a21a17b67a8
SHA256	443d23bd2705246cd64ff39d61b999ab74be6d60db1703d6782bb0d36a20eef3
SHA512	9cf3f48adfae4c7ff8bf60f313939c956b331373bd262f5b4a25fbb04d79b86abc5d73204d5c21a8e6f8f3fd51e503016a1f930e1dc2ea6696c3c7e056af7361

memory/4932-5049-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5052-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5051-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5050-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5053-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5055-0x000000001F520000-0x000000001F530000-memory.dmp

C:\Program Files\KMSpico\sounds\processing.mp3

MD5	fa3dfa3bd735d73281f10a91d593d52a
SHA1	4e859fc874b61d09f0c63714385cb73843fb07e7
SHA256	9390c99249423929fb82c2aad89e19249e493e4845d0c8babc99e1b594643f34
SHA512	bb3908c9458e1494a83a33532e6e165a05acacfe44820cda5c82d70e3662e7b9571c7020d9720a694f8b91e41284779b5df09d300193a46e70656d449310aa4f

C:\Program Files\KMSpico\sounds\diagnostic.mp3

MD5	06c9a7d36b9b6390faa90ca9c0650bee
SHA1	a27a0fdc48c678a9bd34b379d4f4e2c0e9776a9c
SHA256	2445c403447490dd7227617f7e8017da429ad65985fe013c6662906af15da4b0
SHA512	00aec80c11219c86f52c1984f8f40f992e24b6aeda1a953b20891ecd8976cdd767aa78c066924ee5c732e10149449dadc4dc7425e5ba3be9c8ca0fc150498bc9

memory/4932-5056-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5057-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5062-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5061-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5060-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5059-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5066-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5065-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5064-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5063-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5068-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5067-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5074-0x000000001F520000-0x000000001F530000-memory.dmp

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	2910ada830be97f1f8b501e1df93de3d
SHA1	f1b71cc3fbff80f9e68a02d82035bfe2e8b527af
SHA256	c454941501c2c0b6433da1f570304965c48fc73ab43ea7eda038e1723881f0ce
SHA512	f7a8b9e0753b9eaa89d13e4e76aea7ebed8b8bbf19d51c6bbbab9771b5e3336643a614a93be8c55b87a31efaa92807ab6327bfeadd5fec84a27dfad070e6b324

memory/4932-5073-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5072-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5070-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5071-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5069-0x000000001F520000-0x000000001F530000-memory.dmp

C:\Program Files\KMSpico\sounds\inputok.mp3

MD5	28a23b81aefec1336a1046671dc5af30
SHA1	5c89b9b708d26cd44af9635fce8c0abd1fb71433
SHA256	0131a883e4b66e77becc17594a386bcd69e04f1e5185e4ae8a554fc3a39bb81a
SHA512	bc300f57b91a13ec31c9722c87004ea560fee7c6bedb12703281827163734819edaf3a22e322dd7f39c192ac0c319b34171a36dd9190985be33d106fa19a30bb

memory/4932-5102-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5105-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5106-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5104-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5103-0x000000001F520000-0x000000001F530000-memory.dmp

C:\Program Files\KMSpico\logs\KMSELDI.log

MD5	58bff08c6b9290859581fa40dbc2588e
SHA1	ba4400d2c1e24c29f446a08773486f0a0dabea44
SHA256	4fb2dd4679d4305b6ec398b80106991865530fe78ea569446e57768b9ffa02ee
SHA512	adb62b0dfc4ceab0a2b2d9bd3ce81d0510537b351d159b2525955f862473c25a3d2b8dabe5989854de35077bca3d5dbba2a93385ad91f850340a553789f4d6c3

memory/4932-5347-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5348-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5350-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5349-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5351-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5352-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5353-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5355-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5354-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5356-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5360-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5361-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5363-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5362-0x000000001F520000-0x000000001F530000-memory.dmp

memory/4932-5364-0x000000001F520000-0x000000001F530000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5	44494ae1687b7aa7aed646c0e1f44c1b
SHA1	2aac3331c478ebc7e490ed073948711ad1f340ca
SHA256	7f423021bd8fff4ea8baae7635f5394d58875b5f33668496760497d8316772c5
SHA512	369ac5d62ad7d2c8e6820a8c0811b29525310c1a0999a886d28e1777efd296acb49020bcb3c42b910c5d92c0ed1213c5e35a172904ba059042e771d3e10395e4

memory/4932-5393-0x000000001F520000-0x000000001F530000-memory.dmp

C:\Program Files\KMSpico\sounds\affirmative.mp3

MD5	249dca86cbb375d84b52ed4eb5cefdc6
SHA1	244c2ce65343dcfa613c26c94fa8255c7e6789fe
SHA256	e7fc9406c360d22ed281fb415a2eec396b6a7d0c733c828b2a8c106a30753de5
SHA512	84cb0128518618b3142276e7f84f0fdf42b4e662699d822b96957f7ee31630d55eb432148c7f204bd3be46efedc2eea5ea703f3795ffd9edb7181a1e748fb947

C:\Program Files\KMSpico\sounds\complete.mp3

MD5	0d0e8e30d6007cf99f3951424e1d88e6
SHA1	56a6a3a39a5c9210e97a27190464cd25014db68c
SHA256	4d73c58c680396759508b34b169d1fd9c6aa292141c7c58634842a92d68d3c7b
SHA512	8c2ad7488e52af3aabcbbfddefe0e82c594401e279b07f5f4096b695e6f365e932085a8b4b01c91b3e29cba0fa3b0f160537d4962daed70a74854b55e67f8541

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore.jsonlz4

MD5	0f917d0fd8960bd24a5e561a27955858
SHA1	9d1e597465378778a431fe231d0186a089ddc120
SHA256	fe0398d5cf1fda68887990e62d22caef560efec97833533cde8eecdf838af3f2
SHA512	38c60ec6cd70a7608927c52d1083925e49a29d840f8dd013f49a04dd67922d84c4f938c0498c5c8148cc0e241928187bd8593558602260c2fedb2e88e08bce32

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\prefs-1.js

MD5	cd1635a3e57807ec707b37f76a10b2f3
SHA1	809cf2d2afc6b3f7bf80f7c6f48037eddd1ff61c
SHA256	69fc4a3965852b630cea11f869553d971f7e89e089a23f8f7ad5de5054b41c2c
SHA512	8c26b7ea3bcb445d7ce950ac8a0580473d557e5b10709b855a5bb08620edf5d12cb1b3d2759285e2c7d5335dda33a7f85ae723b35bbd396321c359f9bd407913

Sample ID	240627-11rv5atdlf
Target	https://file.fan/3813e1da0f904a05
Tags	discovery execution exploit persistence upx

Malware Analysis Report

2024-09-11 05:39

Table of Contents

Analysis Overview

Threat Level: Likely malicious

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files