jigsaw | ee6d8f24bcf3b55b57b9ecf1e3345a5d1b5fddcad9f343acf9fa5022d26a9c5f

Resubmissions

30-08-2024 18:45

240830-xehhsaygqa 10

30-08-2024 18:24

240830-w19zgsygrk 10

30-08-2024 18:20

240830-wyy47syfpm 6

Analysis

max time kernel
1192s
max time network
1198s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
30-08-2024 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware-Samples
Size

318KB
MD5

4d769fef0ba5e506272a7bb3d8af5bfd
SHA1

a3c8707909f41971591bcee631f9b6c4e8d00409
SHA256

ee6d8f24bcf3b55b57b9ecf1e3345a5d1b5fddcad9f343acf9fa5022d26a9c5f
SHA512

426ff4366a019b0222748a0a41d2d8a851f11b56605dc6e4f6d589e38618bdcda3b1fc86c15435578088c66b9d08bda41158337a3c23a764366a05f7278a3d60
SSDEEP

6144:s/oWF3uokeOvHS1d1+CNs8wbiWQA9AvZJT3CqbMrhryf65NRPaCieMjAkvCJv1V0:qoWF3uokeOvHS1d1+CNs8wbiWQA9AvZz

Score

10^/10

jigsaw bootkit discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Renames multiple (2015) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Executes dropped EXE 8 IoCs

Processes:

drpbx.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid process

3128 drpbx.exe
4124 MEMZ.exe
4988 MEMZ.exe
2992 MEMZ.exe
3696 MEMZ.exe
4980 MEMZ.exe
1100 MEMZ.exe
4864 MEMZ.exe
Loads dropped DLL 1 IoCs

Processes:

MEMZ.exe

pid process

4124 MEMZ.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3128	drpbx.exe
4124	MEMZ.exe
4988	MEMZ.exe
2992	MEMZ.exe
3696	MEMZ.exe
4980	MEMZ.exe
1100	MEMZ.exe
4864	MEMZ.exe

pid	process
4124	MEMZ.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

jigsaw.exejigsaw.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	jigsaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	jigsaw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

Processes:

flow	ioc
587	raw.githubusercontent.com
588	raw.githubusercontent.com
371	drive.google.com
380	drive.google.com
463	drive.google.com
464	drive.google.com
589	raw.githubusercontent.com
590	raw.githubusercontent.com
364	drive.google.com
370	drive.google.com
378	drive.google.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 64 IoCs

Processes:

drpbx.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_disabled.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_increaseindent.gif	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.fun	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif.fun	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\16.png	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.fun	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Distinctive.dotx	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImages.jpg.fun	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.fun	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.fun	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.fun	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.fun	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml	drpbx.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.swf	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImagesMask.bmp.fun	drpbx.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar	drpbx.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	drpbx.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.fun	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Couture.xml	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.fun	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.fun	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png	drpbx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml	drpbx.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\library.js	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.fun	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml	drpbx.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png	drpbx.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_over.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over_BIDI.png	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml	drpbx.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.fun	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Hardcover.xml.fun	drpbx.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Origin.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_windy.png	drpbx.exe

Drops file in Windows directory 1 IoCs

Processes:

firefox.exe

description ioc process

File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico firefox.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MEMZ.exeMEMZ.exenotepad.exeIEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "21"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "21"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4E1D41D-66FF-11EF-BB94-CE397B957442} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Modifies registry class 2 IoCs

Processes:

firefox.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	rundll32.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip:Zone.Identifier firefox.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4972 NOTEPAD.EXE
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

MEMZ.exe

pid process

4124 MEMZ.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip:Zone.Identifier	firefox.exe

pid	process
4972	NOTEPAD.EXE

pid	process
4124	MEMZ.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
4988	MEMZ.exe
4988	MEMZ.exe
4988	MEMZ.exe
4988	MEMZ.exe
4988	MEMZ.exe
4988	MEMZ.exe
2992	MEMZ.exe
4988	MEMZ.exe
2992	MEMZ.exe
4988	MEMZ.exe
2992	MEMZ.exe
4988	MEMZ.exe
2992	MEMZ.exe
4988	MEMZ.exe
2992	MEMZ.exe
2992	MEMZ.exe
4988	MEMZ.exe
2992	MEMZ.exe
4988	MEMZ.exe
2992	MEMZ.exe
4988	MEMZ.exe
2992	MEMZ.exe
4988	MEMZ.exe
2992	MEMZ.exe
4988	MEMZ.exe
4980	MEMZ.exe
3696	MEMZ.exe
4980	MEMZ.exe
3696	MEMZ.exe
4980	MEMZ.exe
4980	MEMZ.exe
3696	MEMZ.exe
4980	MEMZ.exe
3696	MEMZ.exe
3696	MEMZ.exe
2992	MEMZ.exe
2992	MEMZ.exe
2992	MEMZ.exe
2992	MEMZ.exe
2992	MEMZ.exe
1100	MEMZ.exe
1100	MEMZ.exe
1100	MEMZ.exe
1100	MEMZ.exe
4988	MEMZ.exe
1100	MEMZ.exe
4988	MEMZ.exe
4988	MEMZ.exe
4988	MEMZ.exe
4988	MEMZ.exe
4980	MEMZ.exe
4988	MEMZ.exe
4980	MEMZ.exe
4988	MEMZ.exe
4980	MEMZ.exe
4980	MEMZ.exe
4988	MEMZ.exe
4980	MEMZ.exe
4988	MEMZ.exe
4988	MEMZ.exe
2992	MEMZ.exe
2992	MEMZ.exe
2992	MEMZ.exe
2992	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

3508 rundll32.exe

pid	process
3508	rundll32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

firefox.exeAUDIODG.EXEtaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	2760	firefox.exe
Token: SeDebugPrivilege	2760	firefox.exe
Token: SeDebugPrivilege	2760	firefox.exe
Token: 33	3580	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3580	AUDIODG.EXE
Token: 33	3580	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3580	AUDIODG.EXE
Token: SeDebugPrivilege	3592	taskmgr.exe

Suspicious use of FindShellTrayWindow 46 IoCs

Processes:

firefox.exedrpbx.execscript.exenotepad.exetaskmgr.exeiexplore.exe

pid	process
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
3128	drpbx.exe
3128	drpbx.exe
2760	firefox.exe
2760	firefox.exe
4392	cscript.exe
828	notepad.exe
2760	firefox.exe
2760	firefox.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3428	iexplore.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe

Suspicious use of SendNotifyMessage 40 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe
3592	taskmgr.exe

Suspicious use of SetWindowsHookEx 25 IoCs

Processes:

firefox.exeiexplore.exeIEXPLORE.EXE

pid	process
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
2760	firefox.exe
3428	iexplore.exe
3428	iexplore.exe
548	IEXPLORE.EXE
548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2668 wrote to memory of 2760	2668	firefox.exe	firefox.exe
PID 2760 wrote to memory of 1984	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 1984	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 1984	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 2596	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 1964	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 1964	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 1964	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 1964	2760	firefox.exe	firefox.exe
PID 2760 wrote to memory of 1964	2760	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-Samples
1⤵
PID:3040

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.0.919641983\587725916" -parentBuildID 20221007134813 -prefsHandle 1212 -prefMapHandle 1204 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9db0a91-9ddf-40a8-a1ae-f9965662567a} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 1288 46d6758 gpu
    3⤵
    PID:1984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.1.16735386\832654075" -parentBuildID 20221007134813 -prefsHandle 1468 -prefMapHandle 1464 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd1eb26f-60f1-42ab-9587-10aa54571b31} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 1480 e72258 socket
    3⤵
    PID:2596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.2.757804017\310456074" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 1920 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {996509d0-9200-4094-96a4-65e11935d6c1} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 2084 4659758 tab
    3⤵
    PID:1964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.3.431980719\249775884" -childID 2 -isForBrowser -prefsHandle 2436 -prefMapHandle 1716 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80ce7fb9-68d3-4e0b-8885-6d4d090ff230} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 1752 e2d558 tab
    3⤵
    PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.4.94179584\980997720" -childID 3 -isForBrowser -prefsHandle 2904 -prefMapHandle 2900 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c4b69e3-6a70-4b39-b595-b51845163377} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 2924 e60d58 tab
    3⤵
    PID:536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.5.198434697\730393773" -childID 4 -isForBrowser -prefsHandle 3740 -prefMapHandle 2632 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {281a0a8c-ac43-4b3b-8e42-beaaab7d8df0} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 3752 1c76d858 tab
    3⤵
    PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.6.787015984\1551178355" -childID 5 -isForBrowser -prefsHandle 3860 -prefMapHandle 3864 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1aacb17e-10ab-4a41-8550-1cbe5d19967d} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 3848 1c76de58 tab
    3⤵
    PID:2812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.7.759015562\650088212" -childID 6 -isForBrowser -prefsHandle 4036 -prefMapHandle 4040 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5dd0f60c-157e-4023-9889-1b6748de6cb0} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 4024 1c770e58 tab
    3⤵
    PID:2264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.8.635375049\1773313750" -childID 7 -isForBrowser -prefsHandle 1708 -prefMapHandle 3416 -prefsLen 26895 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e1e008a-9e57-4bce-aa5b-a29d1ea8a027} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 1968 1e21b958 tab
    3⤵
    PID:2768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.9.1084431589\1104848092" -childID 8 -isForBrowser -prefsHandle 1848 -prefMapHandle 4532 -prefsLen 27070 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99e1d094-10d0-4483-aa4f-e02805c75c2b} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 1704 1c675158 tab
    3⤵
    PID:2480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.10.781892546\65183309" -childID 9 -isForBrowser -prefsHandle 3816 -prefMapHandle 3092 -prefsLen 27079 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21b9ea4b-ab65-4662-a41c-f4c6cf77679d} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 3808 1c676658 tab
    3⤵
    PID:2992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.11.158633624\1922529498" -childID 10 -isForBrowser -prefsHandle 3992 -prefMapHandle 4000 -prefsLen 27079 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6aa7879a-46b5-442d-8a08-4139752eff02} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 3964 225d1958 tab
    3⤵
    PID:2328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.12.479025677\1094436230" -parentBuildID 20221007134813 -prefsHandle 3172 -prefMapHandle 2632 -prefsLen 27088 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e70f7f65-00da-495c-8d61-d1eb72e4b27d} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 4780 223e7558 rdd
    3⤵
    PID:2604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.13.362896963\1994988775" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 3372 -prefMapHandle 4292 -prefsLen 27088 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d071c25f-f02c-49db-ac40-dce67ae8ff78} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 4020 223e8d58 utility
    3⤵
    PID:1916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.14.1971760994\14697143" -childID 11 -isForBrowser -prefsHandle 4376 -prefMapHandle 3332 -prefsLen 27088 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {015265c5-206b-4e92-a4af-001b81e83b2f} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 880 22719e58 tab
    3⤵
    PID:896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.15.1482088176\1695787133" -childID 12 -isForBrowser -prefsHandle 3332 -prefMapHandle 1852 -prefsLen 27092 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4cd1a0b-2f9b-4376-a714-0a110e6bc37c} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 4168 188fc758 tab
    3⤵
    PID:1772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.16.42065496\1871345530" -childID 13 -isForBrowser -prefsHandle 1088 -prefMapHandle 4680 -prefsLen 27634 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dfb045e-095f-4b00-9301-5d93506a6d9b} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 4648 10f7fb58 tab
    3⤵
    PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.17.212701134\1945139503" -childID 14 -isForBrowser -prefsHandle 4828 -prefMapHandle 4812 -prefsLen 27634 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {123b5b13-6e48-4a0d-a036-690a4dc30e85} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 4752 236a3e58 tab
    3⤵
    PID:3712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.18.1825732793\1943503128" -childID 15 -isForBrowser -prefsHandle 5200 -prefMapHandle 5192 -prefsLen 27634 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97e6b81f-38f0-45c1-9235-efabbb0c5d8a} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 5212 185f4858 tab
    3⤵
    PID:2972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.19.2084175984\1326098018" -childID 16 -isForBrowser -prefsHandle 5324 -prefMapHandle 5328 -prefsLen 27634 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f18a93c-8776-4925-b596-f922c325ee14} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 5308 18b28b58 tab
    3⤵
    PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.20.160618939\721696613" -childID 17 -isForBrowser -prefsHandle 5496 -prefMapHandle 5500 -prefsLen 27634 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f655957d-d238-46bd-92b6-85e02ab9cbaf} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 5484 18b1ae58 tab
    3⤵
    PID:3216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.21.515610171\1925716281" -childID 18 -isForBrowser -prefsHandle 9628 -prefMapHandle 9632 -prefsLen 27634 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {00396874-f9b2-4830-b87a-a28e3454e716} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 9616 18532e58 tab
    3⤵
    PID:3144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.22.987298787\1956202787" -childID 19 -isForBrowser -prefsHandle 9492 -prefMapHandle 9488 -prefsLen 27634 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5019bcbf-16e2-40f0-a3c7-17cc2d552f7f} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 9512 18534f58 tab
    3⤵
    PID:3740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.23.198994380\756136321" -childID 20 -isForBrowser -prefsHandle 5764 -prefMapHandle 5320 -prefsLen 27643 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3ac0ceb-6be4-475f-94d5-56dc0e03feae} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 5760 1fff0558 tab
    3⤵
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.24.1506088310\1171670692" -childID 21 -isForBrowser -prefsHandle 4884 -prefMapHandle 808 -prefsLen 27643 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2dc5817-49a9-43b3-882b-b7572f4956ee} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 4204 24f10258 tab
    3⤵
    PID:4244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.25.1632306988\68670209" -childID 22 -isForBrowser -prefsHandle 8940 -prefMapHandle 8936 -prefsLen 27949 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f89ddf15-6416-429a-bd75-2ee99a78ff8d} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 8976 281b7758 tab
    3⤵
    PID:4472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2760.26.802379742\1805919165" -childID 23 -isForBrowser -prefsHandle 9192 -prefMapHandle 9196 -prefsLen 27949 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {711ccdd3-b5a1-475d-8e05-3db43c2fc4de} 2760 "\\.\pipe\gecko-crash-server-pipe.2760" 9220 18e3b058 tab
    3⤵
    PID:4484

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x548
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3508

C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe
"C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe"
1⤵
- Adds Run key to start application
PID:3724
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  PID:3128

C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe
"C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe"
1⤵
- Adds Run key to start application
PID:1072

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2200

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\memz.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:4972

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Downloads\memz.bat" "
1⤵
PID:4964
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:4392
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:4124
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4988
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2992
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3696
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4980
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1100
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:4864
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:828
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3428
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3428 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:548
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3428 CREDAT:603149 /prefetch:2
        5⤵
        
        PID:3572

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.fun

Filesize
160B

MD5
580ee0344b7da2786da6a433a1e84893

SHA1
60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e

SHA256
98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513

SHA512
356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
275368668780c7fde545a6a176ecdc39

SHA1
5fa03f07c0fe2917b829f5d23e93789b3ee9fb0f

SHA256
d20ce593418d81c89b8a07dcc02035f1ed6109f31d759bad955a4dcfa8f0fcd7

SHA512
251aba4d9e177742fe1202d5454e7efeaad2a8e1ece4980e2aebc398278f2b96489547c960d2f4b5ee1b9d4611d9fc5d359e3eddb258406c4076bd0b725e647e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
386a101fd389737a140b42b9713daad7

SHA1
f25c713ff7b624f60d522941d135dedcc670a487

SHA256
fd8989237ad09a690e07cc796347d1c350d711640cec06803472209fad3e6eb4

SHA512
551448f3efb276e8f1178921eabe315f1eca4e823f9c95408ffc2d7a51358f45dbeecf53b662abc1d8a9f9828217aabb9cff3951d3c008ddc5375ec097a52580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b97fa6bbe199e62f7a4813f188ec5c1a

SHA1
5df575e4041483e8e916308ac6a6adb0d3aba26a

SHA256
a27550153420f4646d4b1fc4eff2d78fcd2c3b071d1dd954953aa3aba75316a8

SHA512
a1e37af8d1a910ccb206845d6a4686b981db26c5eca414da6c9b3a3aa02ab6dc0a31680aa9c4d1773405a659444a2d3c5a4ab0e69c333c3db2ccbabcc0692580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9111e52b1fb457a2b3c65e653818271c

SHA1
0c443f0012e5732d44ed215eef1546e3e68512ae

SHA256
d05a210391daab6a884ea0581e9d4093820e4f07c0fbe88d62788def5a1958a5

SHA512
415d0682c874a71f0cc140a807bb934c7c7c422bc3ddbb4730fe003457393d3c89cfbc7f5b848a3552c184bbae71c98cf1f4b6fbf6dc918ce08b48c8bc14ffb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69da54daeac0fa5fe5de3f6c9ae5860e

SHA1
10e695debcc6c00680e9d70c830a265384f7c954

SHA256
09ab6d90d9f426706ec5d467f0e0c56e2138f3a7701d09214d4b00899dc6df3d

SHA512
2f40cc6e8fdc39ea693982019f272b5a9271bc2fa60d188b0ef9761aebd5855ea244851cfc6422165ac97ede57dd8dfbcfae13622b674a6d17d55952a0093e22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76962ee92414393f4e091d464cbaaa6f

SHA1
59bcdffd1ce44e39a064a9fd9aea367811a54b82

SHA256
6b2e29739f7702f0455e2ac8b078d0320905bd54461aa96c9beffd4821550105

SHA512
da6531811cd065817151c6ed313035945fb9236cc65289ff1324b70a5ae16675c4dca1b97140b1fb79e3f9050a4a24c66e6d5ec30f5ca19c2abb00ffb783c5fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27cc1c087570de588b3402043cf5526e

SHA1
99bacb448874b5cb48abb35c0e139d168213596f

SHA256
9373459a98f92b5c4564dc2b90e3b9c817a413baf6bf38484f4f844d4918ae7e

SHA512
0b550600669aa83607c85f3839b25dc4117f169a73bcbebd2098cb64e8087350b65ff0b45dae8b70421c784ca359452d5591d9b8d441cf4c82cd01dcffc35dae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1da3d41e361e73bc9333d16385490a8c

SHA1
bb225361999de19650079a996acf745b25ef5627

SHA256
705908805da4a52473b77ccc386531637d9e33a24ec0a7b8cfb36319916c2356

SHA512
eaeb2a9412ffcc72dcd07903c4170713b573014abcfff763dfd2e5c5e355f0f2e7fce5bb06cabf405fedd4d3ca59c1bc90b7b5920188597d6e7ac5a2a52a4f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb5f208f3f332c5198fff226388aa801

SHA1
496d475c0d41086d8b27ec3d7146022ce53563e7

SHA256
140d5bde360b9bf189335d5ca612625ade3c0a1158301a0d90030e9a501eae96

SHA512
d4a2038f803bd3431c88c1cfc8f7724428c857e4dd3434a3dfb9548776117f61f9f59ca71805709f067c1dbd0375eec95d21e5985e2ea4fb1d17016de59ad1b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66fd0eeb4a7122c117ee2c1862565048

SHA1
d00b1bd68cb68df9bee6241731422cec0f56145d

SHA256
603b5f34647c83441fe2e56c11db6d13096f73054c54edfd97cbbe30019a05dc

SHA512
b2354ec25ef784de89a59f08f068db4e1874be3afdf73a40dee2aecf8edf646accfaf823249fa06a23b566410444e27f96dc4341b268986d821aff1c87521424

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
283KB

MD5
2773e3dc59472296cb0024ba7715a64e

SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859

SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BLYKNLBL\www.google[1].xml

Filesize
536B

MD5
17fdbd8d29b4c29a86f909c754fe8378

SHA1
da492f5f8f2e41dcbeaa294cd3f92bc2d6c607bd

SHA256
ec82506a042c183386a81085642bfbb3a1e150facdbc6e851bfd041f2b30ede8

SHA512
f449508ea868f5de690ac7c5eaf635d6c1ec5b024f98f6bed029ef178778cd3dc892637371ac72b99376c4464e0618cf84b3a8168ab2ae33eebb16c59ba00b1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BLYKNLBL\www.google[1].xml

Filesize
95B

MD5
d32df2ded1613e293bb2a14880aec2d9

SHA1
8e9ba13f3db128d344df0fb7793105fa36b8b0c0

SHA256
d94599a55a3d3db352460b08f4528a3e955e64cd0f1791be0d2fd2930047e9fd

SHA512
672620bc73aad7dd9e23693697e2305a09856c51a281c6e721dc9fe084804f3d82666f3c237b8a1a09d859171f603f8c2d3a6a33ae435d9106ca15b5bc8c558d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\p6d9oj1\imagestore.dat

Filesize
5KB

MD5
e589fdbcf5bfbc86ce56cd140c1e8583

SHA1
bc62225dc82ec4cd1d2965f015d0f9f21d3b4073

SHA256
ca9af3e0f890b3eb136a6dd266da3cbe6f5f306949a24fabb850ab40df23f890

SHA512
363ef6d4fb26a9aba345fe40fc6384f3a34df09e0b53637164dbdc85a6277c6115bf6a4eb4cf69eba49a6aa9674e8b68a413e0f1bebb0576986a44f08a75dacd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2GT19SJ4\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CR7FOSGD\iHowXYT9hUZIlyFRr5Um8JUZEzs-k28JIAaYyWMV82g[1].js

Filesize
24KB

MD5
0b295ccb9b95b0158a57b177415e7ec9

SHA1
ea44c8017cb481d7ebc28407d00a6f19a9322518

SHA256
887a305d84fd854648972151af9526f09519133b3e936f09200698c96315f368

SHA512
252757fa5cc5cbf213703f4f630025419050d49f746a86d52244e0aff6f1def867ab38119bf00684dc419ca2d007ced38bf44d13c03be34a38ca3ef5a9b22159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GN0JZQIL\styles__ltr[1].css

Filesize
55KB

MD5
4adccf70587477c74e2fcd636e4ec895

SHA1
af63034901c98e2d93faa7737f9c8f52e302d88b

SHA256
0e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d

SHA512
d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GZR5Q8P0\recaptcha__en[1].js

Filesize
536KB

MD5
b0878e919a5bca8858b4c1e59929452f

SHA1
43d32e52807d59d2195d8ef6e33f909d58611e21

SHA256
04a0c20c086ea1edc10ab2a9612afc96ac6bd5a49fa5b310768aba2ab688718f

SHA512
1755dc4aac8f3ffe87864ebcad7247d3828e8b7dc118288544562d8368c308f2cea3a118259347ee005f1461f7dd1051e20a22234c644697f25c1dab64f416cb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\activity-stream.discovery_stream.json.tmp

Filesize
45KB

MD5
deb997f6badf5b1b61630ca753063475

SHA1
fec215c035e31eb8d0ed7b4253c62f918bb2b905

SHA256
7b23dd9f38801ba3e3a768a04c07725ae6554a8793d0084886332c9685b67492

SHA512
c4fc76de36ab4aa0dd77e983a7b69111de292249f99d710f425757a05729e2c784208cc693ffdb00212cd1f08130fb78cae863f2de3a6c1051e459078e97cf5a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\1146

Filesize
12KB

MD5
10a9adcc1f62ac5a9aebabafb69f80b5

SHA1
67e59821a7a63a0b9360ebbb89583966b4306e50

SHA256
2bd116fe1d825dbe1288f3f85da2430125ecc4e9bffb1280222fe595ef95f3d6

SHA512
79a5670e242741529ed39e017e3fd18d3f78f62126b05cd4a0d2eef851a61556e92e1d0cd6568b41d7a9df1206d7f3ea94348c6b047664c926cb3d9079bcb245

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\11854

Filesize
9KB

MD5
64e478e225e54f9afd3dbf840224cd3c

SHA1
42e58356b73098bfb39c805ea8ef288307d9cfdc

SHA256
cadc4b323e74df636a92ef5b06fd5157e066dc2b05718f513bb8dab4d737ba7b

SHA512
242212b73e6cb1ed15a3e8827411b20ae06289bc0a25902861f47b4b4dcc68c2f19a3ff0060ffa407a778c628508b7e7edd0805bd1d1eaef5428f1a16517aadb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\11859

Filesize
12KB

MD5
47931bda93419960c8f14c357ea0419a

SHA1
6dda51b53b75f11b13696e4b73f55bb0d2ec5047

SHA256
f85c4875758ef959fba1157fcd94a60f1facdf3c4080bfbdd11632a70bb84019

SHA512
4cdd2bf97814486e70bf4d57804c38ad126805968df06a9a8672a21d02deb976de3ffd1cd37332f889040051965683f21442bd7a9a8158acea23ba1032c2840a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\12889

Filesize
13KB

MD5
62a4d8f62f4a30d33bf2877a72a3b9e2

SHA1
2cf21f6b2683cf4c0eebcf8e2ddd7a23b0e6fde2

SHA256
51c627bb8466ea58ad2fb72ab5164632334fe2f63e9c0fb69d2bcea8724b874a

SHA512
24c75184b9dc37b36b04ebb3c2e9d5e63bbaa30c3fa52ea7e7c045f9113c38d63ca93801419c967ac0940f2efdf915dc42cd6f18eb81acf92d92204a35328d4e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\14989

Filesize
13KB

MD5
6c0d75f419134cc3ac6e30378eda5d3c

SHA1
b13b2e0b4077bdd5e4e1c8590a5df449ff79eeae

SHA256
f8bf09d001810504d4e36360faafbc52c21d334baa8dbb3b7edb07a2b9d18b5d

SHA512
fd39af4e773e42d9b241c9cfa3b689e7618694762580a99721487eefe45c9a317e70f810774a4a4d891901e7666f84664537d68cbc5f8e5efef34e0ca5203622

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\1590

Filesize
24KB

MD5
a90aa6c967059e665fa307522fe5c57e

SHA1
2050fede5c6ab83e55351d767891716f9212249f

SHA256
fdea7a9b3e9f141353a1a9c399b3aca159e2b13d10ef2ef969eeb5ab9206ba1f

SHA512
be83913e4831aac61274e7c5d59af3cfbfe883798f214ebbf1b67d3ed6406d9143bd458c1263d5b53de5a1fe1c3d2bb6e8dfc72eb660103c580473aeab9fa677

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\16715

Filesize
59KB

MD5
83558ffad2b7053a0c75c646e5260f91

SHA1
20422fe6fc75e459a3cea647d773d39b9d6ab27e

SHA256
8e6f038cc33ede5e75089ab8f254cf3f2e15223953ee9a421e6b00e78820156f

SHA512
1d8614795cabe7d40139740ceddcff8ec83d979b045a5f687b85240056cf5b1f562857d90f3cddc4cf8835c860b3ecf6ef04d64b3258613919602de943a67906

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\17627

Filesize
13KB

MD5
bee3bcf2e0bffad6413297c4c3103df7

SHA1
39ab4421cdeef37fc57e9914177444e7a2bb7c15

SHA256
4697b2b4c1bdd5482daa775a0a6784032d0b0faa2d6c76e0ec00617612a1d845

SHA512
0669a963255061baaf495a9d086eecc09c8b74964a534f7645c6192baa850ec28680073a6cbb8e64b57a25c00dce2b3868ebe9c75fbaf840827eb2f70887fe39

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\20827

Filesize
9KB

MD5
a3b1e4966b283f1777f4e96c61695719

SHA1
a17ae09a0b87fdd299016889d3cc4cd85f38fb4a

SHA256
a3341aa82f6622056b82ba1ad883493a622d28102292248347857951bc2aeb64

SHA512
1a4bb495364ec3b68828069e7379059f1736a711a18c57a2faceefa1f41641e93a81a84160d4b374ef023bc63a1111156036ab07195116bd35f2fc026fb51ecb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\23695

Filesize
8KB

MD5
d5d29dac3e7129059f740fc48cb498f9

SHA1
f9a479d4a1122c4e315defcdac9025ad83c00e19

SHA256
546019c376aefd3017358745f25f2b58cc013799456ccc87412dc20d5f060cc5

SHA512
8541670ed307acccadd698452cb6db287db1f9b20960665ee9855abedf17f81a86a904450bb0642a44c6211bc39b990acfddaa3e824294451b92d81f066a2a0e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\23807

Filesize
8KB

MD5
ad3557a0a121d62718ec60ff7f100ddf

SHA1
8d48a7e131c58675aec430ad77d8be9c8d3b2388

SHA256
83425f239ed1dccf2406ecf842e1f7dbf9461c5bd453fd33149e1ea29b13c3d2

SHA512
2521177f55c316c8741ccb29ddb2291a76700bc9c540bdd3e65b21d7b179ec44f06c4f96e21391a20d2b7f1b59c6fab54900111a34757e54a234059b5345ecff

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\24032

Filesize
9KB

MD5
44eb7c3e874c1021075f0795a68e17e7

SHA1
fbc89105075c84cc68fee6d6bbbf481292d80715

SHA256
978cf56e701c22a3fba48d92cfb071632a223788350b6d8d38b3ec299e5554c9

SHA512
1ff1bde1776a8d540a59413a188e2ad5aea06e3d588a0475cb1ba25f9aefa9909c9b0dacbd21ef4c350d5b56eb9262e80ed5aa0c5560109de0b688b838f7199b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\25021

Filesize
8KB

MD5
ee55ba7870cf68b0fa94b8eaaf73fa1b

SHA1
31ca5ebdf6bc5c045ed278a997fcf46ae43ee197

SHA256
cfd4f850ece4ffcc5b243111aa21efcd4d3fcf72750e30f5cd5d18602100367e

SHA512
e5de23ace760dbaddb8f4bb82dbb23c6d6e193754191a699e7a3d0e005b54dc633d3b32fe41404ebd49adc308063c94164f6c247c0d48c1eae68ce47f7f025b4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\256

Filesize
58KB

MD5
a73fadefed4d6d5721c1fcdd40914646

SHA1
9d597543d5c85f69b18be748b2e983e19bb35412

SHA256
93ae716b588d4a7b768988a46aaf87e6c9855da932ae2959a976c5889a2af2d1

SHA512
a89e19b3e7c4eadee835850af7a41fa4d651da0d95e48942155b979696db88f5583d52a7eb1481c15ebddf89cbd0e8459a04296ab09aaad9b9864e25d4982bd3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\27025

Filesize
9KB

MD5
b0ec8e02cc45db7041cb696f7977d148

SHA1
a79d621c04743d48d3eab4f54af0e437fdcb6180

SHA256
3c7fba2b57c08a32d086e8304c643fd8293c60f652208d75c8adab6e7c79f805

SHA512
c607eeb02dac924338ad4a529cc5516ded5322d91adac289d2b2f4576d73208d1393877a1aaff089bdbb5f08db18e66aef948a2337b9e02cbe80ab799460332f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\30967

Filesize
27KB

MD5
4230f64da3dac554f161cf988ce6b4ae

SHA1
6f24a16154ae969ee3a0ab7834fbaa80d8e509dd

SHA256
27e9c3aa27faf6e42d6340551c9981ade626eab55b140f9d8c13d436c517c577

SHA512
aab7b2b0ff5370cab7fd7c0e72fb2ee51e6a2e5c28c5df5d07c73d69d215224f6e37cb7f488f391cdc921e15f36144db2f31f1b926aaf9d8915d802c5e7944a1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\4032

Filesize
13KB

MD5
cdf2c25d4ffed8b8a2a00d1954b394f0

SHA1
dc3c72e52dcba2a08662ded0d868521f59bff0fa

SHA256
459f3cf25d7aea3f5cf97e6c7cb0dc5f1d94e47e22e99a5f64e7f4a3a46c4941

SHA512
5257150a8aded9556a16ead267f4443a6f48071794467f846408a4a085caab628b7c7ed719a82af5c7d8a9792344ea9b860a5fd5d92c470b897758685d14660d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\4660

Filesize
27KB

MD5
2a96d615c42f35802a024c79c5a5fe28

SHA1
4fd9788b00e1443f879043ad5118a89430e6e3bf

SHA256
06f0bc96d7b373efe27de0af159b1303aa5e58687dfe35c7999bb26df020c689

SHA512
89d3ce803c312efbc20c07c799e1ef3639ff1d06c02f955353305cef816397af738b139e89e89bbb8b1ae799a2acefdfdcc87f208b96610fa6e389a8c127ed01

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\5656

Filesize
8KB

MD5
1de7aefadce0d001a93cf1cad7f7c288

SHA1
dd96dd5eb107091909d58fd222e6a0f32b2e9747

SHA256
f1f1ec56e3afc5517024e5366f895c451af2b7dab7c900e9327ed74bc865e366

SHA512
ed8d298116d0fb6fd01fb6193a96da77ebd0afb579361b819747a75c3edecc7346bb2c2efb5d3e209591ab275ac549db9d486633b6234b390bb9bb4459e569cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\5715

Filesize
12KB

MD5
eb6bf6c9bb542bc005932c64caf9206a

SHA1
5667294cf9b22a5163d1e8a41fed5d0afe819d78

SHA256
529f69307c87cb4e12e55264a243a64f1028c65b2aafe512c7f007985ddb434b

SHA512
c37fecedb948ac3a98234db51f25136be11a39a748b527bac7dace30de4ca92c68d624ef04dc59cb77ab2203e0de4986007f6ad5063eb11e14ffdb0330821e9c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\doomed\5869

Filesize
12KB

MD5
b4041b114fc34894d847a823e8147cb1

SHA1
8d765f57750f2db63bf72307cc486fbf4942b912

SHA256
1397b0c3aed6fee70d5cb6acfc7ef8840e30a2ccdb8cbda0d6c723f4b79aebd3

SHA512
fd10d829dc7282b8aedd86eb608df0289bce8ad6bfaec5e124be75a3e8d9de7e237e86fd683b685d30ce818280d931e9e68412d35dbca28bddf027c97576cb34

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\008802C162A9154F535C2E29053C9269F25FAFDD

Filesize
62KB

MD5
6e2aefef9013311ec34d22b1b0be3a77

SHA1
52b8f561ad106b3af7244ef3b929cbfabeef19d6

SHA256
952bc4019eb9601dca3421f7d4beb4775768012dff2d275c34566deb47fd8c5d

SHA512
bf32a3769fb82208dc60f144e1e5add137978fb7c2b87d4840bb8970b24443bdd963c6f76569ce35feb644371f27aec4bc13224bbb9f8835f3551c41af3510ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\01ABD05F24B7C929E9BBF7B620E2289C4EE00CD6

Filesize
55KB

MD5
9dcfd4bead6f6a0aa8af30d1736d48e0

SHA1
c61fac2421c647c1e29b28cd2f992019ece1e7b6

SHA256
1d07311af53c67788955ba30eb4b3853db56536aae65e7ceb446e8b4bddb74bc

SHA512
4235c0212eafea8711736f24bd361b6cbe11d51028eba9cf738bfa27e1e437605d2a2117cc14896836b5c6be5a548f84792597647720c6800c6b552993adf42e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\0781B10CFC6F1C873D99DF0A70E97A080E54F225

Filesize
79KB

MD5
32ea1492cc520a2950ffe3416d873bf9

SHA1
ec592e2d266dc7bb81b546ac101a1e0b698efdfe

SHA256
1a10510d220266a0680ea6f12b9d16173a452ec2c93a99dc5048df8642eeba13

SHA512
84d5268dab71cf35b1e51d8d0f24f0fab5514ee0e720417be24bfa9b9599e98afa73c7b8073035d5db20aa903a38a2b04b3969ebbd8cca76c792b099ff6e165c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\121BBF69B3CDEA1AABA5823967030769C4433EED

Filesize
34KB

MD5
80a1a196f2d3510c7b977f9aac17accf

SHA1
3226752be64e59e546014c416603d6bb3d3e34d0

SHA256
82075d9379626f5cee3c9eecb94c26765d06971fd256e89eaa7ba47b47f39318

SHA512
c99ca5197c4a04b35a283bb3340d19f214cdbd348c086e25d047b5f19ce462ab5cd6049a675d723800abf36a112d2a15687ff778244e1f0afb7815e50cd48b2b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\1243152E7867EAA24697321508C34F9CEF98EF1A

Filesize
60KB

MD5
0560dc3c777fb72cc89d1ef1dd95f5b2

SHA1
4ba84d00b2e8060f0bf74fa5dcca01efe54cea14

SHA256
f524d5021b8faf512c6466af128a3e4c21806207603abd9446e4105a6c9265d7

SHA512
de2f37e135172f7731a24501ac834f5491ff29023d26bf75159b334783a8937937f2db2a74203533db5ddb8629c63877458b81d6bddfe6ea933e64af3220884d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\166FF906B29355A39FCBD052DCE5B5453BBEDB63

Filesize
28KB

MD5
17a5851140a4d97ebb11ba26a9a5aa1f

SHA1
bd35b878df92e78541d320c981e4709aae763173

SHA256
100b02fe6aa1ece5d1f213f456fee068d6a1f012ce10b882af6c7a4064e2c3b8

SHA512
b2f8fa41dc4b557acfbd6bf35ba07fed9c718e123156fcd2265a563b4ec3ee9a8efb547d0ed443d557e0a44fa6bf1fd82851cd6bb2c3778e245553a2db33a9ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\1BFCF30C19190141EA70968C6D0386B3A55376D2

Filesize
20KB

MD5
d067cca4e85dddaed676b02bd1b040af

SHA1
4297489559adf1cbe76759f28bfdca5bf30d26c7

SHA256
f84fdf35255e4f0a96e76291929ac081c2027c4c8c0bf16659d705693486ce2c

SHA512
4ba4391349331e8b3ae7c2bc0a122069a1ee97bf947850306ac843e9ad97ab517e62b700fbd194e1b4d5a4cca6fef68b7c569aafabb652a45baf62fce113ef60

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\1C9B4DCC5457C27AC283A824FB6C22DBDE49A205

Filesize
374KB

MD5
e7f92511e8665036b1069382870fa7bd

SHA1
c9ddc6e35e8311b86c138f13935f699ca64b88ad

SHA256
2caecdcb807165365397b6b7d8a64f2635d1f98bb00fe798d66cc82710afcd84

SHA512
f43bfc2546d756de234428e811cb6a23affc1cc9fb4d98b2bb4b3ef2f02292f6c98f60bfe6f2e09f5757006aa552ae5efcd8923ed1a3e328db38e0576de56c0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\22687BA94136A0C02D9DC84E914E4B03A2985D05

Filesize
274KB

MD5
45541451e9df5f08b1799385f47fd787

SHA1
6c2468f449f7c261c2540edad00b41f8eef1e1d3

SHA256
05f2488e8ec512c2c6db86a97fb797caecee1b92fd2d6bf077fec6fc0792ef24

SHA512
82cda81e582250655ab1f82d48315fa858cb7d22929ac37a2b06e5a78d20477d646f1fa713ac95701ea2c00343584b403c0de71fe20275d8740c63f0c3c71105

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\2492994A253B970917AF5CDF605580B1C2DC16A0

Filesize
63KB

MD5
af43884f023258cadc1041488fb2a49c

SHA1
c8bbab288d9e7a6d6b442505d84a53d67e3c9b76

SHA256
3b0c2b13e1641a3cf07da6e4b6f226b9539363af304158c3a139895422153ba1

SHA512
2d2b85f471be0bace4a081fce67f280428bfb70ae489f1de47073af5f01d77e9357d6e8dc05a08f75f5e4b4ad06984f8e311bd4d120f6a701eedbe77d3151daa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\26C5D9858055F0D3E69990B155924D86E0637444

Filesize
45KB

MD5
f91a5f3248e416caa152d475240b6781

SHA1
e5ae1b4618ee7ce9799b56d1aec6ce27baa70232

SHA256
1230f08f08a9213d2420dd31c4d614ab6ca57fbcdb45939011f3eea12203ac58

SHA512
5ed01b4d992042b531e6c5c6bab02858de815eeefddb7aefc7a672b17d980358e9ea4cccf1f10e821ec5b29d442136c9ff4b7336b8393ff675e01318e55e906f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\28137B1FF368A8704130B996D2AC119598F8779B

Filesize
55KB

MD5
d0a30a6be658c872bc0f54c15854002b

SHA1
cec6181adfc7f4495289b56d5517103ad0993fbc

SHA256
e54c3dbb20e12d677fe5c6c5223c4029107e6de2605ff7da288e7a90223513d2

SHA512
1c2f3e4f8e9e0b657452718626ea3a013fa68d19006a2be589fe5f529a94140b039142147c70f431ce104cf78def8f944df6928f3cfcc7fe3d116deb3229b20d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\2896ABDC0B3000B0F326A1B7638692FDEED08C8C

Filesize
764KB

MD5
1c9eddea027814d32a7ac1c01e3d1687

SHA1
bc4748d4fdb00be2fef9534dc94ac4145ce9e070

SHA256
18f9c0b7e3c006e7aab5b8987c49208d1edd16d006f1c9f641c73af90e0d917a

SHA512
51bd75bac02bfd4167662e68b2684ee56c3d3187d8adf18bb5e80694df7aeba88a67d6e77054d7bf0a28a5d64176efcb2c4c7f5eff8673c84b0192f44927bb7a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\28E1E5D29F93610BE7D5613D8B8DA1CEF9A67587

Filesize
110KB

MD5
9d496bffed123baa4ce48ed263fd8631

SHA1
38cba7e1e3f4af42be9ca96fea00e3806dfa14d4

SHA256
23d8d918431136c9ff3a70e8edc9e55afcea77d4b358b1a67af36e64d431306c

SHA512
9afa44a477cdb4acdcb55e8462a459bd53ce5e8e1bed38365ec48cc1639276f278cc409140b41b686bd9d51a0d7a989be4074016f3341b32e543a282ea3714cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\2BBDE90041057E3C2007E8BCB76161D49F649912

Filesize
359KB

MD5
af5c1694e1c8cad6e369367eba54b3a2

SHA1
0f45af1258c78dce86053fc2255edadb6f4629fa

SHA256
dba91d0f3bf56733381d5685d2ac6430113120e68c8d23cab41fe68cf74db972

SHA512
1d51e292e5417e007750f7cfeda4f5da9aa1bac97769f740fe06762739c64956935f0d5c0f4f46d9d0af40ee4120f31112e368113b29f77719c3c5bf2db618f3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\2E1C711B87DA91AC0E0B7850CA737FB856D6A3B7

Filesize
220KB

MD5
6f88dd82185e125b7fe7ca27d190d16e

SHA1
c6dccccf56b6f27cf892429bdef281a4a48d8c6a

SHA256
a4e9850be0163396764bfc091c507a967945a1983677fc9a42a91c4db0325812

SHA512
6d441394659622c1d8b96b9000334c5e81399fe09f1a97f7d9effe298634b4ebfed52ed5958baf587c2b14f1a69f32c9e093927b8b212479a0ee22b69ddabf71

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\361EE850B416E1E3561B044376E656CD161CF8CD

Filesize
1.3MB

MD5
2ac9360d188861871b8fdaf415ad587e

SHA1
6f88cb2c12b7e9ec1931f286fa6cd426e63a0e8f

SHA256
37bbfc3f4aaadcdb6399c4e8a3db8feb2c99cd75030d109d161c4e6eb0e75478

SHA512
130efe907a355f85175438e2c65e3ac9ad914612bdaa362b7efffdd16acc341f07b469df11cc7c1e487be00c07947234168a549ec363895bb14c0519dafa577f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\36E9CBE6C36AA08750DC395F95C0A4FA96959C23

Filesize
2.7MB

MD5
332675eea5a9dca76b64943e8193d4dd

SHA1
5f24ced53dece0505ec7dda26a6fcd1f08376a46

SHA256
b31efea56c475db0624d635e759dac02076e3c0f2db1eb6e6b135deffff47a1c

SHA512
e7a044dcfa46c469c25ea78a5a7be42cdac27701ffc8d88db58ad6eb152552624a506ed3d912820fa0eb286d4ed579f08f09020e0e806518b8c355fa693fd2bd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\3B5769283C179770F2CAA780FDC2929B4B9E5038

Filesize
31KB

MD5
c47880e9c70f488792cdfe15bda60acf

SHA1
ce5533a65dfe51ef4635be81dfa10cecd5f680d2

SHA256
7133cb974918a96f4cb973a8e7e88f8e7beea3a480a40d7af1008bb04e8657fb

SHA512
25e6fc6ca00884004f98c9c6143974c80e94aa6ed8ad80bcdccc7882cc3d3c2bd9a7a5706f790a3fc76ab61136a30b2dce5d596f9923ee2f1e78e9c2dc4bbf0d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\45C13727B6DB444F70F2FAA20129C63BE433735D

Filesize
35KB

MD5
d1439bdb357ea7899a9deed2588ad93b

SHA1
b0d26da621218c53b55074262154ac86f42a5778

SHA256
91d551049a432b6733639ad84f486cefc20db265b98f9ce06a0b2585434b4166

SHA512
24c4af62fdf6dc718f55d1b311a09e86207df0d67c003b744377013fcb9fbe887f43a629feb3b60dd742812b82e4bee20c486a11225a8b7f95eea085f35b4b0e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\4BCF7D608B2663D7D1515223C0F13E5D72484770

Filesize
36KB

MD5
4be021909982d6d6cfc41959d50d5b82

SHA1
afc6b7b652ae9567557488d6c2897354ecaf41b6

SHA256
48b6731bff11fc5eaf97270e839c45cd37a27349cf49272397aab6a087adad48

SHA512
42f706bdd8d12e45ed5701b99ba7f7a65f2ae51276df5c2dab81e08a230200f29261f927040b21a1f1673fe2785cfa08cb5f88e5bc17504fa9fd67fb92466206

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\4CA2E679CEC293F142684E37B6B4D5F01FB00E81

Filesize
41KB

MD5
95ade6f22eed3ca84f1d7cfc4b7a0a36

SHA1
593199222b37bca0b68541a07b8ed6dbbba5b727

SHA256
bd825c4d00f42d3e9346fd72b14ae156495e3fed184a3d1e67df567f9659d4ac

SHA512
ca63a8aa0cb366f8e052a4fa49f4d23125fcfc39507091a943347aeb1ef5cbaa1dd3efc06e1f3f05161811849c0f902fa7472ac26cb9132e66568718c2a49f21

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\572F0ED336AE2650801061B8F31BB2D7362D6B9E

Filesize
74KB

MD5
6c5e8dd8fc9276714137c2b984753493

SHA1
5eeb5155d1537a8853bfe70a2a421cb6def0118c

SHA256
45879744f04898c99580e8abc80ee31706f5915d09ac7d74c8b4bb95ffd49065

SHA512
23ac574420a84dfd79112f03e85780b594d6cc46a3da3e88d1408d0fa38c9cc51b479d941b0ca8a071a8e55ab5cae37c669ec98ab83afbd810502951874c1a4c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\57DDEF5CC90A17F06F9173DCFC477961C901787B

Filesize
46KB

MD5
260622b2de9c63380f66e0beb6271bb5

SHA1
a7570b5bc36657285ec61056712458e84f629a58

SHA256
a8dada4c5af10cce63a97b28dac2b52dda5b6ae3992682bda8b47cf77d97efb4

SHA512
101f86e5c45bc83eff7eb47e5f9b4818fcc0f9cb7859e1df1f35e15b16fd9b67cd3edeb01042fb8150fc148b5be7822de9a270dafeca91a53e1cdc9903d87a8e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\5C2A2B940E0EC346270C250EBD62F95402CF3D0B

Filesize
33KB

MD5
3ed00bfd7fa37bc46bc306f96d759133

SHA1
71026e0d5994d5b2d1801add4dfc407527e92477

SHA256
33a69af9ff1ea3bef5051fb5fb1764b87afe0bc790340d5a6d9d34ac91fe5fdc

SHA512
b0cd8fcef9dee4303730fec5945c7ccc516a232ad798d35d6da03e3509fdcfefdf9564e14abd682db58305c17df3f3abd93c7bccc4c9a6006ae4e2ae9903e36e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\5FEB24EB58405AC7D7FC353A4CD3EC67363DE7F4

Filesize
61KB

MD5
f5c8365d64d0857b1c548d2b028e9a5b

SHA1
07174478fa6aa4b5116a8a6805df5f22542d3369

SHA256
b0d94b45f1c582a7a8700c79d5b7350366d81e1c5e8e587e98d261dcf2f8290e

SHA512
8982a4ca0ff91209de5474c9734075368cfbed75c2564dd5b61c63d646d64fd9c4691d4db1c088be571edc2cb04f8a5439f6253909d62078b553fc1db29fa876

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\646829319C67DD4727104CB4F8B6606414E30D3D

Filesize
131KB

MD5
2bb6e5b7b65e39c5fd670e36d10d624f

SHA1
4915cee3a073cbbfa1f113151415cf2637eafd0e

SHA256
62f1c2a310d020f615273e39c60931a554dfa36c8df4ec8e219e2db10b8d5817

SHA512
6c813adf0376bf5332bc5682c9f8bbbfd00b90cb75a49cd982aa997abcc90cfd11f06bd9286443bb94af9da579680162176e95cbc6104c03972b7328cffdbe97

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\6DA69A746F9687E1FF413119EDE7AAED2F9783B9

Filesize
147KB

MD5
7ea7c1c41c175f6dc26457690075d30f

SHA1
069dbff7232fcffefcf518d8d0f1d87abd08bbce

SHA256
86da2327842929326c33bc14911ef39fb33bd270a9b4b45f481cd53dac997c73

SHA512
5ec2af9583c72b6396b2e34e3d9b3388f0ca3dc22748aeb0b4347679dae1499652e90acc41fdbd438cd82a84d73544bc8f05f6c7551794e47533f11169340daa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\72CC7937764E446E107EE110D8257621129E0413

Filesize
246KB

MD5
29ca391f220bdf67c7ffa5b1299a9f74

SHA1
70bd74d7b80a605f789b97e13b0d812b2c0d1d99

SHA256
01ab9552a4959814a0f9951dfb56a954888f30c456428bae1ba6265eb4846fe8

SHA512
3412e0a459c150b2b983de906625a02bae40b10370425219356262e5c8bbd3064c34cb251c46e02b02bc5e9d8afe4a9cf7b78046d7d2a9395472455c08e785b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\73E223E213EE9A36BAD4B96D4EA7F888983168B2

Filesize
1.2MB

MD5
2847e4f9df4f277224fa3699b191c5cc

SHA1
83425942a4ab97cf086d014bd9f1a355e4cc5dad

SHA256
93f3a495b9b24be91a050c5c1666664588ce7fd3e62bc8da40bd99b86d4e512f

SHA512
8f2d84ae2ee9e55a61b9d0c6d46b3892294f2a6ea5e04c4a1c55ae8c05b226d51536edb9c42057d6ad2572dd649a0acec95defe9ccfe63e501ad04e9d959b301

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\73EAA0767ECF1BFF6C0396D2598362046273B2CE

Filesize
30KB

MD5
e640960fa6bb000a57cbf53f0ab51bae

SHA1
b9c33fa44e44a09f86eae0968131e3f24071c871

SHA256
e0e9f4a025d59400f09d75ae8006abe7d0455c551c0ffe2eee1e69f4d5362037

SHA512
aebd70503b61d5afea1812ff5c07332084ec05cf61ffddaa5249e48524e2ba4cf41f1276466c04421288c8eeb84ec31dc909ab11df5ae83f75d02bb7d193e1bf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\780602FC4687537C3CAAEAFAC6F243D879B1EA9B

Filesize
60KB

MD5
4ae6e940b89e9e868d03d0f88d260c99

SHA1
5308b56b6ef9cf33d9744ea8e5eb8fa4050a5fe2

SHA256
5a935425f6e5979a8610b5c3ba08b3f5b7fd2792a23b3726e7eda285aa0f1d65

SHA512
7aa2c0ed11951b0265794cc92274ac6cd2c5271ed08a78896050d9835563f50720f6c825860963e11f9575ac707a1786826717de6cd407bf0cfd0daf0c4e2051

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\78F30E3303EF35B692E18D5B0AC8423D8FD1DE36

Filesize
77KB

MD5
7fe4eb38813f3cbe4b2ac9c39537b155

SHA1
a2e6742798d844bcb682d4bba253a0bf32201dcd

SHA256
a4626f91628e21205db697bad07d1c5b7e71063ffefe9b2017633cd8b67805b7

SHA512
b8e20fd5ec79f232c41d6ab524edcf6ebaafa7b58cbc4a2ffded106057d6b09c538f0332e08bacaa0354dcbf41d0b234bcd72e12d3f8a9f2c845ceb32ac945ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\7EB1CE07FEB459E4E531AF106FAC3E5B3D81C24F

Filesize
14KB

MD5
387b334c86465290900a8152b1c1322b

SHA1
f8412b7557c09231b222aec445a426137469e0b0

SHA256
057899038df8964891231ce6eb96d634f750179e0c5d59a41cdcf78b594199c3

SHA512
807adb14dcab3699aa03bb48c072a847a894758163c5e30e8535245bb27e9bdfc2ca88cff448985a0a61b1e28f0735a04c988bcb44f8a31a31f0b5050ac22d3b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\7F30F53457983F11F2D61636C9FB5706ED9AB60D

Filesize
49KB

MD5
7a765b0109c9c3a207a324d46c05b716

SHA1
bd028da64bda1bf824b6323e1351bada8134f9df

SHA256
72cedcf3e9408b29e45dad237925c1b493b6a32ca36904bbd0c6fd5c16ffa775

SHA512
096a1d82e6f82eafbc3c86ed0b869a07260715377f49f5d590055d8497acc19098fe0604f48dcd79c1e4fdea59bbb4894e8ec4eb8ea08aeb7fed85359068c54e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\80285EC16EDB2FCB53FE4D6500B0396AC776DCD0

Filesize
664KB

MD5
ec8d891ccfb86c573ea64d8d31ca9d03

SHA1
d9cc1adb16d47e41904fbbb21d477f6fa7810612

SHA256
f88922d24b54f40e1c06688c7ba0a4c1225873ea5212210cb362225dfcae722a

SHA512
b2e3847df8beb51268c80962db3a89ecbdab3eb251d877f626ea09e719964d7407b6223575bd00ddd32cc282672b1e84fab80ee992f4583de1b547a0b4a16b05

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\829D41B1F9ADAC0B58E178C1460A534E79DD0DF9

Filesize
200KB

MD5
957ca6cf698dd8a771f57dc918811e94

SHA1
dc7a1102d81090f7dece18e59c99f08ee40cf1c8

SHA256
df4c1942e78a80c32a72ffe24f776bfb08f11207bb9ba749e330856d3e1c1edf

SHA512
a30ffe1c4b2718c221bed35b4dd7d383a8dca64dbed2f97433700a5d907c5eac3e7f8d66c35b6f8592c13ae11e4bc7c6dd63bfe50685d4043d19d2ab4ff2e549

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\92F295027CC95E8E563792CB4B0B0866CF0A21C1

Filesize
120KB

MD5
988a293662247757b19ca693b9f7b6a4

SHA1
fd38f2aced83fc90b766d07b2937899270ba77a2

SHA256
455131aee121201e8aacc9860d399017ab7dca856825971d786066df34409aaa

SHA512
64642a60095d3d42b4178d406f5cd7df9d5243ac95c009e4708af06c4134aa065c6ee434934a17a4775293d4830b16c8405a6017550ab6551b3e80509b25b518

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\95A6480A2C87DDDFA331516232FE79970FD66A61

Filesize
158KB

MD5
de2e6e0a34f0d25891be440273077781

SHA1
33b52e630db2356ea7d27879470e2172df570890

SHA256
a3e903ad98e20c2d8ff49c7b92f00d094d095517c9c927c0ec6eb22425b120f9

SHA512
f48fdf088dd7b44f6851f911064f889a40de3fb01d83d5a4e77474244acd0a1aabdcfafc5def6679e42b0f2c9cade9990350508164db9fd1059739b15c291980

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\96B03B5910989CCE8DEB0C0B8CE94CE64BE03A57

Filesize
58KB

MD5
996917c523a1e7a5e961517d9c2fd198

SHA1
a0aa82a26592dd17060600627b5597781b19b07a

SHA256
4b69fd10e6f8f92f2a7cc5fedd4e56a1c407a2a21f1ca8b144956c04aa69b48d

SHA512
56dfce40f2ba6119886870b0b3580b100080e49f9b19bb9fff8610f524f8c06ef0e4cb7100259ea7021516f57fe1486614d02c994882d3b1348925d8b45eb4dd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\A0833812F069B9364EF5D62E26C7EE65608E1C2C

Filesize
15KB

MD5
49d82e433fb9c0a88179a8de9659e652

SHA1
64a0cff65af41f5b8711a54cad4c92ba3b3442bc

SHA256
5f98cffc50fb3256bdd7f62b498cbf51cddfa6bd07efea6344d32524f0215442

SHA512
ae32dee030eff50160daba80e856606bc8d734fd21938754c396d892fcccc5496561249e5d5df1bae17501416a3adb7235a4fd27030d054519cdb11a4bc5466c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\A7BFD7F859FEEF756C6ADAE32A931308CD5C619D

Filesize
42KB

MD5
0c05f857b1ed87926bca5eb8281942c0

SHA1
00eb397a90fc47078e3cca14acd7d8871ea72af1

SHA256
4fd7439617ec9dc304677381563eda94b1f2649b792eb1dc9fdc2d2e0adb72e0

SHA512
d0e4c35de593f36247043b20868d93a57ec7c8f0741b911ec6775a6baf670cc64754c3a5f30a8a4b283d13cad13fa203eeab5574b8792b89b87668516ad5dd1b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\AC6959268E349C7B5497A3867D6DCDC4D543431E

Filesize
13KB

MD5
97d6384282b3ab51b23db059f8477cc1

SHA1
81759f2598cf2a13dd9a839482859cde31a26a5b

SHA256
304f79b703bf1f404b30a23a31d9f88371168c2ebe1fff39de948e7562fc4671

SHA512
18f536ed22735681811249bda5a901d4324c70690948f41598ef8160b6d93e3b59e0108f80926be1064e6fa7e417e1c55625d53fbe318fc535e2376765a62706

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\ADB77CF89BB7C3EACBA0400910D8956D4F8A5D23

Filesize
1.2MB

MD5
c4f2b0b9d039ca31b0f4d6e07e161129

SHA1
bb6be545a7aaaf4a1a836d193c89aae2fbafa9e0

SHA256
d0e633f564d526e2c420ec5cfc8df0c79819f54cbf5770ce1e575147cd9cb405

SHA512
19c16d4534f4b17d18c1d8d077c0b5cef981fef67cdae6b0fd6a3cc4c40ba553b8b0a195d11f8111c7d30ea842b83a2731176cae72f8bd6a87321a4bd5a96fd3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\AF5E2C735A131772CB35B85E21127F393E5EFD7F

Filesize
126KB

MD5
f00354da32254eb8028abbb8abc0041d

SHA1
89321f24b092f9610a9ad5981657e46e2d4f23bf

SHA256
b4ca3ab9c534b8c976c40007831339e99ef328a46554d0374a4853e0804025cc

SHA512
7087ad76987d733f41473a8c2c5767712c1d148e20b512a09cafc82102cfd090882bc197e3d10579bb445f8ded02d48f63c50485d57f32893277a65a76f0b187

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\AF6E7B7DB9908D7B867517AC33D094ABD56E38F7

Filesize
38KB

MD5
76f5195cd066bd6c468d128a67a7f142

SHA1
1f334fca0a7f3d91ac4d5b02f597942dfcf4e86d

SHA256
f3b53c0b2247649b6cbe5148fe3812581a73e42e0939afabe2fbb353c0834cf3

SHA512
743c39852d6a9cb4577d5c5c421928eeba43d0255114efce5da49735ee5e19b5a42cba929b2bf6c77b50d6a6dc47ff14f651e8feb68ac4d0155f1940ef46134a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\B15DB5D86A3561125EBFE6CB8FE49CC15BFAA385

Filesize
42KB

MD5
a50a1f0f98102cffbcb4d11fb8420b93

SHA1
89b21e23c18f35b3e65d29fad6f334e09d23485c

SHA256
3359ad5b4124966f7d20afaca37c7474fc20266a09e57a069cba8880846cc783

SHA512
431d0fe83881e93d9e512ce844de093e2982a3a355858fcb3b26808c860b00dee9f71dc07b3b3c33b16f39776215a09c7df347bc1591c46cd89e863fc5b6e093

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\BA30A8866A8313A16394DA2599448520494928BB

Filesize
30KB

MD5
92be875a3edbb5525cc55c8753b931bc

SHA1
da999264c21775b81f6a91b7021201b8f935f488

SHA256
ba178d8f3efef2d890ac10bb762b64695627930198740f7b1620919e091122c2

SHA512
c16a666a0e1bbd7569f325d46482c502ea27155d61805ce7599235396e7444b0b7d743c59e032b7d7898d4773572d18698623e0db7a1176252bf3c79a49a33b6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\BD518506D48E5D9A2A1A812001B343D87149620C

Filesize
175KB

MD5
cec9836b8f55013043856e7e313650af

SHA1
2609e6c71d53f5d1c08da85a9c1d9dde84e63ac7

SHA256
9ad27d7073fe2b5e325dbeff4fccffd948f1b9d58dbeaa8bb374159037bfccff

SHA512
8e21912a39c84af270fd6cd7644e8cf123145529371413b507c1f0ac478e4b5a11e9a887d278fa888ed8aa9d19911a3600b2303ab91425f7d29a2ff88de64cd9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\BD5BDA6CAA71A9585CFF4439E6C1BD696837BD13

Filesize
47KB

MD5
f421141bdbccb31785fea4dd33c3bce2

SHA1
2420a80ae941699023dac1bb22a5ab8bff4c781a

SHA256
747d307cfc6760229375b673a8cfe99a8f3e9f83b782aa52ff682e428828dc49

SHA512
3d5dcf1198612f1eb9e328ca784fb1694a079bf7a64fc095674ca9f051792142fbef324bb710c0ba9e9ce1ed9f57622ebc056aceb5144f7e62190198f5593bf4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\C7F27F1B728D8DB7CFCCA0B5822E7997A8F337CE

Filesize
447KB

MD5
666967265310048599ca21baca1c44e0

SHA1
70ce8bdb8989653b55539492d460ccd86ef539e4

SHA256
dcfb78658e9520ec78edb9392cbe0a1f00805ab21469ce51818f86e2b021599e

SHA512
44cbd9e699abdccc382500dcff65b29411a0ad7b3720209fb2d08a91889137f43da774ccc76b2f14f5d29f88163aa5c9f7314329d2fc616c4d1f3da575b77e65

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\C7F2A8A794C8672859A584D4B18797E2E79944FD

Filesize
266KB

MD5
723570bccc2ec7294c9c6bace9aaa085

SHA1
227b09913405a0bb3e356692cd46f2745c06abc8

SHA256
b7df8016a4488a02212703cd47e5524defabb9579c0422ce142b555d601f2b01

SHA512
881699b2775df8bd6f0af3d62fbc1f8b6fd12c46c270230b8a869a9a922ad840ade564d84cc2c21ce401096ae0dd33e3084c07df9c9dd220f446ad735cd77efa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\C9A19F720C659128631F28B59E979F9CAB42A166

Filesize
27KB

MD5
627e265b0ae5e4bee271fb11e509c999

SHA1
53e660a8c0a00c9d1144dbfa6dff5f957493374e

SHA256
c40ff1c580cd45e59383644659358553f955f1ea4591b3b6db1fea049efe6ce6

SHA512
a08ca0306edff50942db9742c687ea526ee3dffcea7bc3bb91be189f1c08dfb467a264b5e601b5d97b41ec50bed50b7166a4410043c904dc08e49f398cc27d6b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\CAD1414BC30A3580B4299605CCC55ABA9A6E1725

Filesize
96KB

MD5
9ca32720f86562d4fcdbac57c7299863

SHA1
f4861796cde644a9ecb97134089b21c1276d5b94

SHA256
0c33fea56c48126374aed9900cbd4640d48c60e521c64d0aae7ebab2890c976d

SHA512
3d846356ac5652861f4ebca97a6af415077de56fb2d50919ff18e871cc68bfb8e7b428cc149b7453dd884daa4eb333f0e39f894612a933334051ae1eb296a1bd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\D105AB5F954C0907C9073BF810F90A3C36C6D3E5

Filesize
841KB

MD5
0cef289dd2c57ae9c2e18a70e54e2e91

SHA1
a3f1f375d5e6e9980f58669af182fced8c7e4e81

SHA256
deaeea1579fe8da5c9f6ee574c6916728585c710072a5ce525f4de6c53d3da67

SHA512
796d795471920f4c8bb3291497c301187d692d183beb9751a2319101dc18b3cbb5b3b4513922943f8221d43b175927815378d67cfc29750baca651fc0c217e5b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\D5274CC9487F5880FB0ADDD7EE2947C8EF06120E

Filesize
17.3MB

MD5
cf2e656fd5f153145d64739e4bb9acd0

SHA1
8295df896a0001299feb68fc9d02cf32a52d9687

SHA256
f6312261614828865e9b7311f5172ffe839bcf1b5ec0b963f089fc4d657d7f69

SHA512
ed0357cccf02b30e56ce05b4c807a25e20e98d1f071227aee17c5ae8f2e813a0b515c4c3f11bcc268cb24914433e0dabfe95da7b0e87ab676f1681bc0ff364a6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\E44D8EA2BB95FA202605B58E615B3400B72A14D2

Filesize
38KB

MD5
f5e4b80e24c149cc8c0d5b326bf7c4a2

SHA1
1077f080dc0f166d42813f583b8a97f75cb05d7b

SHA256
0d8196848eb55817fbc99c6688466c56e6e7bdbdfcf60f3d6aa7e9c57250c48c

SHA512
d1c21cfc41212850c9ef52f69f5b7034dfa5aef27125e84c37ff467f624f978d7ad4003b4eb6f9d6dfe8f27ffe02938ae66ddbbd06201b9be0d41f99b17c9428

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\E6C22A3DFCD18E3C6145370266896FF76AE3F7EC

Filesize
39KB

MD5
2c402b485ad04a1a0ffa7afaff743463

SHA1
c27b750d23ec6f319277b30e2dce447c46e43d63

SHA256
468c71fc725196e007209e099aa52461ce1aed39edefd8639b51124c8bc0a280

SHA512
4b6265e19404034cc99c65255c0a1c40975f9e639de9fe8d7e295d932c0826d6fd8a1b3001f1316401a8336acb5575210217f6833e99a7b1c42ee0b49fc541b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\E82C79F80897EACFA36FD4EECCC130ED5F36FD6F

Filesize
33KB

MD5
74e3abe559cef85669be277eb26b9047

SHA1
8eee5702907514b58ee32b7559f53475c41e5293

SHA256
b05315aea5cf2df47446252ab5605b4f4678ce098e28699208a0214564c35fbe

SHA512
17373511f7020c9c2be495abd6bf72ec643549ce95643a213528b2f477d504016328a9ab6a283afeb506ee450ff7322c40c55fd7cc316e072fd9d9092e1f5e98

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\EADD8AD0D19BD56212728537973592A5A83C9F56

Filesize
27KB

MD5
3e3c76325ffa99c8b34dbb4d07373ad4

SHA1
ef2643d9a082ca7a13a44a13f34b79299ccb4e33

SHA256
e894c9954468febd7a7548064eef9f0f9461d17de148fe34324d4121c8f42cc3

SHA512
e58cac23122a7ab16693c9a84c81586026996aa8a1e3ebd05cce49447d1891f72a38f3f6a4aa347a6be87d538a223ef7bbd4d8298fefada283cee58a8bf708b2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\F54E7030F181831909BFCE5EACACBD3D867BDC0E

Filesize
99KB

MD5
ee7a6b006c73831d3123dfac5c7fa863

SHA1
8637c40683d152de2c7ddf303bc900a98a211557

SHA256
d4f1695a3c5d3d3f5fbe9ca09e0afa3e2e3877a2e278cccdb0afd887bb2bc478

SHA512
dc9959ce42f9fee9608fb5fdb3634c48b58dfd4e33e63cbdef646f04d3f7cac7df0bde566eadc1edf0b18c219026e668f1f2d0750afa2cded7e274ac3599d346

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\F5A1FBDEF4E6F115791D6C8EF1598942067B8080

Filesize
62KB

MD5
3b35fd6e462652b0dc2ab171bf91b0ec

SHA1
f9bab9317ccfb62333b75b180b231441dc2ad56e

SHA256
0e0c83e596965194d8557ca12a5e97595daaabee1d504417dd301b2ab4cb8c46

SHA512
20b85888d7a714c9947b71c5376998650e24b16bb3251f3f7f1120892e732f4560e99d731dee066ef3815548b54edb66ed377fdb4ca649517d155497a9a334c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\cache2\entries\FF405EA908A0CDBF948198368567C7EC073C7A02

Filesize
52KB

MD5
2f3bde0685565ac2c1066e73614a2775

SHA1
f662808ef66dbdb63f275fe7157fdf225a0a3c5a

SHA256
a2bbf202ef1dd4adda7307aa061cfc90b7ac9ffb381f2d3213215abf8ca0c46d

SHA512
72ff3ffcbddcced501411df18c32dec2f27e1a3a4a39a62afc9d8003906d64dedfc162b987ca086f7b5b7f8fe060b72a78e3470161c49bc861c6a2b1b4869bc1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\jumpListCache\9J_5tMFV2tiuwXSxCQCvfA==.ico

Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\jumpListCache\cz2h50k4IusDuDmYxGrMdA==.ico

Filesize
965B

MD5
c9da4495de6ef7289e392f902404b4c8

SHA1
aa002e5d746c3ba0366cd90337a038fc01c987c9

SHA256
13ec8c9e113de6737a59d45ea5a99f345d6cba07f9a820bb2297121b8094790f

SHA512
bb72f0cc815e7b4c44959808b153aad28dbced8d97e50f83ef90229d19ea1c4b3fffff650bf49efe562451fcae0325cdbdffc1a5c4ec5d2c7c70ae9d1a0d8a16

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\jumpListCache\jH0mQAfgZjEVrMY4KbnSiA==.ico

Filesize
1KB

MD5
3a3e572d92147aa3604480df0dd6fc0c

SHA1
50307c505c4427954ac6bed811a472d16a92eb0d

SHA256
e317b10882c2ce2bc58fbef198606f2166dfce6d351df3ef0c20468d5070f22a

SHA512
7eb470bb421b10c22f2b9594e8611e6019fa88fdd948efd5d84f4a0de24352ca4c0374586b5df60f4fe43c8fd5f41945087f41d145052b883bff643ff51559eb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\thumbnails\54d9bb8d2c74a2b8485ab5d8154a3317.png

Filesize
12KB

MD5
ae93cb1e34fa4f33cbd408096202ec06

SHA1
6c9a40c026c3be40ccc7e28cec6d3f1ffea8a04c

SHA256
1e3187f304836ec6acf079fdcddf977ba0b4aed7a021a1e94246288f8a99bace

SHA512
e678e29b9338731399b262f9952ce135fa5f3f32112daae835ef4fd8342109f1d1a2f10460745527c5ee52d28c71638921685b02942de50d4b3df2d847eae102

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77C1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar77C3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CL52WMUD.txt

Filesize
124B

MD5
a865d9364431cfd517b97c79c9e3068c

SHA1
ecb93038a6a9398be14b52f40997fdf3086c6156

SHA256
011858c59b70f2f8cbdcc74532f9de7a973ecc81e984149da24fe7a671205e06

SHA512
21ed4ba8dd6ac4fb5d7e3fe8fa849a47c7a30d95a9065cd2c7f0b6c3080593da83143840af07641a3b1d8680cbfd8d664aa820f1a4c39a3490b0c1fe8f4f4a73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\container.dat.fun

Filesize
16B

MD5
8ebcc5ca5ac09a09376801ecdd6f3792

SHA1
81187142b138e0245d5d0bc511f7c46c30df3e14

SHA256
619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880

SHA512
cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0VM1GH66IA378AV64345.temp

Filesize
5KB

MD5
1f063c99049c9752629bede093cbfabf

SHA1
33df0e6f1ab8c80187aff63b7042b5de9c21fce2

SHA256
1e8d35437a93416bf11ddb849bed31eeb344dc4b76d421174055f59940711c9b

SHA512
41c13c77fe2b96c995a37e7315293e4b7f5afd6d26c608832c0aa2421c6be72d5eb18aa23df95c15044d37b965b437a1b0a43c48ce760a45641de2ab90895d93

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
dec20f2074a66aae37064d25b83fab0e

SHA1
b8be82110745d8ecb016057de8c89bc9556280e5

SHA256
dc3a7c59d40e87483f71f5b04441842bb6360de0f4a57b705f641355a66ec4be

SHA512
212636ef3eaffb39880c5271bec991b87808bcbacbf97f0cafbd27281dc5a1394869683b0f278060ae635e54a77c56ea08fa60493edab17289e10e95c0e8e377

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
31fcd2317aafec9488c042ebaf87f291

SHA1
f223dfecec5459d6436eeaa2e5e3c160a634a0b6

SHA256
071b6035b803d99b520faf61ec02abeb73932b27bf5d8d15b5ace50fc46fe508

SHA512
68b80c47db0151a00e2559e6b21f6cbaa11dfe2e4b886472e37e448b25b1f73968eefed8c05ff037ad37839374878605a444966bbb8127081bd77bdaeb4afe0e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\AlternateServices.txt

Filesize
7KB

MD5
a471e00a9fe3bf4fa3749bf3d2a2deb5

SHA1
26dd4569066bf68f6313200f8001f551f358950a

SHA256
e3ca198205fbd9390140371db1ed17360cd4b6116c5aeec8a186f81a4ebff388

SHA512
0c1289ddaa7c1fca43fe42cdb9cf1c91852a82a6983eee977c4c64ef0cd6ae5e7cd1044b43d12ce790255b63181e8f0016050a77b5f6c2b931af686aeebd68d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\SiteSecurityServiceState.txt

Filesize
1KB

MD5
e24d5dbdc55ea9b263dadabe80c251cc

SHA1
0b146864d2c438af423128f8ce51e219dcde6921

SHA256
a1ffdb8e1ce0135a3e75bdd115aeb3e5a74f0dccb5420f3a28b9f86c603eab6d

SHA512
66ba56251c9fcbb9ac87cbb71a39028320dfabcd717720a626ebb5c1860efb567f38d07ee82b4ed35d29da62b3f4120186544f01214f5915f6459825e873f748

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
8bd6928349a955896c128a3ceff19a23

SHA1
db947045079eda9f1ddeaee68d38748d7f5f0634

SHA256
62e55957a452a8e30c507d4eb5f21d0e282500a9a20f523474a8ceecb5bcc375

SHA512
7fdd32242e07e179a6d1aea9940308ca77ccc78fb22ab29b27b8150f53def479cc7ca5818e00844fe83e7982598350a7e8c5c5fd75abd7d620aa35a80ab866b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
a53042d05c4351c55bd68d0f52618865

SHA1
79dc2617bcc475de7201c32517e19bfc616bba91

SHA256
5e5bb27e22fec5670e28f5ff9cc25a6bb998572a5629b059962c91dc89881ec8

SHA512
4bea8b1d9e458389364acade62533bf688162aaedc96f601832cefa24dec38ea878690bfc8f2d1e2258b754946373e25af9e9894e405d181414d5131f307ced4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin

Filesize
17KB

MD5
ecc6ef15d38bd4d4b16d56d805b58358

SHA1
b9cca9840bc242288ba97790aa2e7e5d492e7b2c

SHA256
04c1e1e1e4c3dcad5dc763489ac2a846df83342bd3c6750cde534ae55cf8c55a

SHA512
5e4956d4a5c38073372f310f7bd71a48e1a639e3560e61d03884890acc3fc7fe74f1ef9af419d31137a4b11f9cb966b08074962ec195099afbb91448542b0581

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
28cc0f946ad9dfaf1f27d5eda84975d7

SHA1
6ef28ef9ae3389889284f7cf4def44c507efd3af

SHA256
3cf2113e3ae09f2e820d887b55cad94f1566c9b2c367e800a68b7a01b6cb9045

SHA512
2df9df606f22361a9dfe9e39b4a0704cd0338ce408e595e77d8151ed10cf4ecaec9ac13871adacce497b7768b90d258983c930358e71b2ea97703837c03ef156

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin

Filesize
16KB

MD5
56c55e2fc28aa77f3aee18135c240d70

SHA1
c6cc9c5a4b9a66f38c6796e438aeb740e05f0528

SHA256
221138eb79fadb5a0969a3acd9b58f0c19f09abe6b4be70db9c0d72b25e4ec0b

SHA512
2dcc4539c0da8c049bd0bf0ab532a8e21486c63c4a13f140b7f3e78eeee5b2af78baff3d9a6e8d295f681c12cec13705e689d46e84169dc0aa99a08f21fc9daa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\0f5804d5-58de-4274-868c-f13e9b084bd7

Filesize
855B

MD5
729b6b437c7e2225a9590be268b0b472

SHA1
eae5fc9514fb3fb3506c7e7fb0847afe454486f2

SHA256
2f0fef991a850b6c863a1c58c47e40ed8a5233e32a05133aa62eca92db380b13

SHA512
35b9d75d3f819fd883593d7fe7aba2ef300f383426ddd8147ca0fa8bc9091e23ebb103a01bd9e73ed9e5a808b6864c6475def940b025842aac7c020672c29efe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\69bd2d33-5f6c-4c2c-bb56-3f8c5dd056a6

Filesize
773B

MD5
705c15df002589bd851e7cd52fb7ac44

SHA1
d32c3ea940695f441a2739a3a1fc31063e256e2c

SHA256
36e2e322df6e216b1b6ade7c12a56d76ee0bf1ad4c692746da3a29e66435ebf1

SHA512
6b7e5d05d4bd35dbca66adabd2672c7f74988d70de43626a1a09e970b24145fc6844410707ea4d319bbaccfcb84e1770990ea6ec789223d48d0a339213eff598

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\9c2861d5-271a-4d5b-8cb2-627ea3b386f2

Filesize
12KB

MD5
f9a579813dc9e3a7928fb35f7ad468e3

SHA1
24d8166e980e99172cd24f2c39dfc1a2a9298c6d

SHA256
9197390a688501c93ea584cf382c2d57fc37c4c6c3b29ad8ffa5572ea393fb67

SHA512
dbef4647fc9ff93b468a7ba04610f17961c0f569ef681e0273be624896984c29d32619511a10f3253910918db4f727b5e0c92744b843571535e2947d8d0b3fbe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\a72c2c6a-6cf5-43d8-8c35-d3642f220fa3

Filesize
2KB

MD5
35dd50f7ecf539e195222de3eef4e5b9

SHA1
f4c9e4d563efab9dcb9424b305e96c6644e9db06

SHA256
0057e0bc891a7b1d6ce8658594b54fbd6e1870b9abaa821f4bb46a9e3da0aa6d

SHA512
fed0f054aac4c1e815e1d63ad9a98e13f711fbc79164aae8c71dc2783fb2631fbec45e61203cac44efb397df31cb7a4372bf650622bd6e409a4ff9d743f568d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\c83169bc-0375-4a60-ba86-b1e460533909

Filesize
745B

MD5
e5cfc86529d2aff7bc7259e6deaa9604

SHA1
4daaa03d4af139226c5c7a9a01dae105fbd018fc

SHA256
54a4654a180571ea64e06367ca5f10a2b57cc9380cabff385cf0bfcf686f6071

SHA512
80d7259da0ccf32759dcc5b6c2ac0bd9b73bc50e7cd89804d1a2165cd3f1dc3e22dce9070c437466da0951f7334cfcd7535cc5e40ff6bca8bd90be59e63139f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\ee8607c9-f3d6-4e18-b94d-a4df27f96f03

Filesize
1KB

MD5
e13cda2a0c36d9cb344261a560033443

SHA1
e06a22d7678eb639899c1809fcb4ca8db2dc087c

SHA256
2ee487214a91def7a615149cc286f2b828b844c0d9bfbc93a1409a076a67a364

SHA512
3ef79e40dad078a26d360b08b83bba2885421c75f3a66b7867395e4723fe7ed00b833ab17c6d5d926f88c87a13657d821772bdabf86b059e3b35a056664f336f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

Filesize
7KB

MD5
ffd74d907acb29abb457e3f7585ea762

SHA1
4652903741f24ccdefdc5140e52abf27a8a5fd7c

SHA256
e70edccb2711628399016d81ae8ffb286bb22eaf240751327f6391b9379dfa9f

SHA512
069e036bc13fdd7136952422235f62011e5751cd9f0731312e6be76b2f008de325dfc0b94b0aef7f551bdf2bede43e0a48b64e663c68b3410f7ddc25bb334cf3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

Filesize
7KB

MD5
8bcce1445ba8ba833b4ce0a932c0d395

SHA1
285e4af619591ecf46ec5e24b1673413d6513717

SHA256
eb1b857df7b2023f38a049c8a9d6f8f6343739f0cb76583138d1042a7d7ab9c1

SHA512
7ba5e9ac8bd5adab50cf9e4b30be380395e1b7f45fcf7399ce63a3f440841f9d23fc7c82cbfde5bde817922a559d0765e469e929c70ba8c4971f2115f87e1dfe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

Filesize
6KB

MD5
ab091f506ed2b525697134e0ca32a709

SHA1
a4f9bb809ffc81fc866ea669d6932834993ac4e3

SHA256
f249bb0541d39682c97afaceb9604182dc00311ade7f095991cd01d4e7720b42

SHA512
557b8ca9bfc310f43078de545238af1779e4436c46b45c5bf22b389668dc52136e5049e238553bbeb370f42a784368997c5745691e5e1a9f794b1a099df0872a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs.js

Filesize
8KB

MD5
75d3b901ad5852ea2e785048012254dc

SHA1
b824d21f533eb7e9968fb17069aa78a4e00ee590

SHA256
f38bd5ff00b097463ec0cca77a08b8c29b98d52a96c1710efe35dab4d430500b

SHA512
8988b1b61bc0abea6e2e1356fba0540d4b8c26a653241733d5f203c59f5ff2f73f3666e81c15cf3cbcb8e87a18ba150aa26b90055ed1a3dc1ff3e3d8d6528de8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs.js

Filesize
7KB

MD5
4360d12a592e0f15fa01743bbbd7ee65

SHA1
fe404493e96401c6fbef8563af8c0fc78a5b40fd

SHA256
5d3b40f3a14f1d3d56a3e941f97aec7188760ae40efd6df713bf01a1c9be47d7

SHA512
476bbb6422f6e6be7210f33e2c4a643dfd595318e3797fd922a7ef79a7ca74c165f25a016d22cd4d971499c389360c5acb5aa6350ef28ad6cb29e8757551f674

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
3b7128e6b4649f83ebcc0d7316176a53

SHA1
e2a9f42a54606d0f79b0a9756380d11d7b28ab7c

SHA256
d62926689012291e5ba312f1579747a21f60e336f5deef51569553a1d89947f9

SHA512
66034cad19bd3a82fc31fcb18c33b928d87c0843d4f431454b41de7862c573d18a729a8599672a068ea1efd81388ea9366ab823ef426f6f8e15173ce955db02a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
0e7eb321ddcc1dd8658dd213460ad8e0

SHA1
cc812dbeedf6f14a6997d38fee52e49d095ca488

SHA256
87166e6461abb7ff5e33da8366b044c867406748f311cbb0bf53cafc37b3b3d4

SHA512
2bbac315a82e5aa4b961fdc73d1466c44c2928da4f13f90559e52ee1f04687084051fd1906b215b06a9303f02fba7dad6498e67454012c7dce9fd1ddf251dd08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
18KB

MD5
2c1c0a3bf6484a8e7a5b98f5bfb30446

SHA1
01f536a708a02e84809a88b2c04b0f5f2bb83783

SHA256
ae9a286ccf21424b3cec068129d6aa40d95cfbec648ad5ed073e117df128c69e

SHA512
392f99192e10cbae5296ad3ee7c55f1f2fe1238d0dcbf31b183a83e799f6330dfc5a82c14e20e9f3111761c2f67e8bf9bf0147157f00ecf80cb9f599a6080e5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
bcafcf1da4339fbc16e0b0bf180efde5

SHA1
4a1352f8a739bfe5812fb60fba1e57d04c4a3477

SHA256
73bf53f61ad244848a5b7e097955662fba85814fad8c2aedd9c5b968c2debd35

SHA512
22ad6dcf2956e49986a29272a1277b7229da3d0680d19ceb7396a45b10b74a74e38ff6c1f988776e2d0b49ad6d6dded0b23199caf9391b6ded7598577abf9df8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
92371031503aab1783f584dec74b800a

SHA1
86e66d778b781bfb4a7607d6da8edd2898c2f29f

SHA256
64d9df5b6aa76039902d71bfba1289eeb716d6ea7da56b79a7dfec36787e71a2

SHA512
36fc128dfdf2d4e2926dfc29af5d6b535d7bbc4872464beaecf135ae426cd2a9abd8561c3081f7f72b13e438ef7afcd6dbc885baf5c310269c6a9b40170573f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
5183154ca7cc28787cdc240b399884da

SHA1
d7e7d6d869e5ce1904f521239a58ac77cde1ed65

SHA256
bc0a5522ad64ed7a479969bc2126535cc279e365fffd6d7e53bc42f924cea47d

SHA512
98151bc8915ed2ccacf69ad4e59cdedb658eeb8512c40219ebf35dbb0fa95ba928ac8723dd84ad9ebffbfdba96afc66eff442c89ec1084cd6b0778b2baacd902

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
19KB

MD5
8a43d57ca870724181c0b3fccd313692

SHA1
cdb5bd20aef25ae82a6e09d82461f6ad3b51d16b

SHA256
52b9d0597236929df2d6293d369ec63c36e7371b4768071ca4ca3a65733c068f

SHA512
b9c7881843977eb7bd05a102a7e69d36ee4c4e02cf7261992fb92cadf759bc41269b88ec8f69a2258e3910ad9cc7c306756c48ca88cdef4802632b3c8812e000

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
63b313ce07b9232e823476824714708b

SHA1
286bd0c2c58e6ce2311b349b4517cd2e26076839

SHA256
eda40b537b8ae8e4f7371c80c62863d2a978c85ebd8ec019c262251e463b9d75

SHA512
0156dfdb854c2623fe5ff0f44f0b507f26f8155fbbeef4ba132b25cf8f79781a322e33830f7afd27715d58e11ec0c7f4e486bf6b2aa246f0dc50f14db89fbc0a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
23KB

MD5
9e8a5f5603f2bfc7ce8d3ae412f59c2d

SHA1
a01aa8a0c19e7df690a79233b3ada20f9d9b7d93

SHA256
8d00961289be05f715ecc4a83f754530e0f02d08d1bddd1bb32b50260bde18a8

SHA512
d8160e60515896d5faef83b393f6c1c762637ca577e454972826d0412a35923dbd17d308a4779a97d942236dcf9e522d3816dfe824865575f7cf0a9e2a24a6e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
0092903ab66dc86dd3b01aa90899a671

SHA1
9d9dfa2ae5b40f411c9871d651210cb5d5e81ca7

SHA256
e23ee718a4ce6b263e7bafbecfcb58823d412479fa70902dfe83073ec7e8b355

SHA512
e8816d19e9aa311c5936ccfe93b6612c67d256c8700589780f0a889b5f61f789fec0618c8129fb60cc085ab1607cc32b692d887d9d823ed6f3edbc02eb9d1703

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
25KB

MD5
06929db4798e25b68435b7d46afc3a60

SHA1
49cb1cdf0e77fff6c720d42c854bdebc63eda029

SHA256
147d93db873e3800080bcc4b76eefbac2fc42b2dd3ca2f24d7f1bad9b614cb9f

SHA512
15ea63c1a9bfab35eedee1dd0ebbe77699b89308040983765b54c9ea25dbc9ee88c2ca7f7c119b5e85c0b432082b8b36593800e6ed7feaea3d1840465088e2b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
7d4bf0e2d6c37efabc19d3112d34a95d

SHA1
3d496d1b8bb899577f56c8864bef85d04d99078d

SHA256
76d70bffcb33fa43651c2b3112722cda5f717c2299eb5862a7d0acb844283bfb

SHA512
5b67cc58b534b37c8d156d9cad5b4863bdc474a311bee2d8a7fb9f81745316632a2449dded9487145e2cdd59a40d39e2b9732dd942fb7bc6856f93cec95d82b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
57b9e37032fb132e99325a49e7da1c16

SHA1
56fbe81f814bcd10e08281f4b686b3dfe71229d7

SHA256
c62664a8e289ac82a8fae18ae7e3dc29ce55be177125b51d6cc1a2e780556168

SHA512
eaece90709f747c2680cb2726a188e5ca026730f764f4cc6cf69e94d0492479a809f21af9f2b5bb280effe2fb795857c2d560886eeb4298e3675a5184386cd5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
406252781ad12d63fc3f4e931ec694dc

SHA1
ae6145049aacecb9d288bd7dc30e0de5b1be6ddd

SHA256
5f6a8cf5549fa2c72529c5fb51dfae92c25ab28b11953b19eb5ed8e631aaa966

SHA512
8f6075722901b8cd6a0f1e6c68e016896e52a3df7b105f49d153776edfdf78b2714810c05e378a6127bee19ec2bd97f334cebaf927ad66bc49cbee2b7fa95f69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
5af920bcfe03eebd3725d8049a67961f

SHA1
fd1ac4dfea1e8714b1d4046532c4bb5708b22eea

SHA256
8873bfce6ddad4c54a8c00abbd195db5316dd730de37cd02ef88dac75ce77c89

SHA512
3a7072bc05c5a3c39b72f69ce9bdaed1beb20865a64dc8351613b6d41ca3e39862cc11481303c81afc6b8c32cfe79296b23089325b25bb64aa0b72f822b8246b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
28KB

MD5
54630fcb5c44d7f14df0765ee265f884

SHA1
ea41b1006ebb2ec2f575f843da4e321ee67f0c8c

SHA256
b145f6e23b6aeb0e913925e445cb1e2f9a5ac5bb67956da7fcfe4afee1e0f08f

SHA512
69e34bf404ae223cea5e9d65507fe1baecf9afbd0456fc92857aaaadd2f82be4b3926c37e2b7bb196da203abc0a5107d795151375f88d068147734b9caac9ad2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
982ce221cd25a827806a719d22da96d1

SHA1
9bf673c7db82152e56661775a72240ca08edabd3

SHA256
9700f811c691a48695fb225b4ae98d722f0a4cf000d724e43eabdd4d58dcdc9b

SHA512
3593ac20a20c5107688f6cb5efc164bcdb5a5c1c817befd6659d870ec7eee571214b4d75283abddc6a90a39a88ef33eebbf8be24e5d9b1e9aa4b71ba72c8fec7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
3f6d89fef4ca65b1746caf103b2966fb

SHA1
15ac2c235e34ff3fdcc6927b0b2a4f2aa4a8aeaf

SHA256
1c4423662c3c3e8c2899da7c0f8dd1d489bc2446273f85bd7aeae103bdea5193

SHA512
31a59e112c36a95c10b3c045ec20a1656337116376256dd19917aad31890e79631efaf0957eb8e8fa9cc0653cdf3e264d6ed0ea60f25babcb1df1114c8a37ff0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
30KB

MD5
2bf3637ba8239fca1a0a5f6403c8a76f

SHA1
b597f0c5afc6700f5c9fb51933e299f550b17438

SHA256
274c8bc949a63252f8f6d31c12db9e3a372ec3cf2a5c523efb32d666bed602d8

SHA512
e2581cb864a02271ba3f168f8c270b5d0fb414685ddd218880b9c51299ac0c471d537724ebbe1bcc708a4905264d4b60d2ce47ecc392ff109286730c4d7bcd56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
de3bc8847b391e84d1f5d36b76acfb7b

SHA1
a48d836f1e973bb6a337f77af7458c3fce2d0699

SHA256
ef3839c106a567ddb6104cb21ada9260ec671421ceba8d29e249cfee529733a6

SHA512
ced77c73a968ef55ab959ff48abaaeb6d64ebf0f6c2fbb07be57606a94da77fa4d37ee354a04fe7a12dac7ee67f69e8c41aeaac6c8739aaf5e15d2b2fab92c00

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
983e5ffcaec39d8aead0a5f611e788d5

SHA1
b7b747fa08f1d5f86e7f3814b56ab7b3206161d5

SHA256
f7589c24e15ded16a3fd3465bd4dabe9d14cc2b76727d81ca2ae751b98b4c0d8

SHA512
2f2a7b66df684aaef3e1c04c7600dee7e3bde6c8cd5cf68c77bd532d492a1e181d109fddfb938c58087a4e33c94f78c399c5254a9e6fcbd4a436ba585504d818

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
29KB

MD5
82323ceb11a243d5a188dd6d8311481c

SHA1
b82e1158699b24facf9663043b4ba14c3d32d6a4

SHA256
8a160352d1c341d60d018bc5c96fb2fc9799e55fbc76f71f9be49191e242340b

SHA512
6f17f1d10a86e0be2e0b32b5b3c3124d30552bda467d582997d028879cfb0141e4a8f9b2891923ddf68494e2941a3b2ebe52611d71455e11bc909362eb21696c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
e3200b72c42aa4b57aa0c02cd18e03a2

SHA1
064455be4ee65fba41ce7e57bcd6ae2d3763a2fa

SHA256
f4a48be3b74f5c6f80285f43b0fc7d9cb43e0c9e8fac2d23432f9c409d5973fd

SHA512
e0f3de5b2837347e16c5a4c0bb6cf5689d19b2c490003c5d43154198c1d29e11fd2dc52d876246c6d3ec41464e10e1a15f04d5c8b50fd817c6970b391f82e536

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
83253e984206ad9c2c8853d629248956

SHA1
2d2e91afd55683d23893f10402f7fe7effa5b59c

SHA256
be453a2ec1f7a2fe1b1889b17062b73d15b25d466283b8c5c8ffce24d4641f93

SHA512
4fa6a8a3b576b47d204d18feda05a480573c85bb9d5cf87829b0a8e53f1f536e64b818c6c913ba30f485e7bb8b7f63de6e286b7f834326be941daa1f491782a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
37KB

MD5
8953e30180203c4c5a24029ac26b81ae

SHA1
e42985413526f4c5cd5784cb70f96928010f5dd9

SHA256
bbace4dabfb4de8498f0d1fdb3b4a0827b2c21d38c4f0c1017265bab48fe093c

SHA512
a92ee5e8eeb7e13faf25f380a758ace41577f40b23ab431afc8f385c66add011dad09863328a8f194365aabfc11acfacd8ea8184b459d8a86ade7d1e37259a04

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
2413ba84023053e318c32ef429fd43b6

SHA1
0f245bf374f5b3f2afc1c3024a58b71ed0b0ba9d

SHA256
8e4fc9d44eb88310fd19f42ac8e37b840af99706af8d62321f04219599b41fde

SHA512
31b6849e17b1ad3b41d7eddbd4f2d44cac741a7641738fa48c4cfd84763c8616184ea7caa7b87aef297c627c0abf26944095e14f2cc6c4df91eeb41e305d2b0e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
d2375ec256eb32cac2b2dd35ef3d21ef

SHA1
b7189be00d2e9553c567c8ff7df6d3123c56e6b8

SHA256
551bc88a24e01c668cc6dd6cacb07ca1f57af772453bfe8db41e6d0c180b7f63

SHA512
59c8da79e1545fbba4bf0eb581078c19e0e8953895346fe1dd79147ae83b80fbe95310da75cfc992745f2863bce4e63c55223b36bdf7d4b82acdec02d67fc47f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
38KB

MD5
32bc0aabb5f55e32c2612792aa0c5026

SHA1
e48277b5e3e4603a1da42dfbe5221713ddf4a911

SHA256
31201fb3d5690c7d7e7d6fa85f487a0e95ce8713d9b7b8268bc87ca0e341df6e

SHA512
8604304948df7bf25e89bc25cc4442f5f04ffb440292fd7da7d00a2dcf7dedd5340debeb8e89e31309877d3275fc2df34b050b19f0f25c65f822532e24d2c556

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
d890967633342676e7aa92677d62fb13

SHA1
f0309bacb17ed46e7cfe8043f89895c94f6b9563

SHA256
4ad8c586e4e798d71de9d049542345682725830bf64ee24b7ba52169a2d2c2ea

SHA512
5fc690e202290f08154367d26fd578d08bfa8ba43da751ff826a5f10fc67e545e938b48f8f8bcaeea696c314ecdbb1ab95cffd8bee1b17b9e8413b87afaff221

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
0e6e114a13bef5096a9541d9d539aaa1

SHA1
923f15627011faaa29d81c7ccca724176e534267

SHA256
b92626236cab87fd151ec1c9eb820a3b8cdb5a946644ed5040ccb53c26aa257b

SHA512
3f612a753f6e4d7055938711d8591f31b524d8c18a0cc8aa86f5ab03a94ca756a828ed4d33e185b72aaee8e004deef13e3b90f6141a9df9a11923fa22924f6eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
39KB

MD5
2697a4d4e8086ea51fecf0f4a9c74cb6

SHA1
a02b3b20e224122947406b3cfde45c0998ecd93e

SHA256
fa57d493c8725cc1313a97c9ce09464447d7f86ce4c754138385124992b33082

SHA512
97c1cb802d2b3d9fadff192dbf50cd3bd3581c022bb849079cb1895838158ae9fc65e85f0595263f8c256748f69934a7380c3ee951af6d736acb382330cf5da8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
7cc45eafd83e417d1b34086601038640

SHA1
be5a44e4d28f9d2cb1c4afbeed55e29749101a7f

SHA256
cab4864e71b9660893305483d8fe5c4118382a8928b1f8dffc66f1985ebfdeb2

SHA512
e59beafc5060201d9ad97c30944fb634da2a9333fce5aabaaef578fc09def798dd44e13312b7ee400c316d366aa180da0c56ae224013634797e4d4e1b3d68a4a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
8fa67a0cf50e27ce75a52039a3dc2614

SHA1
2875c070e70ef6bd5e36e7fc7cc411711f64306b

SHA256
337646496922e6040330625b3b726f0bbb42d69c9ef6249752a7d1f84691c1ef

SHA512
cf29de683e77c505a91d8c01c8699c6555eabedb5cf7a1323511327b4369b806d2103964829d13c215b73391f4878a13a80e114cb79f1ec5fba2c3de3c3b8226

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
451ed0de284c3db88426e0a88fc08f0a

SHA1
471ab3ff19c68d2df3506b7780b488e1d4d20d4a

SHA256
e237231e4b879ae372ef853fb8f51ec1a35465767d3f996972c3044f6095a0a2

SHA512
e08df84465e81684d2b1441d684220865ebba16796b26e4191b5e5d6c2317fe91cc118d2ca0cdfece3db8e857f7d8ac253aed0e45bf87e58c8026b2b0d0287d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
20KB

MD5
47f80e99656fccfd1721abbd8d79b779

SHA1
b600b905d7eac2b814b06e837b3f6ff5b51d95d1

SHA256
890491db364f107b2ad685e3a5a76a68c38b4203e8a1b3f6d9c16aaa14d41d7d

SHA512
9d5c0c136315f6fdad127600aefdaf84bcfa79791897e6aab662501e10252e6a08f831e495342185623fb9c571cbb9678040713ed2a72f31f210b6629324bc32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
ffe9762a3e7e1512775fef6938227a08

SHA1
4fee3cc6d625bad918eafe2803284555b7b36a56

SHA256
0b53231f639637941e307395e747324067de74eb54aecc7083ce8e97ab225f3f

SHA512
752ad0a4d664fe81ba7eccfe5bd5f5053dcdbad66130dbec65169caac0e89277388f91e820052b63f7c3bfd612951d14ce048d7cd69372c7bd24c2c35fbbb303

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
24KB

MD5
02a5e07483db0b539a1f1498066334aa

SHA1
4a7c6f45805c8b8facc8bd7a06c2eff66e2ff7f4

SHA256
fc9e638a6f6a5464f970a67c5c92c2dd4f225e0b70334125899a25ec238fb723

SHA512
389e263db42972eb7bb2808999304b788340e6de8c00772d8bd8e0b15b7c9de9961ec4ec1c91caa5e766d0e5f2bd834721c1a5f8806d18730ec7e8ac6ac594ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
e31a161e301498d72595076a20ddd224

SHA1
5b8cc2815ab97d28ac142f58ba8f75b3015e7d48

SHA256
027c17df048519f32bbfc72900ceae2ffb857db7672e4b29302ee3daa8319fee

SHA512
ab54c495bbece3c988ccce4c9547345affb665e7b729b62a9bd0b9eaa3346759e0b90a4f462e81e2826afd78a3ab873212327bcfd60ab184837f6146ee752bde

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
199f664b62583a895742df02b27c1c88

SHA1
1cbb64f607e8b7b14ef7306d78526bac85999c33

SHA256
b0d5999ace9bc53e7ecf9b1fec370b2c4ba5294e1fc140fd3c9de9e51fefadf5

SHA512
de383ab49bfa563ac3b56f92a23f7b4799a3223a57d37b7057c7f6d345621ed6d797bdf2b964f7e7fdb9b5cd097066290b6e79f0b280965017dd07b7510ba78a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
0d2e314b8e561c9383a080c817aa1457

SHA1
fd1449d3475c1f20b182234465d0e7948027adad

SHA256
3d9b9dd56536bc4cd42008708a1a7ec4b522aeda6fd843371ae5df003c8a2f9e

SHA512
d1f5822dbe352d73d07bbe71571671bc4a4ba15c38a87f9e76801217f468fbd02ad4a547545d81c2ea3d1dc98f71fe08977f63337693b69418adac4f49db7cca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
30KB

MD5
ffeebc45ff41c10a9bc1d6c2413f28bf

SHA1
f1538255bc98df779428458c79f9d2c04234eaed

SHA256
ef175b7a90bddf8e98fec815dc57056bd9c8cca2703ea57aab7690f85c0626a5

SHA512
26996a56179390988f8c743b108a4b84626b34acffc78a9a13bf92bdd85a46f936ffd888d3327477b42ef1914c72ffdd155d9b7dfd3fea3abbaad295a196618a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
34KB

MD5
8fe3b47fdf0c4382e1c3951001bed645

SHA1
deb16a446c2de4168c7c825ef7666b40c9532c76

SHA256
23b1258ce98878740f8bc03b2c9175628623710073b315718e63fe9749497421

SHA512
3a9026cdc14b9a76eb30fe9f7546137fb0edd31732d11a821e20b91bf24c4532f68b4dd53d272ea13e410f33a3b19124772f5e0b88ca7f33fea865d6c86fa4b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
37KB

MD5
46a25c27bb1c27df38895aaac7da2223

SHA1
354eff4e974c348f79f50cdc3b9aa987d5df1775

SHA256
a4c66f7b21264f243741683733bf24c14868703c11f9218ebfc3a275adb663dc

SHA512
e0d1182e5bb17871670a78865eb2059a7f784e492471a79f1a5f0d2214233efd8fa7d1d86b70cf2332c9575ea5cff2c0b53e92b8afa2c2a117d6bbfd6cc5a0ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
39KB

MD5
ce83be345b059383a3aaf6d24fc7384d

SHA1
fa13199ca2311fd9ae15b11a70e7a901275e968d

SHA256
c0e41c1805b0a0487f307fe900e177b3ec1c78b954a1a4bd91d2b05d37717a30

SHA512
5a9e7f5a209e1d5dc699e11da95ac248c0c3475121433ae0d9bd340688374302af08bf602984d1454cac95133de7122aabfc3356f65c444d4b51a0d46118bd20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
b83cc883579c85879590fc577d551cc6

SHA1
9d9a201598efc546ab2ceac6d8bb2b2a1c1ad671

SHA256
de8e3326f3393c0f186894c2170ce252acb5709005ff949574d3b99cd3776aac

SHA512
925fe6e8cb7988cef8f26d43c5162dc314240ee4cc04069c5ab898ef9ee37dbfa2f85b7b3e2e1b2d40e1d38931f323aeb0b79efe374f6f016d61e37de2b2d12d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
a7acb9d1c47c2213d651d12b09172441

SHA1
3adee2feedd684867b9fd9fe33f4b170fb4e0a00

SHA256
b73f15a27ce1de90e9352677f54a08927af545fda080cd265a1d90b96424a816

SHA512
87cd7788c31a7b396a76cd54383d9917d681f9972aeae2ec042b21e8dcf175fe1c881afe49fc4724c90138e65cd32e43c2aefd1b34a78dcf60a7cc056e1ff187

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\weave\toFetch\tabs.json.tmp

Filesize
10B

MD5
f20674a0751f58bbd67ada26a34ad922

SHA1
72a8da9e69d207c3b03adcd315cab704d55d5d5f

SHA256
8f05bafd61f29998ca102b333f853628502d4e45d53cff41148d6dd15f011792

SHA512
2bce112a766304daa2725740622d2afb6fe2221b242e4cb0276a8665d631109fbd498a57ca43f9ca67b14e52402abe900f5bac9502eac819a6617d133c1ba6a3

Download Submit
C:\Users\Admin\DOWNLO~1\z.zip

Filesize
8KB

MD5
63ee4412b95d7ad64c54b4ba673470a7

SHA1
1cf423c6c2c6299e68e1927305a3057af9b3ce06

SHA256
44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268

SHA512
7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7

Download Submit
C:\Users\Admin\Downloads\VlFRKyx9.zip.part

Filesize
239KB

MD5
3ad6374a3558149d09d74e6af72344e3

SHA1
e7be9f22578027fc0b6ddb94c09b245ee8ce1620

SHA256
86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff

SHA512
21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720

Download Submit
C:\Users\Admin\Downloads\memz.bat

Filesize
13KB

MD5
44fbd58c401a7786da2e8b6a6291379e

SHA1
9dbfd08fa557d9dce79911eb4bbddb2008d4f53f

SHA256
d8b47727ea05305ad396977b336c3bfc86ae122cdde01976fa9b0c3a7c2d3f24

SHA512
c369f749ba3ef4e463524b3483c4250311c2a19414a49dc86c052cac9c9d0a3b05dbdbf71b854ccf6f46abc46e439f9264c7672e22a0c3004b7d679e26a56de3

Download Submit
C:\Users\Admin\Downloads\x

Filesize
4KB

MD5
1c604b4fef887029e9a3fa342fa908fa

SHA1
27bd3753c25ea4ea49c7c7b564a1fd641bd0eb23

SHA256
d6a4b048b5f28963aeac2e56db9ceeb4607c068cbe06c041631b9c878964330e

SHA512
ff804c5b76e5aeb6efbd6a7650d5614e922ab605a45873aaeec0ae898e1a7275dc4ec862cd0bef20998e1b741b2add2846e4cfa9c0fcaaf197c4c50aa934cdf8

Download Submit
C:\Users\Admin\Downloads\x

Filesize
11KB

MD5
1882f3dd051e401349f1af58d55b0a37

SHA1
6b0875f9e3164f3a9f21c1ec36748a7243515b47

SHA256
3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0

SHA512
fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf

Download Submit
C:\Users\Admin\Downloads\x.js

Filesize
448B

MD5
8eec8704d2a7bc80b95b7460c06f4854

SHA1
1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326

SHA256
aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596

SHA512
e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\PIPE\samr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3128-6117-0x000000001C340000-0x000000001C3B2000-memory.dmp

Filesize
456KB

Download
memory/3592-7107-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/3592-7106-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/3724-4029-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download