Analysis
-
max time kernel
1799s -
max time network
1797s -
platform
windows11-21h2_x64 -
resource
win11-20240802-fr -
resource tags
arch:x64arch:x86image:win11-20240802-frlocale:fr-fros:windows11-21h2-x64systemwindows -
submitted
08-09-2024 11:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://getmyfilenow.com/lp?id=Sycthex_79570571
Resource
win11-20240802-fr
General
-
Target
https://getmyfilenow.com/lp?id=Sycthex_79570571
Malware Config
Signatures
-
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AviraOptimizerHost\ImagePath = "\"C:\\Program Files (x86)\\Avira\\Optimizer Host\\Avira.OptimizerHost.exe\"" Avira.OptimizerHost.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 31 IoCs
pid Process 3828 Sycthex_79570571.exe 72 setup79570571.exe 3500 setup79570571.exe 4244 OfferInstaller.exe 2012 OperaGX.exe 4908 setup.exe 1260 setup.exe 3028 setup.exe 1032 setup.exe 3152 setup.exe 4500 avira__sptl1___lavasoft.exe 2404 Avira.Spotlight.Bootstrapper.exe 4584 ACSSignedIC.exe 2800 avira_spotlight_setup_lavasoft.exe 5968 avira_spotlight_setup_lavasoft.tmp 3952 avira__sptl1___lavasoft.exe 2720 Avira.Spotlight.Bootstrapper.exe 5124 ACSSignedIC.exe 5572 Avira.Spotlight.Bootstrapper.ReportingTool.exe 5628 avira_system_speedup.exe 1336 avira_system_speedup.tmp 5340 Avira.SystemSpeedup.Core.Common.Starter.exe 5204 Avira.SystemSpeedup.Maintenance.exe 5244 Avira.SystemSpeedup.Maintenance.exe 5572 Avira_Optimizer_Host.exe 6000 Avira_Optimizer_Host.tmp 5680 Avira.OptimizerHost.exe 2868 Avira.OptimizerHost.exe 6116 Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe 2108 assistant_installer.exe 4220 assistant_installer.exe -
Loads dropped DLL 64 IoCs
pid Process 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe 3500 setup79570571.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 64 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Check Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\BootOptimizer\TaskSchedulerDelayTimeInMin Avira.SystemSpeedup.Maintenance.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "77" Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Security\ConnectServices Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Speedup\BootOptimizer avira_system_speedup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Adress Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\Branch avira_system_speedup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\LogToFile Avira.SystemSpeedup.Maintenance.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir setup79570571.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\GeneralSettings\Installed = "2024-09-08 11:44:36" avira_spotlight_setup_lavasoft.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\UserInterface\SilentModeTimeout = "7200" avira_system_speedup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\LicenseType Avira.SystemSpeedup.Maintenance.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "78" Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\Features\CascadingIpms = "false" avira_spotlight_setup_lavasoft.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\Features\IntegratedIntruderProtection = "true" avira_spotlight_setup_lavasoft.tmp Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Speedup\Power Profiles avira_system_speedup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\Download avira_system_speedup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\OptimizerHost\LogLevel Avira.OptimizerHost.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Speedup\MyA avira_system_speedup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Type = 05004a0054005400 Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallAntivirus Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "79" Avira.Spotlight.Bootstrapper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\BootOptimizer\StartDelay Avira.SystemSpeedup.Maintenance.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Security\Features Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "10" Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Speedup\DesktopCleaner avira_system_speedup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Name Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\BootOptimizer\CleanupDelayed Avira.SystemSpeedup.Maintenance.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "49" Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Speedup\MyA Avira.SystemSpeedup.Maintenance.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Date = 53000800010000001a00540053004e0005005500 Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\UILanguage Avira.SystemSpeedup.Maintenance.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version setup79570571.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\OptimizerHost avira_system_speedup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\UILanguage Avira.SystemSpeedup.Maintenance.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\UILanguage = "en-us" avira_system_speedup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "72" Avira.Spotlight.Bootstrapper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Serial Avira.SystemSpeedup.Maintenance.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\DownloadSource = "lavasoft" avira_spotlight_setup_lavasoft.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\Features\NcpSmartScanEventBasedMessagingEnabled avira_spotlight_setup_lavasoft.tmp Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "68" Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast setup79570571.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "60" Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\OptimizerHost\Version = "1.3.0.63" Avira_Optimizer_Host.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Version Avira.SystemSpeedup.Maintenance.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\Features Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security avira_spotlight_setup_lavasoft.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\Expiration Avira.SystemSpeedup.Maintenance.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Speedup\MyA Avira.SystemSpeedup.Maintenance.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Date = 53000800010000001a00540053004e0005005500 Avira.SystemSpeedup.Maintenance.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Name Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\LicenseState Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\ExtendedProgressLog Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\MixpanelCommonProperties = "AAEAAAD/////AQAAAAAAAAAEAQAAAOIBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuRGljdGlvbmFyeWAyW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldLFtTeXN0ZW0uT2JqZWN0LCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAHVmVyc2lvbghDb21wYXJlcghIYXNoU2l6ZQ1LZXlWYWx1ZVBhaXJzAAMAAwiSAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkdlbmVyaWNFcXVhbGl0eUNvbXBhcmVyYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dCOYBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuS2V5VmFsdWVQYWlyYDJbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dW10TAAAACQIAAAAlAAAACQMAAAAEAgAAAJIBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuR2VuZXJpY0VxdWFsaXR5Q29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0AAAAABwMAAAAAAQAAABMAAAAD5AFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5LZXlWYWx1ZVBhaXJgMltbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLk9iamVjdCwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0E/P///+QBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuS2V5VmFsdWVQYWlyYDJbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dAgAAAANrZXkFdmFsdWUBAgYFAAAAAyRvcwYGAAAAB1dpbmRvd3MB+f////z///8GCAAAAAskb3NfdmVyc2lvbgYJAAAACjEwLjAuMjIwMDAB9v////z///8GCwAAAAtPcyBMYW5ndWFnZQYMAAAABWVuLVVTAfP////8////Bg4AAAALT3MgUGxhdGZvcm0GDwAAAAN4NjQB8P////z///8GEQAAAAxzaGEyX3N1cHBvcnQIAQEB7v////z///8GEwAAABYuTkVUIEZyYW1ld29yayBWZXJzaW9uCRQAAAAB6/////z///8GFgAAAApQcm9jZXNzIElECAigCgAAAen////8////BhgAAAASQ29tcGF0aWJpbGl0eSBNb2RlCRkAAAAB5v////z///8GGwAAAAthY3Nfc3VwcG9ydAgBAQHk/////P///wYdAAAADUV4cGVyaW1lbnRJZHMJHgAAAAHh/////P///wYgAAAAEEV4cGVyaW1lbnRHcm91cHMJIQAAAAHe/////P///wYjAAAAD0Rvd25sb2FkIFNvdXJjZQYkAAAACGxhdmFzb2Z0Adv////8////BiYAAAAJQnVuZGxlIElEBicAAAAFc3B0bDEB2P////z///8GKQAAABRCb290c3RyYXBwZXIgVmVyc2lvbgYqAAAACjEuMC40OS43MjcB1f////z///8GLAAAAAZBY3Rpb24GLQAAABdSZWdpc3RlckZhbGxiYWNrVXBkYXRlcgHS/////P///wYvAAAAB1J1bk1vZGUGMAAAAA5SZXF1aXJlUmVzdGFydAHP/////P///wYyAAAABlNpbGVudAgBAAHN/////P///wY0AAAAClNlc3Npb24gSUQGNQAAACA1MjEyYTdjNmJlNTQ0MDhmYTI3YWQyMmNjMzJlNTI3OAHK/////P///wY3AAAAElNwb3RsaWdodCBMYW5ndWFnZQkMAAAABBQAAAAOU3lzdGVtLlZlcnNpb24EAAAABl9NYWpvcgZfTWlub3IGX0J1aWxkCV9SZXZpc2lvbgAAAAAICAgIBAAAAAgAAAD//////////xEZAAAAAgAAAAY5AAAAEkRldGVjdG9yc0FwcEhlYWx0aAY6AAAACUluc3RhbGxlchEeAAAAAQAAAAY7AAAAFHNwb3RsaWdodG9uYm9hcmRpbmcyESEAAAABAAAABjwAAAAHY29udHJvbAs=" Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\OptimizerHost Avira.OptimizerHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\MultipleInstances Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\UseAcceptanceBackend Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\BootOptimizer\Version Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallSecureBrowser Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira avira_spotlight_setup_lavasoft.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\UserInterface Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Optimizer\General avira_system_speedup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\BootOptimizer\CalculateBootTime avira_system_speedup.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccbpbkebodcjkknkfkpmfeciinhidaeh\7.19.0.588_0\manifest.json chrome.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini Avira.SystemSpeedup.Core.Common.Starter.exe -
Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: setup.exe File opened (read-only) \??\F: setup.exe File opened (read-only) \??\F: Avira.SystemSpeedup.Maintenance.exe File opened (read-only) \??\D: setup.exe File opened (read-only) \??\F: setup.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_3A926AE3653F6808623E655D67F31779 Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_3A926AE3653F6808623E655D67F31779 Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 Avira.OptimizerHost.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2404 tasklist.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Avira\Security\is-31HDK.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\es-ES\is-FUNIT.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-DT1NA.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-UMCCS.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-T7IB3.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\it-IT\is-A17TQ.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\System Speedup\is-5R434.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\Security\is-HOITH.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-UL97V.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-IUBD1.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-BVC8D.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-4G4RI.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\en-US\is-1SSKC.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\System Speedup\is-IEN9O.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\Security\is-72BLB.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-65F3T.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\System Speedup\zh-TW\is-DUDC0.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\Security\is-29CAC.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-1Q4CL.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\System Speedup\is-CAG2A.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\System Speedup\is-NOMK8.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\System Speedup\x86\is-QOAK3.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\System Speedup\sdf\is-OBLND.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\System Speedup\is-BKJI6.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\Security\is-BKROS.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-8FC8V.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-PAM7B.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-FLPPO.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-BOBBR.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-7LGE6.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-142M1.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-TOON2.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-VC5SL.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\System Speedup\sdf\is-VCH1L.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\Security\zh-TW\is-KFKR0.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\System Speedup\fr-FR\is-BIANV.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\Security\is-EIGPU.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-QC9S3.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-2MVLV.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\Html\is-QPD10.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\System Speedup\is-DT4TS.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\Security\is-N414L.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-9ATPJ.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-5MV8T.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\System Speedup\sdf\is-ECPP9.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\Security\is-POEG6.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Optimizer Host\is-RPOBQ.tmp Avira_Optimizer_Host.tmp File created C:\Program Files (x86)\Avira\Security\is-NFUB4.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\Swu\is-LLHH6.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\is-M6D84.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\unins000.msg avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-D5O5B.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-JQSA9.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-Q97FP.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\System Speedup\zh-CN\is-FEPS3.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\Security\is-U8H9G.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-HFQ49.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-5OTPR.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\System Speedup\is-4B96K.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\System Speedup\tr-TR\is-M9LL7.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\Security\is-T7E7T.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\is-K5ME5.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\en-US\is-LGFLE.tmp avira_spotlight_setup_lavasoft.tmp File created C:\Program Files (x86)\Avira\Security\Swu\is-CMG78.tmp avira_spotlight_setup_lavasoft.tmp -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Fonts\is-QJV0D.tmp avira_system_speedup.tmp File opened for modification C:\Windows\SystemTemp chrome.exe File opened for modification C:\Windows\SystemTemp chrome.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 6060 sc.exe 5920 sc.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\Sycthex_79570571.exe:Zone.Identifier chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 48 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.SystemSpeedup.Maintenance.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OperaGX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira__sptl1___lavasoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.OptimizerHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.SystemSpeedup.Core.Common.Starter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_spotlight_setup_lavasoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_system_speedup.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.OptimizerHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sycthex_79570571.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup79570571.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACSSignedIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_system_speedup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira_Optimizer_Host.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assistant_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.Spotlight.Bootstrapper.ReportingTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.SystemSpeedup.Maintenance.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira_Optimizer_Host.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assistant_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACSSignedIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_spotlight_setup_lavasoft.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup79570571.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OfferInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira__sptl1___lavasoft.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x000500000002ab72-3735.dat nsis_installer_1 behavioral1/files/0x000500000002ab72-3735.dat nsis_installer_2 -
Delays execution with timeout.exe 1 IoCs
pid Process 1332 timeout.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols = "10368" avira_system_speedup.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings avira_system_speedup.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133702693671206461" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs Avira.OptimizerHost.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Avira/System Speedup/Avira.SystemSpeedup.UI.ShellExtension.DLL" RegAsm.exe Set value (int) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Avira.Spotlight.Bootstrapper.exe avira__sptl1___lavasoft.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79} avira_system_speedup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\SystemSpeedupDesktopMenu\ = "{0cab5786-30e8-3185-9b3b-ccefbf1b8afe}" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Avira/System Speedup/Avira.SystemSpeedup.UI.ShellExtension.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Avira/System Speedup/Avira.SystemSpeedup.UI.ShellExtension.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\InprocServer32\RuntimeVersion = "v4.0.30319" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32 RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\InprocServer32\ThreadingModel = "Both" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\InprocServer32\1.0.0.0 RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupDesktopMenu RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{1A29DF46-C591-4188-AA93-1FF867EF6286} avira_system_speedup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\ = "Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupFilesMenu" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files (x86)/Avira/System Speedup/Avira.SystemSpeedup.UI.ShellExtension.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\ = "Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupFoldersMenu" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupFilesMenu\CLSID\ = "{14CB2BD0-2375-3D10-9B5D-5E18865C8959}" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupDesktopMenu\CLSID\ = "{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files (x86)/Avira/System Speedup/Avira.SystemSpeedup.UI.ShellExtension.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\1.0.0.0\Class = "Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupFoldersMenu" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\ProgId RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupFilesMenu\ = "Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupFilesMenu" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\InprocServer32\1.0.0.0 RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupFoldersMenu\CLSID RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\InprocServer32\Assembly = "Avira.SystemSpeedup.UI.ShellExtension, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\ProgId\ = "Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupDesktopMenu" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\Class = "Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupFoldersMenu" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\Implemented Categories RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\InprocServer32\ThreadingModel = "Both" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\InprocServer32\1.0.0.0\Class = "Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupDesktopMenu" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\InprocServer32\ = "mscoree.dll" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files (x86)/Avira/System Speedup/Avira.SystemSpeedup.UI.ShellExtension.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}\ExperimentId = "spotlightonboarding2" Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\ShellEx\ContextMenuHandlers\SystemSpeedupFilesMenu RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\ = "mscoree.dll" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\InprocServer32\1.0.0.0 RegAsm.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\ = "mscoree.dll" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files (x86)/Avira/System Speedup/Avira.SystemSpeedup.UI.ShellExtension.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Avira.Spotlight.Bootstrapper.exe avira__sptl1___lavasoft.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\1.0.0.0 RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\InprocServer32\1.0.0.0\Assembly = "Avira.SystemSpeedup.UI.ShellExtension, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\ProgId\ = "Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupFoldersMenu" RegAsm.exe Set value (data) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Avira.Spotlight.Bootstrapper.exe\NoStartPage = "0" avira__sptl1___lavasoft.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE} RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\ProgId RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Avira/System Speedup/Avira.SystemSpeedup.UI.ShellExtension.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\ = "Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupDesktopMenu" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\ProgId RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\InprocServer32\ThreadingModel = "Both" RegAsm.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\RuntimeVersion = "v4.0.30319" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\InprocServer32 RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\SystemSpeedupDesktopMenu\ = "{0cab5786-30e8-3185-9b3b-ccefbf1b8afe}" RegAsm.exe Key created \REGISTRY\MACHINE\Software\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79} Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\ThreadingModel = "Both" RegAsm.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f2000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b03000000010000001400000002faf3e291435468607857694df5e45b68851868140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e40f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b03000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 0f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343120000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a00300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 19000000010000001000000091fad483f14848a8a69b18b805cdbb3a0f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343114000000010000001400000055e481d11180bed889b908a331f9a1240916b97020000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 03000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e40f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 setup79570571.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343120000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a03000000010000001400000002faf3e291435468607857694df5e45b688518680f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c0000000100000004000000001000000400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf50f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f1030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 setup79570571.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 14000000010000001400000055e481d11180bed889b908a331f9a1240916b970030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d34310f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d820000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 setup79570571.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Sycthex_79570571.exe:Zone.Identifier chrome.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4176 NOTEPAD.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1408 schtasks.exe 1980 schtasks.exe 2892 schtasks.exe 1104 schtasks.exe 2000 schtasks.exe 5260 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 72 setup79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 4244 OfferInstaller.exe 4244 OfferInstaller.exe 4244 OfferInstaller.exe 4244 OfferInstaller.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeDebugPrivilege 72 setup79570571.exe Token: SeDebugPrivilege 4244 OfferInstaller.exe Token: SeDebugPrivilege 2404 tasklist.exe Token: SeShutdownPrivilege 1892 chrome.exe Token: SeCreatePagefilePrivilege 1892 chrome.exe Token: SeShutdownPrivilege 1892 chrome.exe Token: SeCreatePagefilePrivilege 1892 chrome.exe Token: SeShutdownPrivilege 1892 chrome.exe Token: SeCreatePagefilePrivilege 1892 chrome.exe Token: SeShutdownPrivilege 1892 chrome.exe Token: SeCreatePagefilePrivilege 1892 chrome.exe Token: SeShutdownPrivilege 1892 chrome.exe Token: SeCreatePagefilePrivilege 1892 chrome.exe Token: SeShutdownPrivilege 1892 chrome.exe Token: SeCreatePagefilePrivilege 1892 chrome.exe Token: SeShutdownPrivilege 1892 chrome.exe Token: SeCreatePagefilePrivilege 1892 chrome.exe Token: SeShutdownPrivilege 1892 chrome.exe Token: SeCreatePagefilePrivilege 1892 chrome.exe Token: SeShutdownPrivilege 1892 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 3828 Sycthex_79570571.exe 3828 Sycthex_79570571.exe 72 setup79570571.exe 3828 Sycthex_79570571.exe 2012 OperaGX.exe 4908 setup.exe 1260 setup.exe 3028 setup.exe 1032 setup.exe 3152 setup.exe 2124 chrome.exe 4500 avira__sptl1___lavasoft.exe 2800 avira_spotlight_setup_lavasoft.exe 5968 avira_spotlight_setup_lavasoft.tmp 3952 avira__sptl1___lavasoft.exe 5628 avira_system_speedup.exe 1336 avira_system_speedup.tmp 5892 RegAsm.exe 5572 Avira_Optimizer_Host.exe 6000 Avira_Optimizer_Host.tmp 5680 Avira.OptimizerHost.exe 6116 Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe 2108 assistant_installer.exe 4220 assistant_installer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 1092 4796 chrome.exe 79 PID 4796 wrote to memory of 1092 4796 chrome.exe 79 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 3876 4796 chrome.exe 81 PID 4796 wrote to memory of 4548 4796 chrome.exe 82 PID 4796 wrote to memory of 4548 4796 chrome.exe 82 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83 PID 4796 wrote to memory of 2500 4796 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getmyfilenow.com/lp?id=Sycthex_795705711⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff93d1cc40,0x7fff93d1cc4c,0x7fff93d1cc582⤵PID:1092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,8607808337913414340,16048832341301883685,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1940 /prefetch:22⤵PID:3876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1780,i,8607808337913414340,16048832341301883685,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2136 /prefetch:32⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2376,i,8607808337913414340,16048832341301883685,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2372 /prefetch:82⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3068,i,8607808337913414340,16048832341301883685,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3116 /prefetch:12⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,8607808337913414340,16048832341301883685,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:3708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4496,i,8607808337913414340,16048832341301883685,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4508 /prefetch:82⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5040,i,8607808337913414340,16048832341301883685,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5060 /prefetch:82⤵PID:3912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5076,i,8607808337913414340,16048832341301883685,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5232 /prefetch:82⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,8607808337913414340,16048832341301883685,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5028 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:4100
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3200
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3016
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1332
-
C:\Users\Admin\Downloads\Sycthex_79570571.exe"C:\Users\Admin\Downloads\Sycthex_79570571.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3828 -
C:\Users\Admin\AppData\Local\setup79570571.exeC:\Users\Admin\AppData\Local\setup79570571.exe hhwnd=197306 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-yJD2u2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:72 -
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\avira__sptl1___lavasoft.exe"avira__sptl1___lavasoft.exe" Silent=true AcceptEula=true LaunchUi=true4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\.CR.2956\Avira.Spotlight.Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\.CR.2956\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.2956\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira__sptl1___lavasoft.exe Silent=true AcceptEula=true LaunchUi=true5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\.CR.2956\ACSSignedIC.exe"C:\Users\Admin\AppData\Local\Temp\.CR.2956\ACSSignedIC.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4584
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.2956\90c933ce-738b-4c2a-b609-9e6e9453295a\avira_spotlight_setup_lavasoft.exe"C:\Users\Admin\AppData\Local\Temp\.CR.2956\90c933ce-738b-4c2a-b609-9e6e9453295a\avira_spotlight_setup_lavasoft.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20240908114434590.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP /LANGUAGE=en-us /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\is-DOA3A.tmp\avira_spotlight_setup_lavasoft.tmp"C:\Users\Admin\AppData\Local\Temp\is-DOA3A.tmp\avira_spotlight_setup_lavasoft.tmp" /SL5="$F003C,34139612,924672,C:\Users\Admin\AppData\Local\Temp\.CR.2956\90c933ce-738b-4c2a-b609-9e6e9453295a\avira_spotlight_setup_lavasoft.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20240908114434590.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP /LANGUAGE=en-us /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V47⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5968 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create AviraSecurityUpdater DisplayName= "Avira Security Updater" binPath= "\"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe\"" start= delayed-auto8⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:6060
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" description AviraSecurityUpdater "Avira Security Updater"8⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5920
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Update /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-C787Q.tmp\UpdateFallbackTask.xml"8⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1980
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Service_SCM_Watchdog /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-C787Q.tmp\WatchdogServiceControlManagerTimeout.xml"8⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2892
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Systray /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-C787Q.tmp\SystrayAutostart.xml"8⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1104
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Maintenance /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-C787Q.tmp\MaintenanceTask.xml"8⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2000
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.2956\44bfc573-88b3-4954-bd91-af2d44edc40c\avira__sptl1___lavasoft.exe"C:\Users\Admin\AppData\Local\Temp\.CR.2956\44bfc573-88b3-4954-bd91-af2d44edc40c\avira__sptl1___lavasoft.exe" Action=RegisterFallbackUpdater AllowMultipleInstances=true UnpackInCurrentDirectory=true6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\.CR.2956\44bfc573-88b3-4954-bd91-af2d44edc40c\.CR.32628\Avira.Spotlight.Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\.CR.2956\44bfc573-88b3-4954-bd91-af2d44edc40c\.CR.32628\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.2956\44bfc573-88b3-4954-bd91-af2d44edc40c\.CR.32628\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira__sptl1___lavasoft.exe Action=RegisterFallbackUpdater AllowMultipleInstances=true7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\.CR.2956\44bfc573-88b3-4954-bd91-af2d44edc40c\.CR.32628\ACSSignedIC.exe"C:\Users\Admin\AppData\Local\Temp\.CR.2956\44bfc573-88b3-4954-bd91-af2d44edc40c\.CR.32628\ACSSignedIC.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5124
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN "Avira_Security_Installation"7⤵
- System Location Discovery: System Language Discovery
PID:5244
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.2956\44bfc573-88b3-4954-bd91-af2d44edc40c\.CR.32628\Avira.Spotlight.Bootstrapper.ReportingTool.exe"C:\Users\Admin\AppData\Local\Temp\.CR.2956\44bfc573-88b3-4954-bd91-af2d44edc40c\.CR.32628\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackUnsentEvents7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5572
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.2956\0dbc9385-f60d-41de-8f40-721e9b13b545\avira_system_speedup.exe"C:\Users\Admin\AppData\Local\Temp\.CR.2956\0dbc9385-f60d-41de-8f40-721e9b13b545\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG="C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20240908114448265.log" /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=en-us /NOSTART /NORESTART /bundle=sptl1 /download=lavasoft /Spotlight6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\is-285II.tmp\avira_system_speedup.tmp"C:\Users\Admin\AppData\Local\Temp\is-285II.tmp\avira_system_speedup.tmp" /SL5="$50280,35699068,916992,C:\Users\Admin\AppData\Local\Temp\.CR.2956\0dbc9385-f60d-41de-8f40-721e9b13b545\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG="C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20240908114448265.log" /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=en-us /NOSTART /NORESTART /bundle=sptl1 /download=lavasoft /Spotlight7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1336 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /F /TN AviraSystemSpeedupRemoval8⤵
- System Location Discovery: System Language Discovery
PID:5984
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo8⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5892
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo8⤵
- Modifies registry class
PID:1760
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe" -umh8⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
PID:5340
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\.CR.2956\0dbc9385-f60d-41de-8f40-721e9b13b545\avira_system_speedup.exe" "C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe"8⤵
- System Location Discovery: System Language Discovery
PID:5192
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR "\"C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe\" /VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST8⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5260
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -validatelicense8⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
PID:5204
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -initbootoptimizer8⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5244
-
-
C:\Users\Admin\AppData\Local\Temp\is-A11KN.tmp\Avira_Optimizer_Host.exe"C:\Users\Admin\AppData\Local\Temp\is-A11KN.tmp\Avira_Optimizer_Host.exe" /VERYSILENT8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\is-FA7PG.tmp\Avira_Optimizer_Host.tmp"C:\Users\Admin\AppData\Local\Temp\is-FA7PG.tmp\Avira_Optimizer_Host.tmp" /SL5="$40356,1552217,832512,C:\Users\Admin\AppData\Local\Temp\is-A11KN.tmp\Avira_Optimizer_Host.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6000 -
C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe" /Install /Silent10⤵
- Sets service image path in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5680
-
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /Xml "C:\Users\Admin\AppData\Local\Temp\.CR.18745\Avira_Security_Installation.xml" /F /TN "Avira_Security_Installation"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1408
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""3⤵
- System Location Discovery: System Language Discovery
PID:684 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 72" /fo csv4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Windows\SysWOW64\find.exefind /I "72"4⤵
- System Location Discovery: System Language Discovery
PID:4832
-
-
C:\Windows\SysWOW64\timeout.exetimeout 54⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1332
-
-
-
-
C:\Users\Admin\AppData\Local\setup79570571.exeC:\Users\Admin\AppData\Local\setup79570571.exe hready2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3500
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt2⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:4176
-
-
C:\Users\Admin\AppData\Local\OperaGX.exeC:\Users\Admin\AppData\Local\OperaGX.exe --silent --allusers=02⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\7zSCD742F38\setup.exeC:\Users\Admin\AppData\Local\Temp\7zSCD742F38\setup.exe --silent --allusers=0 --server-tracking-blob=N2UxZjVhMmVjNmQzZDIwMjE2YmExYWY5NzRiMTU2ODQ0NGU1ZTAwN2JiNjhjMWVkOTQyNWE2YWM4OTFkOTRiNzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD0yYzQwNDI2ODk1Nzc0MTU2ODczNmFkMTkxM2MwNTZmOSZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInRpbWVzdGFtcCI6IjE3MjU3OTU4MTAuMjczNiIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdPVzY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfMzU3NSIsImNvbnRlbnQiOiIzNTc1X0ZpbGVETSIsImlkIjoiMmM0MDQyNjg5NTc3NDE1Njg3MzZhZDE5MTNjMDU2ZjkiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI5YmJkZDE1NS0yNDBjLTRjNjQtOWJlMi01NmY4ODY1YmE3MDMifQ==3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\7zSCD742F38\setup.exeC:\Users\Admin\AppData\Local\Temp\7zSCD742F38\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.115 --initial-client-data=0x338,0x33c,0x340,0x334,0x344,0x6cc31b54,0x6cc31b60,0x6cc31b6c4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1260
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3028
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCD742F38\setup.exe"C:\Users\Admin\AppData\Local\Temp\7zSCD742F38\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4908 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240908114334" --session-guid=ddc1f299-5c68-4cc6-ba0b-506fc9c569c7 --server-tracking-blob=YjI4M2U4MmRkNGViMDVjYTNhOTYwNzI4OTE5YjlhYzM0MzAxZGZhZGJiNWYzODY0YjljYjEzNGEwYmQ1NjFhZjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD0yYzQwNDI2ODk1Nzc0MTU2ODczNmFkMTkxM2MwNTZmOSZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcyNTc5NTgxMC4yNzM2IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1BCNV8zNTc1IiwiY29udGVudCI6IjM1NzVfRmlsZURNIiwiaWQiOiIyYzQwNDI2ODk1Nzc0MTU2ODczNmFkMTkxM2MwNTZmOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6IjliYmRkMTU1LTI0MGMtNGM2NC05YmUyLTU2Zjg4NjViYTcwMyJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6C060000000000004⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\7zSCD742F38\setup.exeC:\Users\Admin\AppData\Local\Temp\7zSCD742F38\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.115 --initial-client-data=0x32c,0x330,0x334,0x308,0x344,0x6be11b54,0x6be11b60,0x6be11b6c5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3152
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409081143343\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409081143343\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6116
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409081143343\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409081143343\assistant\assistant_installer.exe" --version4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409081143343\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409081143343\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x754f48,0x754f58,0x754f645⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4220
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops Chrome extension
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1892 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff93d1cc40,0x7fff93d1cc4c,0x7fff93d1cc582⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1932 /prefetch:22⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1752,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2060 /prefetch:32⤵PID:1356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2196 /prefetch:82⤵PID:828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3096 /prefetch:12⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3148 /prefetch:12⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3524,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4468 /prefetch:12⤵PID:3912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4760,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4772 /prefetch:82⤵PID:924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4816 /prefetch:82⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5108,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3140,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3076 /prefetch:12⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5100,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4772,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:3884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3220,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:3196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5088,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5344 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5504,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5548,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3080 /prefetch:82⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5380,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5384 /prefetch:82⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5568,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5556 /prefetch:82⤵PID:2964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5388 /prefetch:82⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5280,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4368 /prefetch:82⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5392,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5400 /prefetch:82⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5364,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5608 /prefetch:12⤵PID:5372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5428,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:5388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5456,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5352 /prefetch:82⤵PID:5576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3068,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5600 /prefetch:82⤵PID:5648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4956,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:5692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5592,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5704 /prefetch:82⤵PID:5744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5436,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5852 /prefetch:82⤵PID:5772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5580,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6004 /prefetch:82⤵PID:5840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6160,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5996 /prefetch:82⤵PID:2264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5844,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6276 /prefetch:82⤵PID:3252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=5396,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:5412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6372,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6176 /prefetch:12⤵PID:5636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6548,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6568 /prefetch:12⤵PID:1272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4820,i,10522109398143727369,11969102391602600610,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6572 /prefetch:82⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2844
-
C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2868
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD5733c527b3d665379f40d4b5529e07635
SHA173de20be7ae971e5dbf8dea2c459c5e9393a0aa2
SHA256aeabbb8386201106dc8445c8bf739d786b28ffd52a9095ebb19de74957afaaeb
SHA512a97d71e4bd51bf8d8bcbe04b0c1afb6ca4a573b2ff75a5b1fb0d8faab5746ee569b9d315ed9f0a2ef21fc431eb835f7e92deb81019c51c2dca5d1612951b8f8e
-
Filesize
451KB
MD55d182dd686856cec5d921394d873c9ff
SHA1c82281f6818c020d1018367127c81064eb9c0e37
SHA256957ad1c36bf814d63d4eba5de433a05c1195df89b49689e5a90525037957ce62
SHA5125611904d857228baa3d49d114aed6ef5b94eea22d84988022ce15d87e92c657122966cbe4db86c8c302d068019259ffecbe470b9a356922ec1d4cc9a68a3bf91
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\System.Runtime.CompilerServices.Unsafe.dll
Filesize18KB
MD5df14f95f8570b4517dce2f53fc86f57c
SHA17375b8fe21ec3f0805045a426fef5ad0edad78d3
SHA2566fdfa8bd1d67c0f57006c4ac6dcc1a1273f95a3ef9c761765793d1e3236c4c70
SHA5128acd89a9d60768238d17aec570eceb32466a5a46d7db8d8e5eca3a26e4a547c9560b3808627efa09e03a954cd72aea421b45b7145d2903fc4755997eb8bd299d
-
Filesize
27KB
MD574ef632858b9a82d53600b4348d011bb
SHA15788e7b8d118f3682e916cfcecb1abc2430ce847
SHA25663a7e8bb4d827e8bbcabc182ff9a1fbdaf838d40e3a3dbda3a6725b1731ca71e
SHA512c01e6037d67d1670cac64f423d0e585a0134cd84af886671517f292ae166437e56fc2dfa08cb33fba268f9b93234f39f6b274b6ffd990840abc87c233a42b905
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\de-DE\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD55c27bd4765eb0a93a098933ea14c3344
SHA1d52b79309152057ad0c5c4d5685f2a55f4fe83e3
SHA256db0fbbbd09020025f3bd03794d6d37d1f5957df52c7fb1c8487afa616f744fd5
SHA5123429def0427ef139419acfe443a0b3cd3d4a37c8cf68c26df96ad1537b1dcc6863bf6a624353cc1b85a72f2e6efb615294072bffa0f1e43469981c55b444283a
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\en-US\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD587935d3c3c2063d1302638ef976f4d09
SHA1f1b5fbe0057aa9b06b3afab2c62ddee98ee95a69
SHA256d03e2b10a9c11fbdb7a9c726b18638bfd09dd40675360de50235b3731e69b051
SHA512f6a5d364d8f4f71d4965cb6306e953ae525d708f6f04048dad42854dad766f6c7c06c335517f66b5cf40f714b2fd1bb2301093c77c2220c1515025f28a0b8694
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\es-ES\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD55342025db29e883a027dd9eff6129890
SHA15eb6e9ce2cd7869d7a40deb80ec96c6966a12b75
SHA256d7fbe50e58d918c0fabade308df578b7464fcc7a202a642ba05a720f003742b7
SHA512c3be6fdeb0b16c0a6935730f0f316d34c9fb1f7efc897e23f904ada3113e0c235f4cdae7da6b2dffe6c9e293d1a131b5e6c0cc18e141163581a8f478a168f5b9
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\fr-FR\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD50999a32e532e150ab3796e09f2621e7e
SHA1a442809dde5420cbe490e07453e382ee78c59e12
SHA256eafd487bc3c1f33ebb9095a90b345e383a6f2cf2f91a43c1d635dfff9710754d
SHA5120b8253b83c1af7476faed34f3a558591e4ea54722e28eb3bc55e3b9d8be65d158f9c72e2689b962dfcd65662cda4bac05240bf20fe5252eb4b64212106779362
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\it-IT\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5cb7c69e5f3b22d63e73d969800cdacd5
SHA1fc0415709b84dc293aefdc9638c05ab4addb8183
SHA2562e66333b503633987098939ebfc51ed4fb5c552c0f9404b155af47c74ace78b3
SHA512172d65073771a063d64db2b2c1d6a77c2746a3d4775738519d758fa447a8b0151c143e3a7e2d5fa5a61436d7403f80274997dbec2e138998942646c6d9ec8e2f
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\ja-JP\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD58cd68598347af8fbc5f1883c3444f8af
SHA1c88d0b1f58ab14039c82388614d853158c7f948f
SHA256e292710db6a1b5d8da73dd3d37f05dbdf57a2aeeab08cde1277407a9d5ed16da
SHA51226f0f39d082fb4f4d2205118d0e85bc98a6e5485b630199fb35d2c1262c433c3671bf0c75712ca609ef96d733c1bbdecb81e0b48a96c734e875da4c9f72e0afc
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\nl-NL\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5166a745eeef70296df620b3288b65cd6
SHA11775b58b72f850d4a74d5283f6b110b76a779d29
SHA256fd717e44a132e6ddbfedf21116e146e84f113344a90325dc0a2c3f58db90259b
SHA5128db98025ca59ee743b09f0a7613dc13c9a5829d05e1dc92e7cc7aeb4e9b347aa75485ae5f92c207e934d1546eb96e86a4917b10082981c99e363bc855309614f
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\pt-BR\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5cefbe3a2a319e0929744148ce712a29a
SHA1fe1a9faedf31472abd308ee0e03866dc2f186641
SHA2561ef690b8fdf4efce71b4b831905f9bf80738a538847a963e40ee086f74c34fed
SHA5126d76a3e1b2a82b24ef5d995dfd358706cb07b070d144cf7bc4b04bf038e97e52fdbab4567c16dbab49a67f08f8140f7b85b287b4d3cf5e71ba434295cb76167f
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\ru-RU\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5af743efa1cec98963cfeabadc609ad01
SHA105704fe9e2aa4488bad434c2263630e5d1dabc20
SHA25682100f76d393a9b32f31194abe9dcca5201756a94078ff35df2367796f93a739
SHA512e8fae3bec46c41ec50a0706da023bd35cbd885c6ff1f24a0d6fdbc259f5acf3384aa3f017e8880d1ae8fffa06e156d5fa37d12fd3f0b9d7c1a38dcfc3bb7321d
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\tr-TR\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD57576727cdf7fe15933909ab3122177f0
SHA162349c7c60fc6aec028b94d34b95aa48d5fd38ce
SHA2560ab36adfa52e71282d600a162ae52cf56f89123b8e7edce7b698d4296be7ba1e
SHA51258bf6a8ccf1ee69232cbad62d3e98a41385cb4f683ac078c8b342a29fa8c684ab298f56de81d214b3c493cdb6981633ccca24371af94c364f9030af02108194f
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\zh-CN\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD55b39b2a0d94328ccb68683b14f54b7c6
SHA1ba11360f41a34d82d4ae7c114984bd78b6e81b9e
SHA25696a3af6e5f3b0e391a4c962ba68999421bfb2742ad7c2af22b2cc42e894d6a8f
SHA5129f4ea92fabe4cf27dc010acf5e95b9a4b085f4294fb2ff73979d614184a66b28873746e5e57cb8da674d5d76952782247ef05851588d1c8f3a22b68f61a4beed
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\zh-TW\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5ff15263a154e6a3a0f50929811db01e8
SHA162b54417d8d75b4e854378c13548b8d0bde73f15
SHA2564a99bb477f588219e14a9d4ef29a780e8a0e760184ccc62bea49cd4c76055085
SHA512caab8a013f046d8bbcd6b9f9e30842afb8108ef35d6e56d3de3511c10c8d4797e541bec01c01e95af0167c2475a12624cf1f40aac2296f9cc7b2c7fa6f47cf2f
-
Filesize
223KB
MD58c35ac6069f7ac705739d88442fdd3a7
SHA1ae4bc657aa9a43b3cc0a43abdf73de751ba385ea
SHA256e8317a669febbcf774a002f2637a3531d3cd8709f30993717887eae9c447e552
SHA512abc9999286dee7f8925452f467f232a8e7bdf061bdc7bce5bed5e4bc50fb61657730e2a6aeefe427042b44bce9b8a99b597405900a857829c048bca89be60a3d
-
Filesize
55KB
MD5e8783a75ecc25257bac6b2dd76a3ff28
SHA14038ddc0db4c1eafbaa6f5938bf22af097ff8bbc
SHA256c3d151aff23ff1d6c32dd371e08322c35ed4a44cb5d6f3570b6d8a2c03c84b40
SHA51267738961cb1fa5d4e57cfebe5193f5a3dd768f3d5c57f29946b7f8e496d0dd904f5715438904976542415afbc125f71385cc505a607b39e1be3ad806ab997b33
-
Filesize
323KB
MD59805763f37a4804067ec1c83a6a43cf1
SHA1a6e685626510c7f415d6996b44fccddfb3de6533
SHA2564713b38d2d1a59d0ada611dcd45aea6ee75e06407e9fd44bbe89700a9a7c39d1
SHA512cfb255869ee09984fb9b3df4dbeae64a5cbfed09de6e92724637f9c293d4d441b900598db71520ac81b0f5724b075936e27aecfa8ad8ef163743d14fd393abf8
-
Filesize
347KB
MD5c863a9b8f754b3d14df2771c5ef92a2e
SHA154106db51d90d52e2f018256976c89b310b972af
SHA25619c31419e5bee816860c7e117dca671fd50ee5d840978753c287fe683784e35e
SHA5123a430828d0809c99c790723308e5b4a7f308696cc5817a30fbc1331698955988d075e710b91348a8ec8c1dc859f323ae852ab955750b8ac09b6604a1ee41dba9
-
Filesize
1.1MB
MD59694c1fe6cf1925d0f3da6da11cc44d0
SHA1a6c43512ba7d7dc88c5ee7a8008909f24ca85d44
SHA2566cb71057135bdce45bae960b94777c9deb9d0f9a0132895d7bb8a8b242671a7e
SHA5128f769f19ed0457f5ec774b7a6221c226bf66bba54ed90240cb9f59cf4c6f3035b751ef0f651ae7318abd692e0c9a5487880858371759efdba16d938e9faa06d1
-
C:\Users\Admin\AppData\Local\Adaware\OfferInstaller.exe_Url_1hem3jux35iv1vzfopbi55gu03hcnxpl\7.14.2.0\user.config
Filesize798B
MD5f3da41e2f01ec12a28efa662df2fa963
SHA19760227f497132829ec34fffec6184969043bba1
SHA256a4544f806b5637e45e2e702c7997d0b6a52b805670a72aac518d189c3004d1c2
SHA512ae4f56f93a2386abe8891ba5ba1cc7de166a28c6a2f3913870bed2926ac43469bbbf0b4b18acf2fce7c7f120056e36b3777aabbdf9715cc12d2159403e392e59
-
Filesize
64KB
MD5b5ad5caaaee00cb8cf445427975ae66c
SHA1dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA51292f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
1008B
MD5d222b77a61527f2c177b0869e7babc24
SHA13f23acb984307a4aeba41ebbb70439c97ad1f268
SHA25680dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff
-
Filesize
40B
MD57476b53072467db7bee17ddd7194838e
SHA16e5bd209d7567cb97ba5aa2abcf1a04bd4b32220
SHA25649bb741e01de9ee2977a43c1af7b92d07b7291c20d5fca51001439a43dde80d3
SHA512a79c62357fb329ab8ca70e18e9c43442a6e575cab0c83f0fa8b9be2071eeb010af0c7747ed67f3a6a9444f35e2ff655fe29980e448ba26f8d3018e03ea4ebb2d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\880c33c7-d063-46d9-81bf-2f839a78e598.tmp
Filesize11KB
MD53912722b3bfe5fe750e7d063c98a430d
SHA19b966a75b99f52f4d8861280f35c63dfbfe1dc27
SHA2561914a1cb094f317d6971a36c2d53ee75c63622fdb5ed6c6e177768e3386ba9af
SHA5125589e99e11ac6d41fb04d1491c829e549a7562805db55d7e7eb00101c2a701b0456e53f46d1a9e074dfa662663273b7bf0dd847895ece3d7cf868b77f41832a6
-
Filesize
649B
MD5238d3a57d056f0304e11f52f6a6c1055
SHA1a7067fa7e8ceb59d97600ece01887400655060ff
SHA2561cb6619bb506da8a009153463ab2f5acd0ccb165fa5feb8c213cd96768f5b5a8
SHA512862ef356353b6401f5041de399e8145661eab35bbfd4e61b9186bf8aa834a6136962f049649f5bd9be6ed0613a1e8b1f86567686238a296df0069353d9d09876
-
Filesize
52KB
MD530491e52fa0f507e8079e0ee0934dfdf
SHA14dc0729d309d5dba7799eae0de8372c8191ce19e
SHA2562fc98abee2ad3cbd6c9fbd48df7d940580971450ef1b545ec706989c9328607d
SHA51222ae29c3530b64eb4cbedb1fc62873fb51ad79d886480cfdee2d0cbf0131a7fcff1f17b6e18e1909c606bd7a3551c17e743a23cda55b37e16fcab31c18335592
-
Filesize
72KB
MD5cd4cfe33426702b514d5bc7f12b4c44a
SHA1368584ea7da86ec23fdc8f451a24d01d42b2ac3c
SHA2565159452457a9566b21740e47111aa5a711d4d29a133e8bf23770353670a2f255
SHA512c60f4e31d55ca2a9c1069503f0e46f8965dfeb3dfea1750bd772f0095041c51146fe2940c48b8c50ba4d452c8d1453f37788f9e611ad4f99a465648667a8263b
-
Filesize
87KB
MD5d1bea3ee30e271b2a6324fbd3a97efeb
SHA16ee9fc0d6faf8444d9cb5274689076603c4a7a49
SHA256d8c247108f3e2de399a91d62bb6626db0209445527ccfe402cb789b4ab4ffc8b
SHA512b743cb3cdd2cdf4efc226c8c9609469ffa88679f21e9964fde20d095d44e37545527073451cfe809dd18e03be919dcfa63ab462ee4fea06647791ec85caacce8
-
Filesize
100KB
MD597017891d1c306821543191fe086e677
SHA1cc6e959f91f774ba7e0b93ab5a8de38ca1e00d20
SHA25690ad6fbe589b21a9af4ca1dfd63db76da2041e03ac556e986a2dc67582c564e1
SHA512d8c5645e9df49289c8a22f640c42a7ae01113d29adf7e86fe34cb874677ccb753af5d3c48cac0dab4a747d83a00abe1ae29184500d5f8c0ae79b0210937a4b87
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
212KB
MD508ec57068db9971e917b9046f90d0e49
SHA128b80d73a861f88735d89e301fa98f2ae502e94b
SHA2567a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1
SHA512b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf
-
Filesize
1KB
MD5948cd99f65d6f927978538481f0b92ca
SHA189baf22b59b42c032c09708ce251d7971681d887
SHA256d1ca954a0f974692fe28005cac87fbea07de99fe2e819abc4328ea6133f1022c
SHA512e28a259b4f92e790db49757641d0951f9c3db7246df8c0f1efd963f1fb4af6c768d1e8cb6f498fac8a0756d7d1a2a956108584c00f432b90b1f7c32ff3c74876
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\_locales\de\messages.json
Filesize191B
MD5a76f0ce2cdba56b542f72bc6da74c3c7
SHA14a2534ad0bb90b0a63acf722c22ab0cda4d412b2
SHA2565e74fd32b3600cb0123c2b18a5ab1f0bdde061c7f7e89eaa9c8ccc6c5f82773a
SHA512920f498b5fa7d0d5807b43070d88f835b5b9052f072d6cd402167893963d8583e791d6c87958f0aa21dd6fb432844e90a32965c9194f2a6df00fff6986b163db
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\_locales\en\messages.json
Filesize171B
MD50510de8efb19105d9cf1590ee922e1b1
SHA1c634fb455bc0460873503c85885d9e4581d875f8
SHA256a87b5a34595e164a31f4afda3ac03492cf5df0815f1359fa6272b07d16aeeb48
SHA512901369f9462e7f58821a986f8cd016db73a1d353397b3875dda25e0d357213b74d1eb743a9256be32cdf1cba047f9370334783997bc0d3e3a3c6d518910a0101
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\_locales\es\messages.json
Filesize173B
MD558df41f6b84356a4db5abc3d64904387
SHA12f0e3671406586868c3e9f5b4b6f9faa4fc22640
SHA25657f653830c4323726b4fe29d5875254e05ba5e0c1fd5559ed230556b367af183
SHA512e428ae21d22da396a74340ce18724ca85da55aa176712dddf3c1ab0316c222cc19bec60704650bc600fbb72a1ab46f4011d38140e886191f96a93ccb3180fd48
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\_locales\fr\messages.json
Filesize194B
MD5b9278c1b3b38fc0b7d6e020a5fac671c
SHA1d025c241c1f4773e8ce98b6da20842e5f3975534
SHA2562e1df50f291233397bdd0da219c1feef528120957300df1aeb922b8af97a6147
SHA5127b5e85471923c1146614f24343372da7001ce96d2622c2979b195d2dc93aff120f5ccb8d79c5abec752601618172ae06bf4ef13289a6600f0458edcfcb2d0e17
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\_locales\it\messages.json
Filesize188B
MD5eea4a75563337e529ec75932ee78b7b0
SHA1c19464e187f1d04cd77bfd235eda2c3eab14d7f1
SHA256fd4489e3eb61f51ee75a4c28d2e79c6d54e37e65c9b7ab41ce2124c29803037a
SHA512ba0adc29c616fc765242fb9cda17856a0ef589634eba4abd2c28d99531f4ba855f9ca5464232f851b655d9132305ae875c6eadbcad0b3d3a090e8e46d388c5da
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\_locales\pt\messages.json
Filesize199B
MD5f41b68a4f8c9d7ffba8ac5f380dff323
SHA14f33bc48bee69b479507948b973f77df4eadcbd4
SHA2564c5351a9031cd272e336412ca3631643fc82f94befea4a1a9783d2eaaf333a77
SHA5126e01d62c865fabe066ce6a14b3630102b94ff227209380bf0f43b2fc9bf4f85cb7806d92537370aa95bf541d7779cd113d65f1d778235d9c463267a7238f9478
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\_metadata\verified_contents.json
Filesize4KB
MD56be087cfce786abc92c9eff23e80d10c
SHA1d26f9624e15379b07b54c2780f09a2a7b79cf91f
SHA256e028147485b4466d364e80c35b614e90cb126579c2172e23ec78b258011baa18
SHA5125cb83a656d02830294b0465da75d982622a54ee400a34451ca838ecb31fe0525fa40fc10ed7e203ab33502109de975783696e65b489f50b6d7642734944d0bc3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\background.js
Filesize1.1MB
MD51969589ed9aeacc7f90464fa5072fa62
SHA173bd25d2ef88ca4003ac710473bcd2492e27a5f0
SHA25624b021ce1f0a80d8b3632e87ac72ffedf323186fc8b03be1ae3da2b0bd206975
SHA5128fb2641498f2d5e4028459740c7c244ec0c58cc9745ac583a59121ab9b0af54e614fb11f95748964117b0c85babd1fef296333ae66e0ef11e402a4b3e0482cd6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\background.js.LICENSE.txt
Filesize1KB
MD576e4242185e4dc5c685b94177d7ab7dd
SHA1f8fa99ee4b5d70e0f72b61493390fcb4a282c296
SHA2569145d7b004e4f8e7894b2ed612440eb45d756a46b5cfd66e3784b904c057dacc
SHA512c4f6fb1035a25aab15982de501857dfe3bb6c70515303abb598cae9ffc29ca0fcd0eae67bb05340954cfecd80dc9342dd0348cc1afa6882a3b4b3794d4fe5b80
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\contentScript.css
Filesize157KB
MD5e72fb5ea8672fe5b2e04731ce94cc3f5
SHA1522d4b4cdc6d82e64069890e21430814bad7080c
SHA2564b9db20c892bbb4e2f78e3a3eb0bab2f0ba5b775a1a52f39125dcae8c6ae4e9e
SHA5127c8c0266f21f7051c049c8a3a7bcd3cd2cf31d5527782719b54605d8c665e0a5df7fbec894bb959547bb5b476828a0773fd44a37fbcbc8b70751ef3bec15cc61
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\contentScript.js.LICENSE.txt
Filesize3KB
MD585d0072ce63601702a8aac69046392df
SHA175cf9b16f86a3de6104d44376bda6c96720c121c
SHA256b420cba7020a3d8223942c1c867ac29f40b917406ea6b722639cb9f3d539f39d
SHA512a5b04a7f191b9203cfc69e39d6535199b79d0f8e2749366c0a4c7427af8dda11dcd9d3954077b4a5d4f1a939ce7cbbd5d3ec98167f5392d8dc61cbb2938569c9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\fonts\OpenSans-Bold.woff2
Filesize45KB
MD53326e4d74d3924ee1c882c29f5b571c0
SHA1074d6e274d90a1b510d6eff3a5f8d26f567c1575
SHA256c1c24d6a7ce4bd24b1f3f51ab6f74667c94263fa4b109cc3ff32f4f22848087f
SHA512b1da8a12df0c4c923aeaaf434667628b305cb85a9bf4496cb9119749fb001eb8b20929043fe1b6fddf9bcd3da68c4d3a9d6a7e8b29103a15244ad104ae64ca71
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\fonts\OpenSans-Regular.woff2
Filesize45KB
MD555835483c304eaa8477fea2c36abba17
SHA19b18ae04f11fc74d27f281737b23b45a4bad5937
SHA2564c1c2e95835201077586a3698cd47806dd18df10d32a1e6cb6aa9e47224a55e3
SHA512e816266c0c453ced7d567a9b7c4958df9c63f740105e4668b95c64a95a9073b5cacc06867e71edd558c8f2f00f289d2440911430b6e8e0f6687e6ce3316869ba
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\fonts\OpenSans-Semibold.woff2
Filesize62KB
MD508952b029e4decbc8ef9fb553cae8cea
SHA1931f5105f0e909f90bdea2e246a1a230809a699a
SHA256df0231affb521137bf135898b6ce4c2ce59a79e3e23068a673868366c7ac68bb
SHA512453eaac7086915ccbc83c9e5a4fa26df5338c149ff80f3ba1d5b0c28ba6eb10696980162ba56430d5b62fa54b5d186cf6cf806084c2f1c944b95bfae6509877a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\icons\icon128.png
Filesize8KB
MD56e424e19ac4989cd935919a904678eae
SHA11275ddc671d892f2a06571321ff1db051ff77e77
SHA256865c026aecf34b7fee40fc464cdfaf0923b79c76c7a7576f1b0f8764dd47df3c
SHA51252ac1366311867f57678bdae6726d8579d56fcb9223adc2f6c9b791f90c7ab03df907d5b0121e3a71109e5dacf900f8e0a244c68260e3b1bc588f5af11e7b3fa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\icons\icon16.png
Filesize597B
MD5d2d34592a14c4a4f546ce263e6c3c0fe
SHA198bb0f219b0007eadacfd0bdadb91c15e9568ff5
SHA25641c8a55eb2feabdd53d8160d4e33ad314ae261609f341719a8e20259d0ca1142
SHA51279df92a051c649f7eeaad7457e97b20599d46cb54abfc7a31a9421fb72ec3bc12a71804ffe55119e8d526cff9192a943d21cf40c38ca69adffa0ad5029ebed8b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\icons\icon32.png
Filesize1KB
MD5f14898a33f5602ef9efe717e157a6387
SHA1f9097ded952e1ae7ac047b1e5122cae3817b2474
SHA2567248df40759b75e84d94c13db95f218b739ecd693efef34a15f242f5254cf8ea
SHA512a15a367a1ae93411e29ebb83ef75c60d4b49ef06ee35f57c7dcc2c6110d54b94ce749293d2dd368c5e9d79e670589600d7aa98f7e797acca550cb3f3f509dc2c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\icons\icon48.png
Filesize2KB
MD5c933f282958d8453a9d9fa0f7153aca1
SHA1c1eefd1ae90b60fbc1f7e3c924bbd6a7b4af0284
SHA25697dfcdf1e3f75665cc94fa35706cdc9e54066788249000cec0681058081ab27c
SHA512fa11b932ab88792d539ffb4e67b67229cdcd4cc216bf67fdf7a4b6c17d0f2ad319d2249c58060aaf8f7a49b1d03508ed95f14fe3f42f57e6d77488bd0a6df36b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\icons\iconDisabled16.png
Filesize599B
MD56320ccc0694e447ffc0982dcd8cc946f
SHA125a19cf9ac46daede3e11cd59e4fc2d64259ac9e
SHA25656b3b78b00474e5297784bef8545272be7b0a154366ffcc48ef8927738930d9b
SHA512a93c5a521de27c9b346391b778f048b980e68815a1d05bb31fa963ef889da32b474556d600acb1b93c6ac93bfcc9641fa83e02a922568f8d1feeefa8715cfaab
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\icons\iconDisabled32.png
Filesize1KB
MD5d87fd83845b05f9a2bab7d649789ee98
SHA1607eb59036192e06aa3dac00a8e4810295254d7b
SHA256601b503e3cdd17df5b10a791e4e1cbac839cbf41ac7d484e972e213c94129078
SHA5123a8752403e36a1fcc7ce165543ecf6c5c328f7da951fd63e2fa89b18de09dd2f256e4af3721e69e3c2ea52978bd64e6743ebecc7b9c306ce48a8641bac07324f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\manifest.json
Filesize1KB
MD599832c2455aaf3f3aa4ad41150b73022
SHA1e4baedce0933c374b3fca2be12389bd6676acab3
SHA256012d7356f814a3a45a90171612c7608f9a3b6ef176181ba75e55a424837a153d
SHA512e119514827ee0a05c6b2b4d6bc5785a5c6ed6987828714e65df2237a97c4a269a7a8ac6ea6e038f4cda90b1bc43cddb39f2a921a41b2dc810a50f03683b994e1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\popover.html
Filesize179B
MD549a7b2740cad481349629fdada7cd28a
SHA1c4cc9c878ca6a036ce273ba743ed558a62fc0b83
SHA256d8a1e2839a14509c2f61845849a2397b8ba3aa4762416dc335b879a812a60305
SHA512074dddfea2b17b03d3663257f4bc68912d41fe504526edceab5583499c62c59e83c69d20f51be115b9a9fdb8c4cbc14e3011704d5745b347e83389f0237dda7c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1892_1860943734\CRX_INSTALL\siteScript.js
Filesize175KB
MD5a496510b7e3e755f6436f1504be1b5ca
SHA13abfaf344fd1a102bb68fcb9d83cbd04f8b85078
SHA25626db279638b8511da9418e26319c41039f314b39e3556ccc343db4de33db6ad6
SHA512113cea420b8818b3141150970b6d6b2473a8f3db188671764657ba3b68dd8d2f236c789205db17c1e4c932f3a3cafdbbb7ae64b87a9ab86f76b745b124ae5e29
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\caljgklbbfbcjjanaijlacgncafpegll\2.21.0.4943_0\_locales\en\messages.json
Filesize149B
MD5df3f22c1eaa295e15d92284fa3d018f6
SHA1ad602e6540d59c8e817196c2f70074863ed44a35
SHA256a82bb22aa3fdf01214124cdd56d1d47a9508e57ef05cf64379bb41615a4104e6
SHA5126068ee6f412b08cf81428dee3659cba33d1b5ecddcf1acc25ce2a158c607452dc6961d925df3af83b8766fd817906175594b39b1a396e993589b916abb6aa162
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\caljgklbbfbcjjanaijlacgncafpegll\2.21.0.4943_0\manifest.json
Filesize2KB
MD5ddfb44023f2efd29f53b5aad780a3fbc
SHA1cff54289e1216d232fa9cec51e9ddcd668b53665
SHA256b4cf33ee88d198eb15b12ba6c89721f53d4c5ddd02d23921e640929232205786
SHA51285682e5e23e0e657906aee91ee2c71fb756fc4e355dc62efffc3ff424b9a3de70ba66f5ba2ab106dfaa91562d60b6aa809ee7eeada9fb7a35d2c4e8b2208c730
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk\4.3.0.2568_0\manifest.json
Filesize2KB
MD56306449acdfaed0aefe25d956245f9b1
SHA16b3c851b481481e473f7defcaa57c45f5ad12d4a
SHA25631ba31e59691fbabb78411be44f628e3b7796066256578ff6a5bc637380119a6
SHA512413c05483fa4b6fccbaa8bfc3a29e20d2b8f04c26d6305131a7ec69c7d4b69a088513619a0a9915836a596b901dff0fc4bb1e866fc33375740dda21d1dbc5616
-
Filesize
10KB
MD5fc84813c628a3fb42aa2c7734850ca65
SHA16d4abaa94d5cb2fcd4e39fa707cc0034a80ccdbb
SHA256234a7b0af62fad91c359fcd5477f8277ac2f27c1267958f3ec98d359983541b4
SHA512de6a66da200e8932565caf1000f1fd770d2b9f810bd975f586034425a94cf8b749549bddf6ed2c21af50b9b3c43b716a1f6778b2465c837fc2109ed28d5f6e95
-
Filesize
12KB
MD5af6dd642ab629632e4529f501e360f76
SHA1550e1fa419b7eaeab64d72cbc7e170a402955a94
SHA2569fdd9060bd2516f062966d93f36d2eb4eae9dae8f27ccede71b4390344601847
SHA512b9c91ece60038cc1e9db832114cdac24d299d2f6e2152281a04c09a194c40936394d897e138b5e49750d94375bc847253db137181455003df76cf76b19a0b2db
-
Filesize
1KB
MD5524f0518f314632e3dc8135206fbc767
SHA13564e98349e382a013881174e12e2896af99b943
SHA2565e35ca4fc0529b09ebf4a77963e33ed6399911a73a1d75d8cde18b5734bf8f82
SHA51278efa3eb84d240740400a9a3a2edadabbbbacdba5393494ed366fa4a2847473dcb2ee3f5bcaee3f386694b09c514e54d20cb27c79c3e919196860a349f1b8025
-
Filesize
11KB
MD5fd6840c2d301225d345047d461439a75
SHA1e2e9ae87f7adce10c8ea3f92ce4286425c5c2651
SHA25617217a184f5330c19e602e6aa1d5dbb629271de566450e404771625d6606de03
SHA5127d6b21ab09d348fe8e5070632d5d2d20175f50fa6b9abf64f9fbb2ecf8538408d21efc1d862fe080fbd59b31fbf643cbd630b44c6ad18763610ff35b22a9c859
-
Filesize
12KB
MD55c94d8dae57dfe6bb96e26897a815f62
SHA11c954be050ec338d09cf97e7fa18de262ac33c2f
SHA256cf4162fde8bf41cfbd674627fa311735acae3def4b1dbde2db510eae6b83b05f
SHA5129c6d0977765bb901f2a185fd2a2ee8a43b440164de9f9bceca5e145140090fdf01f27289c87f6c6e9e72a0c3da6891ddd241ae6dab7bb584b3386d1a1e14c059
-
Filesize
12KB
MD59c7b6513b2685e86701a52dc5fa32c3d
SHA1722ae2c203bc71b0955d79ee499f14a8ddc4caac
SHA256e43ce283fabbb13f8068f232abc44f14c35ae7e7c061da3e44319c0342fdabf0
SHA51243d025e067131cf3bcdcfe9bcb4fc50c5a227a6eb165394bb6f1948dfe9d6626e874e889c4ad266598a26e1cefb76831786f725df24d254a6148c72aff37b560
-
Filesize
12KB
MD5a6b6ef336fec79c7aab4f7e41229c3bd
SHA1476509939313a5be87df9b6ff6b83fe1b5e5924d
SHA2562b0d944eb1ce4292ea1d6a76b77bd308346992fd4d40768a505f2a88ed6e551c
SHA5128f14d3c83e0c290ae5b13cf9c5436ef61becab3cece21d61a0008ba60210e6c7c92029026cd23e24bbdc064676c359c6c70d447b2eb44fb4982f00f9707e79e6
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
691B
MD5f1d8df99d751f99f48bd54358f4b7c44
SHA14fb059149270cbc2d6feca7bf35feb687a5af2e4
SHA256045791b080ff8bec33f7b16fe42b1c8e00eff035d0c7206a588e5f0a42da33b8
SHA5123454deb09f261fec947551bc3c0875009924c470cc0fcbc7f9aae1a4ce5f8acda6b1906466e93c0d7df37ad8f904aa1d992fcd45b778a76ec22627669f24ae17
-
Filesize
1KB
MD5ac953b01aef6c293fd54a5431ae53c3b
SHA1ae7542adb3afa1c0a85ed02672ed7dea64cff25b
SHA256123798c71d0c4df1036bc718cd836050a2d9b1e7ff326d2ad8f016508dba4441
SHA512f92c65b715dbe8a1f9e2bcea20b439e208258488a92b85c4c6fbacd3a16c66da28fa60c3568c192ab37662fd7c60cbb70ab537758f9dd978c8ad04a094db0fb3
-
Filesize
1KB
MD54164cfd6c9ad122f44350362841ce794
SHA11dbfceaabf91509ed2c7aff4408327b21dcaef1b
SHA256e99e4ff7750a5f266ad5a181761eda30d2e3b3179b0bc23f8dc38f7aa775ef57
SHA5127d94135baf408c8326fb752a459f2d519a792999cc0b37c685ab19f52ec54c3570d91b6ee882c122f6b046360321a1c8752d10df8d330ba88f362da865f7dcf2
-
Filesize
1KB
MD5c360789adf092286d51107f1bb03b2ee
SHA1aff7ca6102ca9c03eb756001f20c048eaff54e79
SHA256ea027310bce002a9162e65bef59985f458362a0049301880dbd33de93500b75d
SHA512364f086e80a9eb94ebeef74e17ccf6a5e1c2646dddcc0e3d33d8686022699c8b5f50bd229a36b5a9abf7c11aa18ee58e5c4ded1766c36df671c101aede4c731b
-
Filesize
1KB
MD5650a30ed1c9db6965f9ba73d3bd52ba1
SHA1d3ea5730e101c6ce6ac311b20b7d6d2ad5ecd950
SHA256ae68e923736660d83bd4d7079045fc319ae1a85040d3faa6b8eacc5103e2bf65
SHA5127f2cc4407c498dec4e4b88538c8917f7f94d8a8f4422169baa7778c92ee978e9b841e3ff0585d48563b3257fd8a94a15fdce87f2febdbc186cdf37d913194aae
-
Filesize
9KB
MD53981cfabe7644ddd7b6e624105df4e84
SHA17a2add3a9f58e8ec9bacae3f2c6addf0866757e3
SHA2565646cb7cc416bdda9283b7c808eef61c6fbf4195538c47ea4a1050c630b5f7d9
SHA512bdd3b8d784cbfe22a0455dd370c8715a00a7930618406377b49c76e292dec5b5217e7d4fe6591f520e2bd60c82754c7879bb4a85a29cab51f1174c2d212a03c4
-
Filesize
10KB
MD52b3cb1ee1ce314965f1ed4201f60439c
SHA1b968679c0c30912eb09fc5c92cd7aad6c43fa34d
SHA2562dcb4335c28d5e1e425f15d07287e3e89f593a7d7051112fd16b8a80efea2330
SHA51223681a2b3cd861646552c83287ef5af1077986be70506fe6b96f017c709b6005cf8f19e5ce823aa1bbe723503b7164a32a0c2c9168ba16452264c6629644f2be
-
Filesize
11KB
MD50d405aabf79a2e9236d283e3841d9bc4
SHA11b7320768ba49629c9254f9512d64c8f6134efbd
SHA2567c3ccaf0ad0958d0395fef82a1c0b476be61b26ca030fddd6387c75140d63ae3
SHA5123561e3528102d9a22433875e28208872fb687e00f3737fb333c4ac6e7783924c2438c55865f730cd7bcb57ff83afb650ea82421d33c631938932311d783ed7e8
-
Filesize
11KB
MD56ec83afb517f098e99b84209a9c98961
SHA157fcaada13c0f35e6bfe86baf537917218d5a2f5
SHA2562dd30d3d6b5c3d258b517b707ff37c47e21490de47bdebd1e0881de9543e678f
SHA512d405fe08420d589b6ff566d4cc6c83f0bb8e272b9643e5075a920f3a11f329e8b07ab1f929eb16379c10558b6c5e50cba3452648a61d952939fb4cbd8b3a1292
-
Filesize
11KB
MD5706fd0a11a8086ca7be28e251d92d867
SHA139fc39a6cbd0f02893b5235092b590845cf6cf53
SHA2567c900c1c76c2b899cc8f1d5f1da77ee697ade7dc69e3e3b1dd1353134617bca3
SHA512231da899037634b544b5b9c1abdb2334f5a9d62613c40809bdbdd91bcb904e634003a6728f127e7f5344b5a81ef5886a5632c7053beda7096e043520f436a024
-
Filesize
11KB
MD5f7b6c36ef7c30d0769e9ab965a932a90
SHA12cec397c0162a2d9f36648bcedd0fc8c371347dd
SHA256fddeeebb38a4a27abb3a9dac5cf8858b16052df5ed4ca54e5352ce8b5a6e21a8
SHA51237ee0b99140f82d56d2499c48d4de4140c899aae470a62be37bed9bdf786a1b303d092f5d20a7fe9613910fa538f059f5fdc1ccdc7ca236d3dffd2fb86ecc829
-
Filesize
11KB
MD5234257211bd9b030867c8fcdb4120c22
SHA1e5461476aadda024229a1c41ee6beca1381d8b7e
SHA256b246655210848c98df23562035dce5486d3a501e507b773ecc792d92e2f9036d
SHA51222b69c8ad7a13ac09d42274c67ec65bdaf83ce9d23d8bb7e35f2103564051a2862bb56398e5f1c43e9ccadb58dc8f891a001dd3c4afbf52a0319ee1e3a4d797f
-
Filesize
11KB
MD5f935aa2b560276af792fdb55c1e32ad0
SHA1a59a4c56ecddfe47a290196c92725501c009963f
SHA2568ff3bff51417f6dbf78881f5df78922e7eb7a63b6e78c01e52d13dc6fe1c72c3
SHA512d554b6a50134b356cdf77b1b6e4b3c0a422b6c28893b7b11205ae4762c2a64de4e72b483bd9d61e021a48f54bd081dfe4048363c87dcc3a4f01c2b456ca524f3
-
Filesize
11KB
MD56b4acd52036719c9385a7bb09f40c7f3
SHA14529540fb4d22bb1fd7c7fe03cea06404335e171
SHA2569580c398bf8368fcb87900c54b5bdd12aec7cd9ab11ffbdf0629eb2e3b794b8d
SHA512c69dea476805175df80f3f2831c0fe2796d2fb960faa086919d2b135cd2ac6d168682fea53e07ad1fe2ff997b053ce042fc2f1c231619974d852229aa53b4a24
-
Filesize
10KB
MD52f733fb93f01279845c9b5931ed52c8a
SHA17c3176389c6ee652a6a28ea4c3fe5cc2fabee89d
SHA2564cba9d833538ba084b93dee95fa86839fae97b7c29e35288b402ed47bca1394e
SHA5123e7fb17e93c14853f5f47f3c7798045346162028b62cea22b9e3ee1388278e48a33efc9a445e5e22c29c1e2cd5571979db21f50b1a0eeb67180ce91edb560b64
-
Filesize
11KB
MD59e00b071e502eb0db9fa12135986a915
SHA1ac2a01806dff35043c806b8a75722871bf963b5d
SHA2565a5b4874c2fb70ad30b3fe50e86ff51552a01a72f58743744f9ffeb61257ed2e
SHA512325897de547eeab2c09c2630f19b1cbc486629f9e2f8fd3c3eddc1c0362b471e2bb7675555563f985de948057f9960ee6bfc6aff34bcc97c05a3c304da6053f5
-
Filesize
11KB
MD5800502bbea1e478dd1f6121fb0315aa3
SHA1198c7bd0804e1e2793186112da4217776cb47551
SHA256ee428afded0fa25936d601c3f335b88c504c547627cca1bd175943049f38d287
SHA5126d34f2e8f20269b83d69aaf761d315f0277420512738340cd492f9b44a7ea919677cc50d1854151320e0ef9d8fba4649e8ef6fe1cd249db8c8eddbc80bd3982f
-
Filesize
11KB
MD56efddc278cc4a7c43f54cc86216a469c
SHA129f66ceb3576a314cf139141e184f0d3d9cfbbf2
SHA2562d7478c272bba1851746c7365f8eaa91b01ae82a290120286d192f8ff795c6fe
SHA5123ea463674c0a47d95080f23d6a24f61b6a51ba5bd86be73e1601fa154970645f088fe77a8b8aedd0a2f81e4b86bb787050d953be1486e08eaddb030da766d639
-
Filesize
11KB
MD579eb9bd960e7a173ed16ff4ab37bcf74
SHA1191cab2b13b5746f8bcc15bb0c35cf26133dd0f8
SHA2567e143cd49a6f475eb40d3971d905cc518487aca212ca2b50bf9aa1c67db20b1d
SHA512e112bb474b5294aae9ebc60c4bcebe96680faf9373fb1ed201a2d93faac1df91aba535c9b4cab734d379961cd4e8386f331a3a5661dc245735d4dbe2c8ca8ab4
-
Filesize
10KB
MD57fb3e8028981c1d11f8f291043cac0d6
SHA1bc79508122708596481ec8f5b2d1caee34111349
SHA256e13c1553c4f5c5e81ba071c4b586c35917effb38538da670ab544a8ec0871066
SHA512f062aaf6bdbfe2095639a3771c1b8823cc9829cc20fdd765933d7edfc7c380ef79285ceac09f7ec8443976cea7dc514227015b1c0fc87d8ae47c96b7276a8e5c
-
Filesize
10KB
MD5b90179cff4a8efce48be91c0c1fdb5df
SHA1713aa191f3b867816677bb8d772e77c010ffcd5b
SHA256447a32653ca64538b67638fcf3cbb84527e82726639ee1dacfd6531d2d195957
SHA512b8f663557fce2dd1d42eaf78c38f5e66a9ff3af6b51d3ab1daff7ecaa9fddeb02bdc41bcaf03a1f3d04650bf727bc24de2d98a6bf11ba7e1cd425af476b4527a
-
Filesize
11KB
MD5844b1b09cb363323b53169b8381af6a2
SHA1892b5aff52ca38db85dd698e09f475a59de621d4
SHA2565ab8619359f56665e42cf61e61b9841d986e3ab8deffd49715e6aa20bf7d0463
SHA5125244685f684fd413ace2a37b332026790e9c9b2c883afff4bb5b509dfd5efa47aeafec20b21ffe6331188dbf35b9be162757b1de135706d175ee516e5b765e9f
-
Filesize
11KB
MD51864e33cf557883c8310d013b353a9c6
SHA12cc31bebf2539f7c3dd08cd0cef3f9be68de39f7
SHA2561d408a57dd18a184bd501c55110572de3022e9f50d4d361d7112ae5722117366
SHA51222b159e0de9e80634871368c4b688be03e0907d95d09e011dc5360d38471f1349e0f25f14800e804f3f95c889ed45d231bf477b090a899870e396d455027b2e2
-
Filesize
9KB
MD573c4b7d959a5a46970736b997f89ad9e
SHA1a0dc5a0d42a9d9c9a3ddc44ca4c3776277b80b44
SHA2564db174d8e0cb8c17ce3e9823434065ffa60c1c137e1de42951fbbe3e53840b57
SHA512204eea575bec8ce0c1a21529236ec553b306f67975cee8484d2ed5b14c69470acd79d27200f99bb5c2278ee2fde82d47ac4707dd7f66742b1f882b9e55bbfbd6
-
Filesize
11KB
MD53b33d556fbcbe430bcbfe9b6379d5e29
SHA1761885c1143735fa4ffd6249c9870e4af944966a
SHA25682f5042cd03decbc8b915cade7e060acf12206e87281b73478a61613c37a2009
SHA512044aeb895dac87f8ec27dbe846cb72b250cb0bb4ce17940e90a18979f3712dacd3c2175b1627d1ca3477df5498c66e213b9c26a68f10416f8a6290eb11055e6b
-
Filesize
11KB
MD5477004eb040abcaf00dc7d49e8a0d504
SHA1424a36efed86d1e56bb27f764a332a4776913d89
SHA25642186f4b3daeb7f889e0952753b97353af5b0c90ce1aabf8c015cca0889d57e1
SHA5127dfaffe90078475cb3e0559dc0f2e20378207fe1d6ec82e86cac0c23f85dc03045d147937c90e27393f37310eb44976f7372acdafc91e9d44f556907dda24fc6
-
Filesize
11KB
MD5cad7d64f48673ab19928cb7380db534d
SHA14795680074633df1fa2cefdb394f8342f2b5ab49
SHA256addda70cc846a1f3c27d7b6ddd11cbec2fa737646ca8ed5fc72761758cce7de9
SHA512319088db42688d5ac993f2d0359a29b92eb9fff37d62003964418c44526b2dc76d30d0190611df4ef25146bdc6322402ff53c6163a3dcf6b784c3921933321c0
-
Filesize
11KB
MD512da7dc230fbffd4398e88ff90833bf7
SHA19157ed837cbdc71636b3ca6a3a6b26a5ee3faa32
SHA2563b095ab736684dfa49455b94fdbca8fc0d400c0abdcef2f8ddcdaaef22f14826
SHA5121137bcd6e900a5ac4a3150364ff2e1a0db9b585878fcf21c66401a56f8c6680d8ba1a903a4ea431811bd966bbbfc354ac6d3637ce7fa0c1e8232aa00b1c4f60c
-
Filesize
11KB
MD513fcedb588b348b08dcc2f0b2a7446a2
SHA1cbf4fdbe2fd61f0cf3b12d33eae87a57d5f8cb51
SHA25619739ae15d22f9ce88a7fab1980ac741e7f5123989ac3626692ffdaab83e01e5
SHA512286b7616bc7ad3b3c0106007abe5242444096a9d3de5716b3504877ac1cdc0760a72af8f0778739cca696d60faf80b23a0dc4d1c4039b8e9c9789d6dab1c8d16
-
Filesize
11KB
MD53fc014b63bd7c7abc835ecc5073f96bc
SHA14668b68ba4eecd68d62785642881b222e3924240
SHA256dfb2b3e6eabfcc29d12e501ec87355333d78d430c939318caed4f934ac5b1ab9
SHA5125143f06b17ab97c52bb1a359c229c96b40e72b97be3c47ffef7f4454b5cc11b805c091ffa2e506ff4199787587a562e1a66f97b0f93415d17751db49b9e6932d
-
Filesize
11KB
MD5faab1369e6240d388c88264281d3ffaa
SHA14552cbe10b9b956ba5ac730a3ddc3de2fff8e8be
SHA2561c610529cb17504f546df4bfceab77d10ffe8218bbe353dc6b32c9dbd0b2bcd2
SHA512d454213ab416b04ac60da447d2b56206e55c6d615d5c68f96f111ea4aec30326abe630aac1dd12a898f5f8d93d96ed5abaebc2a407d5d308d1cd716ae5ac293b
-
Filesize
11KB
MD5f7cfe1cde9a675904772a0069b197cec
SHA1137877717254b28f7a69cdd697be4fe24c8584ba
SHA2565485885e74b9fd3c231f4d6bf49f4c20b3f3256c87682f7e920ce85f429841ef
SHA5128579c00e3e4d16e279c25f8ce4e1b0ddc3001991d08d592b59246126b41f0ff4f08e68b9e985913d02f5c0411cb34cdff98b3f369645bee7a1b0616b3988655a
-
Filesize
11KB
MD5ebf40bbd6e0a03b466ec9c2ebdd5f125
SHA1e41d563decd188011dd7f4e10a5a6ec87a686f59
SHA256ce6fdaba86ab798df8a5e672e6c5a6c6f360c74fe96591f798cce09f97a68f44
SHA512b6798fde8bb70a89cfb47dc089866bcf00a467049d3b304d82a3725a28502dc6b4d76aad06bca56e27e0f4a9dd6144a07834538f9c18d3abfdb3118ae6ad89ef
-
Filesize
11KB
MD52c1d7a73e8fa8f6933e35eadeda60ac7
SHA1ce2134adcd5ce8bdd54a1812116deea7e9ded797
SHA256bde709faa65ece8eaf14d275d0cd591d662024bee71387efd3f8f1ccedb9bb7e
SHA512766671af79ab4680c73f2238d4de6c8b38dae070538b3d4365bbd475e32491d04a8dee222b09ec6f3f19b42cee06e689409a80549c84fecdca43f76887c62f0d
-
Filesize
11KB
MD51a2f26fbd35e0f1056c421a01cbdbba0
SHA111fd47bb10cd146bd38eaea7e8bc4734b5fc6046
SHA256a11da54e5480e2ffeaa533a75f2ed2c6de6b0764618ba9bb44a6dbd575b6773b
SHA51201b1a531fe479c5d3e09562f049660088a3dece18671c2d4b55e68d303eeb74e29b66090704f3901de332910011a951cccd83543a02a7383771c8b77e9698a49
-
Filesize
11KB
MD5b9d9525f3b3ea8c1661283797708e118
SHA1b5bb3376fa7811edba967dbdcfc449beeeb9589e
SHA256f94a4079bb5c4ec69a1e1ae18400c6d7ba1b260bad53a1abb297edebd508e5fd
SHA512b958d606c0c6355c7b66fbd5af4deb85865a262f53a910a2ce663a657a46df7b8f52639e8e5a306564e5226c8f50613a783cf05c3ead32a2a0921585f178d592
-
Filesize
11KB
MD571dd05bf121743fe28614d181738dfc7
SHA184ee738a4d643661ecf1b9c69dbbd2c8f005bc9c
SHA2561eddfe96de29564d5c4d3cbe74be1cd388044f8d25d4d8787b8146a3d9fba950
SHA512f6c6406e7fbeff096ce16b72863640d27422a0b62b6e9c3cd738704e5fdce67ab6717d0c6ef8de67ca8645d308c9b6856f14ad1c93668585a3a91923be67e9a9
-
Filesize
11KB
MD5ab63cc0a47371729fc8550bcb053814b
SHA1afb36648af357f8595cde305dc6794f3ad1cad26
SHA256d87707e80ff533bb78424b87062bcc874b4579d5630cd432ad4b1f9fe79ae8f3
SHA512aaabb3e974b4cbec835117db240b9ad8a4e4c7d45eaf44b7e348de834cbb4ac322cfaeb240e07d0ca7120d7d103d602c91e7ddc7a37cf55cb08fc6c8751a8a96
-
Filesize
11KB
MD5f3033904b7278f189089da67d9e7b38b
SHA18431396b879bfad8badfe8727355c9dddbf456fc
SHA256dd8c661421bbbf0713a281a30a869d9e95cdc140d7bb7f12e5620443f6474bbc
SHA5123b0ee862b7f1b5f2fc759dee849e265b4e2eca6b637721d9d4b4a051c5dfdc4995448dad68ec5ce327812c0e9e9084e578a06d1c62fcfc7d076004099f2aa28c
-
Filesize
11KB
MD5e0fbbfde3958d0e3a85aec59fc1a5a93
SHA141d27f94283af8c9dcd363902e74a277dd3b1288
SHA256bdd7a872e318afadda7ee7e114f9def9780ff14ac7d841926e0636bcaf47e126
SHA512e45fc205a27698b55b8c03a3762c5dccfaf91090f55980933e33a4bcb1b3fc71bef2f64c9c516014b7d35bfe0584a4af0c93c763b52865a59f35d1be38ec3afc
-
Filesize
11KB
MD5a4ce3e058e1b7683611f2375418e3bb8
SHA1317b1a09f80015f1aa3d4a3a5d384a4469007e0f
SHA2560ef55a0f41d847cf4c4030e9d260221971ebf2f4903f32970aee80fc23a1cf20
SHA51294738fa5e2467a540348f952a4ae0008fd73a7d74006778067d81d33f544bd9f19898f24bcd5a68dd6d70db5912668929e73b3e8d01b2d6da28def7960523864
-
Filesize
11KB
MD5fad525e2c1121fa2762f86345816cd1a
SHA15a0159873cf8e69adae794206a837b2597df0243
SHA25656a3f76fe4862567981d4868ee4fc19877f3c11f323fe1ca0accb5cad9c84bbd
SHA512b8a000d0a171899c64f5fcdcb16aff9e5d9ee7d550ccb01b95d6eba660e399af15db7cc9cf5d3522d2b889db6918faebba168965fbabd50ddbf6e480621f7723
-
Filesize
11KB
MD51189fe8c9a1405df8b86ea50e9e499a1
SHA1ce61fa197f520ea193f5aa0fb6e4844a6d06fff1
SHA2566c68b156d8e0779c48ad834ca7949cf8d009cc768f256251362c3f4eccee5e9b
SHA5125001263ae44c0327414cd96fb9c719dfae14b20c44fba09c0c79fb92b8f845973524d5aa23d78045ab634153e05625e8e81a0aea5a703c64f688cdae5dc9b8fd
-
Filesize
11KB
MD56b2d5f74402b3b23b0bd03805b325038
SHA1696b7d62abf2cca0fe91f23ab502dd8c35c0f43b
SHA2568addfa33ce16879db6bf336b9d4d0f8e855079d2554831fd0b75908021935d5a
SHA512893eaec0dfc9c36b3a839a00c662c1ef5db9563ca448d73353ac88547c45c1947b6e4bff6a600054496b98df9c25ddddd3449b0c765e47e952c1fd85d73bcc24
-
Filesize
11KB
MD580528a306d05aeec56fd1e39e8372779
SHA11b60cfa5b6e3167e5792a2f4a5b50d9dad6beb85
SHA25687374e7982c1099674d8f04e10552924d18bab377e1b2a9ea53e3edc65acb5ef
SHA512fd1e578f47ee2dc52e53e59f0bc34d3897ba749a328a830466e8b97837a7cb397e1d6aa3013239cd5a2580552331bf978e2e5bd7018aaf8617336c5446a47d30
-
Filesize
11KB
MD506a724dc0e1b25e5f0b95b50e461b1ef
SHA16a8795122b0707acb36a0481e852fb8a6f629130
SHA256646ceac32ebdce560d5f2f991b618ba33410581d2c59e6b0f2aa0193bb119742
SHA5123fdfca282ce449ed26e47fb8a72eb479be67b82fb332ab2bab9bd56055096189a26d88b372557577f2cd59cd93e404dafb0d16709fe3dc28c1619875f648bb39
-
Filesize
11KB
MD5b7f9d50f898d03489cf959991ded8598
SHA1f4efa635356860d9f448f53ef2589b89128ae102
SHA2564b24332091f701cebd80ac3086d133521526715103433f7010f137770933766e
SHA51295348e9e6970651c08d8024a9a90d6a80dc898039b5af581aca41d0ba4d520a2aac410f21813042f00d33268558640d4ba5358e26254af4fe0556b844d76eddc
-
Filesize
11KB
MD52ac9a294605cfd164bb5086b43894766
SHA15a0f62efff1e8f29753057b40099e4d7729e8864
SHA25634b962d638643aea228e5207eee57018ca123d2f9a707217cace6d934229b4ac
SHA512bf2ceb3bde56619d597d2cf48001f01defdf3c76dfd8b9d3e22e03117b4c9c2eafa9a96597b017e649b9216a5918132e06e78be21ce62c20dab9c5dfcebe902a
-
Filesize
11KB
MD5912ab625979e77aaacfa446cb55151ba
SHA1db457abfe29b0ec13d9648cbfb99328157a7bcc1
SHA256df047823b1040811245267c46daccf64733e6dbe454bccee65e4c0dd4dc75f7a
SHA512788b57c45906d27389720510ac8c769888533a5946743eca6915547b6746992aedd6020494fe130a7c16351b328a9e8b96125a094137858bf04fd911e98a600c
-
Filesize
11KB
MD543252412c02cde09b066917da2a000d4
SHA12b3b563b968536c266b852c131ac58f1da05838d
SHA256774bd1fcec127b11f8fd111bbb82bbe29e138e0814d209bb8e6fc518fcc19e30
SHA512713c3928ca46abc81e379562da7b885089ff93423369e78e081fa1470c0aca1e624e99876df5e7e993c48e8211179cf0d16783dd51e5d025ce917a7081426436
-
Filesize
11KB
MD5a10328221171948c204c5bd95759aa21
SHA1ee2f6cc3879a7c67f5ac6e4cb0afe04bb3b74b7f
SHA25623af6719d4725e20c905240f0f06b848a8e1213b65fa16478fe2a7bccd9905f0
SHA512a00f9e0f8959128d3bf53493f8d4aa300f7f742aeb00b83128f898a727cbb2f1f83a91c48f2f58cde50a77bb0d747c153094bbedd32af1ed336fa3f396c74917
-
Filesize
11KB
MD5729bbab4e5d0b8ec0df92b85bbb05092
SHA16bd6c8e9823c1ed6186340cb8be4775d65755c07
SHA2564e335c23add3ff643e871b0bccfd38588daea43fdbbb6db80cb825bc42aabe3c
SHA512c3c4d4876913cb14c80634a019d4e38059ebcbd0311d043c0251c5a152e05d8a25d20151ce9bbff4709fc6eaf3db7aaa39e981f470e98608c9f46f0f63ee4cb8
-
Filesize
11KB
MD50db42e5fb0b7b826f54a93bc2cca5c9e
SHA163b053aecd7244074e78863f81525db6eb6fb791
SHA256955ca3cc706eb2ebfa6ac3d6856e23599ffe06ac1fdd7197c7a98dc7d58d2b0d
SHA51213f9edd37150718e6110fcc9a83985c3b1a40011ae576990f0f1f3fdbde689802638727264325c54d71e0be8adc29c48a299eeb26dadb87e3a4b85f5630b74f1
-
Filesize
11KB
MD57a718904490d7a8dde3bc4ff0c7d5e67
SHA16e5cf46a69cd10169a3070ecf0c728bdb4255f4f
SHA2566c7476020b682ebf3345cc8f38ae67c9d82622d9f48363051568e39a170bc6c3
SHA5129a88f936f853c39772202dc3bb5f6eb5bdb13586e714cac20201390bc04952dc7456389d0b640482eae6ac550d2310e515d2e538a00d2588dc7773970a4efac5
-
Filesize
11KB
MD5eaeff2cf170a077aa02fc7c7e87818aa
SHA149fb0764cc9d82ed1cb05b337e1b4dc213d7e384
SHA2563fd572ca92952c4fe7752db44034512686379ee6f32fd89a374df76485b52765
SHA512d0a9f8fe06153c23b469c219440df50cd8d63a5c6a8cc925a83288b2480710a265922a5df584f62fa774df945ed89da26192b1b6f4291b822f00774872549228
-
Filesize
11KB
MD5bd44d6eacb20263114eeef5b84f4c55f
SHA1dda2d5014dfc66c1bdf2cdd2f96001e80eec2d35
SHA25689de213e02d49ba91a8e3f9b2630d9e07aa3b56f7bed50b1461f2c6fdbe5680e
SHA512775e2431e202ec2604ced7c11faa58aaa75a6ad660716204dbe39bf67aef0091f3c220cc39f6f2012c85d516a15a373464e160c1ea54b9e72405e81df6fce9a1
-
Filesize
11KB
MD5d46d16f8d4e9018f576662cf2c159fa6
SHA1ce5f132488a38bd2346a143c92b0af39c9f8908d
SHA25650c8898fd5bc9955fe4de1b45afa4fdb47b3b4b094f26ec5ed900347e04fde74
SHA5123af01ddfdbf3d8c40f30b44afaf541a0f77d6528917a5597068fc8b5128deb2d45ee070ef8b34f4319140216ee288cea39c145844dad0e6232d145e78e545eb2
-
Filesize
11KB
MD57d24b38bfa6244d5c7f0c2b2e610392e
SHA15777951eb8e981b9b1e2152ab56e1b0c4a84f953
SHA25664924ebfbfe7936909331331c440d23f5a7f74145a865b325578c45194a3096f
SHA5122649c57a1af411079cd2669112285b36cfeb433e00faf685f3afa5a55bf52f7edf8121c958c1bc7bf8ccea3ec0037fa20b5b5ad0d1ce098a3f426885fd92b256
-
Filesize
11KB
MD5660aa66c59e9f4be8693c90060b472f8
SHA13db0adb1d46dbae852ae8a873854e84ffca607d5
SHA256dcbe9d8e75a471e8e6372781db1eaa84069b02aea997a94aa1694fb51a57835d
SHA5124c2f1df4fd663daa2335f1820edd812958c9098abaa5d2410a39091883dedf2b470bbd121a19810a232cb10b31856770eef79a3e4ae76940c79976c2eb73b5fd
-
Filesize
11KB
MD591ae95377ae10d504cce6bdc79280abc
SHA135886ecfa626c5c6441cb569503724a041a312e9
SHA2564cbbfee7c5dc269d7e7bfbcc3cb74cbf7e07171eb825590034e44dbb1ae99591
SHA512ccb3043e2e76595d2aaa7573b925e9550e1457d38e67580f8a27d346dcdf2ff12f87dbdce00dd9497cc70d14c18dd36669409fc430ef03cb2e22d42d0336ebec
-
Filesize
11KB
MD5601eab022185ff1bdd1c579899bfae8b
SHA1e84c1d21852655753a9ee4b04a4572b1ad55a3fe
SHA2563b390636912b4bfd63aa04e50f1c5eb037ee1b43c20ffdcaf965389c9abc406b
SHA512e0eb3815e027d41b4a68355a9881f106323178af3dcd1638243f672d6d682c734425a427b0f4cba9d759319633f3a1ad5bb1364abc55770043f7cabf48175ecd
-
Filesize
11KB
MD515fb379d528d58d7f1ae90033cbe05f6
SHA108532ed9c46f9f305fdb6854b10e56fadeef2d85
SHA256ed91004bd751b780e7c8e64e9a9c7ecb337388f8baa0626d5abf6c9244dc77b6
SHA512ca5bee3f90bf1ac30621fc6f7f721bbcd4bcbd03ec127a0c4d3ee1a78564274d38e240e6355856153eef77ee8e2daf97ab732bb56761fa873b6d8c30b670cbdd
-
Filesize
11KB
MD5957b69281baa3dd3f5611d377cc55cee
SHA115dc45f39ec41750790da4da85941c51a7503491
SHA25614dcb78990536d69efb4aa60ad26ae2867466077bc7eefc1b1e300f2a7b33e86
SHA5129521f42053dc712380eea0847f5c6b12d60c877801b99152ccaef74c405da7c1e50810463b8d1ae9e265c6ab513d333cb826893a959b791d10b9f5dcd998713b
-
Filesize
11KB
MD573eb0fdbbcab6daf6651bd6eb8b2aa28
SHA1d30573839b060cb5f1e758c363ae175c667ec070
SHA2560d7f1cf28fb98334b6d9da7a1adcecb99fdcaa3e9323bbc668df045cd1f1e1b7
SHA51266396a35cb9b601fe89d4add58702a09d229239b2e39bef353eca7b15f67d549299526dcec2c55b2924dd0fc87dcabc80933d96eca04a15dd34e8e8a2da25e5c
-
Filesize
11KB
MD5d7f00651cb309f2329f32aeea6d510ec
SHA1e028a5958a128f98e076e7d6d09768b75a416e9f
SHA2560680b53d1db6e50e9540a3d2ef245e27117a229bea68ddd757b490f5de78e53b
SHA512d2296ee8314cf8e56bda7df44a590d7bdc680078696acd5038735a3350a3158d781093b72b22c476a38df02f63ad3fc086d236326b8d912fa85df70efab1e911
-
Filesize
11KB
MD54beb14e6675b34aa6830e6a27c65971f
SHA188ae89a14c1d3fff93b2cab5950b6260f806d73e
SHA256b4c70be8821fe110e898a60e27ecfccfd5507a4763d815cbbb4ffc638488832a
SHA5124b9d4cda278bd6e7177e01ad5afd6ee64e86127254fcffc821c16c2709f1dfedb22d80ffdd8bfd3d88bb17ab56e3b9d3cc242741e297acf8b702f385c7f5bca3
-
Filesize
11KB
MD54f5ae8defa8f525f6ead6053d72ee333
SHA1b7f9fe8097c2d5671a2db736d08416fecc8d2b6f
SHA25645b51afc5cf9817ba18939bfce92a1841f7bc958e2fc836781c5a2c35976a76a
SHA512f2a2896cf29b370262d92bfc9cddc30ad1342a57aca1d66d05e008de33d0dd895a70d89cdb19461d8adb2e78fb04f6c84a5dd1dd7fbc6a6311f2ab81abf70c03
-
Filesize
11KB
MD5889452cb7647cb789fa8b65ea5785994
SHA15929a1d819dcc2b6f44f901bd33e8232adbab05c
SHA256b904282228657aa997b0c6f6a1b1208fbb1001fbe4718dfe8cb46f4b27dc4968
SHA512f71a68a9779abf731f0de85fdf6e90e6f444d0f473cfcc8de11e6a6439566e38697e16e533ea3df0f3a8a5da061b5d28de2bf809916c69792414a662bfbfe623
-
Filesize
11KB
MD5f22e799bab5e5295f70d78ed519a66ba
SHA1683c4d37009cc56aa59ff7a2d8abcae55b6ac802
SHA256decffe0b0f2798baf8781054f6d6ea02e0194ea703e18ec79e5b86d81f9f8be0
SHA5120d36de78d7a3125622f178bc5ee2ded0d6b733e71c9c5f93ebf5b9dbffaa2165e71e353d568dcf3f1cce60bbb265f46026935f3fd119974b6a1feeb319971861
-
Filesize
11KB
MD5635d6189b904025730b38b0f4dec02c2
SHA11f928e0d14a76f0151fb6b729d6dc817c5fab4df
SHA256a7c69264e382c5fbc9423126e98ddd3b118cbf0f2e22cd7cc21a7d48d6555b30
SHA512503126aa912994cc42cb61f8eea5c59d619e9db15ed20ebc852d6d929111497754059373f320ad4acdd96f0b4b22ca1b2ec5cb08594fc5c8fa3ff754aa0ef914
-
Filesize
11KB
MD5b53271ac6782d48b1dac4d0d69ab59e9
SHA13404455a3ecf6b3bcc2204e4d3c6720959a1b8b1
SHA256bdb1dae27acf58f744b8103da9a7f5dac610e98718e6b463cc72b885909da8e1
SHA5126b14755a457e01d33c878f6d8bd91438c27404366b6d413e15e6eeb348510327fd47f1ac2c5bba11578389f2af0081a8040553898330b762b42e40b4e2f7c59e
-
Filesize
11KB
MD59f5cfa85cc28694f6a13d8a57195fc0d
SHA1ea3f2faa1ff430fdb3df974e67603776606a363b
SHA256c1b9bb9d17b7c0926f5a4c8f3148ae3e84a3e0294e398f80c0ed7a13ffc2ab79
SHA512ac209da26aee1f71f4a25f6d5f8c9db4ced53b31d0f4e86c8f53b53fcc6a12d755bc0ac88811ba8150fefcd49a76ce937c2eaf5391027fd2adf0ba86a7e02a4c
-
Filesize
11KB
MD527f384138efd2147e097f57ee6872f6c
SHA1610758bbf5508f154cb99711808b087c75d756f8
SHA2569d753d496a555c90a99e5923aecd38160b05638be55a9300aa4dc1edbcc41587
SHA512ee39a328009a1fdd8ee713abcf878ae8c2800f42a83ca6b3ff4ed9809294e58117a10937c8a3d25c96f764e1252a49921021d3be0b7e70a7412ebb128909b3bd
-
Filesize
11KB
MD5bdcb329ce885e3f14e4eb16597bb5f11
SHA10a7e155fc43b5a48b0eac9a4a89e0ef2c2a6dfa5
SHA25616582c8df9c2dc2168677886dadf04ddf36802d009ab47e2dbda71fe344b046c
SHA512a89495e52e482406356475c73acc7b4ccc87c10054f10ca25fa9a4101df03dc99b1b40f73d3e5beec056a5e68d972e306f86b9dd14c22582852db41a4d2cb040
-
Filesize
11KB
MD53d91a1a6e520884b517f587ad3764d8c
SHA15409120404b3dca07fb265251550b902630924d0
SHA2564cf2d51767fc921b1f2af4286097b3a5f8acf1de7915d151b3122ad2e1805510
SHA5127745ca6e1a5affcde6be7519a414d9df60be4a8bbe7008d4135bc65d0e0e5a58f125fc21b01dcaa8dc51293971d77181e734e5babfe08f93e42dfa9f69f0d59a
-
Filesize
11KB
MD527bd51b86b61327d3950a2159efb6249
SHA17097c827e718a7d0556a2df9e80fcfa408fb8df4
SHA256e7ec94fa22f521b756fa26de60750063292defaea28bcd359e937b060d3e9aeb
SHA512850a3c90e5558c50d62c451e57c827d3eeb09a09e8e6087233c9dcbd43fc37a1fae0d9e5cd386dd4337477beb12d1e131825fec7dbf6085718a9a2e92cd9f9aa
-
Filesize
11KB
MD50ea8c296f527141cd3882e6ea3a559ae
SHA168333fbd02ec9914622fba2211e80b3b0aed08a3
SHA25603f66ab414f3af3f576a616f5d73fae40ab4d52f6181ab5a4850ed74bc7e2836
SHA5123fdb2695b030746f07bc7e489d1d48e4a62ac7edf4d1f16b1bc8cc349cd116300d27e1eee3c79160c3be7d7cd28d0b5cc93695a77aff8ba13a4607a5a4324260
-
Filesize
11KB
MD5e514f3aba8f10b8cdc25d1751845b86d
SHA1ddffd7dba388f230aadaa4bc95ed09b6b414208c
SHA2563a652315e595ca16b5a2948aa8ba87749a6da82efdd8531c38602c0f151f0e39
SHA512d6168dc8730bba3508033a096cebc6e094fa459dfad09360de69ddaad6df33f1b8163c58d44efc162e7a3676f426ea59832bfe8482b3e66c4117f420e76e2ab9
-
Filesize
11KB
MD568c41ffa5b66c878c6fe19d5a7f2c59a
SHA12be1b38f8cbd0727133617ccaee13b2f9206c1b3
SHA256731ddd4afbbe6acd91333fc398fce86bb74ab31d6a50ba646624c5e0a8b2452e
SHA512030f61ea96b59e19236706e13144af568bb62dc28f50e198bdd89633af8f8f51058d0397f9d65d7e9625dba5b5f7d6f1e2e3e3f03382c9bdcb7ca48d5211eb5f
-
Filesize
11KB
MD5108e81d3349e1ad3a25641ba6ce6593d
SHA198ab16a563529aaf13277dada67bb2dfa81c79ed
SHA2568327f115aa68c18076c20a9b364b74ed75fbbedd05e21d234693f57d3391dc8c
SHA5127868bf2a1363804b4c0a9df7bc8b62b7621a0d5e1c8b4edc774babd7f4a6c07d96ef04254b77453f6035c7b184f458128c3c5f531e34154d74faabccaed34895
-
Filesize
11KB
MD540c0a2de530ab86d0e05e155974bc8d9
SHA167e12c645f512e774c98f98b2696d15300ef9079
SHA256dad3c6569bdf246122d1994a720d0bd2663e25b840a3e27d4c7c67066f2107ba
SHA5123d4be6d0e30d18115bca89bcb7781c15bd1d3cd0d4332697963e6a9e02cd09b48265cf4f24505fd617197f9e0a26cd074f1419ee52d38b72acd72971bc2ded9b
-
Filesize
11KB
MD5041d9372b861e8c74aa01d2e9748e1fb
SHA1bfbff1ec927d74c4e019d26eb8a84fa47c28d01a
SHA256d608f6b695d5df9de15ae997a3d7ca3c47da2563be07a6dbc946f447b6f676ac
SHA5121143fc5b093374c5d5aee0942ea8689590c17cdbddffa80a3563a4867f35f301c111ac09264e9ec92b0c69037cb504ecd38c413db2a5113d2ddbfdb972d04d7b
-
Filesize
11KB
MD5df1eadecd32079072a0e3816d4068e67
SHA1fefcda8afabee0fb0bc4ade2fd6e67e84096b5b4
SHA256f5b6a5631b4bfb9b36d9f0c7479a4a101247520548cc944b74bd3eef7c880a48
SHA51288a12186b69d10b1f983a991f401c63bdc405584852a591b71b02476c54f75c911cbcd6868abe870051fa96feda8234c0ab7e6a75986dee092c61c388d334484
-
Filesize
11KB
MD50f281881538b35a72cbf6950dc5a9361
SHA1d462442bd1b9abd473b04033dead0506f3ad0a9d
SHA25621cd7f342e07c68c53cbdd7da40fa64232ae78aee62f2cfdac023c520506401e
SHA5129d79e55a119fdcd8e37d46a1872981c7edf1e66f54b0eb0af2150618dc2ea8b3f260dfa44dfdf1203c903da698a44c4cb26fde9af4e395614e15546ea0cb8d06
-
Filesize
11KB
MD58657c47a7c08b470488a8d274dbc3098
SHA135fffec8c8276901ca7b19aa7483983db61029eb
SHA25613a462b18d4e6a71977082c5c6f7836eea9706ce81e13ccf31101321feb39036
SHA512218c655308a1bb2bea300d28e77b9bdc1b010a405a7966638bf99dd06d27c36a142679c60efe067c544e2a09e3875c7dc2f2fb842bdfd2183038e458d88b7d80
-
Filesize
11KB
MD5feeaff4caae3ed9e58c073c6fc53cf51
SHA1d6aeb29465cb53a4e2c7d3417193f406345d83b8
SHA25638635d94603ef25bc2c6f8a67cd782bb922186b41273f844a06e827d093c75d2
SHA512e3fb368fb6cc160c360cc81218bf031a025e7d8711b0c9cb805e9e19eff734467f04c9af4f03fcdecb940b12430e9dde2e3b523a90c13cead47074d73c27a08f
-
Filesize
11KB
MD5d5c2877752a7fee13f91305c35fdbcca
SHA15e0601ba3386d8b7762bad08973b2c5b806c7777
SHA25637c7463ed96b9fb7d31710383d706f46859b7440f45cb9059f750586332a7ecf
SHA512ab669f8d868b760ea87f1cb82bf9de7554dc2eaf60e6cbd608b872fb235cf09cdbbfcc6b5a64e603da683e37ca584d3ea96e6de1336fc801813541fcf7bb01b3
-
Filesize
11KB
MD5922c33189e7780bf02366a23f3ad5cab
SHA1f16aed5938945941fbeb1fe55e4d73ba60779128
SHA2565af344da359f8cbbad4bda84d6f069041fc152e9be48cb53a982b3a1bf09fadf
SHA5128ca8edc05aea528110f401b54304b1b86d5d054c7863b029023da07c773923a789d0fb88ea50b4178cb6478f44197f6afeb2d8f3c1a649b8a578d9856f90eab4
-
Filesize
11KB
MD5bc9faf33c8ecfb526f4082fee0504ae8
SHA1ad85748028d03dfd8904075256a9622066981d22
SHA2562d1ec8cdb1afaa2a453e15e37ee36b1f956ad5b492f4807fccf366b4c0cd09cd
SHA5129c0ff7b81be6ad49b44d20562f527123094223b7f5bead348d070fb5353e70f73063c25f7a874e0b397d9cd9f9b71b6220cfa7f3e4b93793b610fb4f2eaf7ebd
-
Filesize
11KB
MD50d68d14cfd2068799939a2792b015bd6
SHA1d982803ef6513ba20d6c3f9ae46ebd801f324abf
SHA2563a727122d24ad7a5d9b21719c60585aa7c7752bfd6bed3f9fa2297e04e02a691
SHA51227e0ab5ab9d4fb8374e69a8a5bd1348ea01838227e2c69c69ff18834d4560915c26f9131c25044be80c7b4cb66f8755fb0a071352491c1d35c7cc578ccf47356
-
Filesize
11KB
MD5780881965067bd3d4851874978323db8
SHA17a22cb2be8bef6659580b8d3d0fe831d928474ec
SHA25604346d55d19abe632e32285f1c30073ca833708af45c748a595853e5c98d7ec9
SHA512d7908d503acc852c46b1d7e10511d044303ee1c0f42cbf9235ebe948b4b3bdf1c0c3561c958d1cce6637bc4e81a1e2b2100d9994e942765fa8e1cafbd150a7d0
-
Filesize
11KB
MD5ae1b5adc42069a8d775343198f2060b5
SHA1ba2416b81f468d87defeb52496138b015b311f13
SHA256fa038b4da909000f10fafb2de3a66ced9205ed4e7c1087809c0a2522d54f54d4
SHA51267331f78b355d6af746c489df62ada9ee30a7fe65b7b60b2a4483d9678e2596ace59870745ec5d4d6463307b9c0129ee9b71a71a14f12a960ac650c53af7902f
-
Filesize
11KB
MD54e01056b0c620f31d80ba13c0ae29f91
SHA15307cac816b55e1c5c14b3f3ab5feeb48a72fb15
SHA25645b6fdc29476c11e3c8fba549f68c58f074dbea8cbe91b26162081bb040db2cb
SHA512758134a0e26f2239b93ab7a5a362900a3fec7e98acf8c6a0f3bc0ddb4f1a8bfa21d35a0495af45270cf8fab19e6afcb654a6548fa13526fe39afa0f5679657b7
-
Filesize
11KB
MD5e7ab98789fae0d8b175d5626fba21749
SHA1559d59193ca2202c803e146f06a62834bf6a8b5b
SHA256c0c808969982ed510a09c3ffcb5726f277ce1e56e1e3e4af63c32d24aa47a7f2
SHA512a2443eaea6b583818e405b2ce05361ab51bd5052082808c03d39490432d75cc3fd27a53505919261d309b81616b47efe26b3428fc805f48c282e05c1066125b3
-
Filesize
11KB
MD5f521533f5836e553a2f9a672012205ac
SHA1a708921f01b2696ba94b0f86b9a02ab102f62278
SHA256a205bc4be3463c72735e9215e2d36b3140ab43c2237a00394f80fb96bcfdb65c
SHA5127ba0390a09dcc2c585d1525251b4f280b00b30e9cd4f67e311e375d82ad848de79207d49fb6d4d75882cb5c61ab1026b88dd27ad34bc8a689046f28b13f9d9f6
-
Filesize
11KB
MD515c40f0fee2002ff24761d07de552e72
SHA1a6a2ce6a156c04e06c318f8766c267166d257d7b
SHA256a7d86cfbc40116e48c2a9e5873690d83094f0c4c0abf3ccb55e525528f9b71cb
SHA51282e68203ec388174feb1793b8d609cb8281bb5bff4c92688bfa48cb49e5eb461944ceb025dedde9eca8a7a27bcc17debfe1a2abfb7a6f93b471a9e3741692d8e
-
Filesize
11KB
MD5393db9d7b82a45b14f9f13b35e33d546
SHA1e537ec9d8517239c27c25bb1fc2c51a46742c442
SHA256c717a9a9d5c082d6c68daa6d7edb298a81e62cbbb02b605546a8922bf2ed4770
SHA5126ace9ddea360a6df22c4c8feaa19be80e8dd22103a6291b8e8daab16b485ef0c27815b91c1c82afae0e173cb4083b9440bf41be0eeade8e27eacf195720ef26f
-
Filesize
11KB
MD55d931edfdfbdfba581ba9ed318e51bf7
SHA11599c0e20487ef8e1900719cf34e042fb48ee991
SHA2566bf914dccbaa0bc37b6772c252715a8090532ae3ad847a3ad51fb991f680df6c
SHA51230818117294fbbbc03241c71606ad7e1466b4a5b60ba9e9d0260b9e27d42e864c6f304af7d08afcf49d7ff9c2551262e873f724efd943764ab683148bd7736f0
-
Filesize
11KB
MD5299a4de33017840f8e631a80c1df282a
SHA1b1561a4b154c34118b8826b95120683f1a31a539
SHA256798d237cc74c9474d2325e297c9fbe7ee6e96fc7b93c9254105b2f16efc7f861
SHA512c1a5264f69a0499972bf750edddfcc02e67bd3069650c35c93609a88e5934ef1b8b730210687cb2f6cc708586b65055e77e159a9cbe5ac954d0290e4b8eaa636
-
Filesize
11KB
MD5433f3b8c794ed2fb44ed7cdd276a6647
SHA1cb85ba5f46361b6c5709657db80dd26da8ad2e8f
SHA25607e8a6c16cb1994ecdfe905c90a49c5f5830abdcf8659bc97e92af37163b0258
SHA512e33f78806d0a68c1b81be14455f41a808da3ea5a4d9802f581dec707960cf3899f63bf7e032a078a8876301334c9779a5066f5004d8c20c25440bcd2301550e4
-
Filesize
11KB
MD56079738bdbdfaf9516a04ff10c8b3977
SHA11d7ed1f03cce4d7001721f06b65d766637e81269
SHA2566913ba6a934aa1ae9607867e5423be0f6e63eddc2a145509ef1723dabed59eec
SHA512b95d9f065eb304e247e04c44b4ed280b69a8a9979b330f37f1896d8ccbcc0ca8bc4d0676ccea82d925a806f699a1ecfafe520f986efab6f6a96da5da5dbec4f9
-
Filesize
11KB
MD5125c2a535e26ee5414d9aef3420d5642
SHA12ecb1b7d10777acdad16665f240a31d54cd43c80
SHA256e503ad3278428687a60696d1579eca08c7b1bade1c5cbc4b8a65f663d93e0d6b
SHA512f4d6c4c4dc9418f5b2b77987991a6f15bbd1ccd95deae6b658bfce5ca865e1c3917f8387c7aa718ac362aab2e5b1a92dd3b9d8a028d23da8874bcf5d94c5a6cd
-
Filesize
11KB
MD5eec859b23d9ee36271a7a5b1a5623461
SHA15b7a5171de3ccb821c508e8a504e4e8e8291c591
SHA2560a04b1d762e3c9ea892528aef8ff2ad826f9dae26cf6dd4afe21cf5a0663423b
SHA51270bfc57d9cb3f95e16398124db427affc5a0cf6ea03399c15c4adebc85cea0163479d808854c7211a79db165aaab3066349266903e93b12b50461d9dfce3411d
-
Filesize
11KB
MD57aa43377d174dc3bd3e177032a19479a
SHA1d2dcf668d6b6af59de88ffd032f596d8ff46d08b
SHA256484e32148e18993ed450ea168fd97ef677cfbc71d54281662d6b8989403c1ae0
SHA5120ff55b918648d812c6ea39faa8e10309488791284b40aa508ace6a25db01ca2c2f0bacd68bc1479a6e576d179686125d7e4fd7fdda7c09d78ed9aa27b74a5751
-
Filesize
11KB
MD5020860a94897cd1a16aba063008c9b1c
SHA128a3a1eebaab57b57ed7ddc544d41a4f4049cc95
SHA2568a917e912f3702884f83c3e7a27f34da82206cfb0fe3cbdf34800da6c2696c54
SHA512c4d8f40380d1c0bbb53799c849a27f367af92ccc69b4b6761a454ad10c6e72606297096c8586a739c0fdd8e4d61ff153c925c5358378ded84d4877c48770b6d0
-
Filesize
11KB
MD56c41d97d3378aeb60b56a0c58757071e
SHA1f57e0477eb4e88890fd17aac7b4971d5977b5692
SHA256815bbdac5dd00271d5b2109ae577a9dc91e3a59780ae7eeb25dc45ead95ee459
SHA512c76d5170fb9060e83549c5bfc482ed2b135adf538dcf9979f7b053af7da18ecb535ae3411a16f9fc0ec1d682bf61556ebbf6c4bdfee4749530e96bc9490d2c2d
-
Filesize
11KB
MD5038992fdd58ec433b6df779ea8b87579
SHA1a0a6ed34194fb9a27e079289100248aaa4d23e1b
SHA25677ee5949610cd8fb2197b1ac21c67811f36a45703b7ad00598976f5dfe325845
SHA512c681e579bf64d23fa64df7b33cab784788072e85607e15b696e3c9ce38adddb03e04f46c18c15416243c474ae347e1ff32feae977e3e5e26c08d9e7e068da5c2
-
Filesize
11KB
MD55137f265b05a53085f97664449b755ea
SHA1970eb3855b4f69dabfe6001e9ea6d418f5eef2f3
SHA256885302e55820f3e10132d828b33bab1997362c9c5a62479bc23197dc388f7950
SHA512eed2b47c968f37826045530a0e21a21ca446705fffdfca4f68aed9e971d58f8cf70e3aa2b7b882d07794e440173d1cf4d56587605093cbfc906cc6aeb4fc8fd4
-
Filesize
11KB
MD54c7ba4c983ba6b3b03a6729b918781af
SHA11feaaadd06e614fbdcc9bd1d14cee7a8f7c8501d
SHA25639f326de80b82ecec6ce25c0256f65c6d38d97e8fd54ac41e8265c4212e6ad56
SHA512da99f51aec2d8f5467cf178a24cd908db009ae7c11694b9ca3c032dd4129e374e66850e5a94b1ff0aa94eb0d2d2a80632eef1e6943246a541d5547b6c5ff0acf
-
Filesize
11KB
MD5ab3d7bc53ae44093d485db7f1daca510
SHA1a8d3e4e396dc3b613e43f8f2ecaf278f8cffe341
SHA256f44850f5319b3ba3ffceb84ccc05aab3a8525b04c94d8a6bfa563c08a72296ab
SHA51296e06dc91cc2ffa526b81f36cc0663ef17250c6e08f5d9b48157944a14522ae70689008e7294645d15c5bd801aa02a1420c3b1caebc744986d5216e2ab798880
-
Filesize
11KB
MD540628dd5c7a3aed33742ed42b9412242
SHA1c9f35c084e43f1824312a9d3721bc28c0332f7cb
SHA2562978c3917ae6638325d5b639cf08fa8abf83afa78a3cf013f4fd50fd2c2174ea
SHA512a081c4a5880df96669a596e8f98eafb353372da71f98287437c0f8fe2bc7eab2f6505df06c00fc258b4a747ae44800374bff51a547bbecea8bf736dd63b196a8
-
Filesize
11KB
MD5c8a9c7e5e34df20d385e03f5567c6e20
SHA12d97d886623183b5510fab7d55a8173c03fae8e3
SHA2569b5731deb4d1b8bed1c9da784287e2d8528cbdea04bb4cfbdd021643e9043c49
SHA5120c490de062708bf251d910dd7083669159cadc206e86136ca1bb94de3e6d5bda78dd921afa5f74dfc7adf18ac94a26e87272f0a3077f54185f007dafffcc07ea
-
Filesize
11KB
MD5147aa6211dc39109f9ee516fb79ea7bc
SHA1eeb5130be67a0a14e00b0f52c9ff19fc8379448c
SHA256cf8c1a93a90a8dc145ea918b595dbc5a5bd3ac22a18df66ad95363cb887ed207
SHA512ed8b2fe88d35e5b9d50f90371471e4bc1173af96884ab3de94cb1418845606bf58c5bbed4b55a285a19b92c94df5828cf2ca0feed35c7040e6352c285040e965
-
Filesize
11KB
MD54818c327bf441064c9d7eaeded4fcb70
SHA1a1c4134adcd1b555e20b56ae58bc7afb8fcf6b1a
SHA256e3ee0cabc7d811be17f2fc07c8ada8e39b92069b95e501e689bb031261fc0c3f
SHA512a5f252affabe8631b95af18b4453847de7661dc1bb54151f2ab098c6a7a9ea6c6fe12c793d13e50d1981cd8770ee2e4b431588e41822b823f05d3e88d6ee328d
-
Filesize
11KB
MD590f1b814bef5de280c92b4645bc60762
SHA1131bec50433ba4b72449f1d8198e2e6d8a3f93ab
SHA25648d7e5ab9e971104cfbeb7cd1bd46156ca8900e4d7b3343fad0b2a575a0b33e8
SHA51223bde1d3d5187e91f54596a77aa123d66f7cf4e83a7302901a8590ed08070dc98d783a62c185254804b71a24abb7194a273aca57560b0c164d71a355c33b5112
-
Filesize
11KB
MD57272757081b2950d2bb5d017f7e35999
SHA1e2c94c4d543042db1c84df8b159909f9a1fd7810
SHA256ffd376ae26ec04374777a2236e86db5eda392ea3ba5f84b7bbd9cda6dc121cf1
SHA5127139a4593399bcab34618a22c6710997f79a30d9ca6a834c0b95e9d3f52db6c9efae3a5c4969fd00b6120ecc52f8d022d4dca4fee8da372a35de239e686f98b9
-
Filesize
11KB
MD584f610e1b00c7e8b2a538ce6924abf90
SHA119a2c5fc9bc7f5646e4db527ed93ba3114143d1e
SHA256cfc0a866ee574f2f9d2cb02cb60423ddae9fd0efb50f92f22fc552ed23541cfe
SHA51279b3f5aea1077161a5932195ef318445aa237a1f762e076e75ec396e5468c58c1fbcb4a6c95e30258e94291d416abaa10fc7e22b38ab738a4c26378945f34a55
-
Filesize
15KB
MD54bb133048cd0b27fddef85bfa4162ea8
SHA1c4aa277b54a871a06694378e21313ae7974c10ad
SHA25682f41e17ecc22e91d3ec09a5af51c5e011cc6317a92f7831bbe320c4f741bba0
SHA512b7195169905817184eb27ca44708114d590f28a6801be186b11013a805316c743f15bd94ebae76e2ee19f2aa47a21b58cfd8aa83d394874e0898a03b2677b56a
-
Filesize
24KB
MD50665cbd0b6ccc43994a33ead683d85d7
SHA149415e6b483f3daf93ffade9e907a8856c5e69f9
SHA25690601aa35e077f62716100431b065f97ee7c66ebf52bf68b852d167c910289ff
SHA51265f925995bd8c4d4aed6b9090a0768d6e525f3a1b9559430573f4f99bf602d7e49a047eba9b2cd7cdd948c7511a74fd344cd6aaebcf3630566e15a80c9f5744f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f90c0a9b-c983-4a9e-9a25-d8cc89ea802b.tmp
Filesize11KB
MD55e27415ea3a7cf98993671d7db539582
SHA1d80529a10893f8036e445378138d157fb9c14cbf
SHA2561239e63e44431721b00570fbb5b82084ddc6bef934a79ac8e28caef984a1e2ad
SHA512951b57e4fe9710603974a4c0501b8c219b240b1e21da4b6f1772c62097ad371ae9501d7a880cb9488eb8214d7a40aba84fd13001096bc23d3990138bcfe2c6c9
-
Filesize
195KB
MD5e6ce4c9024de93dc1be63599e3621d29
SHA18bd54d4e622f4b478097f9a0a0d97135f0a5dd2d
SHA256d4465041057c22f3357fd287db6f90b565df9dd02552e8040939d243dfbce9ef
SHA5127ff7ab512cd0350692af41568d7d7831433df22e25a66a8456ba4daa3b3de163d3613c37b983c0c969fe50ad06d5e503afe9eb833f21249820c72c659e92e976
-
Filesize
205KB
MD594e7b3db1b110a7f4e0f42344a99b52a
SHA1f37051a94db084b1600b01b9e877efa8e6c5c5a2
SHA25641033095c155da4b76649ead44d061cc8d8c94c9ed80dd8b7c4eec597c17ff18
SHA5129753faf29e85eb8254757e9dafe552a61751269e48b3eecf0a9281cb1dcb4e760349807fcc0340edc8b7bfda0267b5e6c163af71041edd7415511aaa13f160ea
-
Filesize
205KB
MD5a4113284e640434eb2191c693ff6ca0e
SHA19bfc9558d36d931555a6a053aaec1eb77c1bc43e
SHA2561931630cc5a01f02df4bcde2c2b20b15ee5e08e97821f9201cbff097bd0d9010
SHA5122483cbeb8cd34a6c62d4ececc9ffa694b5a3b3eecd9775e479bcfbc6c5366177a4b5b6a5dda36b63ba6b2dafcdc9a13e8401c37d157fd01d818af809b991b9a3
-
Filesize
205KB
MD580b2559ad9f6ed477863c5ee49ecd5cb
SHA1c4ecdc4c039ef56c907cb61c76ff35981fa5a309
SHA256fcad5d82e70191864e8e9c094e7f9a56df419e5876c0dffd1cff18fd42fe8846
SHA5122f6ac12519d8c5b2ef8d13da2982ea2dd711e083a526a7623b0fe67ef949821211767df8ffd9cdeb45b4c48841f9030f015ef2e58c0e4c12da142ced57d63362
-
Filesize
195KB
MD502c2598d75e65a04703f012e90f12ae1
SHA12bb88b6707f60202d23c5849f70b8fb1fd4e6997
SHA2563725a7fd43184a01d7232b2032cf6fd97a73dc4b96e1bc10d9d3ae880d2e83f2
SHA5128fa17620fab964c54493bb750e9625af1116358c4badbbb2c052861cd9f566848610349132c7b4dffdf2f3dff161badf50fc47dfa5ebc618cfd959025c8fa8cb
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WC3VGW7B\Opera_GX_112.0.5197.115_Autoupdate_x64[1].exe
Filesize1.4MB
MD5ef77b9e63a994d1bd5a1c936e4bc264f
SHA19d7fe87b0dd4042ef6520d491134e0a16894afad
SHA256ba6263ff430697fa6de3065e58d302f7ce23b947d8e0fb892f679cd745e6e377
SHA5124ca4d38f0de304bdc11fc6a74fdeb8fe6084ce7a0a9e811cc6def2ce017dedd1c5729fed0962db2e8e8376d669778087087ffdfffdc1f167e4235ec649a70f1b
-
Filesize
3.1MB
MD5870793693920448d5ee409bfda20038f
SHA197c65e0854497f038b35e1458a1cea6386a4ef3f
SHA25682f92f32683a6b95d6aa2871728b9ed77729e81ecec0c1791946530467d9a849
SHA51258f9cce62abcc61515e6e3d72a57712ffb3c091218f9b49e8f019f838c018596e1eee8044e6210add9b7343c61e91959e482422dbb7b2e5f64665520d366c034
-
C:\Users\Admin\AppData\Local\Temp\.CR.2956\0dbc9385-f60d-41de-8f40-721e9b13b545\avira_system_speedup.exe
Filesize35.1MB
MD5aaba5dac0f60ea249b7e0f1505909eb0
SHA19899114f0b381ff7ba25849633a36135a0dac5da
SHA25607e0803781af3728a80cdeddd95e26b0b7905b8703e5a46615d4401acf5169ef
SHA512b653693790cbc520774ab72617196a0c7d6fd29a2d989269c421ab98a06f3b0d1e0c958d92fa6dfe822980efe46ec3ffb3dce5334e5def876973745120e90be8
-
C:\Users\Admin\AppData\Local\Temp\.CR.2956\44bfc573-88b3-4954-bd91-af2d44edc40c\d41b55f7-9a25-4823-a050-92a22d01957b.tmp
Filesize6.4MB
MD53ad6f1d43acfdb4533ade2e597f09ecd
SHA1295d0c6098f19c81c48a40db7a97a88b4f0632f2
SHA256dba4515014a26c44fa8cf4c7f2502bfc29855879e5c890e037e24d09fc757cf8
SHA512405f9e510612899c1b1a79bcb1846f0c283e173b7a7b57de307a3c72d5462ccc323a7a93d69528bb461cdc24e4e22c7038f17276daa3bb31a8862fa6c26bd4bf
-
C:\Users\Admin\AppData\Local\Temp\.CR.2956\90c933ce-738b-4c2a-b609-9e6e9453295a\avira_spotlight_setup_lavasoft.exe
Filesize33.4MB
MD56cfe12667ac17822ea98fb4b35c59f75
SHA14a24b371f5c5b9deb2fbfac8ebb914b8b3ab026f
SHA25692bcf925b39505ed4abc088db1c395e7ff091970274bacb96a60b67786fd80d5
SHA512b058d53416a09a9232f206ee0112a314600ad6c1c6005f7c7b96dbc65011e9b95d5d48d474f62449da02ff99a912499425ebbdfd0c286a28fefb52661832ff58
-
Filesize
5.4MB
MD59b41201bb6d9b439103b7a2fb1d41038
SHA1e5c7f61421be5c5b0115c1be03ef1bbe8570c832
SHA256f6d4a140924af35dfbc63729736310737c6356052094b19fddcb6e88d7e210ed
SHA512b06fcbac44b679dace89ad633269f02117aeef19a9fb1d481d19f8d5246c8dfd305eaf228994dce10c9f3c3151bd4aacf82c44e541ba7446b23f48f0e23c3eb5
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409081143343\additional_file0.tmp
Filesize1.4MB
MD5e9a2209b61f4be34f25069a6e54affea
SHA16368b0a81608c701b06b97aeff194ce88fd0e3c0
SHA256e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f
SHA51259e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5
-
Filesize
6.4MB
MD5defd30ea336650cc29c0c79fad6fa6b5
SHA1935d871ed86456c6dd3c83136dc2d1bda5988ff3
SHA256015a13bd912728e463df6807019b1914dffc3e6735830472e3287150a02e13f4
SHA5128c6ebbf398fb44ff2254db5a7a2ffbc8803120fa93fa6b72c356c6e8eca45935ab973fe3c90d52d5a7691365caf5b41fe2702b6c76a61a0726faccc392c40e54
-
Filesize
1.1MB
MD582f0b122e0b9fcc48981696b147ab408
SHA177091b1086455954849b2f52e1fa815c92899471
SHA256cdfd3e8e93189131bbdc4a92da7b1976b6aa5936ebe5d493403035cace40a022
SHA512296f6ad131e798e78ab3741936956c2b33f633814b5dcdbe8c49bb0caea3c653e1bc3adb38e64300731cd3cf5fb77df44fa7ca423246e6d1ee2cc6c446728167
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
8.1MB
MD59f8b47b8f3d4acf39870421606b7132a
SHA1ca720fa8222baae199b0ae6f3a98f6f538bf87fe
SHA256ac8d64f2a424e08e59310512d9f0e0aaeebfcf7a04270a62944e0f63fa7523ab
SHA512736fddccc66680b09bd27b89f5efefd969bd1ddd2e5a6d22fb0fffde4323fa99a73adc8fb206d5fef7f5cd605a48e311f0da285dd290540bc32a36feadfa15d9
-
Filesize
5.9MB
MD5640ed3115c855d32ee1731c54702eab7
SHA11ac749b52794cbadfec8d9219530e9a79fc9427c
SHA25629b4cabc7a0e9dffbc2395b976749be0aad88357dd3b1d7e0cfc9b0c645421a3
SHA512bebe55fdbb363b78c4a6371304f65b89e03a03cee5a8ebceee1681261d8df64a0de36888ed763c3a607ae2732ab54e2e41edb624f37a7fdf8755c40e6bb96f53
-
Filesize
57KB
MD56e001f8d0ee4f09a6673a9e8168836b6
SHA1334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38
SHA2566a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859
SHA5120eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6
-
Filesize
117KB
MD508112f27dcd8f1d779231a7a3e944cb1
SHA139a98a95feb1b6295ad762e22aa47854f57c226f
SHA25611c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa
SHA512afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb
-
Filesize
5.7MB
MD538cc1b5c2a4c510b8d4930a3821d7e0b
SHA1f06d1d695012ace0aef7a45e340b70981ca023ba
SHA256c2ba8645c5c9507d422961ceaeaf422adf6d378c2a7c02199ed760fb37a727f2
SHA51299170f8094f61109d08a6e7cf25e7fba49160b0009277d10e9f0b9dac6f022e7a52e3d822e9aee3f736c2d285c4c3f62a2e6eb3e70f827ac6e8b867eea77f298
-
Filesize
15KB
MD5422be1a0c08185b107050fcf32f8fa40
SHA1c8746a8dad7b4bf18380207b0c7c848362567a92
SHA256723aea78755292d2f4f87ad100a99b37bef951b6b40b62e2e2bbd4df3346d528
SHA512dff51c890cb395665839070d37170d321dc0800981a42f173c6ea570684460146b4936af9d8567a6089bef3a7802ac4931c14031827689ef345ea384ceb47599
-
Filesize
75KB
MD5c06ac6dcfa7780cd781fc9af269e33c0
SHA1f6b69337b369df50427f6d5968eb75b6283c199d
SHA256b23b8310265c14d7e530b80defc6d39cdc638c07d07cd2668e387863c463741d
SHA512ad167ad62913243e97efaeaa7bad38714aba7fc11f48001974d4f9c68615e9bdfb83bf623388008e77d61cee0eaba55ce47ebbb1f378d89067e74a05a11d9fe3
-
Filesize
19KB
MD5554c3e1d68c8b5d04ca7a2264ca44e71
SHA1ef749e325f52179e6875e9b2dd397bee2ca41bb4
SHA2561eb0795b1928f6b0459199dace5affdc0842b6fba87be53ca108661275df2f3e
SHA51258ce13c47e0daf99d66af1ea35984344c0bb11ba70fe92bc4ffa4cd6799d6f13bcad652b6883c0e32c6e155e9c1b020319c90da87cb0830f963639d53a51f9c6
-
Filesize
160KB
MD56df226bda27d26ce4523b80dbf57a9ea
SHA1615f9aba84856026460dc54b581711dad63da469
SHA25617d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc
SHA512988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5
-
Filesize
119KB
MD59d2c520bfa294a6aa0c5cbc6d87caeec
SHA120b390db533153e4bf84f3d17225384b924b391f
SHA256669c812cb8f09799083014a199b0deee10237c95fb49ee107376b952fee5bd89
SHA5127e2e569549edb6ddd2b0cb0012386aed1f069e35d1f3045bb57704ef17b97129deb7cde8e23bc49980e908e1a5a90b739f68f36a1d231b1302a5d29b722e7c15
-
Filesize
8KB
MD5be4c2b0862d2fc399c393fca163094df
SHA17c03c84b2871c27fa0f1914825e504a090c2a550
SHA256c202e4f92b792d34cb6859361aebdbfc8c61cf9e735edfd95e825839920fb88a
SHA512d9c531687a5051bbfe5050c5088623b3fd5f20b1e53dd4d3ed281c8769c15f45da36620231f6d0d76f8e2aa7de00c2324a4bf35a815cefc70ca97bc4ab253799
-
Filesize
154KB
MD517220f65bd242b6a491423d5bb7940c1
SHA1a33fabf2b788e80f0f7f84524fe3ed9b797be7ad
SHA25623056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f
SHA512bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e
-
Filesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
Filesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
Filesize
541KB
MD59de86cdf74a30602d6baa7affc8c4a0f
SHA19c79b6fbf85b8b87dd781b20fc38ba2ac0664143
SHA25656032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583
SHA512dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641
-
Filesize
133KB
MD58db691813a26e7d0f1db5e2f4d0d05e3
SHA17c7a33553dd0b50b78bf0ca6974c77088da253eb
SHA2563043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701
SHA512d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f
-
Filesize
26KB
MD5cef027c3341afbcdb83c72080df7f002
SHA1e538f1dd4aee8544d888a616a6ebe4aeecaf1661
SHA256e87db511aa5b8144905cd24d9b425f0d9a7037fface3ca7824b7e23cfddbbbb7
SHA51271ba423c761064937569922f1d1381bd11d23d1d2ed207fc0fead19e9111c1970f2a69b66e0d8a74497277ffc36e0fc119db146b5fd068f4a6b794dc54c5d4bf
-
Filesize
172KB
MD5b199dcd6824a02522a4d29a69ab65058
SHA1f9c7f8c5c6543b80fa6f1940402430b37fa8dce4
SHA2569310a58f26be8bd453cde5ca6aa05042942832711fbdeb5430a2840232bfa5e4
SHA5121d3e85e13ff24640c76848981ca84bafb32f819a082e390cb06fe13445814f50f8e3fc3a8a8e962aae8867e199c1517d570c07f28d5f7e5f007b2bb6e664ddb1
-
Filesize
1KB
MD59ba0a91b564e22c876e58a8a5921b528
SHA18eb23cab5effc0d0df63120a4dbad3cffcac6f1e
SHA2562ad742b544e72c245f4e9c2e69f989486222477c7eb06e85d28492bd93040941
SHA51238b5fb0f12887a619facce82779cb66e2592e5922d883b9dc4d5f9d2cb12e0f84324422cd881c948f430575febd510e948a22cd291595e3a0ba0307fce73bec9
-
Filesize
291B
MD5bf5328e51e8ab1211c509b5a65ab9972
SHA1480dfb920e926d81bce67113576781815fbd1ea4
SHA25698f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b
SHA51292bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928
-
Filesize
134KB
MD5105a9e404f7ac841c46380063cc27f50
SHA1ec27d9e1c3b546848324096283797a8644516ee3
SHA25669fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b
SHA5126990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940
-
Filesize
101KB
MD583d37fb4f754c7f4e41605ec3c8608ea
SHA170401de8ce89f809c6e601834d48768c0d65159f
SHA25656db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020
SHA512f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f
-
Filesize
151KB
MD572990c7e32ee6c811ea3d2ea64523234
SHA1a7fcbf83ec6eefb2235d40f51d0d6172d364b822
SHA256e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3
SHA5122908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682
-
Filesize
766B
MD54003efa6e7d44e2cbd3d7486e2e0451a
SHA1a2a9ab4a88cd4732647faa37bbdf726fd885ea1e
SHA256effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508
SHA51286e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198
-
Filesize
426KB
MD58ff1898897f3f4391803c7253366a87b
SHA19bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA25651398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03
-
Filesize
74KB
MD51a84957b6e681fca057160cd04e26b27
SHA18d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA2569faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA5125f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
-
Filesize
4.3MB
MD5b102cdd8d737a4bbdb6f661361277813
SHA1a66c7d08024945dd18f8eede13781e24289595c3
SHA2561ffbe30a177463c76d6b48d92a0f4c87144d01d7a159463012e1377c36f69280
SHA512adbb0e90ca2e29aaaac7968b9af4984ffc012b7eb79f8d11cb3e1f4510c8a7240acbe75febc651eb489402cac2d037223870e46482bb45cf409242cc3e6daa46
-
Filesize
2.3MB
MD55a0d834ea87899647b79051b170aaf7b
SHA18a3759c32de03d3c551d41e85d1e242516a3b016
SHA256ecc78f79182ce9ce75efb8a2ff9a7fb3fa9d76290837771dc286154fc2d7bc07
SHA512e583f21d661d487c091c98b92d6047e715290dadaf6527812a15635c94e3ebb7736fe85a10c98695faf5a8e1432b2fbf70a14bf7d885798cf3111b9293b2c831
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1892_1183960385\95e2422c-b2fe-49a9-9a39-376c671cd4b0.tmp
Filesize1.7MB
MD59d7c85e958816aa0fe0729ac69913e48
SHA19b040582598b2a53652a90401a57b1e54aa73271
SHA256598946ed9524cce117568dafeb7a386c8f498977b2f404745bdd01438548b302
SHA5125c3a9d76c013c8ee9157d7fbca62107f2a04482fda06a5a44f61d109d84e8e8889a402bc3dfcc1e6e97cb5117ff79a9f2930a1027fa54d62747cd7d5bb587ed5
-
Filesize
225B
MD581f6005d4e620b21a13cda8c521fb24e
SHA101fe568895993c7b242b25eb7e6e5d1073a82b72
SHA25649a05fc37600b7be604af11cfcc48f017d735ef205f0831208a85f5a51bd6a68
SHA5127689b0069f1be03fdd95cb48f9a5cf6553cd4f496c6226c5e4d2796719a77e626455dc689da5220c3ab7731836d67a85da354617f77d3d275e4071e0dc5d70ed
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1892_1183960385\CRX_INSTALL\_locales\en_US\messages.json
Filesize247B
MD516a706ae1fbc72e86de7cffecdf2c24a
SHA16510e8aaa9b8e5d1d249c4a056255797d9632b3f
SHA256daca358f3c9911fe3d82f87a1544e8265fbd19250f19e84fe43b3ccf060ecd2e
SHA512abfaeb0db06fa8ccc802a0465c0fc34031284c615cfa9682066c369c2a89c19e807c8ab473e888a753d134fcaf1b0521a21c6904d9d4b64655337e7adf3a4931
-
Filesize
10KB
MD5e72d6ec78bcbc8fb54aa0cc62c363a53
SHA1f0c0a15a848ff24dfe425fe0fd493b5075270bb2
SHA256278d382fdca7e2a694f94c0d0171a2e79ed6b76931687357c534b7a5959f61c5
SHA512de29e1724a4984976fd3220ae20970a762c4a0ff1da08df00b7c99f7be090114ee2dbc3e89e33ed5fd617159b299942d39039f142ca864a90b069181f0868e96
-
Filesize
54B
MD5b176b474414092f01ce861f9da4bf2a2
SHA1d175c77bf023434e6bdd14697d12653a4d397755
SHA256e61a1a270d678bc281c6d857da661c2b9ab77dec18f2723dcc106463e1911c63
SHA512692fe6310ef028b4ee7fae0d363947084fc1bda5d95b3d9f2c52882e02e75fbeae88b6fcbcf7e954400eda5f66634a45bf2eec022da1cca19cd64cff9600842d
-
Filesize
4KB
MD55c96abf57abfc0c8d233a915d8a45278
SHA1dfb82a20642c8569408cc58e1f5329f4bd530e3b
SHA25698b0a8047168a3c7424df463c1959578103360e8ccddd76575da1ad4addaeca7
SHA512ff6c9d771be44ebbbac173135d86b840c74f0bbb2f72992f2151b9ad034c22a2da4e53c89fedbe68d0a31292b325e255d739d47d291fd3b614d18df9caf301a6
-
Filesize
171KB
MD5dcbf559e8d3c057288f0359fd9ebc226
SHA1d09a90ff406317db1a1031a926b8b84c66f03867
SHA25684fb8dd4ed47f63e17d5a27e3ee29681eb1cd57cb6cb05c3ee62dc310b6d30ac
SHA5128412725409946efe6f6d7871fbabb8ec8fa4a0fb8706b0d97578f17b68893ce92bc5f41f929188e5b0a26e0173c98c76ff2f46c06d0d9884b2ef6d40c0df9a57
-
Filesize
5KB
MD54672ef0eaf7515a69409c9c0fd3e62bd
SHA1ca920038f11d0ae10069b87f0ee32260a0d0f523
SHA256593ba5536ea92a87e55004874648ff12f096c71bc4dc81c084f0c59cf662cef8
SHA512304c5f7440e6e38127594892d993c740ce338f3b12a64923ab6793936126d0f68df27f83d0213f85926a15564ce84e81401e06448ff8fbb0d92b871db984e526
-
Filesize
14KB
MD5c58a253eabbb0e927be40fc38cdbcb20
SHA1e059d751b87cd0d8b41d8946038af32aafe9dfaa
SHA256388f0023cf6c338f0f14c8c4787550e38427e1013d6c02c187c040d461d75dec
SHA512e76ae4d3f4fd197f04e412577ef7a7d6d7eb1e5f5dee14cda80250471ed4a47ad500172df014d129843375886a074eac8bcce3df7b1b2102c4bb1010ebfc92bd
-
Filesize
88KB
MD523289b6675362aa2c60f1a435e2374ae
SHA10a8064e04e4baabe3812e4c246af27a0695975a7
SHA2564947300ce5874a8f49c81c0202f50ecca05da6ed08a2d55931c45a1b2970c462
SHA5125fb07f5aa44bc0ce02004d03c75b125d7597e2a399f32cd6c9f6fdf4fef75a18e2b426b6747884c39d230429ea20b3300b77e457b875db44b8cf66cdbbd0e265
-
Filesize
52KB
MD53ea79da9084d0dff04fc86d8b54e4826
SHA1b357ec969c4dcd12acfa30a5bc272e9c05d9433f
SHA256b921ece32faa4ff9fcc0e773182e2c3f6745558c467c52acd7501e2c6cdd965f
SHA5127d6a9fd63fd8547b409a70e1100f7681264b1d08e0a518ec6d4ba04f8b30acecbe99b35684261677dea5976071ab79121ad8a44316fe65a3ee03266637f13002
-
Filesize
1KB
MD516aa6b7a57ed00862d0106da2ea9281f
SHA1229472fd4759a6ede4acff8c5841b2922ddb5b66
SHA256ea2299d44948ae88d95e31cec8677f05a2174b70b896465ad787e19143eafe6f
SHA5128b3a3a138a1ab98658502cb90a3cdd650e7092b1181477d86ecfcfaee18589178f714688a58fe2c924b46f834ce29faeacf0fb3413e1dcba0077739f8b47f301
-
Filesize
3KB
MD55bf73fc5729ccc1eaa81865cb6f491e0
SHA1877489af9c0ff9bced96733107a2c8ca260bb7a4
SHA2562929cf9a58fe263184f9b60d8a9b27af2a4b85bf978fc3bcce8ae05d9c721f0c
SHA512c0246398226ac1f75ab3c628c3b426b89c543eda8f833f3fedc8ed8a90714ae759c6a2ed0c7d36d605e554a7f9aac574ea7228e598d5c7acf1d5e4ba455dfaad
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1892_200897271\CRX_INSTALL\images\logo-password-manager.png
Filesize2KB
MD5833fd8f51be1c48926c2ec18bb5cdae1
SHA17b07c0ee94fc37be4681e10b5f218d7ce059eda9
SHA256e023fdf40b211c886d5e3c3488523baf0a2c6451e5c7871951799ca764f2164a
SHA5123c45cac2f4e860d1fde138207049d0ad732fae9f7678036883151748f0ced6bb96e96170cee31ad349db2a6c30f40317a3b29c944b56e8e6c2aed7f7f67ba8d7
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1892_200897271\CRX_INSTALL\js\content\app\notifications\index.js
Filesize3.3MB
MD5a5373f828c50d1a9dcfeb464cdcd2632
SHA1dc4f90a6a07a530ed88c864f9ff6382ccc1ae965
SHA256358de2e7ec31758326e51cd0e38dc4016a57f719f2284d22adfbc115e53e8b66
SHA512c445adb59da0c7fefe58158119f705466143706fb139b3951c8ae3d1df2b40bb2d78867a029d103980d7dfc1cb9e3b64975ff4c48d095d7b4e2a3bcd08de94e5
-
Filesize
1KB
MD5bd4bb689c6beda2ad56c815d1e2fedb4
SHA1d2e964264b579fbfb69f47abb5bd5a4d517c3b13
SHA256b6481b6bde8523b5884befa2160ee25b353c219945e765dce88926251a76dcaf
SHA5120c2bb6cb1fc49d0274d4cf9aa84bd26fb249adf710e6a656600657746fcfefedefa64528e7070b759ded171d694ed5fee90d914b4a32dccdc7874163a63bbbab
-
Filesize
31KB
MD5a0259d6fd3e6ca6fc1bb62b5a4c1e54c
SHA1c05ebf04bac7ee20b2737b7f280e76d705d6421c
SHA256d66779199d0f564d91fa0fd56b6bd43d41d75f29be4810f2e8951e7a1214cd0e
SHA5124161d3da7e188eed393e00f0c205baa2ec19668ced8590e124e306bebd5f7e9f51adeba77df389fd341989d45e4072c7eb1f37ecb3058b5ba6e7a140c3bc21b2
-
Filesize
1.9MB
MD539433039c2674e9008174bd6fc078b37
SHA1f93f620f33ca02a4294e58e6c97c32df1c5c2479
SHA2561d6e5308c201c6b71dcaad389873288f119d3317c2d72700ffee8f4440dfaa4f
SHA512ac6bb704ce1db3cbacaa4fec1773ef1c708515f9c8f67f25cb11a3612e1361aa5c130ee49fdc27c03a1d5ced908ba6a293c142c45d071cad452241d022ddbf25
-
Filesize
884B
MD55a82ac9a9a65b25992a4b8b86d1379e0
SHA1ea596c4f420e9121383b4c1b466f6aa76322d495
SHA25616d9a71e57e3af82d5c961916e5c57b9abf582d0d3d0bc7164402ba585a06892
SHA5127ecbf55d70664c31f759da9684c3086c4c0dfd88a5831924239f7c0428e71048d83ba29fe8287666d1f11fac7a6c0be83106040d973827e2176d20962c2d06be
-
Filesize
3.8MB
MD529d3a70cec060614e1691e64162a6c1e
SHA1ce4daf2b1d39a1a881635b393450e435bfb7f7d1
SHA256cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72
SHA51269d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b
-
Filesize
282B
MD59e36cc3537ee9ee1e3b10fa4e761045b
SHA17726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA2564b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
SHA5125f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
-
Filesize
303KB
MD55ce13cb0b55f3ebc546a9187d368183a
SHA1ff47bce78281ff551088b98ef91cf1717e20d484
SHA2568e07e3d78be9eed1bafc8b57f2839e219aa88a228ccc74326b6f52858678677b
SHA5122de528e82ee3ec7196899be21344b8641b8cfb3760fe16966936dc5043ec483ab9fdb981b4f5e0361f3650a33674aa826ddfe793b7e4be4668c0a4a50a4c4a68
-
Filesize
572KB
MD5948e560e4bb1d67ea5d185d55288620c
SHA1a2631f264b484005a9ecbe2b722f268633eaa642
SHA256683339d0de68df3173719dda428bfc9d31e42db34211d68b6bd1c7782d478e28
SHA512cc5cee9641ca90c23be8e69e31f9532cf8a3443db8bdb40c251ec2a8337e0c35ce5ec2760f97a73e920bb44e1a02bf6df353c5ec2ff401e31bb4ad8607a38ba6
-
Filesize
473KB
MD59ba0694239322561bb61fefb0299b459
SHA1afbb639bba8e252fd45f42a0d3475660ea24a842
SHA25636d98d7e74be218c5db182d69afbc251c57e7bda76c6297446045bd373609934
SHA5124144beadc8a93490216513f1143fcb1c1209ecb98c4308e1fc23ddf0efea5c053a71984ad7abc53a96fc90ece960c602a923bba3268a85fbaa3a391724a61ae7
-
Filesize
798KB
MD5b68e67e58323a994b2334ded8c282237
SHA1acd0d5a721777da9f664ff19d94cf266a2f17158
SHA25624cde4e0c2203016769b374fe3b2fe58966739b558b9ee61b5895d2a6eec311d
SHA51265a669fb18cabe9e536333f988035ef41451730e5e5bb56628cc55c0d455c630caced7e8f18a03d2400be57f9872d5d5c2c63000574a75b65d6f1c3d37e59c48
-
Filesize
699KB
MD57b7cb4319acbea7cb301b12650b8cfd4
SHA1e24d6aee26cea9a52826f6301b3b23e20785e943
SHA2564056f7a1696fc4424b038fab6d0548b00f1e061edce0837545a9b3d613ab859b
SHA512ddf8e5648ac561929425c8b12607608095d88921f0602343511775b52ad54c7e7288233071461383d65e53f16b5db53c1894b717bcce8d60e6a63fe6966309a5
-
Filesize
614KB
MD5a728067e872e6840e883dcdb50f3ca73
SHA1f3ba8e4a1f95531f5a8b0a74a16893244e8a96ff
SHA25666284c6f084530eef277cb9273e4124f517d972961c59148db719f66236c6d51
SHA5124ab5e9fab75361d4d3d13fa9ca10ef900c897ddf3ca1fe1111aee241c392ba84d45a13109b1f4fbd0581d7003fbbf7c917d3e7f41aa584cf1aedbfb63d250c54
-
Filesize
530KB
MD56ed8a4dfc46052835a908358349651ab
SHA124999fc6a06a6ca4d0818548ea44e01127b357b4
SHA25696ed78aff9ee36177388ce1471e179e5a224cb3c7d8a381602f977dd98fcad54
SHA512e283604127eb84f40078c33f13c89526b0782a97468914b0896fca049fe1b0968d01a8cb9295e99c4c5a4365e44b6726b3a50fc52ccc1ea08be78927e22689dd
-
Filesize
657KB
MD568e8aeed81022fc28583bf9ccdded4e9
SHA1748ad277f32a3f6b46e4727056dfc8b1a30f449d
SHA256520371c84b74f2132c3f4ed469caa30bb4c1171b5f686e02f2038b4416365906
SHA512f4de03d6825eca508720a994df7e7f396eeaa4c7b6ce6029151f698debeaa7f8733a2fe7fa4f61adb71917e297815edd9a60cefdb38b7ab2561136d1bf649607
-
Filesize
332KB
MD520df97f965b03ae527250510fb08cbcb
SHA1b1a25768330b51b2df94561f9835a86e5328b14d
SHA256e4f135f7fc9d85ecd76e2a0484fe81af2c4cd6558af1d893352a1a3b0456d1e6
SHA5127e3ff11ad5fcfa54e9199adb0988fac353666a922338ca5b3b15313137f5bf5775f94d5d3e4236a01e8042a4925c216c4cf5643c11aafe3b91c73af2e6f34aab
-
Filesize
402KB
MD547f712ef6690152dd58009d5555d51ee
SHA1daf60455aa9e1116f044ebaa6ed2574f81aa33b5
SHA25698d127fed1d477a410c26133fc67a657c6d50370ac90081cc1ca8a02f52c617a
SHA5128a8a8a6abdb920921f3b7dcb8a014219846c323748b19c3546dec0df68ac9220bbe77ad168d95abf07c0575b9feb50b7b65ec232b8bed119c6320cee7d9e7e56
-
Filesize
388KB
MD56fb4ced8ab3306d26f624dd0390e980b
SHA1418a0cbc22b479d48ddc4e6241b5ea2ce7f961fb
SHA256b8278945281f4466148978f3a8af5f9cc7a610553f9a675b84422aa74811ed76
SHA512f140760a15d637e42cf24038e10ff6249207e8e8095415b8434d81fbfd80eb7f921505e56a89a90e25261060fcc500f84c1c0d565bc8bf3ecd8cf8f3aea0ce57
-
Filesize
318KB
MD56351cb10da417ac088401004450180e1
SHA158b72c9799c3c7ca64c989d589e22be93011413d
SHA2564551939cecf9a38b3ff452bcadd162962f557b1cb069bda1c9aceccc7c5c173c
SHA512014140c002b6cb6945be151849a3bd3b016238bb708376b4e66ce4e121d13e6bc343a822cd9522254c4469152d4695044845435a6f479ad9ce9be9a894a4693c
-
Filesize
417KB
MD5ad71526fc205f62fa1dbb5055d93d25c
SHA10e2ff2188ebf8be254f29e61a92555df3826ae75
SHA2565d9a7ace1e5b812b16e987857c166ed256d42b9aaae0192ef8c681d14892eb31
SHA5126056ae5f0ab22e789c8fc57f82b789ca095c7fa5c593e039578362350d0c12a4da3cc3c38781a5f2facb728dfdedc97f2e55c25fac9d00a73a863a6ca8998c64
-
Filesize
445KB
MD55f1cca5cb2ab55cf668bd6a117825035
SHA1668c8c9437100c4f1dd9c187192752c545c7fac9
SHA25657b298fa04a5acfc25dc2c8238034dd7d28e565b07ca90d207a02dd6621a68d2
SHA512825797ace7a495502aed9906e2b4ca5898edace278e2a71d6312139a39139fc0f11ba911cbb8e6e25d0a9eae480db2d754b29707199d2ed6604ccae50a6a472e
-
Filesize
728KB
MD586e974b88be36b0a3d38eede7a21f7c5
SHA1d67d6f7a47534763ae7d998df7619adcc5d254ae
SHA2561512efb076bce6684306a79796f75aa87b60f7bfdd8ce5284569e82402d611b6
SHA512bb921074f444d27acd26d42ac08c26ef5b80a1c0e8a4c1a4f20c922f0634607c0b0f68ad89638a25b6fbb167b3baa8ddd06fd01c60ce19026b6d7c949f588f2f
-
Filesize
742KB
MD5ea5423ae0aa43a43a9d9688989eb5a37
SHA11da03efdbb3918de438d7e6460364c0cd78935db
SHA256ae92f8ccc6840dbadeaaaa7b6ba848b00a34892bb2158155356921f4326b2e3d
SHA512a6691ee5ce81233da66cf0f114096ea39f5b073d589305377862cbaabb6158aef887fd182c9b2afa6693baef5d0c181a41c2bc7cb957017c8349bb8350805174
-
Filesize
544KB
MD521ba402a4a3de4c1793e68c376459eb3
SHA12ba8485679665755150018494c4ab0a0bd16404c
SHA2560d6e5ad76bdf33ca8115a680dd60def1e2f09524d0c608cf5884d1a39e065204
SHA5128b2c7ec302066833b2c7b48b8b54c22cdf46a1c5ef51d2878b765acfb0958cc8bca3cc2062f804bda744b60be3e894126820f63c9da561d2b5d2b28c0945b55c
-
Filesize
629KB
MD5b6ab2d20ad7b591f988f9335c4e3a00b
SHA172627fa5f614b5e489bdf7a135a6ce2ad053cd6b
SHA256d3474a5daf0f7d8399a98dffca2bec4057b5ae2fb263ae7e8cf80f8fbb338cd4
SHA512049b73702837c42d22aad2d4ffd92597c9e0190a61494fcd50e2d0e05ba7543cf20a19b2cff8635111dbb856c919877ebe0eb70aa5924a75acb3281e9317f924
-
Filesize
558KB
MD5629931f087405a62ebada2c6191cf85c
SHA17cb677208cf992bcf2222cd8b0e089bd13bc956f
SHA2561509911bd4ab9ccb80c2d192f4daf724a7f58876fb7c5f7d7152a91cef260747
SHA512344c1a690ba03a6007f66da97c62a4e412f0f50a95914ee1ec16d53025fb12720495f8e06eb03722e0a7dde11751d44666580de8bb79210ebbc2e41c5ba5a5d6
-
Filesize
643KB
MD5a97015bce958c433ac3a30353beed694
SHA11821514a8fe7ab8257861e2b3cab34990042222b
SHA2561960b0ab942fe36d41e715e3eede7ed5ea8699ff4245e96884f209bd39d1fdd5
SHA51251eeeaf0577d1f967e6001438de1412f8a544991da996e9fb7b97d17cbd0c3d26619b91f587855ca4f0b95b98d295610d85590bc75dd88ac75ef24789536b32f
-
Filesize
501KB
MD54c689dc3d995466d0ae02f8f05571db1
SHA1abc3790028b7f69ca01c85b495a62b34b45464fb
SHA256d152213fc36e7b22340b908cb1a6f2872832ebf2fbe8341fd654299dee4bec54
SHA512f180b3c9a7b1621c9f0b6e067f3014f5ccec6cdabc7fde22e93c07683d0a2a76d2bc2732c3a9ee33cf57fc3d7175fbec6afd0a2b79cb30b0ca5e20fe7319836c
-
Filesize
289KB
MD537d93d9984489136d9cf69a363bb0169
SHA1c46bd00bf77e57a15ccbcc0e8f16f442e31984dc
SHA256211de2e15f2c1f1621ab71aaa4cf2bbf131325d1b7a6990d969746ea347a8076
SHA512176f287f585007b07a933630a7bd0823e3005207999fe57503dcd841a6d01f4ca6096d6559a936a71e1776bc74eab206a5a058a4b9b0d7668fca0931b44112b9
-
Filesize
275KB
MD51d64a9f44a3a5b0beec1542bd1ca53f5
SHA136818a229cbc1efaa8dd126fa3d632af15d0a570
SHA2565f1334a7390058c323fdcb5d7f5aa7dcbe10c12d26283f5b1ef8eb57c2d0c3f4
SHA5128ff2d9a1d9e8724dbf7e6891965865ee7d1be773422d84cf45a3f2853bd65583a48ed9337c17b2b666073ed446584ff4acba7ef0b3e9f4fb22bbff3f42bac30d
-
Filesize
516KB
MD59fdcc178f88935ca9ac889b7c2a30248
SHA1aca800cb60e929506628e4b952ec607e33b46e65
SHA256698a684cc3b47cd940380e048984639aa9bf74f030888e0e2b07fafc3b00e4de
SHA5127a0fea6cf64f28461b1c43e86c84e4ac64bace6789971b6fca09d0f78b316a04ba5caca808700da40d0d90c95077600d41709f3e3d9557271e9a3db2060810f0
-
Filesize
1.1MB
MD56e956bd1fe0d5cef3af7352f88ad05df
SHA12cfc47f5797ba378bbdfb61496fd9e69a36f422a
SHA256708b1eb752b25fa343854391e914628259fa58075f87119c4806ac755fb14da9
SHA512b9215c345f6422f16cededdd70ab9c7f4d84d797eac7dba5c589bc05fb8eddd4bb40a99bb950f3176a439cacbe18c8d4aba607d213204d6ca28580d88b20b09f
-
Filesize
770KB
MD5eaaccdf3ed63b6e942154020ab180dc7
SHA187c2b26445f190d1766424545c969411cf9382f9
SHA2567d65b38a0a750ef20ba71209af4308ed258c542f7ce2fc593b3a5b20d191c571
SHA512e8349f3b1941ca15ca195b3d955d3fb74c134eb9d0a65b99820c0decded6a919e9930764588868f4228ffeca8475038a8010c411a6709c01536ac753bb2dbc19
-
Filesize
713KB
MD59cd3fbc776749a67b09c947737acdf46
SHA1ebc8d8718448dd67cb48c163675f3cc34328d3c8
SHA2566718cfd2731c2c29b3816c80349d7e100a6c3aba220f0844c1f45626e551a4a5
SHA512a2d0765bf270f3f9156d9409bef2b38957c2961967a00b235228be41b480d20bb5217d4fd808275b4bf2f6fab09ce83b4a9712794ed10c3f66c2223313cf60a5
-
Filesize
459KB
MD5819b8f1ecf24473bc30dce7038b4f8d2
SHA13b1509172d3ce52599b56a63aa94781cd1508e6e
SHA2569d1b70e62091b393ce7007d0a1d8c44488e4f680b9dced296d82a63a8121dbbf
SHA512fc5b98bf93be5ad4c67d152d8fe96dabde606a3a36d7e3a117b6ca850aebd8cb75b157d08fcfe50e462f8a0248ced3b9e52adae11b6d18573ad2102e8d396fee
-
Filesize
487KB
MD516679a1e99bcba8aff4b2930b1f1e042
SHA190df21e9213ba9690114656da0c67d3a347c7f59
SHA256fbcc4577d4d9e6524a09086b6acbdac3c70aa6cd5a53c7592923345c6a8ef72d
SHA5123a8e0b04d00192762ce24907c7b5be07c82e2e2eadab339cf1ee180d2208e755bb17f08cc189248bffe599c3f09162acd4d4016971ad079d5f656ed16a5a4a1a
-
Filesize
346KB
MD524b8ba6325273e68519356f7907bb9da
SHA165abc7cb00ad5df80c1e989d1bec3895ac2aeded
SHA25627860dc66b3f5ed6c8b88180be46f92c68b386c5aa675691789b39046cdb150f
SHA5120e0f57ea03609ece007eb9e01fb9ed283b8fe356d20b8e5be7ac12f21f392246ae99caaffda833859504547065f5fabc7f96b43a1e398dc699bdf9b52a3153a1
-
Filesize
374KB
MD531a94b419dc06348d9f68c4f0f1e0fea
SHA1565b9e074fac2baf0587f6d376fa47276e523aaf
SHA2563775d4f2c21a4978274aee306cf86c98b96d563f3db1a0e4b6663c6a4fb686fa
SHA51224d3c339ca610756ab26d738fa4cbaeb477103e1193596bdf4ffbf88fd67c9111ce6af5c2a625ef8305ff3d6f8439a1187af0d109043c939f97a67870276b272
-
Filesize
784KB
MD5f27fd5ae23d3f70c4d6bf11951b0218f
SHA13bc82a00f2c08795740aef129647ffc4b67d4eb1
SHA256b75b9bc546172792f5d6a4b4665c20ca44e79c3f84ea800eace69acfb5d74ff7
SHA51288b43619cbd350480b74265bd1a08938227c55cfa922953a352d094a2dd095efdca0e075cec7a4677b8e5502c8896f6bb33a57b9a7ceab7758af60d528fe1889
-
Filesize
586KB
MD55b9f13f5d34d09c915c9705b8efc185b
SHA1089be9aaa25e516a79f8623fdd2e35a7ea1a6707
SHA256fb7e33949be2171b6d99d1fba662617ab460ac525ae4fb22f1ddc7ea6b6470f7
SHA5123ad68fed3a0f137e3d741f749cb91f364f6b0e4bf06165b8b00ceeae78a9c905c434792d931c3d7cc72d5dacc3c0c8d3a49dc08a257046bbeae4956be2a1f95e
-
Filesize
671KB
MD503935de80c735b53bfc9b82a7e6f4c3f
SHA15d55b812f3491c019397705626654495b08883c2
SHA2564932ab5cc5a809aef44a0cdee00e8aa6856f8920d8ab4f5d2cca76cd838201f5
SHA5127ea482b3ded6546cb73124c6379aa1cb022ef8164fe3d3c8c8a3ec6930f33cea2f862b18a8c1763339a534444e72e85396633c020e1769fe8404b8ac5fba9ff7
-
Filesize
600KB
MD588ab2f354cef6f38213d502a175dc3bc
SHA176df5f971214118e350da9e9aa2b7fe953a5a08c
SHA256cf3d973babbb1c1f37858d1b0e7647b41be0755a7634e9f81f2334e68fe9c21e
SHA512711f3f164b1348ee8af004c77a8d5b8ac3fb21dd21ce28403c125d29fa03de8b42792f4bbb7cbdaf0875f2f3ff2ea1ba731510204eb65eb919b1ad7d1fc615d9
-
Filesize
9.5MB
MD52ba8c3c68e800a1d528f5b02fbc5e239
SHA144ce2f4f9028724899b2dd1ff36864f9c82d1840
SHA256bbadb6ccbd7d9d7dee928cf1c31b377b8b5732390bb22b76ed8b2015ac69aa3f
SHA5120e947fef1616c2a189e56c341bd29f2dbe91b9f45272f5f83cd0c0fe299dc36da758434d58a97d04b31d44662faee1e4838df6446da49e4a39986430e4713958
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
431KB
MD50635ed5d4c24ef7b3eccd41972c94ff8
SHA1ea091c2371e9b086b04dacdf521882eb9dfad8fe
SHA25668bed4990f0418283e870dcaae9833773e7e8798c92fc26fcc423c2ed7ff9309
SHA512f0171494465729ce2d8bd61f4897abfd41cd60b6fe2eb74f5aac3e8262e546c150db7d007a8df148508730af911c2715bbf6b00a7e779ab9b4339b0213b3d0e2
-
Filesize
756KB
MD529f4683583467af6badd8b95583b1964
SHA11b40d517b09cbc01148435f6b41d62d35a9a496d
SHA256abe7390df59398e7673b72bde745bcaf65f633c52018fd852f6e87f635989c7d
SHA512adf2642503e131f02aa67171f8c9ca08c6fcf67fb99583cc663cbba84147f2dcb8d8c9904703d8f30c7bde6dfda5ca2e1454f1c6f93906feff53e6ff7c59d0a2
-
Filesize
685KB
MD5bc5c55e65f56a9032985c6e3d4f3038d
SHA1db151ab6d42007345de369b201639865584a54b2
SHA2568c96bd74034b7fabb0d2acd62014fc561c3b47a2ad85af14a60069f2e10137ee
SHA512e632eac8ccfcda6435163a182e6e0ff58ddb04981036ab1f2d393f8db5a9a666b871d2ce5d32489ca5b0b713b2af66067bc791ae0798dfc9c44b78fa129f2fa5
-
Filesize
360KB
MD5dbce68314eab16ca6b414e047717cf01
SHA1262728cb27f3279505f9392524e1e16ded5cc702
SHA256ea3b74dff94bcb83e9cf94ff8e2d9ddc4d578a570b96f8fb6cebd7ccaf95903e
SHA5128547e25c9c3164a44be38e5484c1096d28dbbd1a23179edd0c4a6e5ed575b9c92fd8faa7b4bbd859221c87a388fa3f8015adf8499cfc5d77a653f6835b0e5f23