Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1050s -
max time network
1050s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18/09/2024, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
alterware-launcher.exe
Resource
win10-20240404-en
General
-
Target
alterware-launcher.exe
-
Size
2.7MB
-
MD5
4af0f95919968b3532fd5109f1e6fee6
-
SHA1
bdd35631146d1cc10f43374a14dc3d9c80168d37
-
SHA256
743db4f06c2d37ec3a1a5bc9869266638544b9acf24e1403e7776c1dff357284
-
SHA512
c3292412774dbb72132803786e7f30b6b87f976660b34fe78aca2222080acdefde9d44484914bdc889a79ef0e22582b6752b1f170b9067926c4b562dee1d763a
-
SSDEEP
49152:QTnKYBANPY2maIwCnY73C6YV0EoViMYdxHqPljH2mQtvt1w:Dv9jAtV1
Malware Config
Extracted
crimsonrat
185.136.161.124
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt
wannacry
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Signatures
-
CrimsonRAT main payload 1 IoCs
resource yara_rule behavioral1/files/0x000800000001ad96-6483.dat family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\ = "AVG Secure Browser" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\StubPath = "\"C:\\Program Files\\AVG\\Browser\\Application\\127.0.26097.121\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Localized Name = "AVG Secure Browser" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} setup.exe -
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe\DisableExceptionChainValidation = "0" AVGBrowserUpdate.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation avg_secure_browser_setup.exe Key value queried \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation aj5A64.exe Key value queried \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation AVGBrowser.exe -
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDFE20.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD1943.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD194A.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDFE19.tmp WannaCrypt0r.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 45 IoCs
pid Process 1868 avg_secure_browser_setup.exe 4996 aj5A64.exe 2764 AVGBrowserUpdateSetup.exe 6968 AVGBrowserUpdate.exe 7524 AVGBrowserUpdate.exe 7556 AVGBrowserUpdate.exe 7584 AVGBrowserUpdateComRegisterShell64.exe 7612 AVGBrowserUpdateComRegisterShell64.exe 7628 AVGBrowserUpdateComRegisterShell64.exe 7676 AVGBrowserUpdate.exe 7696 AVGBrowserUpdate.exe 7756 AVGBrowserUpdate.exe 8124 AVGBrowserInstaller.exe 8052 setup.exe 4856 setup.exe 7172 AVGBrowserCrashHandler.exe 7220 AVGBrowserCrashHandler64.exe 7476 setup.exe 7564 setup.exe 7644 AVGBrowser.exe 4844 AVGBrowserUpdate.exe 2292 AVGBrowserUpdate.exe 3844 AVGBrowserUpdate.exe 7792 AVGBrowserCrashHandler.exe 5768 AVGBrowserCrashHandler64.exe 696 AVGBrowserUpdate.exe 6964 AVGBrowserUpdate.exe 204 dlrarhsiva.exe 1500 taskdl.exe 1356 @[email protected] 5456 @[email protected] 2876 taskhsvc.exe 2472 !WannaDecryptor!.exe 4824 !WannaDecryptor!.exe 6064 !WannaDecryptor!.exe 7464 taskdl.exe 7672 taskse.exe 5544 @[email protected] 7420 taskdl.exe 6808 taskse.exe 6172 @[email protected] 6840 taskse.exe 5636 @[email protected] 5204 taskdl.exe 7764 !WannaDecryptor!.exe -
Loads dropped DLL 49 IoCs
pid Process 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 6968 AVGBrowserUpdate.exe 7524 AVGBrowserUpdate.exe 7556 AVGBrowserUpdate.exe 7584 AVGBrowserUpdateComRegisterShell64.exe 7556 AVGBrowserUpdate.exe 7612 AVGBrowserUpdateComRegisterShell64.exe 7556 AVGBrowserUpdate.exe 7628 AVGBrowserUpdateComRegisterShell64.exe 7556 AVGBrowserUpdate.exe 6968 AVGBrowserUpdate.exe 6968 AVGBrowserUpdate.exe 7676 AVGBrowserUpdate.exe 7696 AVGBrowserUpdate.exe 7756 AVGBrowserUpdate.exe 7756 AVGBrowserUpdate.exe 7696 AVGBrowserUpdate.exe 7756 AVGBrowserUpdate.exe 4996 aj5A64.exe 7644 AVGBrowser.exe 2292 AVGBrowserUpdate.exe 4844 AVGBrowserUpdate.exe 3844 AVGBrowserUpdate.exe 696 AVGBrowserUpdate.exe 6964 AVGBrowserUpdate.exe 6964 AVGBrowserUpdate.exe 4844 AVGBrowserUpdate.exe 6964 AVGBrowserUpdate.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 216 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_The-MALWARE-Repo-master.zip\\The-MALWARE-Repo-master\\Ransomware\\WannaCry.exe\" /r" WannaCry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\grgzzewzdng210 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_The-MALWARE-Repo-master.zip\\The-MALWARE-Repo-master\\Ransomware\\tasksche.exe\"" reg.exe -
Checks for any installed AV software in registry 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\SOFTWARE\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast aj5A64.exe Key opened \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\SOFTWARE\AVAST Software\Avast aj5A64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA aj5A64.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 1525 raw.githubusercontent.com 1567 camo.githubusercontent.com 1568 camo.githubusercontent.com 1569 camo.githubusercontent.com 1589 camo.githubusercontent.com 176 camo.githubusercontent.com 1353 raw.githubusercontent.com 1524 raw.githubusercontent.com 1526 raw.githubusercontent.com 1564 camo.githubusercontent.com 1565 camo.githubusercontent.com 1566 camo.githubusercontent.com -
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
flow ioc 1142 https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html -
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 aj5A64.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe -
Sets desktop wallpaper using registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" WannaCrypt0r.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\AVG\Browser\AVGBrowserUninstall.exe aj5A64.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_uk.dll AVGBrowserUpdateSetup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\ffmpeg.dll setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\hr.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\nl.pak setup.exe File opened for modification C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe AVGBrowserInstaller.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Extensions\external_extensions.json setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\pl.pak setup.exe File opened for modification C:\Program Files\Crashpad\settings.dat setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\sk.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\@PaxHeader AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserUpdateCore.exe AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_es.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_id.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateOnDemand.exe AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fr.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\bn.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_fa.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_nl.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_ru.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_tr.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\gu.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_en.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_no.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdate.exe AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\d3dcompiler_47.dll setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\it.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserUpdateComRegisterShell64.exe AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_nl.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sr.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_lt.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pl.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\sl.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_el.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\chrome_100_percent.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\psmachine_64.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ja.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sw.dll AVGBrowserUpdate.exe File opened for modification C:\Program Files (x86)\GUM6EA5.tmp\@PaxHeader AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_am.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fi.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_kn.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\browser_crash_reporter.exe setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserCrashHandler.exe AVGBrowserUpdateSetup.exe File opened for modification C:\Program Files (x86)\AVG\Browser\Update\Download\{48F69C39-1356-4A7B-A899-70E3539D4982}\127.0.26097.121\AVGBrowserInstaller.exe AVGBrowserUpdate.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_tr.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_ar.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_ur.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\ar.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\mojo_core.dll setup.exe File created C:\Program Files\AVG\Browser\Application\SetupMetrics\bdb029ac-edb6-4595-87a4-74834842932c.tmp setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\psmachine.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lt.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\en-GB.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\hu.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\lv.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es-419.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\ca.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\es-419.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_pl.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_gu.dll AVGBrowserUpdate.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5} msiexec.exe File created C:\Windows\Installer\e6003d1.msi msiexec.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\Installer\e6003cd.msi msiexec.exe File opened for modification C:\Windows\Installer\e6003cd.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI469.tmp msiexec.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\Downloads\avg_secure_browser_setup.exe:Zone.Identifier firefox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 49 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdateSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WannaCrypt0r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aj5A64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskhsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WannaCry.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 7676 AVGBrowserUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj5A64.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj5A64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 6900 vssadmin.exe 5324 vssadmin.exe -
Kills process with taskkill 4 IoCs
pid Process 2188 taskkill.exe 876 taskkill.exe 6296 taskkill.exe 6740 taskkill.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6" AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\Policy = "3" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppName = "AVGBrowserUpdateBroker.exe" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6" AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\Policy = "3" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppName = "AVGBrowserUpdateWebPlugin.exe" AVGBrowserUpdate.exe -
Modifies data under HKEY_USERS 34 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\ AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache AVGBrowserUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 04130000e030a63b9909db01 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineIdDate = "20240918" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser AVGBrowserUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 1b605a6f2fd94a6da6ee3ea9a0547eaa7d44b13dcd2929cb0f5be6dd4fb24645 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\endpoint = "update.avgbrowser.com" AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineId = "000058d4b27a012b9e3e4541471e6c69" AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\devmode = "0" AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\hostprefix AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache AVGBrowserUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache AVGBrowserUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\ = "IRegistrationUpdateHook" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\NumMethods\ = "10" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270} AVGBrowserUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVG.Update3WebControl.3 AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3WebSvc\CurVer AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2}\InprocHandler32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine.dll" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DD8E03F-6BE1-41E2-B931-A37C7D1C0317}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{925547A3-663F-4673-A7B7-3FCACCDC4879}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0BE1521-7935-42E6-B606-058A559910BA}\NumMethods\ = "11" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A42B2494-93AE-44E1-B76D-BA8509A5167D}\LocalizedString = "@C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\goopdate.dll,-3000" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{30612A81-C10F-498E-9163-C2B2A3F81A14}" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\ = "IRegistrationUpdateHook" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A708F91-06A3-409E-83BC-4A5CF10C8025}\ProxyStubClsid32 AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DD8E03F-6BE1-41E2-B931-A37C7D1C0317} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{358EC846-617A-4763-8656-50BF6E0E8AA2}\1.0\0\win64 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191} AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CredentialDialogMachine.1.0\ = "goopdate CredentialDialog" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A025DF-6171-460F-B9A1-29ECE33E754E}\ = "IGoogleUpdate3" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2}\InprocHandler32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B02B2F29-8637-4B78-892A-CFD7CCE793EC}\ = "IGoogleUpdate3WebSecurity" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\NumMethods\ = "24" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AVGBrowserUpdate.exe\AppID = "{82C85EAA-7C94-4702-AA75-DF39403AE358}" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EEA7BDE239E6384EA053D0B7B67C65B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoCreateAsync\CLSID\ = "{B80EC6B9-55FF-4E4F-B4E8-9BD098DBBAA5}" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB785069-B832-4423-B813-47F7422BA6E5}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3COMClassService AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30612A81-C10F-498E-9163-C2B2A3F81A14}\ProgID AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE} AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CEBE594-0680-4815-86E1-615A6BE65E0E}\NumMethods\ = "4" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A025DF-6171-460F-B9A1-29ECE33E754E}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65} AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270} AVGBrowserUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2} AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A42B2494-93AE-44E1-B76D-BA8509A5167D}\ = "GoogleUpdate Update3Web" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\.xhtml\OpenWithProgids setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C7E81D6-0463-485E-8DF5-2ADAD81FAF40} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\ProxyStubClsid32 AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32\ = "\"C:\\Program Files\\AVG\\Browser\\Application\\127.0.26097.121\\notification_helper.exe\"" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.webp setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{925547A3-663F-4673-A7B7-3FCACCDC4879} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E37D9308-A3C0-4EC3-87C5-222235C974E3} AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.xht\OpenWithProgids setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AVGBrowserUpdate.exe AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\NumMethods AVGBrowserUpdateComRegisterShell64.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2908 reg.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj5A64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd aj5A64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj5A64.exe -
NTFS ADS 3 IoCs
description ioc Process File created C:\Users\Admin\Downloads\avg_secure_browser_setup.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\Ransomware-Samples-main.zip:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier firefox.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 8056 vlc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 4996 aj5A64.exe 4996 aj5A64.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 8056 vlc.exe 7884 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 6968 AVGBrowserUpdate.exe Token: SeDebugPrivilege 6968 AVGBrowserUpdate.exe Token: SeDebugPrivilege 6968 AVGBrowserUpdate.exe Token: 33 8124 AVGBrowserInstaller.exe Token: SeIncBasePriorityPrivilege 8124 AVGBrowserInstaller.exe Token: SeDebugPrivilege 8052 setup.exe Token: SeDebugPrivilege 8052 setup.exe Token: SeDebugPrivilege 8052 setup.exe Token: SeDebugPrivilege 6968 AVGBrowserUpdate.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeIncreaseQuotaPrivilege 4996 aj5A64.exe Token: SeIncreaseQuotaPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeIncreaseQuotaPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 3636 firefox.exe Token: SeDebugPrivilege 3636 firefox.exe Token: SeDebugPrivilege 3636 firefox.exe Token: SeDebugPrivilege 3636 firefox.exe Token: SeDebugPrivilege 3636 firefox.exe Token: SeDebugPrivilege 3636 firefox.exe Token: 33 2292 AVGBrowserUpdate.exe Token: SeIncBasePriorityPrivilege 2292 AVGBrowserUpdate.exe Token: SeDebugPrivilege 3844 AVGBrowserUpdate.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 5544 @[email protected] 6064 !WannaDecryptor!.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe -
Suspicious use of SetWindowsHookEx 63 IoCs
pid Process 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 1868 avg_secure_browser_setup.exe 4996 aj5A64.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 8056 vlc.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 1356 @[email protected] 1356 @[email protected] 5456 @[email protected] 5456 @[email protected] 2472 !WannaDecryptor!.exe 2472 !WannaDecryptor!.exe 4824 !WannaDecryptor!.exe 4824 !WannaDecryptor!.exe 6064 !WannaDecryptor!.exe 6064 !WannaDecryptor!.exe 5544 @[email protected] 5544 @[email protected] 6172 @[email protected] 5636 @[email protected] 7764 !WannaDecryptor!.exe 7764 !WannaDecryptor!.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 4724 wrote to memory of 2156 4724 firefox.exe 78 PID 4724 wrote to memory of 2156 4724 firefox.exe 78 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 2792 4724 firefox.exe 80 PID 4724 wrote to memory of 2792 4724 firefox.exe 80 PID 4724 wrote to memory of 2792 4724 firefox.exe 80 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2388 attrib.exe 3348 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\alterware-launcher.exe"C:\Users\Admin\AppData\Local\Temp\alterware-launcher.exe"1⤵PID:2820
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.0.1267671284\1823111117" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd99c2aa-7161-4d54-9ef5-0203802ce741} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 1776 2a6587d8458 gpu3⤵PID:2156
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.1.1169787363\1860050673" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {620f07d9-0148-45d2-b2d6-2b51db82db6f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 2132 2a658331a58 socket3⤵
- Checks processor information in registry
PID:3092
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.2.3801453\1719471495" -childID 1 -isForBrowser -prefsHandle 2944 -prefMapHandle 2936 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {716fcde3-81c9-4fa7-90e5-ea8f53b321fc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 3040 2a658759158 tab3⤵PID:2792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.3.1775251606\1732174024" -childID 2 -isForBrowser -prefsHandle 3456 -prefMapHandle 3512 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f4c05aa-8edb-4842-bc3f-926b970cffdc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 3516 2a64d762558 tab3⤵PID:3180
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.4.1734189433\144661467" -childID 3 -isForBrowser -prefsHandle 3944 -prefMapHandle 3940 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4655f14e-1dee-41ae-b006-e6925bd928f2} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 3840 2a65dfe4358 tab3⤵PID:3440
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.5.772655261\1069716895" -childID 4 -isForBrowser -prefsHandle 4920 -prefMapHandle 4916 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c066793-02a2-4b87-a90b-5aa0059fd45a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4932 2a65efbc858 tab3⤵PID:1596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.6.557133865\1176470708" -childID 5 -isForBrowser -prefsHandle 5072 -prefMapHandle 5076 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9efff52-f0e8-4ed9-949d-5c37175da84c} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5064 2a65f3ed258 tab3⤵PID:3348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.7.920169307\2112874374" -childID 6 -isForBrowser -prefsHandle 5284 -prefMapHandle 5288 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99c4915a-364d-47a8-9088-1c685ce2a49a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5276 2a65f3ede58 tab3⤵PID:4256
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.8.1358294070\1157579184" -childID 7 -isForBrowser -prefsHandle 2272 -prefMapHandle 2660 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b182b49-3b8a-4ad8-9918-1c6a4da67e99} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5456 2a658a55b58 tab3⤵PID:4284
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.9.1346521284\1461543781" -childID 8 -isForBrowser -prefsHandle 5016 -prefMapHandle 5004 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c72758a5-6a73-439c-b53a-7b17af7e22a9} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5028 2a661c51958 tab3⤵PID:2428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.10.1725905689\1780544138" -childID 9 -isForBrowser -prefsHandle 5904 -prefMapHandle 6072 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b74bfa10-7319-4eaa-8dad-95517d2cc15b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5864 2a660b82858 tab3⤵PID:3212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.11.1743739469\1698006757" -childID 10 -isForBrowser -prefsHandle 5816 -prefMapHandle 5808 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d15bfbf-088b-4e80-a2b5-03783afce109} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5416 2a65dfe4658 tab3⤵PID:1224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.12.1207111419\814360943" -childID 11 -isForBrowser -prefsHandle 5352 -prefMapHandle 5480 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bbfef58-ae2f-49df-9940-2e3875526844} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5528 2a662c4ce58 tab3⤵PID:4076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.13.1895520298\881121082" -childID 12 -isForBrowser -prefsHandle 9904 -prefMapHandle 4460 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24355836-0f5b-4630-af81-da455ba6049a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4576 2a65ef1b158 tab3⤵PID:4388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.14.1661194221\1637747925" -childID 13 -isForBrowser -prefsHandle 5704 -prefMapHandle 5460 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fcaa253-53c5-402d-badc-3dcf5bcfe55a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5688 2a658a55e58 tab3⤵PID:1104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.15.1840769970\1736322571" -parentBuildID 20221007134813 -prefsHandle 1448 -prefMapHandle 5432 -prefsLen 26777 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2912c9a-4eaa-4b8d-b7c1-3598df6d6aff} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4692 2a66376cb58 rdd3⤵PID:4016
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.16.589615036\2106031476" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5384 -prefMapHandle 5372 -prefsLen 26777 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6fde613-d4db-429f-803e-c574eb2d65a5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5396 2a663d98358 utility3⤵PID:3028
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.17.1809026445\74364837" -childID 14 -isForBrowser -prefsHandle 5244 -prefMapHandle 4688 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2176320-25d0-4169-a0d3-04dec022470a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 1448 2a65b166058 tab3⤵PID:2088
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.18.1389921718\290118821" -childID 15 -isForBrowser -prefsHandle 9240 -prefMapHandle 9244 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cf0efc3-2a34-48d2-b7a8-819cffaa4e93} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9212 2a661255158 tab3⤵PID:5072
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.19.1069021686\274808377" -childID 16 -isForBrowser -prefsHandle 6356 -prefMapHandle 10116 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70439923-e539-4a7d-aa93-fb793e6565a4} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4460 2a6645e7358 tab3⤵PID:2076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.20.1403906855\2093882964" -childID 17 -isForBrowser -prefsHandle 9824 -prefMapHandle 9916 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a5b5297-fc1a-47bb-9e47-cc69b83b2397} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9632 2a6612b7158 tab3⤵PID:2188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.21.1480060550\1005371452" -childID 18 -isForBrowser -prefsHandle 9428 -prefMapHandle 5652 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d459706-81b8-4f29-8f8f-f0eb8fd7cd0b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9468 2a665066558 tab3⤵PID:808
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.22.1877237901\1174862409" -childID 19 -isForBrowser -prefsHandle 5532 -prefMapHandle 4960 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a3eef98-5c1d-4aa3-8826-c24763c8f107} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10012 2a665066b58 tab3⤵PID:4752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.23.116437921\225715968" -childID 20 -isForBrowser -prefsHandle 8828 -prefMapHandle 8824 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecf8f576-7953-42aa-9ed1-ead3e80e1ce5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8740 2a665067d58 tab3⤵PID:1404
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.24.1512054813\1847828640" -childID 21 -isForBrowser -prefsHandle 10084 -prefMapHandle 10156 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d81b3ae-3407-4539-941f-074237fc8dcf} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10108 2a6641a5558 tab3⤵PID:2796
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.25.596096088\211042372" -childID 22 -isForBrowser -prefsHandle 5032 -prefMapHandle 9088 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {823afe6c-9e16-4b71-b080-8967552aa4f2} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9244 2a665b82558 tab3⤵PID:6028
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.26.1837840257\726243811" -childID 23 -isForBrowser -prefsHandle 8408 -prefMapHandle 8404 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab028043-c380-438f-937b-8efc015563f1} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8416 2a665b84058 tab3⤵PID:6036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.27.592645779\835789488" -childID 24 -isForBrowser -prefsHandle 8212 -prefMapHandle 8208 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c000810-f8a8-4e04-9bca-eea710ff0ce5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8224 2a665b82b58 tab3⤵PID:6044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.28.829295389\1198901972" -childID 25 -isForBrowser -prefsHandle 8492 -prefMapHandle 8848 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c14278fc-867d-465d-b168-862baac50e6f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8508 2a666288558 tab3⤵PID:5924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.29.1487319126\1800581706" -childID 26 -isForBrowser -prefsHandle 9380 -prefMapHandle 9588 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9283e92d-a98a-4662-bde1-4216be5f329b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4300 2a6650bbb58 tab3⤵PID:4376
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.30.921745295\946609326" -childID 27 -isForBrowser -prefsHandle 8588 -prefMapHandle 8528 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cfac111-78a1-4757-938a-ef158b98d43f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8796 2a662b87858 tab3⤵PID:1868
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.31.180833687\253147647" -childID 28 -isForBrowser -prefsHandle 8052 -prefMapHandle 9808 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e5b46ad-30a1-457a-9c3c-1c7abb977f55} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7900 2a662b8a558 tab3⤵PID:2936
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.32.1009495250\438964623" -childID 29 -isForBrowser -prefsHandle 7984 -prefMapHandle 7988 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f822bdf0-0909-4863-b2af-3fee4271ab73} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8584 2a662dd4258 tab3⤵PID:1224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.33.2036490974\1695826256" -childID 30 -isForBrowser -prefsHandle 9124 -prefMapHandle 7968 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {972f8608-5bdf-4dd7-88ae-f6b9791520ff} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8972 2a65f3ef658 tab3⤵PID:5380
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.34.337926043\225051119" -childID 31 -isForBrowser -prefsHandle 6152 -prefMapHandle 9064 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0223dea4-d2ed-43cd-b060-67162cf1dbc6} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9212 2a661137558 tab3⤵PID:5944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.35.1212494327\1254117856" -childID 32 -isForBrowser -prefsHandle 8448 -prefMapHandle 7880 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8a67f39-5993-4310-92fc-721123665bfc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7712 2a658a55b58 tab3⤵PID:5488
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.36.340915966\1705405833" -childID 33 -isForBrowser -prefsHandle 7596 -prefMapHandle 7600 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec79109b-4d33-453d-bef0-387790377f6c} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4928 2a658a5fd58 tab3⤵PID:4828
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.37.1845489907\2010022783" -childID 34 -isForBrowser -prefsHandle 7424 -prefMapHandle 7428 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e7754ee-9f77-43ab-8b30-d54aae941cc3} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7372 2a661135a58 tab3⤵PID:804
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.38.1183218298\1872634629" -childID 35 -isForBrowser -prefsHandle 7428 -prefMapHandle 7228 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26a346b5-90ac-4b8b-a85d-6bdf83e619aa} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7212 2a661ea1b58 tab3⤵PID:6180
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.39.1966258158\1483032214" -childID 36 -isForBrowser -prefsHandle 7456 -prefMapHandle 7484 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fde591f9-9e3e-4efb-8075-631de6b84748} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7148 2a661ea3f58 tab3⤵PID:6188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.40.887713148\14076364" -childID 37 -isForBrowser -prefsHandle 7036 -prefMapHandle 7280 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {082ba880-20e5-4e2a-b62e-b789c1857e44} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6300 2a661ea3658 tab3⤵PID:6196
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.41.1418488241\356406825" -childID 38 -isForBrowser -prefsHandle 7132 -prefMapHandle 7148 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9062af4d-7022-4180-af11-1b5d441ce650} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7016 2a661ea4e58 tab3⤵PID:6204
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.42.1010518286\2046648963" -childID 39 -isForBrowser -prefsHandle 9016 -prefMapHandle 9036 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90c17369-60ea-4ed8-874d-d4bee027305c} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10044 2a661134258 tab3⤵PID:3400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.43.1718932381\1659397115" -childID 40 -isForBrowser -prefsHandle 7024 -prefMapHandle 9632 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4005dec-98d6-4c01-ac2f-c167badb1f2a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4336 2a661fe3758 tab3⤵PID:4848
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.44.700547237\1811610808" -childID 41 -isForBrowser -prefsHandle 9464 -prefMapHandle 9168 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89b93205-86ec-4ba6-a5d9-c0ac14f7312f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4464 2a66210be58 tab3⤵PID:3636
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.45.119935072\1923932786" -childID 42 -isForBrowser -prefsHandle 5776 -prefMapHandle 5780 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37e63ede-853a-4271-9152-083c883cadcc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6924 2a66210ee58 tab3⤵PID:7012
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.46.63832016\1521595712" -childID 43 -isForBrowser -prefsHandle 8112 -prefMapHandle 8088 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cdf1b6f-a952-4330-9793-ee805419800e} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7028 2a66210c458 tab3⤵PID:4344
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.47.1578425455\1523440712" -childID 44 -isForBrowser -prefsHandle 7952 -prefMapHandle 5896 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e312838-ff69-4bce-8a60-676cde5add9b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8100 2a65c979658 tab3⤵PID:5312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.48.322449415\10664982" -childID 45 -isForBrowser -prefsHandle 5468 -prefMapHandle 9128 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f77b188-6287-49f6-9673-769742f4685e} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7768 2a65c979c58 tab3⤵PID:6884
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.49.415443667\1105092303" -childID 46 -isForBrowser -prefsHandle 8112 -prefMapHandle 7748 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da864b61-3c94-498d-ac4e-0430673f31a7} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6880 2a65d71eb58 tab3⤵PID:5140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.50.1145720364\1350694353" -childID 47 -isForBrowser -prefsHandle 8032 -prefMapHandle 8580 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7b2f00b-2f72-497b-b7d4-982ce1e83d96} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8188 2a663a4ba58 tab3⤵PID:5440
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.51.1210471403\1390582392" -childID 48 -isForBrowser -prefsHandle 5896 -prefMapHandle 7952 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e274d02f-f4a0-42eb-9dff-3468c95ba265} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7804 2a663a4d858 tab3⤵PID:5456
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.52.657155230\1917237364" -childID 49 -isForBrowser -prefsHandle 8432 -prefMapHandle 5864 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7b75018-d76c-4abd-a2b0-7960066e51fc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5644 2a663e94e58 tab3⤵PID:3124
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.53.852274923\930609621" -childID 50 -isForBrowser -prefsHandle 8528 -prefMapHandle 5644 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc583d62-cd1e-4bfe-89c5-eb846751d90a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8424 2a66403b158 tab3⤵PID:5596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.54.1106453375\1209406326" -childID 51 -isForBrowser -prefsHandle 5532 -prefMapHandle 7264 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1beea77-c2ac-4c4b-9b5c-50b9f68e64fe} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5436 2a6640bde58 tab3⤵PID:5480
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.55.1206639682\1690563381" -childID 52 -isForBrowser -prefsHandle 9916 -prefMapHandle 9536 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9aa5514-6a9d-4ec5-ad15-bdc7176547b5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8404 2a65b178a58 tab3⤵PID:5144
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.56.291904047\748555281" -childID 53 -isForBrowser -prefsHandle 6408 -prefMapHandle 6404 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66d9236c-ff04-4e9c-8a84-6b0eb25b3f40} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6420 2a663ca0758 tab3⤵PID:5276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.57.771296403\100132169" -childID 54 -isForBrowser -prefsHandle 6600 -prefMapHandle 6592 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04385b65-bd9b-476d-9569-29c31dbd2acf} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6608 2a66491b858 tab3⤵PID:5956
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.58.251256087\338412576" -childID 55 -isForBrowser -prefsHandle 8412 -prefMapHandle 6588 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb17006b-7c7e-494e-991a-325e038859d7} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6608 2a664a50e58 tab3⤵PID:5792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.59.367453286\1350232082" -childID 56 -isForBrowser -prefsHandle 9228 -prefMapHandle 5364 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2af56a99-2242-4a30-957c-f7ca4012ed9a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8196 2a664a50558 tab3⤵PID:5340
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.60.1628073918\186263094" -childID 57 -isForBrowser -prefsHandle 10372 -prefMapHandle 10368 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08c1867a-3107-4904-b2d7-7d740c80e602} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10332 2a658a33558 tab3⤵PID:6952
-
-
C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\aj5A64.exe"C:\Users\Admin\AppData\Local\Temp\aj5A64.exe" /relaunch=8 /was_elevated=1 /tagdata4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\nsl5B4D.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"6⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6968 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7524
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7556 -
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:7584
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:7612
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:7628
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0ie0ZBQkE2QkRGLTUzNUEtNEI4OS1BQjkzLTY1NDQwNEQ0OThEM30iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins1MUVBOEQwMC0wNDY3LTRGQjItQjFCQi0zRkRFQzI0NkRCMTd9IiB1c2VyaWRfZGF0ZT0iMjAyNDA5MTgiIG1hY2hpbmVpZD0iezAwMDA1OEQ0LUIyN0EtMDEyQi05RTNFLTQ1NDE0NzFFNkM2OX0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDkxOCIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9IntENjlGQzQwRC1BREUyLTQ3OUUtQTRBMy02Qzg4Q0U4MURBQTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTUwNjMuMCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTIyOCIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNDIxIi8-PC9hcHA-PC9yZXF1ZXN0Pg7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:7676
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{FABA6BDF-535A-4B89-AB93-654404D498D3}" /silent7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:7696
-
-
-
-
C:\Program Files\AVG\Browser\Application\127.0.26097.121\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:7476 -
C:\Program Files\AVG\Browser\Application\127.0.26097.121\Installer\setup.exe"C:\Program Files\AVG\Browser\Application\127.0.26097.121\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.26097.121 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff69aaebfc0,0x7ff69aaebfcc,0x7ff69aaebfd86⤵
- Executes dropped EXE
PID:7564
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:7644
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.61.1940652448\166545101" -childID 58 -isForBrowser -prefsHandle 6384 -prefMapHandle 10948 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9c1d135-798e-4aad-8279-c21dba086edb} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9040 2a661fe4c58 tab3⤵PID:8000
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.62.2083818536\981442065" -childID 59 -isForBrowser -prefsHandle 5300 -prefMapHandle 5156 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce130893-17b0-46ad-8783-1304545a96f6} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5116 2a660b82e58 tab3⤵PID:7664
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.63.809849872\775777518" -childID 60 -isForBrowser -prefsHandle 5204 -prefMapHandle 11204 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b035273e-f89e-46f9-bda7-611199a73008} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5228 2a662264858 tab3⤵PID:5808
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:2832
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3636 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.0.925240826\1867829622" -parentBuildID 20221007134813 -prefsHandle 1644 -prefMapHandle 1620 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {828be36c-a1f4-4a49-973e-4dbb9e4cfd0f} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 1724 24ef30f6b58 gpu5⤵PID:4344
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.1.1835994436\830726714" -parentBuildID 20221007134813 -prefsHandle 1892 -prefMapHandle 1888 -prefsLen 17601 -prefMapSize 230321 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e047e6a-b74c-49e7-b6dc-a6ad5177589b} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 1916 24ef2f3a058 socket5⤵
- Checks processor information in registry
PID:1932
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.2.405471480\1993952449" -childID 1 -isForBrowser -prefsHandle 3120 -prefMapHandle 3116 -prefsLen 23698 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff7fc401-c249-4628-b493-63f370b4c57d} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3168 24ef8029358 tab5⤵PID:6032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.3.1677851904\1540161136" -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3852 -prefsLen 23805 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {edc2f267-e2f1-40df-80ad-71f81ccca9b1} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3916 24ef87a8558 tab5⤵PID:6028
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.4.1206410041\1263801892" -childID 3 -isForBrowser -prefsHandle 3696 -prefMapHandle 3768 -prefsLen 24887 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bad0c58-224e-4880-a2b5-a646145f3778} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3712 24ef8eb0858 tab5⤵PID:7916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.5.786578772\2107368128" -parentBuildID 20221007134813 -prefsHandle 4224 -prefMapHandle 4240 -prefsLen 30501 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {10e5634a-779d-4447-80ce-4b01cf33bbdd} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4304 24efa978258 rdd5⤵PID:5580
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.6.682251912\1532786877" -childID 4 -isForBrowser -prefsHandle 4300 -prefMapHandle 4436 -prefsLen 31920 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0973f103-ce6b-41b8-94a4-9d1647758bcd} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3904 24efb721e58 tab5⤵PID:7260
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.7.1593891756\1460833457" -childID 5 -isForBrowser -prefsHandle 4860 -prefMapHandle 2888 -prefsLen 32092 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63e5f367-8fc9-4f89-ae0a-fc7ec8db136f} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4840 24ef48cdd58 tab5⤵PID:1044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.8.465074148\197669459" -childID 6 -isForBrowser -prefsHandle 5048 -prefMapHandle 5052 -prefsLen 32016 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cf98c1e-4758-492d-926a-6fac9e26bb9d} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4892 24ef4a0c758 tab5⤵PID:7160
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.9.988668513\404865402" -childID 7 -isForBrowser -prefsHandle 5636 -prefMapHandle 5712 -prefsLen 32442 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ae27b6f-2220-4865-af05-4d05477cb071} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 5072 24ef4603558 tab5⤵PID:7104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.10.16605903\1580975062" -childID 8 -isForBrowser -prefsHandle 6096 -prefMapHandle 6076 -prefsLen 32755 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a892447-96bf-4f5a-a1cd-750942a58be2} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 6032 24efb0da658 tab5⤵PID:5272
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.11.150578193\578154528" -childID 9 -isForBrowser -prefsHandle 6600 -prefMapHandle 6580 -prefsLen 32804 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c51c0be-ca42-4078-b827-842e2a5d5bb1} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 6604 24efb0da058 tab5⤵PID:6256
-
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:7756 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:8124 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:8052 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.26097.121 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff62318bfc0,0x7ff62318bfcc,0x7ff62318bfd84⤵
- Executes dropped EXE
PID:4856
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
PID:7172
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
PID:7220
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2184
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\PushFind.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:8056
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4844 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:696
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /c1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2292 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /cr2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
PID:7792
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
PID:5768
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4868
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:6964
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\RAT\CrimsonRAT.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\RAT\CrimsonRAT.exe"1⤵PID:6184
-
C:\ProgramData\Hdlharas\dlrarhsiva.exe"C:\ProgramData\Hdlharas\dlrarhsiva.exe"2⤵
- Executes dropped EXE
PID:204
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCrypt0r.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCrypt0r.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:5548 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2388
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:216
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 146581726643294.bat2⤵
- System Location Discovery: System Language Discovery
PID:7460 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
- System Location Discovery: System Language Discovery
PID:3080
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3348
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2876
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b @[email protected] vs2⤵
- System Location Discovery: System Language Discovery
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5456 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- System Location Discovery: System Language Discovery
PID:7512 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:6900
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- System Location Discovery: System Language Discovery
PID:7320
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:7464
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7672
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5544
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "grgzzewzdng210" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\tasksche.exe\"" /f2⤵
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "grgzzewzdng210" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2908
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:7420
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
PID:6808
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6172
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
PID:6840
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5636
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:5204
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 13301726643300.bat2⤵
- System Location Discovery: System Language Discovery
PID:6712 -
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs3⤵
- System Location Discovery: System Language Discovery
PID:6900
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:6296
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:876
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2188
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:6740
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe c2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v2⤵
- System Location Discovery: System Language Discovery
PID:7200 -
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe v3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4824 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- System Location Discovery: System Language Discovery
PID:6320 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:5324
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- System Location Discovery: System Language Discovery
PID:4288
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6064
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:7764
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4356
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7884
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Modify Registry
6Pre-OS Boot
1Bootkit
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6Software Discovery
1Security Software Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5a57b514be8f1ca8a493a5aef8232d8e6
SHA1720d1e72dc57c741b808dd5a2e6d9141f0250de1
SHA256f16af0f781056da973137cd6a482fc1cdbfaaf729ea959875e172206431b70a4
SHA5129135f2c2097fdf7fc626cf09eac25c703c55dc911737e8fccccb83704a83436334c4a264a3979527a43895c431d086947b223a78867d6eaa0f5d112196012ddd
-
Filesize
28B
MD5c77604c7e5463b233bc03b306135ff96
SHA154cfc9bd449afb21a35b2ed615dfc76e24fcad60
SHA2567db7b75e925cb7a4888d9760256a9c13174682a7c9ed9a3033bf51d706be64ba
SHA512f5777b841966c0b10d84299b0ad57b8614b2da104c3b6585b1d3b3cefdacf548610c277e105158099306768c9f68f91093144474b175b8ffaac63f43c127bc90
-
Filesize
149KB
MD5f73e60370efe16a6d985e564275612da
SHA12f829a0a611ac7add51a6bc50569e75181cdfd58
SHA2569cf076866935a0c64366efaeff2ec76d45ac816030ebd616fd5defb1870bc30e
SHA5122e44e87c285bb7b72d45c8119d08ea6f2d13cea77cf0005a3cf530790bb86c7f2df7c5edac9d86c9d7214abb224738c3bf6b31f6bf104051512bb1de133042dc
-
Filesize
170KB
MD5deef1e7382d212cd403431727be417a5
SHA1fac0e754a5734dd5e9602a0327a66e313f7473bb
SHA2567d410e9eabd086827b16c89ee953a643c3e2f7929616c0af579253fd8ca60088
SHA5126b472a57fb89b128aad9ab6313a9ce8b171f7d73264c67f669adc5cf1f0421d81f654dad1419b620476abb59dd54e1aa03a74a26c5c93813f6fb8575fbd97d4d
-
Filesize
204KB
MD5cbcdf56c8a2788ed761ad3178e2d6e9c
SHA1bdee21667760bc0df3046d6073a05d779fdc82cb
SHA256e9265a40e5ee5302e8e225ea39a67d452eaac20370f8b2828340ba079abbbfd3
SHA5125f68e7dffdd3424e0eb2e5cd3d05f8b6ba497aab9408702505341b2c89f265ebb4f9177611d51b9a56629a564431421f3ecb8b25eb08fb2c54dfeddecb9e9f2e
-
Filesize
428KB
MD52a3ad7362e6c8808fbb4d4ccaba4ed4a
SHA13f896f7df7fe202f4a717713c503665bb4dcaed6
SHA2564dcd341907880c8dea840819628b19c5ea42ca2b5c61ad57147d0ac7da9b6759
SHA512892042ac713e4d5b488262a584355dafa18d967035788799c1773eb39a4616461beb9d79a230d9f85cdefd1b4076b8a5e1d4bde17254bff1f08c3eba56469679
-
Filesize
512KB
MD5dd5dc945cd848bf503862d0a68c3ea5d
SHA19b277a0c733ed5698b0656da8c3b99d2f90c7ef8
SHA2568cc98345e367b083f545ace66d93bf69e03a4fa08b84805a9925fa4c94ef3f8f
SHA512f6eab8422bde24d89a7723c6175b4197a50e18aa0bb5b8f419e5a23b265d85dcaacaf136b8f6ef6bbf2bd6c0eaecd8f86093f594fb98e596f4b39e9c6ff227e1
-
Filesize
1.4MB
MD504a6438c50564146e880c5eb9d57905e
SHA1edf5d454de99159d832cc9bd0d8dbe132d749804
SHA25626109d47bf9960e531888e6c545ca8cfc24fee2202b549df29fb8bf9c58e0812
SHA5128705d0ab2f8a6c1ef567ad00b33ff2cca01391b105eb0ade201d981f091e4ba87e709860ab9849bf9781698fb42ab8efe53ea731af310781766bace1eb1dc19d
-
Filesize
42KB
MD5ba03b29d5d44341084eb06bea8f1e702
SHA17d8dd7556ea5e299b55ddc7477ca758fe2c64f48
SHA2566a6aad33e2910c29a6d919aad074d89359c5e6723ced7ba4e215a62e9513749b
SHA51229f902587b7078deb12bee6bf9993748109749ec12e6490d5f84bc9c532a5a1f414149d5760641ef052611bf2d441423d115dfb5a4c4c6f5e6d6a1f386924cf2
-
Filesize
41KB
MD59c77be0843f0fe4864a04f8d5f24a593
SHA1be03adb4d3c33520e652c7a6ee45f09d5ff54a54
SHA25639547fa5d7b93856235288b1021699b4f36f0bea10b10d6b89ea184a3ad77bb1
SHA512f504c98b03a5d72c078b38a2cc4fdd94dbed159f5a2ed47c2c4a53fc6ec8a3b1fd969d5ad85fc7503e64427a36adee7a14f15f1275a9194103e43c8a8ee45d28
-
Filesize
44KB
MD5c0b41217fc33a6a53ec69ae7399460f2
SHA1d7dd8d543b7297f1a1e138efa1806972c9489c3f
SHA256d75a1a41ad7e5277576e3bdf35a858be3a6f540d21c8ab4156c842d8f1b3295b
SHA51237abb726b78421aaccdbc94b358cda6b581e89ac519258eb39c6a7f0706cfc64c3a96f5c29539ba67c6e2d2afd6f10b6b0c063b54366c03376ce234d132a8253
-
Filesize
44KB
MD5aedf6d96ccb64f488379bb1fe65f697a
SHA1901bbb7873d8f698f49c4b6be74fb50b353d7b5e
SHA256941d22186ef1bfe27052e78d21944d6088cea152d1ede51452f04fb032c92f90
SHA512d1d889a1fe75924f3569e07d9ee3f552afc02165210f5c439d4697be898b72db397bb89e7d0706259f92c1cb5759009f9e1ba5c52f764e63514b3da41dada1cc
-
Filesize
44KB
MD5f951cf3ca93e5ae5fc1ce2da93121d98
SHA115bc869406857437babe41cd3f500c356913499b
SHA256eb00cad19ed1d16f52928962f2cc6231d65eb74b2314976ebeb1ec860103e746
SHA512b77086ad2b39723d697d7839d9243c1c0769a2cb0f6287cd3f2d64eabd6a48d8fc2d253e9089c6586637ed5dc5970c2608615fe77cef5003f0c4d53401ef73bc
-
Filesize
43KB
MD57f3dcd851645d3d75f636c8440fb057f
SHA185debe41ddcb46555a0d00795e41e460a35583c2
SHA2560b31785d1931580cad5ef16d4ff5723802d12c38b56746e70fcf91d71162e043
SHA512d0d21c397899aaa6a718b77195a6af1556309615616fd6583ecb84b04aa7087e76eb5fdd6cae0a4ff1c0f85bf72e1f51ae002042078095f640eb95da363889e4
-
Filesize
43KB
MD59a421423686559027e4301d36bcf58b2
SHA19669424f4e7c765ddb917a515d5a8b1486f87daf
SHA2569d8ff148793d99974fab93f38027e1999323a48620b303f82170751be5dd6b69
SHA512f5d62fe17a820323c4b1832cd3bd9c8fa291d44dceb88a8a1a8f94c6166e550ab9baf9357c5ec3388230bc75f0ccd3aa2d5247fa5d242013d22c61001128a951
-
Filesize
45KB
MD51c15851d9dd22e4ae3f3bf249da79035
SHA160fc5652b5e1c55056c961d4d3b961492cb3432b
SHA256a9dd72a08c0c58a71b2289d76efae681a5c8eb5faf73e49b873f15ba4050baa6
SHA5126da386c35b317f39613da73340631f927606bccd0a8c626537eda896eb32c9a2ed1d71c7cf838f1a4b90553f3f788eeb5e02fe84774fb0ad2f574bf4e4d7e248
-
Filesize
45KB
MD50d15748f01df49dae986f1e27dc098ef
SHA135a435bdaaf47795977b28cdae2e4ea1fdae73a3
SHA256df13c38061cb0b02dd8a9023a17da0bbe1cda6fdedad5203129fc702c7fdd9b1
SHA512290e9936f50e3bd11c1b9d28decf3b43f5e23bbff16801e7b0491690773d057b6bcdcf48c48a7ee16fa2400723b3e974e2b74e3899590a8e660c2e9c78b9d141
-
Filesize
43KB
MD502465169cd873c4492196e03457f2771
SHA1837ca5e54a8c12577d0d05a32996dfc04067c5ea
SHA2564eb9edf550bf1f66382e5d8bd4958438891cd2ca46557d14f4b945dc176ec025
SHA512e73b5f3951050f2903b80b89d2b9fd9ebf69adb922eb8238ef4c01f413ae67727d7598d4ac15f7ac8b9257aef0139e0924c70c5898357142a303d7e2b15394c3
-
Filesize
42KB
MD5418853fe486d8c021d0cca2e85a63d63
SHA19504500a7b5076579d74c23294df4bdb1b7c517d
SHA2564cbb2591c1eeda32bcf295685c993ce4d16acc968697fa12e2a00a1b7c4b37a3
SHA512dc2ab4e2056e6d73a274d700bc16f75c7c687b35874029c1908b183428dec010373045d4a52eb3f5745f8b91d624cf5d40cd7f37e353f3a41348e2a054a266a3
-
Filesize
44KB
MD53e5971e8559c77e8901ce30d14034730
SHA104cc21ac4a84abd29f7d7585282345881fd81721
SHA256613418b8779f7440b88f1734d6c514706df9dc9a58a623966cc1c9ba4e29c28f
SHA512b4592b25cf676db6d6de1be811c39bdeecc24bbfd4dc72fa4b3f97de866f9b0fec7c85f7d56f048f61829c1d8b4109e4a0c7e14a9e410e30a6a8da702941e00e
-
Filesize
45KB
MD55f8ea18786d5ef1927cd95537abc3ae0
SHA15530650ecc719d83b7aa89e0b326b5698e8adda2
SHA256fa416294b078226a8919dbb8f75533a6ef96d63d5bd17aac854eae68791433cf
SHA512577dc7d19e4443e8aede759a781826c091c17d12fb06e89b1306133f21e01dab919045183a916e1b5647ddf485134a8459745a9199df5c7e36abe192645d8e25
-
Filesize
43KB
MD55029406d9202d6f2f279fdd3a06f55a1
SHA1dcca8bf9392faa0038c6cb5d25929726b16804af
SHA256cac545e04d701c39f4a730aec4c3dad177d8ea4baca10651f150925644874864
SHA512519538e05f8e21966e4878291692cf25057bba3c993c0034a33b1da7c9eb0a8fb881565717ceb6c1139fd601b73b1f1e2aa46e20aeb6b93f897cd2ef93172934
-
Filesize
42KB
MD58564514501256ff045cf7aa6c1b5a797
SHA140b9aa8d04c48fe2ecf193c2089418ccc938676d
SHA256f3f46a6da6c8ccb3ce7fdd0cb5882f45523decca95852b8c775bb90f8e92c1b3
SHA512701077c8a1c70c1bd0c35f54aa838dba7b7b6f832e0ef2776673092fca546276166c3638676451c9655086b740b9e193cd54f952fd5fca481b964083b881bcc2
-
Filesize
43KB
MD557dad7c22bd635a5af8fcdcd63d4e530
SHA18aa11ea5c1cacd9b23c29989f22e82c43c827d0e
SHA2561e0d05927a455115265db9308e0f78ffb7bbb5442f36b8483549efbe415454a2
SHA5124236609e37ec41bf46d0f45e228c9021c1624e2f98a642eab513d290a4482da13764fcc2d044f78ebdc09e0cfc63a251678d169cb33e251d6f6d5de9b96c31b6
-
Filesize
44KB
MD55ed0105f4043466a99557dde1f70e97f
SHA1c57c935cc4b25b6375ab3fcdfbb265f4c586ec3e
SHA256cfbe0120ddf8d5574f7c44c85488f53aecec4df9bfb25f1cefbabcad5af46096
SHA5124fa641810f758e0031388ec146467fc130780e2f2cc8495b6a2fff0679d7bcbe7526356f85a97b5338e84d791ba14e812b2c182fdae01763640be3324fb59526
-
Filesize
45KB
MD58ddc3f7276c12ac407cadcda6e2a3e12
SHA178c5e802f67c8b6ae3fe13202e6a54d3cca69df4
SHA2567f2f0f9f443a022f5aedacc40c28d0654fec488f34435c75979118464256a8b7
SHA5120d05bdd2d5e9f36eb09182e8b13507ba03e256c4aadb77bbfedf29584a47fd1e0733a825a3f687d3058e53c8075caf6dd9d24ec93f1bdd58ca97106827323540
-
Filesize
45KB
MD5a4061e8408cc59cb898adfdc4f173278
SHA1ae34e3058a40449481590bb3a63aa0225b4f6f98
SHA256e033c950ecc6333dfcb944e70622e77a6498ba0e23fd144117dbe9a2a0c15be6
SHA512d8a847e9a21c86c7b9b072e16914f42185e3c0e1d99f6ea5259382eb0fb89578c7a7f9f62f892f1d20be180dfc327bc076ea038057895c8b92cb1f0c053e0b2a
-
Filesize
43KB
MD538525b8a1b15a8aeb4fcfc8bee8358bc
SHA1ac2ba33b8ad778a8165c87b579dad0dbef5bed75
SHA256271e83bc86e490cd5b6cb9cb34057c7684d233c56a53f4f553aa07507c9dae52
SHA512ad8df196174ceeadce4588dcd365066665267b922078d92b328ba661a4ebfa6d06b4263a4b8a28e4efb4d86e1140d71a3c3bf4b7b60970aa20552aa7f0c73acb
-
Filesize
44KB
MD527c0dbd61a71420bb4d1a0be2373a175
SHA147b4c107b711caf5a6b2978bd6fd6b53ebdec5e3
SHA25643191a4c507a112e96e06f959b6cf78406bf970b021ad8d7db59d1b9c52779bd
SHA512d1f20e9a628bdcbd26b8d5de89b87bdbc8dab871651c86d47c023daea86c7ada0a565fdd05b48c7643a63db044639f4eb89d1640e58c9b32722e4926c3c5e72a
-
Filesize
44KB
MD5114cc594fab2e564ccb24a826f3623e4
SHA1c3c3fb4ef6ea6ff0e7a1e0289320b2fd2788b03b
SHA256c89e223a42d7173f915dd088ebc84b0048cec772bd4221b4b90ce4c0e419ffe6
SHA5129a7eb5710340cecb2d32de26322dc862812e185b6d260d76c0c7f642f30cf9e43c88aec76b515148ef986db0c77fd0e31f71c8fd26d56a4cc72dff0d023abb5d
-
Filesize
43KB
MD57e7deef6ac35c9d52410fc356391c7e4
SHA143b3d918867a93ba109a3e4eacb45f3cd5c40b93
SHA256963f4d2ad7ddcdcfb6185521c0590a92f2014897d5f5f525471ac81f3807fc5e
SHA5129eb0e9be0a973693b4bd167f6c1118dd9d702b1951a90f0a3a6103e77c43ee6afa173b79d3ab21fe94a98c320b17ab0b787cf5b6ec47d9dde9e3e8c14b8cadc7
-
Filesize
43KB
MD5dae35fa037b6248876347521c5298566
SHA18358fc05a675ea56f720052fbb4b384d97b94d86
SHA256ce0652b8dfaf21b6192b66bf75e140b3d72aa545e0edf62d9e82e9b0878ac5c5
SHA5124158b8fef0da76ead12b5d6e421c5709664ba84d1ddde44ef6bbd1023084cad3820a37abea03b206635a945a2435b301234cf5bac3c8e2861a852b2699036ade
-
Filesize
45KB
MD53ae3106694098f8420b182ad5e3354ab
SHA1bc9dab621b03d4126b97c260becd7f4525255462
SHA25659b406b29538c3c3d0f060b5fc0ccd36556f8a6278327935a5475c6b21741dc9
SHA512f3625be57976083d642b01a41a53d6db6cad3bfc584a50de3565fe10975a5d7d2cf4f8b41bcdaa5ac70f8fc4ada113084de07e2ed45f26401dc2d4f8f4c322a9
-
Filesize
41KB
MD531227325c8617b308ccd268c2be7e72a
SHA171e369f26e644e643fcd538d933e4087dd593f1f
SHA2564a98e34a528eff04c2baf4e9e50489086e58d2e32e1851f33674abbe5e104c68
SHA512ba8d94dde5b7b74a39ed54a5f3e47a558e0c1deb632018c82423c06806071143851bb1d8c7a7bada6f13e71734e7a29457f3741266972b777cded41c953a9645
-
Filesize
40KB
MD50cfc5b7b3f86d6bfaec9a0713da74df3
SHA181a278fdee9edc302fe4e7a88c9addb230ce6df2
SHA2561d7fd1b6a614538530385e7a40efc95d3b8be75057ae03bf999aa2419d1f9f24
SHA5128b8f834ccee41c69c581f0b80f26b0cdb536f87bebd5a6b1f02cdf6f1aea5cf5b29c356e82c7a8fd591bb16c0938a790ac8f90f6d27edc95fc48a5aa3c30cbf0
-
Filesize
45KB
MD549000b4a101e635b05123f21b360b492
SHA1635f697f41c0591168e0eee10930728d9dec5a53
SHA256a2aab58a4397c040bff69d45bef4ede6842034bf897799a9347232c4b6c9c7a5
SHA5129b62c2048e9c132089cce7da02ea5c95b5856f1c6e28d5581f4a0b1748e681bdd78c7d537d273a64f9d476e4ec62da5c6021cc1ccb69f7bee216e7bec6ddc6e0
-
Filesize
39KB
MD5dd2f783c0017630f9a2969957f4eb84e
SHA1d42218de12a7c1c48fb5e7d60e61e32ce0cd9ac6
SHA25607e63e0e3d23f192ac131efc459c2d9f79a4ecdc39403d43fbff320c4b5fa261
SHA512689f625df8aec45a6343249739ec094cbb1245a9dd8847ffe6bf62fd2d7042d529f77216dd22e8b33830cf21b158f0ef6ea42af2248051c8d97205eb0229a22b
-
Filesize
43KB
MD538606bfb6c9bfdf74503f833ee2733e5
SHA1670abd1279f642ec7b19f663e53f2813a716331f
SHA256df6c4228da3bf66929d81b99cb35df4a4389418490144630e1d9d5f422b56b38
SHA5126cc6f2fb0e5bf0241656cce5dc7311f05b8d79633f2176f8c172a9fcfa9813e3963576363d539fa1a8a58fa6bba138dd0baa7562274fbe99be5cda60f4671747
-
Filesize
44KB
MD583c356f6310d51f8ffc1d67d580f5914
SHA1f9bc318975f288fa47e8426b4c450a93b10af45c
SHA25698e35cea7cddce15191594a70f8e15ff2dd1c02bde87225af0331441c65bca26
SHA51228a26cb1d88d072d7898ed27c3e9d056efedaa2cd9eccf951429f41df2c0162be3c14e58cfb4cf50b633d759825fa815a9249e7690d2ab75f60424b30dbe0424
-
Filesize
47KB
MD574e24332295807ca5ab8be9f37dd19dc
SHA182feee443e0c8342ef830c182fc2a3c98f57faf7
SHA2564675474b7ccaf45c9fca9c4d141260f233807ddc68cf854d0900bb1f58522b67
SHA5126682d18ed66b06f07bb6b1dc227808d5c872685ed271ff4b34a57d4ec7c7fe5316b6207d1094327db4e3166fc2288e47065cb72a275666a4b403dde8e33379af
-
Filesize
44KB
MD5390c8645cb5e0f93054c063c5e5928f4
SHA10d17ac3976b3219750853715c06baa34e8ed751c
SHA25698ae5da68f38dd4e43e307543d3218d4180c09433ae72c3b661eb73591a7a589
SHA512b1bf09a5111890fa61dd944dbf0cf2804cdd96c5fee3193a80fb15cdc6fdb455fb4e535e8aec337ca4595623bef29c7f6784e53e222c7a5df400dc61965830f6
-
Filesize
3.3MB
MD567c73b883072bd993ecf0618bbec3312
SHA1ae589f1faec5846b4008f307538470e40eb66033
SHA2569c454e3342fe945231e5cb53ad2d69a5b9277a83d1d9182256637146b6b318f0
SHA51206d41673b9bddd66565b3f740b1fc9da28bf18a56d216bf4ca4c6ff072dcb5d05a92024431ac0e2e866dfe7b4a7cc18d5bbc4a9439dc241d1edd1823d3e16445
-
Filesize
9.1MB
MD564261d5f3b07671f15b7f10f2f78da3f
SHA1d4f978177394024bb4d0e5b6b972a5f72f830181
SHA25687f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad
SHA5123a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a
-
Filesize
56KB
MD5b635f6f767e485c7e17833411d567712
SHA15a9cbdca7794aae308c44edfa7a1ff5b155e4aa8
SHA2566838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e
SHA512551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af
-
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Filesize102B
MD57d1d7e1db5d8d862de24415d9ec9aca4
SHA1f4cdc5511c299005e775dc602e611b9c67a97c78
SHA256ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
SHA5121688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
-
Filesize
1KB
MD593148b2e78ef7cc8033fb8be4185ca5e
SHA14494c605c20d05c59b272753ad012e63b4cdc95b
SHA25685c851a8f82e343bc68e17ee40efa39ed2d74bda64d291c7dab8c7ac8d49c2fa
SHA5129b90683355b4601f8893aedad7cade12394c2b6e97d444e15abcb27f9683dc0d4834736dfd899c9205e36550238d20d146dfaf5aa4313ff1e6559ebbbfe73b2d
-
Filesize
27KB
MD5c39ead11e7f48bdb16db26bcdb5cc5b5
SHA112195c66515d1c41d85b2e13a935ae2cf042a8af
SHA25676e14e9bd08d4cc71bf0c50dc0c4372acde4393795933d9f2ae59240831a80d6
SHA512af3651c91902fb549e8881a1919cb9cb4403e25178717dc990bc4b6c3016ef4ee403c3c1842db31deee8c4a3dc303b218b885b2144418233ac754bb44fccef81
-
Filesize
14KB
MD58500691168fd2a396d0266fe429ac918
SHA182c21c640008da6177b5feea8fb1bb315c832ec5
SHA256ae770ec04cd50e412c8a0e8920463f79907478ff33174365d9ceff4d22afa07a
SHA512126c793779f493c023a339ad3868d5b445e50491e44193d26ee4a0e5f7d9ed454ebd4af2172ff15758c87d56ccba5fc3b563235782045f4ed5e023c5903e4ee5
-
Filesize
27KB
MD57c3408270d8dd76f9aab4028b0a5ceba
SHA11c4273696125dc2bd1e7b2b7682b37a7230a18f2
SHA256448c11fbb4ee1e744b68917d3289b1d9760e3d11c3e50d63657df3a8e23f513e
SHA5122a18140cf03e8a3799743e4d910b19648131ec39469c19be66b57c7647735fda7eb9f6e1392b9c8e5b84621cbc6bd8981486f7eba751161b3a08f08486b594eb
-
Filesize
7KB
MD5b3048c1e8dc07bd649bae416eac491d6
SHA14f700dbe81cb80e613108f594286c7c61712e10c
SHA2565733a5f48fd14bc43680c89f4d3f4a25d7e39e67322cd1b70e8b29d00d9bd6a1
SHA512d207d48840cee7507575080d3a040e6e43830d70e348acf66fc02ab93396ca1a6a60280d3ca7400b4990774fdaab59f857283c9822e6e8fa4ac22b2640013fdc
-
Filesize
15KB
MD5243e4518903db3e5ad9dcc27c56fed08
SHA1b571fbab7b38be6636a92b50645d1acc2910bfd6
SHA25646d02c4fac077b93ee8d99e76feb8dec6804175880bc1a5946f2c782e234cb2d
SHA5129b22f22425210a27a92e2f10f610a4c6b2e13538340498291a8b4e1fd3c76414f45ad7d44524e5b70c2bb7b1f37b187a7efb5d41cfdd8546378046d21ce991f5
-
Filesize
5KB
MD54a99e7c12b49c5db19a928a94dab85df
SHA10c260794e374512af5368046d3dc6c70e08a1fec
SHA256829044638e755acad13506fcee00cfdfe43af8c241c796100b9edb3926594717
SHA5124a9848ff3ea3fbf27dd5adfcd5fb97a24555e836cd66fe0d165c6337854716e62ede9bb1ff76e9f0fefaf3049f2b1af28cd4bd6440bb88516804ecfcefcf8ca9
-
Filesize
27KB
MD5addc16f0d4156bba83493c65695ed0fc
SHA1a92cac4b67d26e7fce6d5919d37e924b56245f04
SHA2560eecfffef03a8cb20c13a25afc1b23f2a0833d331da449532ad8a5de454e4d38
SHA51247b2d26a83dbbde8ada87b94e0ed902857fea737fafb833bff4def3c53bbb365442c529d92c91f59e76334c4560c778734a8ec7d994fa2297d26165b5cecac75
-
Filesize
7KB
MD5968744c5f1a3395952cc80672e61ef27
SHA1708efd5812e5267260a48908cbad4c51fd2d0ad6
SHA2568cea67e0367fa3b61ce6346965ef6cf3852d974b5d569723d7514ac7f2391ac7
SHA512252e93f68b27266a6f1c7166571938615649ad67fe96cee6f7ee530a03cec8c8d58f91d89297423270db49ae931611ef23b4131d0dca7a52998b0bb54578393a
-
Filesize
15KB
MD54d370a09c89d1d00836be0d159a558d5
SHA152b9d0d6cb11dba156913a70d6976b83119b5e0b
SHA25686ff24bbb9bd2fd01404538d84492ac1ae3b345da3db0bb669f05deada92102c
SHA5125ea2637c34d25cbc8a393b586860f9f06c912eeceeac8743dc87beb50511814cf6cf1e3d10062409a558d22593880358fa48219ecf98f6a5a8904499a4d85093
-
Filesize
8KB
MD5b538f6c44dc93d0dc836edeaf5f13c2c
SHA1ca47de7e9ccfe9fa3690c284eac6425322f4c325
SHA256f72f3c50475e49fc6e27525a0642aa02b32caea17ecbb5838fb9be3832935faf
SHA512339e0d89b5c7816620f945838c5d50e2a88dca77bfb28b1bc7cb2f5a02be18da5d36fe722c4ca7643ca21a05b0b6f1547a7eb1e1768e551f1e17295c172a001a
-
Filesize
23KB
MD58f23081974aa0491e8de0284036bc8ea
SHA18e8f1bc62fb98eac4220f6ba88cfb5a21f2c0427
SHA256b79c8caceb835dacb951bdc1c8d615b9b6c256f9622882217ed9ac3156b3f39b
SHA51286217fe8a53c00c49e2155c0131b9fa7da85e14104868262ba3c3317ef52dec95fa4d6600dbba54f6cbdabd17a4cc214afc44d90d7a3ec6854d98f4ff425a3e7
-
Filesize
7KB
MD5e6a9b7d530ff714c37eb8318d75c70fa
SHA1f579364d067497751059b274d35bddfafcf6f545
SHA2565d500173b711fff55b2cee09da0580690a2c32216a553be2abdadec83a4226a5
SHA51288378b6225af612ebbdd672446a31712992d9001e0b9011d13e59cf567e79dc643c73659c7381f3eabf841f8387e878e7cbe1114968ad3dac209a2ea84386db3
-
Filesize
21KB
MD55cc022c5e3d3c9ba6686ef557d0a9474
SHA100e114da36117ad18623f22bc24a76cacbe132b4
SHA2565198447a3e54e8af8b08ccf73a04b6d9cbfdda6f5ac1d03f36e9b953e10a1839
SHA5127cc2bad27540d336d47ed339f2c1dc1eb931eb69701cc2984f7aeae0715d421e3470faadbee500b5e0ea15da41929eefcfa5d7bbf3e3d5009113d08d7a577301
-
Filesize
8KB
MD5dc8c7ad612a88f04a1032d01bee0cd90
SHA11a1af54412271630260a6aaecf37a88bce564ded
SHA2564670d0a934bc1eea16e703590e48d4028ea8440652d3928c6a647eb4220b82e9
SHA51285c932b6a89a192a7b523c7d4943304820f3383802437d19cb47d04151d0af13393ffc753130fcaaaf6a38da3d7f0ff137ae0e2a44f2af506b3276b78e9ebaeb
-
Filesize
8KB
MD56f28466b2e20e929ca1690510ebbeab3
SHA1a31d4a61192d8284ebaecc54fe390d2cd787aa9a
SHA2566c79bcdbbf83fad56e797153a53c3339cfd75bd08009811fdec10ed8ace3d179
SHA512b045c515131e8d50890064beb07cd8dfedd6ef3f531dca6f575ccb10afb19ed02f5ae74e755a39ecb6418a22dafdeb17b1f5a2ccb1ad28814217f1735fc425fe
-
Filesize
8KB
MD51e875fb688001441969627213f4241c6
SHA1263e048cbefea7d258bc2664a38e346e46222c6c
SHA25614f891d95186ac1f3c9ba8f2faa4d60fe7345946cba21c10dc7ee191a1f1eb5c
SHA512f9d1de47afff9ec671ec32388de093219d684feefeeb118fb0e6a0bdf4d079aa43f9242f9b2809beff03a069d065b64687d0810b7b31a45364b418e751cf77b6
-
Filesize
8KB
MD5040b3f68c8b310171544333f5c3ed11f
SHA1140cc70ed0b29a18a7a3298696e35e33fbe3a67c
SHA256ef55f1f5e753f539cc4c2f8b100706ed6fc3814a43704f2103ec704fe68a5658
SHA51208c0947555c8bf0c7444fe15a441b7e30611feef720103f3a80f1adc329efa84117cb57e2dd2f73d5721320623a05b766c325cb3327f4db7d38752b4b24f39a2
-
Filesize
8KB
MD5b0256dcd76484056bd9bd67ee960ff7f
SHA10c59328acbbde1fe1d02a50660009dc77cb1f2bc
SHA25684c91d7682eac0b944faf28802fd0f1d1e22dce9dcbba5bd7cfd444c0d199856
SHA5120a175e4a54960608980c220c0accd6282b96f9c6aab06250d854b069cb20babddc98c0f78f73575522a21b2d964dbf97a565ab868c9fc94c4580677254bee9db
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\01ABD05F24B7C929E9BBF7B620E2289C4EE00CD6
Filesize68KB
MD56af809b529cd6d4878b7a6d4b60b926f
SHA1aaf7cd073336d7c98070ee3f24f34be26d632b2d
SHA256bbe9f734b01b268669a7749a866c424d641ead5fcb75884db440becccb5eb2dd
SHA5122c69d6ebab71eb2ec85e4eccf6289548c8a1addcc5c1ba08abe3b02fd220d8757365f383a6ba930f7d81f903ea813482790994087c81a60f1822b9775246b8b1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\027E6BED03090055EFBE6ECF794DEA90B346DD4B
Filesize14KB
MD5e8b0a2a476991bfefbe929f8f1bb6a6a
SHA103a5de5b021cdab3247148e2fc2c0c7bfeef0e31
SHA25662358d82f3ae5e24c105f4f7ca1287b707ea5ab24ec61a23fd4b096bf04c2556
SHA512d0184cb3a977e228b0b9cf9451c94569c933ef1ec08a993110c98e22679ce7f510fe10721629686b7d53fdf9b33132036ed81ce765b8c307940a9c88346cff49
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\0334C1D29A43126A467AAFB397D122E28AB8F4E5
Filesize83KB
MD519510a1b0e1ca78ed213ef0916501eb0
SHA1418830897ee0ac6591a3b8dea711dcf14f395aa3
SHA256565602141de17b0407c185c11336c868a67880e3be7321f97baacf6f4c978580
SHA512cfee9ec2059e904439a8c4941c152335628b767748b9b51c251a65557428f3187706fdb88d998b3472aeb1af582f9483979ede939a0cce19b1d089acbffcda82
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\039B57C60AE51214719616442A88AC451A57A217
Filesize14KB
MD5a85f2b3257cc48155106ac6830cd1126
SHA1e4cc197e548a24e57da659d0d2e1b977c490fcc4
SHA25632696f79559d9b39fa968797d862304eebb098894ed5ead84e2c30237f7bc0a0
SHA51270fa655599cca0ce0e26b33c6c8a92750cd8ce7fbd0ac50457c016e2d491fd2d167e868e2508accfe3b873030554b762d451907466f2893394d74c29d6fe361c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\05E6A1DF13B5C9CDAE24FABAD7131C11BCAE5F45
Filesize17.7MB
MD50711dc121a2620cb8a0823dfb66518ff
SHA1ef46f6a564714206541de90345f6e47a99bd4d7f
SHA2567e8ebf35c9212dbeee160032f9a7279ebcedb57b630db16172b8cd4c91d013dd
SHA5125e3be47ab7869503b5059e9bdc858060c20a9fe4180d9e627317eb8056353bdc7922b60e4e6ffec39dab6028ddc1a8bd9e2f17bb31c899fa05cd4957cde1427a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\0781B10CFC6F1C873D99DF0A70E97A080E54F225
Filesize141KB
MD51b31ec59eddb9ebc5e5018b9c15702d7
SHA17d390d7a3991920c37eab039c36fc44b57604fc3
SHA2565c01422776b428723281b083bfaf9f453e74b831cc079bd1ecc69c59c58beb54
SHA5129002cc14c775be83e777b17d50092cfbe194c5950d12e9b028e4ec608c844c251e654beb0197d98652e0e22bbdb343153e8148efbe662c213d2aa9bd9a64b297
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\0CDF62286FACB30969B0A3C5CA1EB489E9CB9180
Filesize599KB
MD5368bfe35ca5b06ce1f4b5eda88431679
SHA1433ea42ef321f6012a46208a4fb04fd8041bdbfd
SHA2565ee9f81e748f481c1014e8d8b30b38a0f56f8685750bbb62def6ec7ce8ec1c73
SHA512bc6577a261240960f1acfbea94290ad162026bde7478b65301dd7ac7a1946903ed0ba21c55aa1f4ebdfec1ece4beba30b786459eacd6e10ff45aa149921eb64a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\0E5870B6FDA96C4391013271C3A705C512BA548A
Filesize15KB
MD5de3f0ca3aaa516524b711ccc4e9f8e8d
SHA1861679bfb1b7929a8e88db85da3048cf8f8622fa
SHA25684f8708b8a16f6553c537ef9c075cff4529b474f795dd00c6bbaa4d2909bbdb5
SHA512edb3a40293af9c64e162449ee37d14bc690c133ea059b3575fc69ccc703143b1a634a9f7fb7bf1f731bfac7427bf9c49a1ef9e783db12abfab2da4e166116633
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\0EEFA6E8FD25053ABC063C8A23F8ABEC30074379
Filesize17KB
MD5944f30be1bd0cd7b7d9a311be64c57bb
SHA13d9170e9eca8852b8e33a39f27e18b1da89bcb86
SHA25666f373cc61ceaa2504a76b4f700e78461f43d8f1775186e4f69031efda9ab2eb
SHA5129446b2917d3a938fdc72bf6c5b5b394a2c2f16f5caa7452f58502aebd5180bf39eb49a00313afa3cf00cba0e044c32a5e41d87637bc388dda645254b65d825d9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\1243152E7867EAA24697321508C34F9CEF98EF1A
Filesize111KB
MD59f0cd47b7300869321ea3741ddfef705
SHA1a66c1ec2e051e602bb991c38c4a25e5a09f250d6
SHA256a04c5ac290bd6c2e9a35d05bac71f32c9a9a46b21278cf9cd0da2beca2fddf44
SHA5121ec2c2a24e4f55a1211b1db3c0850d71979ee518221e0e84e1342fe048a1a813a20df8735f6f712f4bd03ebd5a367955ce1f3da91767f73e422286377b78084d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\1402A9E66F9AA3A9DF2F0E11E293B20FE3C199E6
Filesize35KB
MD595dfbb34aba23c2708a3bd60ac472749
SHA19d93ce1f11dff5113a846ce9d48fd3d9d6f1dc33
SHA2565e144cbf85f7e1b90c1be597aafc604534509afc04412f317f41564628de0c76
SHA512edb2219a8cfae8c84f143f8fe0233950e42c740c71206e54cf5e7ccd67ce04535716f6c0a3c4a50142b8038e33d1db7c201e0a4ccfd7e802f14b19dbd8267388
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\1BFCF30C19190141EA70968C6D0386B3A55376D2
Filesize20KB
MD523d2259fe26fdb440138cfe7491178db
SHA101b8b4cce468d85ac5029cf530f490390343491b
SHA256703555618780b3a92fe8c1983c42e23cbed46bffccfdc50975d32c855036fc28
SHA5122a8a81b56970358d0d3acf3da58484277f03f2bd57da30a69ea96aa37402729a96d6c8dcebeca381e88f1c307a2a51258bace329540047b094d69d206a1c9527
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\1FEFA1FC23EA1B8072B430B69F42770C9DD6BD2B
Filesize37KB
MD55344074397d674206d9de5a3d27beece
SHA1dc11b59ffb79714396c2459af9a7d56ab8ec3562
SHA256f015757631ef23a2a0f9e73df075490c5183357291da3f5b85ae1c8424c2b504
SHA512fb7cc9eeffff23dd136427fd88cc158043465100c07f04cfae0b636a56c0dc43357a2aa72c4a4754b12c0752657231d0d715b3706be03499dc64750a902f373f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\22163D6014CE47154DA0970E434ABC30C5660352
Filesize185KB
MD544e279c974c5e9a07fc4ecd1c72836d7
SHA1fc4c3207f67095eb70d74067f3a861825ce9bab4
SHA256172698b1da4abda9707d652d151abc26d0087f1d590132e9645758685afd222d
SHA512341ac32ab795a7cb98fba6b7cca295a8fd861d0a13c279e7ef0bf60ef8739d1d0eb03d987b21428dff5157cf1918ab92bfddd2c971da2f256da462af962f5a7f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\28137B1FF368A8704130B996D2AC119598F8779B
Filesize97KB
MD564dc2854324006b836e4e8dab28ce40b
SHA18dc8e7ca0fb078d66e034d594fbf0826a792c6ce
SHA256da9f45277ccce2d219f5d67f8c7e3d8b8a996be107598334b9eff32738a95888
SHA512dba5be925dae44f1813eee3f8119a199265c8bde57627225f8fac6f3c8cbff1bd92bdab7683cc48f1c2719889cd45b7bcc19ff8afb72c29b9bbcab7bd0f5a262
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\2F276B9B3590A66B677C741EF60A083C5C9275CA
Filesize524KB
MD5801e7d002716f0e4e90ad13eaaf07256
SHA14ffbdce99519bbd360b405da7f452e763f8466d5
SHA256b6c894e9d37807bea374037bbaf5a3a1e8106fcd635cbfeaf1092c7842356de3
SHA512af3fb5f64029bd72b6aec78548cc1b9f223a59349ae8e92f088c79545342b552b82a1054286898e832694c895c5b1174998bb9fadaf5d670c7bf6e2dcb174065
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\32EAFE6FB256F462D4CE50C72B3E2AF1624A41C9
Filesize13KB
MD5a28b9f188992bc80ea37513259c5cda1
SHA1658e080eb32497ed85d732f329638d942e325f53
SHA25668793f8988428f6c1a939aad727ef3b6d22b5e8e7183e53ef0ceada87c1fbec5
SHA51262c51503b1e3e3001c9e23c7559070c49817a8a5be8a46813d2b74c93cc2d9a57388383b283f179540c91f6e6c6875017ca99bfcd0c7235f3f5d41116e6ec8bb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\3736461AABE8C5CA9B449B237E5E9010F61FBF5B
Filesize419KB
MD5f7558dbfc26dd8627be36464a216ab71
SHA1718d18fa69f8f9fd398b1a2ef6b415cab564587f
SHA2566f8d702ceb1bcf3db54961b763519446a3dc93214c6a6d0b5437c5869688ae92
SHA512e7a4a2852f88e4f98077850c1648990f242919a55d70dade2b40cdcbe775637ba54938d2b87badd924972e0ad6a21c5c17a83c1c7ea0f7db2b183040975eaaef
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\3978041B462D15805341E404172333C709FCD8BE
Filesize243KB
MD54c6e81008ca35deca6b8ef8d80572dc2
SHA10f78e45727b8627aa47fd8c9ec32f07996ab10fc
SHA2567d918502ce095626d0f8b55f952e5843e76a8ec50b484663d151c86e447d5d20
SHA512ec75a3e917b442c3b71b3b1b57b6c856ee86220836d62cb63f2b35d4ef5c7f015790275ea4a019034f6908a82a1dd66037cd02d6212e6024c56633dfb0ec7344
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\3C1026AE7DE10BCB03071545D9CC6411993E9B58
Filesize100KB
MD54d34515d8783937724892ce4dc995978
SHA1dcbf89ff8d6404b61e071173ccacbc48c306be99
SHA2560b05c33f1d3fc6d574698c00fa77c3ab6d19c0aaf737327f92a687ce04ec04ae
SHA512fab6ae019a9443eef104f143ddd21ba9e7c44d8ecc128b89887d6a72773495d5af8e2602400853df2ebebd7d9635f2e9e82e4483b2463144cf788f30f22b1a1b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\44B8AC897000E6B5E2F9C335446D907415266257
Filesize114KB
MD54b2b21b7bc4fbbedf5d7c019a70bec6b
SHA15dff8c286586f46c184e7ba59a8b91565cdcd0d1
SHA2561b38e5303de7ac3e8e5bdef67cf53b56fa97b1a1d06d6b6d9cc179fb01bc5d0e
SHA512a9a843e6a4ac0a35dde76b99c3252c1dc97873cd9c204bfa6f9b32877bfcc88ed549c667a8ecc0c3b9d322a182bd345bfffc52bc61c4b3be233337ddd4a9eeac
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\44B8AC897000E6B5E2F9C335446D907415266257
Filesize123KB
MD571f32c254619843b61d06568089e4c52
SHA1e933681fead6954343e9d89745afba4ce77991ba
SHA256be8f61aeed86b9e17514c4cecfe9bce91d086be52f862f39e2db346fcd069951
SHA512b7db3b27708e88360fe33838ae6278c12265e17d7133353ac3475662f2f33d1454087801cde324853d2eac04137d7f471d52dbac6b99843316a972950fdb7e94
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\45B3C58F902E6DC4E91D2CD7FDC52DAB4CBEAA2A
Filesize39KB
MD5c0f605c6224beff3bfc51d3414a53c84
SHA1bed9908448425f7cf08751bc459a8ce699e21d54
SHA25649b62e3c998912f66c4320fce43de63d9db15c079b33ace8f2d249e3509caa98
SHA512027acc0a090d9ce1681c74aeaf5032c3478ffcddf2ca6a58a099af22befaf3ac9e24eff304821eb5eb07bcdf4d757308a228bbd8eb16dc00c4aa2eeddb058cc1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\45C13727B6DB444F70F2FAA20129C63BE433735D
Filesize62KB
MD5c7b6c5340ab4017cf5dea6e02266076f
SHA158a4eaf586da832989a919d97a64930f7c951e1c
SHA256e74b9b2b7c50a834884d0cc610371188856c1a0f931021aeb3cd2fed87fe8f63
SHA512dcb03fd7e41cab6ef1229616fe88c05d492647cbe9bce83354c9d86da45b20f454cb83d1f1135ec6568c33f26aee6e3b0cb4cada4596123e0cd940470e897fa4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\47A3FB15B3D55971630E8F674FB9BC2A78BB56C5
Filesize14KB
MD5927c73af27adeacb0fb8fa7c920d7866
SHA1e0da396df0fbd3720eeea2fb5f6a4cda532aaf7b
SHA256e5564693b506cab93a6f3a423ef8b96e0b12153ee3cae17bcbfc70a482caf812
SHA512c8a32dd727fff3333dc72c05ee39f6af09f9efca3c9e60b7a71f105b9a693f5df25b499e0668b7c726bc1ca7d36842493a78e7197ec76a64d45d5c872009d781
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\4CDED0B46277936FDC762BF5275C898ABBFD5EB3
Filesize102KB
MD5bb9e9b4b412b28bd9e33dac7af103141
SHA1ff2f56db0533efbf0fcffca87e8afcd5c1c04ffb
SHA256225b66e343da24bcca1aee6af65bf410d5151eb2237f709f505701bb23cc776e
SHA512c454af7fcaa0843412b43800a91d9994b2007e2ec660d111e0ce963444729d6f80670287c590dce3bfdeb39b394ff52a6b5acaac05c92c78e05010f1c94360a6
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\4EB05E05AE445862E2FD570E53837658D07DD679
Filesize15KB
MD5308ff0996f0dd0fc076eba8ce27d8bb5
SHA1c563a123cb073f3e42cf25967947ad28c0f5c16e
SHA256406be8307c59a8c1ee0af8b9c047c1adbabb7647eaf99f1e7c90ff4f6d5d1eb9
SHA5121e2bee4b0eb32f7366b2281d69bacd4a25252156917f5ccf11ed916582a35e4bfdab7865c896d5a52db48f37829bed16d06042fdfbe9b5de22da4c6446b46b73
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\57BB158699FD265EBD9F21B93F85E0E626743EDB
Filesize64KB
MD5f19e77657047b2dad0908fa81da6f21b
SHA195d5a772de247ba8429f840568c4de48cfd3e82c
SHA256408d4db7c190985d52bf027c2220e4591ec02eeb02e3d7aad6fb01fbb714fa5f
SHA512076700eda4ac99219995f6266ca4e9b2a3d1080eb9ac8decc1f68c8b98eebc170e981181420cd84b9743e388de9dce658a183d91f3cf25d5803201b9ff6d16ea
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\62C514A3D9BDF3FCB31C6A5B8A4FF2FC8BEF667E
Filesize221KB
MD5af0c2f2a951e719897df427c02b5b25b
SHA1c3b94db6c829e58cf3bdc817a5c8972dabd4dbe8
SHA2560eedfa23534f5bc48e51b9d5773038b818640b69e8aacbbce9300d6a6c88cc50
SHA51274567b7be528b404d9d404db55f110a394ae23eee465b08730bbe9b6469b25f88f3eadf5afcc3f2b145da1ac94f94244ccd430efa15f93484fc9468222e0185f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\676A9EC9B136C6909AE473E48F3BB9D849F9AD11
Filesize32KB
MD51b9ab4bad84ab7d5a13a41e09ba3c589
SHA103de77c68be437f97690345722c47bd9ea4a9a9a
SHA256a8e51f296f8b18135aaae9c714b8f9c2a85f4348d0962283f3cd2313141d065a
SHA512d2efe3f162ae90fcc8b81f0a5b3d9916b997ab11bca4f5e76204e65b4b3cffda1d027ef103460d69970bced1a2c8d4b67f0ed4e906c3d751ceba3c30b5b37ead
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\6A04AE56AD1DF108CD27ADBA1FF6DD3CFD8509E1
Filesize31KB
MD5d6adc6b415bd41e3a89ecc2a79ee6244
SHA139a9081b17061da34bb64fe0e8f6c27a1117ff25
SHA2562c217574fbf976d34199647cd885b8d23b2f12f438f16d16a218af871d6d4dde
SHA512cac4562e50787dd80b597d27396b60c7771830479f5e495af774b97e0f27cb7f54e256a2a4485f80c7ec22ddf7f514e5cec4613085bf03e9e1c3028f792cd57d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\6EF134EB3FA2B484AF9A12A2106C87B286CE4C30
Filesize250KB
MD5d86f1c4c49324cfe3d1064bb5df58356
SHA14295834b22b564e8d94f1ee9634d5dbed4430ee3
SHA256216cb3239098793dac283d375f57e115eec8890d98f869765c68b9fbd31ccf5d
SHA512b177818374d6fa86de311aa4ea977ce38b13a8274010c99c94e082ec59abc059d9e35c9dbc5b02437efa7a9984ebb3d650e6fffc51b6346c0651db998b23ee57
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\7BB28068B12C4BD8C25EC6B2145534303B67C150
Filesize204KB
MD5720e290998997a4fa6bd99e60039d3cf
SHA19240d44516fa5532aa508aaf51dbcae537d78d56
SHA2560ade68cc22b3fb25fd0fec1685a82142ace07bdbd6959d6f854bbe085d8c5978
SHA512e44fe696575327221781d297224fdab4a13ffcc2af5bf1986d9d174c3cabb1926556b87e340d2ef6b339957e80406b39de657e8d71b47ab3ed86f873de3a0a76
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\7DCCAFC1365D206666565F856BE1D8C395E60E9A
Filesize13KB
MD5cd35391fb6f12103b461209122492f05
SHA1e6af285f498b981bc4fc3d2d9084bd54a82f731f
SHA25663d2f763b0e30da9707e014807035f51665ac66beaf080ffe05635c80694ea5a
SHA512ac39337fed6aea6aeb37d6ac6a6b800a41c547b401a2913c4fe0e1e33385d1e3e6ebc97bdc61179fe8b939abf54c878253e47148401f74cad07569a7aa510bd2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\80285EC16EDB2FCB53FE4D6500B0396AC776DCD0
Filesize1.1MB
MD5df05afc59a9c76c719c231d0bbd0a56d
SHA1af52e2367d39831bcb2f4b542500754aafb1aa0b
SHA2565fe0fea21a1f26afb6e049ac75077a08edd0f113c958205f493c59470563040f
SHA51222629fb9d024fac49189ed8648819effec6ef0d918a9139a1f77916075744e399becb49a0df6729b71f3cf8dcb528040878a9be02c8a0ffc839b46b5accc0c57
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\83F5A1C45CBF5DA2EC9AA394E3194AF37368CCD6
Filesize14KB
MD52d5d70e7e036f47d65d37c73db3c0764
SHA11075bc63e5e5a647407d10f8bc84de7b620f95ad
SHA256e99c3492b5beae0c42ce9cfa26d122010b7e0071114805c1488a4407284db367
SHA512030dc5ad22f1a804af0f13c7e983a0f09bf02edb03ac7605f7375a91637f85f40948a1f05d8b134fa5e1c57f159c7a3580cdc8ba0678c6a282f114fcdd61d2d9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\861488CD251F042EE273075F23EA4E34F6014642
Filesize47KB
MD5d420e5c3de2aff779e53250f4fffdd7c
SHA10dcf9cdb34ff3d245d7ccaece9016d001c14541a
SHA256e8fb566833b864fcf77dcac05da8969c31b27a984cad1cc245e068568ebe536b
SHA5122d4b00c1b3d47b043a2bab09e153eb435616201732274e51e4b67399393816d39df8786981ad38097c30b9c65e1567300b82104edd92ac1b22da74348fcb358c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\89751F14315B5A8187805B379FE4265E13BDF9F3
Filesize13KB
MD542c007ce73dfc183a8c84ea5484a426e
SHA137517df96c62dd834e2249dc0d533b9c4ed5af86
SHA256653af43526d3ddd2645c4c264e87d480696c11d7cf1a6fa3d3d982313dc94660
SHA5125a94b471f6dffb62d53cec13da72f765289cf1da6bb22b81039ae30997c13b2425b57dab2719d21939a47d71c5430e0f7e69ef88a29dc81c625a14eed058a8b2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\8ECDCEA3C0FCF95DA60C035D0D409AB65FF51BB5
Filesize51KB
MD5ae491147d50d581ad8d46a3f3731cf5a
SHA14bc51dfab53b0674729bd6f63b6c91a810f34593
SHA256e3453b3edc6099a89f534bb28cab6e242d7cbe8cc5835fe457d62ec551083090
SHA512c9b8f1c241428f4e7fa01221e65c53fa10f144c1eb38483fe67ba62a375d4afa507477f97f8650e9b661e2a8bad78f75c6e6872d5d1a1825529bb39ec31110d4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\8FC936AC4D5043F0879EB0AD57AE1F1817C36C61
Filesize32KB
MD5e934f6ddf162d122215a10869e5c010d
SHA187a4481881693518a310de40bc14efe363a48dbc
SHA256edf1d7a6493b7e102522a18e2df438912fa5591c2d28c0a5dacc988d33fc815c
SHA5126c569b891336ebbf8a6876837a36976a8f6d3616fbe2711d53642fbad7f9dd54030ed9cbae1a1b45e15b27ffff80e5db068fa67b2748325c3b7fd873c372b3e7
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\90BDD4E54E2D0C47FC36E0F2DF80A5B00A64EFD6
Filesize32KB
MD509544d1eff08cb9abd2f7a60357a8740
SHA1314501ea082148fc8c6a5b845b24248e44515ed7
SHA256ea37d9c16f991e33721cfe5825ce30de9674c4f944f6574c3873b8ece20e2493
SHA51261b7617529d828bdadd223c3a4877b39d889ff405a42a447b8fa33ff64b568535d55e6c207c52dda39cb7c2677d71898052320b4780eddf437cfc835b5315067
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\93628B06A5DFF74BD4A344CD558FA5F28618533C
Filesize14KB
MD5cc24828491f89e0836d22dc515b191dd
SHA1694c15101f8070c80f5430d89ced6ca22a992acc
SHA2564c1c1d12784998e3ab6d1328e45d2e06f27d2e715597910c6969367170e63587
SHA51277683f891828f0082422fe9193cb976df58865653cdb82529e28a977f9e6a3b314e0ddbf1b7b455328e30ad32d74850fb99a3222eed560549ebaf325449a740d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\9376466CBF064C66965B4C678BEDBE69AAD08BA7
Filesize73KB
MD5022998cd2b2f410a669b3f1d4caef73c
SHA1dd31e3703228be3410ab6cb09ca2f5cb7d439ad4
SHA256df4d582bfadca5298c61b0ef081e40835e3919160b71eac8f1d915e80c2574d4
SHA512c8d80217dc2e4f544cd692c1fe66a4b7ead823f976cf54744e50a5cb11f7e1b73db6b50c8c9951ef80853c57a82aaeeb499cd06a7c00fbbf65f27863e853d72f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\9E153E43FBA49EDB7D2FF3F00D771FC734829899
Filesize61KB
MD5545bfdd88072c95eb1fed3c0c6712a71
SHA1fc8395143162a77a0fb9665ebf073008bcddedee
SHA256fd242bdda5a15b1cff1d5926ff212c8b339818f2499b63e8aa8852e6b3228a04
SHA512d6c8e0f0ef39333b4e93ba86f5ad95a8c3b6c62ea21fd68431e4ec8ebae492aa1d827eb07999ad9273ff0f2473244fe58c4bc35f617310cf904d6edf66dfe350
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\A955C4DBAB0484FEB6B6510F1945CC6B13BC7ACA
Filesize14KB
MD5e59f713f6bb8dee7cc1805ee7ef77863
SHA12cc975835b1a4c4657abe76cc0cb2a5041a52830
SHA25634ee06a82c21d018bfd50cf69ec8699c28d140057ab05471b1831e86c384e210
SHA512e6f7b732472a91e9a0d6639924b19052a225167ef3b2e01634fe6505f5dc6ed3695ef16d1b50f3955c97005b84ae645ed2fb7d6247a1cd22cec6d8e2780f0274
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\ACF875F282EB12F4797967869942876F3CA55B7A
Filesize16KB
MD5372c443c81c312ef6ea8e3cbd4ed7d4c
SHA14a15ce117d3da6b5e7cd5b95ac7ef54166d9385d
SHA256ecb3c3c183b63e2c9c1f7784adf27e4eb3e1f6a38b658e3aca07b7388f3f8faf
SHA512935ab18448c472fa191bc0fcfbde77be6410d277c3689ebd449b21d037630bb7d67b06ec2aea5bb282817c978123156738be2a689f2717ae51d6d9c800fb1c7c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\ADB77CF89BB7C3EACBA0400910D8956D4F8A5D23
Filesize2.0MB
MD51d745ba61168b64e9feea4606a526521
SHA15a6c72d90cda91f19cf1c097ef4cd941540b0d82
SHA25610c9dbd1044707093543a65d375c121c88fad1b44b0ca5be6a5d4d32eb899c45
SHA5126274f4aae442c9dec7a3362f928637fb77b5fc9d29472cfabbf6d50fa3adcbe576be6b1180519cd19a31fe95f783dfd08001aac48d018d3e4d94cf988b91067c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\AE4DF132513B5858B0941DA86502358AAC839A1D
Filesize16KB
MD52818dcb0534993c015e6a3f7926d7b3f
SHA1935c74044a9ff3929386899cd5f645cfb30109b3
SHA25642f745bc4b6a4dc8e732ff27c91d67bf81755181b27d6081e96336df8212be57
SHA512abc53f7061218af66eed78d11fb1a7bf636c937b0cf01b2aac44cbbb450e27024818ef80f216939ffa6ebb5fd0524d1081aad5bf61d7ca35952be9fd4dc0a0ff
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\B27DAF93EC8133D4C44DA49BAC4A4FF94DEB2A16
Filesize123KB
MD5e7a245e0a23dd6d51a474f2cd257f68d
SHA113fa361d015cafb5821491075595902ea313474a
SHA2561034b0e8474e7c740503e5bc7dcef6793d808a0953897e13f7548c56149cc83d
SHA5128f65810710f3e11f7009d6d8e7d7d988ae2fbe3c5c28d40e4d0f3cd3fca73e6c1d958d948657883d56ca56e5a21b0d1784d658d81ea859f46e073b1110bc3307
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\BB02427A28C1624189BEB07A70764DBA29CC7E8D
Filesize380KB
MD51d4dec78c606755ae52e7ce1331f0e89
SHA13a4fc4b712ff11f6ab867641630cbab3f7165ed1
SHA25623fdcec098c0b24823269a892f8d064adf124a4a31ccd4ee432a06c82516753e
SHA512d16979f7a379caeadc192e5533b75fc86d18d7449a22f0612b59eeaaf71cb6ae9480ea27da29b2e32fa4ca92f58f9c063a74b96a2341e29dca080a3997fbbb60
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\BCACB8DBDBCD64F192807A78158BC9F7B07FA8C8
Filesize16KB
MD594274039f5691f973a851621ffe2a173
SHA17492d4f7dce417dec1aa115c5be2f4145b1ee9c6
SHA256e1d48a4a7d7456581274b63ef9375585ff54cc9d23a956e132c15383110ccfc7
SHA5121d77d25b9c11a38776e4e8b6d315dfbae86b02736a610789e2cc1a14a9bdc02087ba4a42b83827bf99280adfa2dbc88c490b9962a609de01e334723c412261bf
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\BCF1D31A8BA3C254D1978D80E301A5447214114C
Filesize55KB
MD5006fd42aad7ae4d5a76214965325d74f
SHA1a2beaaa0501fca57b090f7ef6ff7f55e3b4f55db
SHA256ff2f08bb77d51b8fd5737022e9cbb1e8e91a5676384634520f7763d836980970
SHA5124b295363f5b867c41c9ba68fe02c52df05fe7dcd32583e25333f524f2458381cc014ab418f5edc865691f32306a862876aa98197456672e9e1631108959f9ec1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\BD518506D48E5D9A2A1A812001B343D87149620C
Filesize314KB
MD5ce2a1ac784949a1c17663ccc77e0da11
SHA1efe63368c74291a7127f32aa4f937904883147d2
SHA2565b9285313daeb026f0393a9cd5439ae730137ccb05d6f78a6756f2350427cb18
SHA5129486f4384b04c30aa72dfd6207180c537baab9b6471e81d857a2e1416a7c8c4c83d17fa6f40e360c9b2a83a80ffe43aab903b25d035e32e16b4ec7d6a7e3d7c4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\BD5BDA6CAA71A9585CFF4439E6C1BD696837BD13
Filesize88KB
MD5ba0d7c8f712ac8dff3b0d61a832766dd
SHA1843083f8ef9d08b42e799ecd6038cfa13b84753e
SHA25664455b3ac50928f265f57970d2d7215873504e94d9f6b478e39d666078110623
SHA5128112e0549e5235e5713f06edfc2de90c9e47a1cc2423dd939af282d868879788f0d9c158f9f26fcf5cbca1db01cb78cec567261d7995c9658c5d307882b63dae
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\C6F083340792DA21A151531AF8C662557DE2ECEE
Filesize152KB
MD53cea9e661714a76065dfb05ae0568f33
SHA10733763c494838af4e8ebe93426e8fd12c05a06c
SHA25659791f84f189bae7c01865eb42fc32f61a0174a5153b89ec58ace64a0e364dbb
SHA512d04d4ba338d67794b03754a0e5b480ada0ea5c0fa7f127b425fa4b293334105335d9b3434a446d4c78c5a52bc7c18f5bcad13c42472c470efae30765cf5b8df5
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\C77FB4383BD5DF4BB455E7EF3ED75755C3E38A5C
Filesize53KB
MD532cb85a27b07cd87e4c4c588e248a08f
SHA1f9b141b09e453d1d8b91efbb3b905e1d31a493ea
SHA256a6e6e1f5e97044900a4a386e27d4e4b3a37d388b8857aaa2ed70dfebd593151d
SHA512f8fc474ad8a9943070ed019aafc3e2881bf8392f05f9dfba4d3e5a055594959b6e7c1c4641e3445c56f013e82af9e9d32c56d53d6611e086b1a0405c13a6ee65
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\C99EA98A5D9032D2FCAB011415C22D8C4B356154
Filesize14KB
MD5f8c60d2927b6aa239d0f7e7f4550d24e
SHA1f4453768412489fdd594ef768b419e3fd0cc834a
SHA2569ce2e028bb77c563540167e48524cf8d990c2c3c2ebef433254545664a48d755
SHA51233ffc56a469281a5d0d1e1dc1622e79e7ae66b47215893a71dbd6d24162a4f1cdaf9db5a7576b70d3e4c04651cdfb683c14dee9a8034f0e54972e6764902b4ac
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\CAD1414BC30A3580B4299605CCC55ABA9A6E1725
Filesize137KB
MD50ffc899ea2b352678d54c4d925c87e46
SHA1424a8f5f8fc09da7fde1414c726dcc82e026c166
SHA2563f336dedd1b3538342b87c40613c6c2148f00c577bf6a017410841944af5954e
SHA512c71590ce4472f7380835181eba56b9cd65764c94361dc8cf80fcf92ad46b064bb805bcebaa87e793d07402724a24d853817a6e94df8a7655159e036716debe31
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\CC781311EDB0FA207C7EA7AF0C720872F6DBEB95
Filesize12KB
MD593d91023b89e0478a9839df717d2da84
SHA187f53f27629b511197b584a674407f75ab19e009
SHA256419a3a04b5614caaf68d2af6fd2f018d0d21bd12f1bdfa317e921851ed80ba57
SHA5122b163c591c3fdda0c5c4e9ade01feaf5766b594813e0510dee4776129b57e3d1f92113b47b3004eabccb6446fb77a88c381d86bf454a91bc9f4e6057bc3a0932
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\CCE1C627D4C52CDAA0B852B84E77EA973DF81D73
Filesize20KB
MD5184fec4ed3e875464a547d8f99f33ed6
SHA18425a8edabe1dc8d8b719a7d3881724fae251beb
SHA25697af0843ac60b23fe0f6cc899059867e97ad9bc3172a3713b5012f465c9b4755
SHA5128c67a68e5d3341780af7fb20147085c5dcd587cefd15b8affbacd9c3a51b0a1a6e45297341180b24376f75b9499da5231dfb6dcd069f28112d14172d04f9902c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\CD781BF9D4EF8499CEBE5A41941989482FE5C6EB
Filesize122KB
MD56425a550b14b3d42158203bb096c6c2d
SHA115999fc9faa63a641255348a17f8a00aab003d57
SHA2567292a90ad3ed756bb99702c02a24ab2c176c747165fa6589ae3f63124a2219ae
SHA512195d2add2cd7e2456eaa2177a1f35ed65c9519e87c68721810f8f376a2aca16a3e4473fe111c0211482e6f2a27cf3fc89121ace976e65a4a7bc7900ebe43392b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\D105AB5F954C0907C9073BF810F90A3C36C6D3E5
Filesize1.3MB
MD5dc797471ac6b779085c5e1da07ee2077
SHA122d9eec2c760701fdced0a6f30c75afbe5250463
SHA256de863da44e4c94765b68830382a49cc0fa7fd1c9f00d804c476d40909b73b372
SHA512b0e535f8f3bd20a3b5fd905a60c0c3814c4da1679c7a18bdd28130aa225e6657ba2294ceed86db3dca7e200b98fb5a25471eefdc497a7c6ba238a6cbe9c1f7f3
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\D673228FBDE556F07DD90F1AE1BF3BE6D158FBE3
Filesize26KB
MD509a3e29c2b32fcb231abb1effe834b1e
SHA105b8c409d651a595af99dbe6548c11b062a37602
SHA256c7f0e36d19386be8ae1c3fb4e60b1b65ac9ab8c27faf8909f0bc24bd3d5304b1
SHA512ac9b6c2271f5226a46374c01d7c9b5788f1e2dc9c54fca353c7b1ed4cf0c18d6ddb68d852bea7038508ec0cb895e8aa2310c622349438c2510ae5f503e711219
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\D7B215485138856784BA0EFF4E00ADE88E4C6C15
Filesize22KB
MD57b9a743792315da31d48a9f685a034cd
SHA15eeecc86a4a8a1732ae38e193da064ded7cb1ed3
SHA256e0e9ec07c97b803c52d9ff743db56ff21ff82fa141efbc0fc294808c0d535574
SHA512e7a9761905d20ba75fe48a15a9685fb44032ee36f98a7b75ed2a74994e08c6712aeb297941c693c81e959df59e4c5df16fd005c25411c41f89f7cadca8112d42
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\D91DCBC75ACA3B74B9064DF4DA63D61C3C8C39F2
Filesize13KB
MD55936c557e5573b158a3be6c86803ab87
SHA1869fad7572403b6f67a4ed6586192eb724304d1b
SHA256154f50ea7980b3b9257b95990e5ddac1ad63ca29f45120ecbb50056755f1d62c
SHA5126ce6c8f3b678abd6dd013ba843ee9d50326293d8b008b760cebd08d71e121c1895dba979f2ac7b7706509a23459f65af804455120e467dc8b8a9f86fc4f920ce
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\D9D17E89CACE3C58E7B0BAEA0F4A935474EB3FA5
Filesize13KB
MD5de6a3642ec839bf8a372371fb63c1697
SHA1c8d6fd316f1f52f3dab25164bca5c832299b2e27
SHA2563d17bfc07cb207e65ee4222975b07631738ae0c9ef2c03a53eb23bd1e0415134
SHA512ac9d2394b25ac9830e1d50b73d7d5bfb3fd884a79b665959ae68635b910df4f2bde0630b19d696efbe1cf0454679f58af59d719d9fce4e1c7a73caec17fb6a4e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\DC6086EC8F3DCECB5FDAB23100B46388E4B264AA
Filesize15KB
MD5896a50cc08dc9ad6de1b7de1c80571f5
SHA1b457a1dd5d6991c8ec2f0377c4e3ecf777547067
SHA256364a17e49fe06bea7d225475ebf09d98c6e42157454e7e3d88bfb265946fd106
SHA5124c1cd212d980cf02979a464cb6c36df7c8250bd1bc591d37b969bd94b7c8dbadd8c837c74008b45843878f209b92985061754dc5b6b5fbf779944ae1929b03f3
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\E043FEB329129464EF8A0CE4F6B8FA07926AE211
Filesize13KB
MD55d583a09f421fdc22e126a86fed1a1ce
SHA1beb857ce7e2bfa62f1c2d33eaec3f28f8dc77404
SHA2568761bb29c207217444aaa68848c38071254602eabe4681f4920be3fb55ccf93e
SHA512ffa29377ce1e9bcec7c7df17b954ca909fa4a910e739cce859d70bfc40deda2a8e9407e051913411a076e460e6c9ae12418acf384153807d14e58b6aa4355b0a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\E0BBDC420A43C3682B7EC313454E0330762557DB
Filesize25KB
MD58f081d407db592dbe2316338e2b6b9fb
SHA1647923e595a60c88e911e8ef2babe54b7ea8d886
SHA256451178a5b3f6880457b2884ffa019c49d5422cc1439b0e04f7fc0fa2864dbffd
SHA5125db783b63e08c9541533b2c8acefda0125b54f79ee3a5f8511e11fa56bccb816865ea707fd1b04c5f8ad9d583a4a2e4e0b18d7172cbd9d92ccf5011f2f8b2b5b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\E44D8EA2BB95FA202605B58E615B3400B72A14D2
Filesize71KB
MD55a3d1b965e1181fdb799207b978dc652
SHA181c08af52d3129c1130fccf274049987a421b09a
SHA256134f4b70ba949ac16b00bbeeb7fead55439a88bc0238f4a59c7a066bcfdad48f
SHA512856ad1e53191e1e30beb04918d33245ace9607a14a8ffb81394c02acc259d14c8be57c51d713cba033315c031daaaa5eeb243b4eb22effeb3e5da87ef4a722f1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\E9FC0C2DCD87A95C50F94F06B94EA53549DF85D0
Filesize31KB
MD5181577c7ecd5458988d169f715e55e1a
SHA103cf2099cf5cbdcdc704f45de1af4d1f1e61e1ec
SHA25670b666d6ef507549be1315c1dd9917d42d0bc592259c3aa42e12addafb2b23fd
SHA512a4bc4cd6c274eec1f36e0faed10b27f8490dc95e87bb1689a99e3271449e75702aa5010da3a84d36a8721facc4bf8f53c37861faa4388a40148ed16eba71561d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\ED996825E85CD2AAFC47EB276FE13AA207E7DBBA
Filesize40KB
MD507d67209d7ef2e18c62ee82b70f7bd01
SHA120f4f049f98e08a44d7477a5ee2f3c40cbaf08df
SHA256ce8f4d4a2730ccb365e07b3cef516d9ce11bc55b1f4c3c785a77b16873dac5a7
SHA51263e100a5e17dbd177ea52d9195a25bb3a5e1cedfaae342d8cf5e9646f71fafc3793238bffe410accca4b81c0d3223e7753ef935d73ad9de3765c33e485809df2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\EEEDA1117106A7C89B2653C7007844B6EA31B63D
Filesize14KB
MD5c804e326c30e25eaaa8e2230a60027c1
SHA116a84cb2b77aa33fef0ae26a9a86179493a98396
SHA256284ad14f851b1fe43e240c559e0ccc9d822ebebb05d5a16e364f21ebc280481e
SHA5123de83684a02ca481dcfeebdc8c9f7e339f02b0f049461f33954ef5f6e61a6344ffe3d4cdb95b2994b6e11bc5383a39dc660de3920d544ff28c4ab6f1ed4e19ed
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\F0A83887CAE0F036550F77B54B1FC0084C6D280E
Filesize14KB
MD5f68399c52475e646e1fca50b6636e062
SHA1c4658ea3575038632d66b8bdd938df415cdf6931
SHA2561a8c1de2c098ef900c562ce4edb7bb91ab6971a6f084d313c0c27f41c3e235f0
SHA51288e9afb453f930eb6c87463dc52adcb57b3be84f9bc68997b42a1aaf790787892a7cc3af2f60056ee104c42a293d2a35d8f952240fea8f1d24a2401e6f888087
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\F3EE56124B465F78FB4C9A44DF691FDBC3505C1F
Filesize15KB
MD53a8013a45df00b02f63aade485351441
SHA1c222aeaa80ee82a995c9b51d4c3faf97ecb823ee
SHA256165264b928bce52b11f2c2325a69efac5b7a4ba7a4c1114d66104ce13a590955
SHA512bb21488ae9ce1b0d03fe5d7f45b3ec5ed1f82b9b0b73ea830bd3287e178d93ce8019f7345b787d42633dcb8d4d5846911e4e6dfc5c7240086b141c3a09c591f0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\F54E7030F181831909BFCE5EACACBD3D867BDC0E
Filesize141KB
MD517a745f540117d6aa665eeb2d7cdbc3b
SHA189578157afa923f8c0833934466cc32434216f21
SHA2563cd2eed2e35464247d14a8d07f76945bdd8db89c0eaa185313d39a502f4c3baa
SHA5120ed46ccc7e68f0cfdbcc134ae96ab0c49f733418e1c9aa9330cc71b9d3862d57c7859cbeb88a7956d50361d7891224be1b885c979983eca6f2d26849c789909f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\FC517FFFB9404787F62D7181751C6116228E8F41
Filesize21KB
MD597ef8e97fd3782bb482b45b712d22d49
SHA1d090013ffa3be04db5fcec1b007733e6e1f6fd9c
SHA2569a6aa610d0e1c7b920b6d006c738b33f71e5c7962455fe1d9415a122f09ada91
SHA51225c401913a7f61f8272774058dc7e68e2554d9cb00843d596dbb7fc529093ca541be9711f6493d61d6475ff4970e7499c02aede0843044273bc77c2b50a7283d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\activity-stream.discovery_stream.json.tmp
Filesize35KB
MD5aded1f90e8d422c06373931d3d7a7230
SHA1a0c9c6ce5404fbf5b387bebd373ddae282d63153
SHA2567e33d47da4ca19d9f3bbea9fa029d0e26eb5c10d62549f020e3cdfce21808b43
SHA5123122f0a81877a4c7e8599f474fd94decbafe80d3cec2b30e57d92a82ef5c03aeaccc35f0f94628ad41fc006b77b11302d87aee6f97fe949828ae88913adc89c1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\doomed\15223
Filesize7KB
MD59346db2e6ae53e969f57eb59c84c6eb5
SHA15cb5cb3fd58707322397170ba856b998316acc79
SHA2567e4b4d79638903b77ee0bb9b8d81542b380b3193ccd1aaf520b4948a5337bdcf
SHA5121af05cf176708ab8ae78d718c897b23852be747e6aa43994e8d8ed5fc3d27220ed4d5bd7e4c7772f1c8765a6ec044256513569cf510f1ff6d563bd1036a6b708
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\doomed\30619
Filesize15KB
MD54bbfeccb4c73d091a5e4824bd14c93e8
SHA1bc484931cdc788a4b688047480e972fa02218162
SHA2566301d5fe7118757da604834c3ffb7cf11a8b7e189347e307f3621711414badb9
SHA5128aae2e447603b2e2c0b3682d3d08e4d3153d49675744d474226c04a337da753360f48232286bba273af8b97a2fdbff328dc560897f641361a7ad0358081bbe0e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\doomed\4896
Filesize14KB
MD557f51ba780268dc1ff13f85123c650ff
SHA1266e0465742002cfb7650d9a90613f81b9daa598
SHA2569663c96874c10ed53f1c3016654883ebc1a1b6c75d94c0e6dc30ad2dc42bed45
SHA512175814b6ff4d9d7dea2b0ca21598285993f6f04f6ec915d08c979e7c41c4d17acde55aefcaf2bfacc4f38834a8c3c9c0b644e88b9f92576296fc9deefecf7ed1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\doomed\856
Filesize13KB
MD59a0dfa5af2a8add7f7d4188fa8225fc3
SHA1c10581380240e244d7d4c82e5199c444af0e8fe7
SHA2568aa00cc3e57d84d6da6ed04388df0f7823b2a4305eb2c06485db5b9ba1ad82d2
SHA512af01d39c475cb18cd52380b9d50c50330ae57291f0bd3ad3fd3e776c8d8f4873ce23fa895bd9b899cb0390cbdb78ad2df36d01b0da7ef708e6afd6ec5f3b2086
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\14EEEBB526F03187D2E41BCBC38675951A605AB1
Filesize165KB
MD58a61b883c41f3e081189f155470266a0
SHA13ed9ccef045912e9206edfaa30be518978cce530
SHA25633b3dea77b596376e2a03783bae13266402ddeb18c9e23eaf760b2f7e8b3d464
SHA5121d25002edb0cbfb9e6b3378a8c80142f9e85b036954c189100165f0259bcf095b7e9a0d8c7aca4158caba11ed8f065b54a0d6b5ce512602440ca3d25ccb8d0e6
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\1A90EE7CB658D028D892A52155A137A13C848FB5
Filesize14KB
MD5fd26fe6a833fa30bb44b8313f9d13317
SHA1b9a7e650ef8ee02e5df3bf41e7ccf4cbf0c750fb
SHA2565c4c32aa938ca3369849c490fd2f4f9f9e431f217f04a12de2074b8a1b83ac64
SHA512a57f6c4fd3790b3969c2f5d55d1923b336044450073d43389f31d82c33e9b9c4a093e01839f93f7293569da7ad7493d1fcb604bf1c3cfd6df94f68ca8906dd4a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\1B7355D3237115521581D2ABDC8F6BE16BAA9BAD
Filesize13KB
MD5caf7fd559e417a4eb4646d70555ab5bd
SHA17b8cbe6c7d9bb9f7947d4cceddfbddfc4d98c08c
SHA2563a1379eccca8dadb54ec3486667e45eaa729e3ed71695c855ab089916c0ccd75
SHA51273c26017ec8d2bc4e9f1942aeeb95754eb04b1cae073262752ec969f84ca16b71ffa7a6507ac30187c1a4c49562142e74329d9941e107738ac922420fc4f6c00
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\20893C9EABC87EEA544BFB0F7C41F4F949271073
Filesize15KB
MD511deb5b64be0458e7080fa08cfc0b1c9
SHA16a69b2e7a5e62eba98672f8ede9318c3d57a15f8
SHA25624b09ef22a5a80359ffb1bec6bc9b510aad36c2b739ee935e977fd8522145a08
SHA512eee4fee5bd94554b50e23222d6efad0bcd259cf259ecaa2865c59e29c3d6df29335c44e1244cce035b2c9fafc1dbc2bb1990e5dfbc9dc39f7a91865df9be1490
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\2492994A253B970917AF5CDF605580B1C2DC16A0
Filesize63KB
MD53351822d5b81a1d04f2ad1ef5f8ee3db
SHA1ddcd5d2dbb110aa4057b80fe2f2228862f88a1c6
SHA256ffec01082f05ad499086cd03db85888f2e67f6c84d1c91ec1dea6b5f033d07fa
SHA51262c4c93eaa88aeacf03ca6799b3c0e4b7954fe600ca58f4d7eeeaaec0fcd8e0a37cdb3951014692faedf57f1cab66b2e34a372d3ff984045c142b18590e6ac60
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\33809CDBDD69269236BB05F66DFF2693F384205C
Filesize63KB
MD57c771449c32f9d305e97e1f14ec31e81
SHA116d49fd899abc4a49199177ab7fdbe7bf2153f0a
SHA2568be6301f1aa01712083c5b9dafcbe41491cdc860047f934880b39554a71a45ba
SHA512ebde9e27ff1f83f9e11bf0ab34747c0d4a62f14ea4f26d5f20b91557e2877bbc4231810620bc71be9a5eea187d005464c3fecdf75fccce9e92d8f4f7f01fb030
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\3D6A554909F49A678FCE54FE07F4028C5A4FF4CE
Filesize19KB
MD586291b6444b5680a75957bcf861ad508
SHA1ca070ef3af49430478c89e3085a69b35ba92ea98
SHA256fb77d9841ad53766f3d108027b62c9062a81e38d8e79019bf97d76388e138568
SHA51216aa3c9e043fb086f9d783a4ba0d91061b7568ef01b721ddba7ef444fb95b5d27aedb5254e296c29fb0c1d9f942ec9e687278f56bc88a9e3122b920457e75f66
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\4F7856C2FCEC54849D77287BB8FB77413C7E442C
Filesize16KB
MD5aebac943fb984340b422142eb33bcf71
SHA1afbc2fcc50bf20df4a0d4a45993084669932b242
SHA2566100f79e23375d6f38846b7490379e6fa345d21dc646fb20b4e743a7d20d7f5c
SHA512da867d56663cfbfe9af397eccef4af9db7caada32de5cf3d2e1c56a3c3578ae3481f9e19ea64697aa5fb64ee0ec8fa540ad9560387b0a17442a11054e514001c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\7195C66CD98ECC1D360961499C7D5B0D69066B5F
Filesize17KB
MD548e8e2adfe5dbf3ae5be091e2eff0d70
SHA182b4dd970e18eba4a361aee40b58c562f89e1de7
SHA256f74950c8815ec2ac99df37fc1bd9657b3230d943e7477224e4c767974913f6f5
SHA512614c21a5f6b94bda153eed925dd297062378470bef6976c865c5e1e5e7c6050e6e99a7c7c3b5c5c60c6f2b69cf31ef529939caa1768e9310318782f0eb8f6fae
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\7B7CD63C3E494167AF0E698A2E816524653EA140
Filesize19KB
MD554cc384bec184c7fff89087a2e69c3fc
SHA12800d149866f0228154354eac290bf984a4ce4ea
SHA256a687651df7ef8eac0b44f40dbba2d67c0fc500ee1cbe7e3511a791d794dafc61
SHA512dccf9d4ec9c1ce9bf84e9ac6bc6c0d6d470af8cf9474743ecfe0cc46e6b0fbd77ffff78ecafcd219894eeab4554f30a6f7bf14dfd3b5a12c3a2fb2902624dec3
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\7F30F53457983F11F2D61636C9FB5706ED9AB60D
Filesize16KB
MD573d644ecc45f35acc2ade0e14d5cd275
SHA1936af3d012ffde77e51997d79c4412dd6b4a2269
SHA2562a0a83810baa9152a3f842e3b79fe403789e31246dc727910663fc045881d38e
SHA512fb47bf60f92de2318d95df364a64c6b55f9710229ae38908c19b0f1b943d1f05c92e09d4a0cf3836906b835c17ac62f3ffcc5b503c54b583e37fc7266376fbc8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\9F5673E95BC24C8C5C3548BAD5634A2F17537B89
Filesize26KB
MD5befe7ae255fcb13adffdd51082ef24c6
SHA1ad82e8fb51375c0f95f3c804728e9318e406d368
SHA25647f8f61356bfdaa42cf798d2d5b1ca9304c89036e288e01879bee302905e1f97
SHA5127bc6acc24c01529dcec07c181de9b9ac1b18a2d116061e13c3a2849402ceb4e4b6052f751f7e4377cc2543d00960e2f0851b8a6f2c3d4850d657bf9539c9b763
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\A6C74BC2260EAFF823C7AED38BBA607C962CCB55
Filesize39KB
MD5a88149bb42418fc7e80947ec5979bff1
SHA11d4e56fa106e51d1cca32eab2e88d96470bc2cc6
SHA256d08a383036593cfb964258d2c7d194abd5f74338cd957b92dd7b9209fc204684
SHA512997dbf7a6cd7204dfc1ddf024ab5471252cf2a2f4fcc119d96d34b0bdfae32dea52a260b474237567be169b3aa0548fa2794647eba770792d4f3cc4f576a784d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\A88237A25AE3CE1B15EDA90DA9F8A67F98289CDD
Filesize14KB
MD59edb8ce2dc0c0d4be44407b2e9d0bfaf
SHA174746705466c74db8272c8e641b0cb0bb58d0167
SHA2561a40efd4847f132c2d72b218b4b5345e429c01c83a5548ce699f5781b4e7bb8e
SHA5122090bce0e1244502ae700a4eadc92f138ccad86f949ef0cbb64fc4e587e0b1d0312eba12709e7b26807d587ad52e9d0e0397d2ede80ffe59f8c0bad638226f37
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\C5673E68AC3B5F8C43D8E52F5AD057E90B2FB9E2
Filesize26KB
MD527fec0e7902ba41358aef409392165c4
SHA15c503c5cccffa13439ed5f750aa1b5894623f8ff
SHA2562b098352975eff54a845f16bad456587c5f8b7fc0674c84d751c1f1212fd9998
SHA5121e7a30b92f33232b890643b19027f5c9e5c85109030ee2edc6e4f523b9d9768710bea0000a39f21246da1520c97e22bdf3990c1cff7876ea307ebd7619d4266a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\C9B7B47B67A9B7A98876B5F64D27D619E80A1581
Filesize151KB
MD527b6c6534095a96d0f6d56ea9932bebd
SHA1c709d09b9bfa3e64854a6c13618322ac44d71a01
SHA25677972a06dbd18fffd04df42a0d5bfaef76237bc36cdf3fc62d7ca1b934054e73
SHA5124794c0d028d704966135be8dad0131a7014fd2d03ed547c1ab08ea572ab088d00e693fc529e201cda70b32dbd4c176290bf1264e0a82bf802933a6a8e0c42f74
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\CD5A64FE38F37DEBFCABD6AE8C058A244024130E
Filesize14KB
MD50ac7dfad3c0ecc008e2b71d1e42fe3e2
SHA17904697a8e0fdf1cfd8426f04d5a6615392ac4de
SHA2562aba92ee48244956d816d0629e8ee8361cb379048089c1d43661442a7181cade
SHA51238c9eba7336681fd5780ddc765361b0c4a4f030e49cad4de65c78010c9494fae85c065406ccb1f8c2684b8b441fd9ddc1a961dbb02b1ae32f7c4f6515ac20877
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cache2\entries\E6C22A3DFCD18E3C6145370266896FF76AE3F7EC
Filesize39KB
MD5dcad140e8db0830004f6aedca224deb7
SHA13c4129fcc59cb64d005bf6129cc49679e74ce8a1
SHA25621e29929265ae3e95af1bb3b264b7a4ba735c5b38b455008137d88230c250575
SHA512750a53b4f7748762caba3f44b4f9d750c2e151559d47db90c15e0b981400c27c871128dcdad42fe61b91052e0aa78bb2467a6ea1ad465b7347d41475160f12da
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\jumpListCache\fUygSJE95mVhX0aejfGFaQ==.ico
Filesize603B
MD5145f2163ac418521bd7403dad4051ac2
SHA1fc0ec4703ab6078ef0f5dbdc6479f8156dc9cb59
SHA2565db3e064f488f49d80944e73c49aa1e7efc0896d745c28d20d2bb82920b6e738
SHA5126d192b20c247375ceea375ba2b0b12508b8edab9dd3268ab331c1404129e97022642b0966c5ce34fc1f8dd65ea7358bdcf4d174c1bdd2a4af937d7f2c271bc9b
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt
Filesize797B
MD5afa18cf4aa2660392111763fb93a8c3d
SHA1c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA5124161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]
Filesize933B
MD57a2726bb6e6a79fb1d092b7f2b688af0
SHA1b3effadce8b76aee8cd6ce2eccbb8701797468a2
SHA256840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5
SHA5124e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]
Filesize240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\TaskData\Tor\tor.exe
Filesize3.0MB
MD5fe7eb54691ad6e6af77f8a9a0b6de26d
SHA153912d33bec3375153b7e4e68b78d66dab62671a
SHA256e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA5128ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\msg\m_finnish.wnry
Filesize37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\u.wry
Filesize236KB
MD5cf1416074cd7791ab80a18f9e7e219d9
SHA1276d2ec82c518d887a8a3608e51c56fa28716ded
SHA25678e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA5120bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
-
Filesize
5.8MB
MD5c79bb78a0bad2559a7037913dd1f1f34
SHA1a5b36348ad93fdf971201f31136d8c9b056984a7
SHA256f63b47288af395ac9c02c980592691e2d446fe8b4d3813007433ae262af693c3
SHA5121bd81cbe784427e54903159225e0fd94c0fab1d9498c11db177d86268f34129e6835759a9a3e3822c717349043930e13168390fcc2f9a74f9699f14497cfc888
-
Filesize
34B
MD5d31cc067f585fcedecfd1c0717937ea1
SHA1de6cfbc40f02e8edbee2b3f9d094eb62470541bb
SHA2567af6c530c6538048cb17143bd35d34635db7991f9c1682b92302510aa38da5dd
SHA512080209af13c2402d994cb20aead7508ea4276811307c4a4d2cb6dd3d7c488e92896c72b928822bd0c298e54a5bdbee796fcb71e2a57715d971eeec1153f3943b
-
Filesize
6.4MB
MD5f40c5626532c77b9b4a6bb384db48bbe
SHA1d3124b356f6495288fc7ff1785b1932636ba92d3
SHA256e6d594047deecb0f3d49898475084d286072b6e3e4a30eb9d0d03e9b3228d60f
SHA5128eabf1f5f6561a587026a30258c959a6b3aa4fa2a2d5a993fcd7069bff21b1c25a648feea0ac5896adcf57414308644ac48a4ff4bdc3a5d6e6b91bc735dc1056
-
Filesize
1.6MB
MD59750ea6c750629d2ca971ab1c074dc9d
SHA17df3d1615bec8f5da86a548f45f139739bde286b
SHA256cd1c5c7635d7e4e56287f87588dea791cf52b8d49ae599b60efb1b4c3567bc9c
SHA5122ecbe819085bb9903a1a1fb6c796ad3b51617dd1fd03234c86e7d830b32a11fbcbff6cdc0191180d368497de2102319b0f56bfd5d8ac06d4f96585164801a04b
-
Filesize
26KB
MD5d4fa24f021f155ce9214dccf812c3b7f
SHA1864001ab7d2c87af00b7153cd096e0454b3f4e9f
SHA2563b0889281ff6367bb736690229f461bb4ff34b7437f54a5c71b877a104c0f876
SHA512de1720af369890df89c8550d49b4e3e2e353e4a21ef30be5ebee9216e312a57ede9f7919e71de592d0bad6e482d48fb759dd1d1323caafa506634e9f877f6213
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
Filesize
126KB
MD52597a829e06eb9616af49fcd8052b8bd
SHA1871801aba3a75f95b10701f31303de705cb0bc5a
SHA2567359ca1befdb83d480fc1149ac0e8e90354b5224db7420b14b2d96d87cd20a87
SHA5128e5552b2f6e1c531aaa9fd507aa53c6e3d2f1dd63fe19e6350c5b6fbb009c99d353bb064a9eba4c31af6a020b31c0cd519326d32db4c8b651b83952e265ffb35
-
Filesize
463B
MD511480836741896f0a32c6d56db5c2130
SHA1ba12af22fe651ab1bb79401b3f3b680f63dc98a6
SHA25666ccb25ddd4a9bc6bdcb534fb6332ebfa5d7c4034907e7b77e2d27ce1e398199
SHA5126bf7916b3b81cd748f966e36953dc13309082d0b7464cdef7945c25e0d8539a7129c12c1c8698d7a6655b9857d3063f23660e5efccda279a329a387ed54fa5e0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms
Filesize5KB
MD54e677bbda1814bf0f57bf5f1cf20cfa9
SHA13a86609b049bccfa9627b1e7f98e47e7184f0346
SHA256586de193a4221642775c708f7103b8500781957fa6e9a358f9af05de3579a83b
SHA512cc4f1603b83334c4228549c926ee8b8d5c898870c3df708d3e12962820cb44c74f834c41628e9812311445641901321e99d314152c52c6fd5873d408e7a6d205
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize7KB
MD5dd1fa0ea3e91f3451d4868083a3cd945
SHA1c5b00c5dba85cbf9816b381dc153719071213fcb
SHA25652c073019c6d1e929c604f65b6cf933cd1c7f563c74e12e9cb75918ae9a17bd1
SHA51295adcdc77352b8573a10067cc5c3cc9fe64681b6ed05f9bf82d9301d0d2b581f2ec2c2a621914317d38e963aa56c29ebae5e0f797dada55adda4918509ae902f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize22KB
MD5f6285881f235bda163113dc65cb7a576
SHA12d3d46c9110727fe8ae40976365c31db1638eba0
SHA256b95dac0c32745a8d2016187637ca609c123a685d01a5ad27ec821588d5a09b8c
SHA5125179084b5b5274b0a8e31c18fb975d6f3c3c589a061bb258a201223ae7a1e8fbff17a63e00be62c283831d226bd130909133acb8069feb6be024fd4a32266ae1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R21THTBZB2G8D0N5T1FP.temp
Filesize5KB
MD51d49be7cc633c362a136152efc3fca9b
SHA1ee1dfd5969b269b06f053f1a226c396e70bd980c
SHA256c5d18a5ff0d6e42bfd4b6a8dcc6c06f010bedfe858f3252f7cd13cf221bcab53
SHA512423727175bf35b5b9a8ab6ce7acab5e230ddb4c2c232e831bd3dbc110dfe7365563adfbe82bf7accfa881670075b6e73247bf09cf50ab753d35e0f6b883ed7f7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD50f2747ca1d77fd9df83c8bb3dc6bf9dc
SHA159dca3f57ed926744d579617f6b30ba53522cce2
SHA2565da40bd4ff1dbbec21ddd03ffbf921daa3d6b28f5235b3d91dd65f379186324d
SHA51227a73fa6bd9e80971f6ee0d2a803e098621701da8b1338e56f7ebfd32bd21637562742d26399e99e16b658a3964738e0a52d860629f33bd35ad72059c7ef4f1c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\events\events
Filesize2KB
MD5e8e539aab9ba562d03770296d6c1fe31
SHA1ce5f4b615824eb9e45b0c63bd94fe2d10bb17235
SHA25655cf704a3161d934a41c97f51250196278cfac5d625725c54957e5076dc2bf70
SHA512322cbfb4a05d02a7f8df368132e3a5ea7b6bd3afcfef6c0e74396819078f331bde8f5437bdd4cbf0e84a175f6949eb57dd9e66f35dc698d4bfc475b58acb7ed1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\6419a011-07ad-4968-96fb-f4ac0492b91e
Filesize10KB
MD5dad1ca826abb4381070be9d004e38dc2
SHA19602a430e98b7e512fa36bf4d3f660366b9b9323
SHA25646f19076d1d597aa16005f4128d1037023ada1cb862fd94f297bd2912db343ff
SHA512016eee44e4405002712604e1fb218105bac5b95c42115fea72b0d4095b4a24c323e70bc9a3b79fbc63fb8f1af24a29c76b74ce22e339bf20d61839d789e06343
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\8580da56-4e2d-4170-b014-f075d906bcc8
Filesize746B
MD5cbe5d81ab66f81d122d7514876476bb0
SHA1105ba91358aa52d3a9c6fef7f5fc17cb2ef657c7
SHA256bdf7bd9885315b697b37e6e7c657519fcaf22e1664cc532384808de4d562b0f3
SHA5121446200a0148a2586e966f49d812ac93ec6b0c9812cd0b59d5d9294dfeef50a83a008d4c6e2fcf2f1469aa570f3ab5386d9da4a19c3194c4f23713c1ada1c08f
-
Filesize
5.0MB
MD50497de8c2b9a1a717df580bcea390b59
SHA1904049b1612af33a9213391642f6c1bcced40bb3
SHA256b2bca8d286ff5469a8a4e9ffabeb31619f69aa4f2ab3a4f781ca175227040a5a
SHA512eb9eb6629ecb632cea3c16e47c8e25672805b180ba80e88f00ee6cf3f9e30517f2527c157f1237829b157af635473f7f873252d315063df599126f90c98e1db8
-
Filesize
6KB
MD573b2a31b1bdc82233670230948442b9c
SHA1741e0f6d79edbe1933eca7a930f979cb4cd52bcb
SHA256d0705130a045e6d4f33571872ae62c56f50d425ce3930347859da7e3dba31617
SHA512b0b1f6ef7ae26dd96de9eefa168f2534266c0894aba328b025b5ac3b6f134b07f18089b1a5632381ba21ddcb49ac13ad6fe898041e6824dc5b0c57d1a36f72e6
-
Filesize
6KB
MD59cb4871969bffcfd3deca7a8adc284e5
SHA1a4c93084c0bd583ca019e87c2d31b3ebf7072bb5
SHA25645cc149d281ac6ce194f5721e9f79667cb6f8a3e5268f549c04ca43072ed0416
SHA512611f5856f6f5288da722f047ec1a3163c32fde44e4eb4c305096009988d6add59560e96b72531d27b10b8adb288cd329dd73ce3ebe331461dec96cca7e9faff9
-
Filesize
6KB
MD5403c0df1ae0fb75c463419a0e6bae5e0
SHA17c4be6ff443c9acc72f14a9fd74ebd6d9bee9518
SHA25688ae42db35fd3f1137f1beb198af2499fc4e10fd8c92b20a7080c3da9b9da274
SHA512aa1a462f91f26bf917c2520d5c0daecba9daa9320fc42c53c010b1e7719c84e6bc7b4312cb7f6e798d62c5bdd8a1db25e8d048a6545a84bfe13b813e3e7548fd
-
Filesize
6KB
MD51a973bf330041af1759a9adb9b8b0b3c
SHA131fed74874958fd5c518b9872c3655057af28f5d
SHA256b32c0c66d650dc5179d774caf233819ac2e11cfbe4f1c46194dccbf2f5e66c05
SHA512a8d7d1f0471c4ec315d40ab09c9a311af48735eac889b2f3d46f452822b7bbdcbc427ceb25ec24dbd54cc8c2f5a77f796cc39f041636fa38de84d7c3fe0d79a2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD55433518bfc33ed008935514d6b6a6ed6
SHA1d76d3e4f1e298d8d09b7562528ac51d06b111b80
SHA256a92fb9bc48e74b243bae678e7b5c79289cfeb4c0cc09bd6b629382e5a1cc0b88
SHA5123bb43607876f530774e4a3c97d1fa5aa611053eb9e52733bd90cca1e13bc323536bde99cb63bc4efa688e8b29cfe59fcb314a2f98f2929d22d4b5a672ae654a4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5a8b96e890f33598b049fcc692054d38d
SHA1814c7a9978705ca61c402c7de3242d11c97db0cb
SHA25656a085f7129f3e276c03e1f5a02b3fa155b8467cb6d15cde85aa5750b9cc5f52
SHA512379af978020adf72233d7b7e92f61d8cb29597b39e21251096e32c71db408d970506a0fda4e9167efbe7a11406cb585078dd83daa5c4aaedc38c59c8bb159735
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5c913fedfa3956797941573ffb6f54376
SHA1aebc214fc149187048e45aef577f8be0c6714f8b
SHA256da5ed46fc6facfe99f2ee35813f2d7803490814e7adf15482e60b933092785b5
SHA512e7d6c2dba08dcb027fe7305f5ad40874b4fd6199cbee088449a97f991a0f57c9f2be0636056cb944105cc8a8f0598784a88f4f8aafc604278d71aa19ab5041a4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD55581fd6fc805798bf06b2992047ee483
SHA11ecfaf323d8ba5d11bea55208b4341d625651e90
SHA256d33bbba9e310ac0bc674bdbaf8247b94c33427b6a54a38fd1ef5ecac06274ca4
SHA512385277913394e832b8c21fad47d2be9c1d0f95bf6345bc45c3fea1016173e19e9e73ea634ed10b4595dad151a23b56fef8e19057fb22bdffd884c25a7e4b54c7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize15KB
MD59fbeab3d8c80cac01b5deee41309ea77
SHA1cc66457e2fb97eae36aabc5a1d6767b41667fab9
SHA256a2fae19e82e2465467f1ec96c0649c01707641ae70080700726b87c4b377bfa8
SHA512f88e161f338385a5dfa44d7f5a61ba4d52d6189b3a4861bbcf9dd63424bf14feb61f6277c4604890e9aed00020bab0d6bb25c0ffdd90f283f687054df564d2f4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize23KB
MD56650d3ff7949a00ff86aca001dfe09c2
SHA1b82943d66285f5ed3f77f12fd2e8c7cc900a9547
SHA25660e68edafe4a9ff18ec36691b1a8d5a41f8eb6ea87f46a1d0f2395cc338031ad
SHA512ba3c1a8028d9335bfe023a0de17941d0e707881b63677962e108b5ef4b59efc79b103146d4552c96c8262e9cc605f8dece1c3c0189a3636a60825defd474219d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD567fe2493fefb82aed8037284c8b69a54
SHA1f2ab3c7bff7504408ce421850d95c78fe9826733
SHA2564d5d0a5f63beeef9509038cfbdfec1ceebf39817431105121964cecf5ba85b58
SHA512ebb23a5048a567d26aa215394b748da96fc75b175b67b8ac19da761c95e4d58f071eff8045d51adce6eef9317812e1d47e143e1894f3b0d52302ee226bdae28c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize29KB
MD5aea2b1339052085e30d740e0c6acd112
SHA158d2d816651deb5ad325e7a4e2cdf62904e2749a
SHA2561b92028a72a1abcb8adb245f9cbc6a95ad90d5224e1b524f185125920bf64df4
SHA51200378ebf575f55008dc89f121001aaf7579f037f3ebb31e452768808899c80fb5ed6c453670f3f25060aa8306eb7e82683087ef9a38f880641b273b627c2ee23
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5b00868c29e9fa0f23a2a3e2bdd5d81ad
SHA1dd45e9658f1b47aa87c3b9b98f0fc8d3845973d1
SHA256390ae5f5c792b85f82977fefebd1bfeb70ec797eef531e8e1c2e5bccb83d801d
SHA5120b0ea2765ee1bdf73bee2b75c3bd60c23bce9ae252fc6d5d8516b4926444a420642ed5ea878a8ce6b0f68b89501c2528899eb6fa480f8c980ca4471b826d28c6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize31KB
MD53d3e0c7ae060981f58c71dec5c399371
SHA1791b940cae8c586957b6110eec06fa99810bc0ef
SHA25655955a16938e70978b27d36cbaeb035c65a0d55ff45a69b334fc6263d1ffb678
SHA5121f5f120ee8eb79d29bfb618fce70b2931df4e763ddfb2cbda6c7be38b4ffbde77e13b739995c5c35903920dbc9025fcebed81e722372892d151df0c30e492bf1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5378cf82169e731189b1e53af79a6195c
SHA1ef258b193c760ebced33495588911073a5478522
SHA256974bc6e60e0a12a858637488d4a09056f13553b9a91774d37ecbaa1d0cf53492
SHA512735b262994c908b620fa3223707a649a34846c7ada3225a144ec200642f0f5340dd69bb7b15efe5de1cca91995beb021f201d6ea4960af23a1807fe3fd065a18
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize31KB
MD56368571ee19e4e784c453a90476b48f0
SHA119846aa728da42abeefb257e3830bd1ea9d52f90
SHA2560f073f8464131cd3a2161be64a8f7bb95d3bf44b8e9c42ce104fdf2d294a0231
SHA5129428baacadb871f0837194cec8bf4960281245bf398992b8d6ee3db6e927cc016ada86acad7411e074f377f061d3290790686da9f610178fcb30e59015ded941
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize8KB
MD5f0385fc1fcb1663aea180e8046edf4a8
SHA15b492c76c4c8bab367fd7df5fa13c04937a4c1c7
SHA2562dbf0493fc5c9e143054baacf29f25666e94ea9686f0091d0e9703ef03dadd9a
SHA5121092fbae8b82b42f6dc6336243d702fcd0358e095a8b721a6d7746df3822769ddfb07d7abca44b0a71c9f7d9939b00f17eea148525a44653d78168f8c645afbe
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize34KB
MD515bbf409f1c6cf813624ea92c948edb0
SHA131458517e81877bf4557c677f1f849f2d208de3e
SHA256269caac4d111b99f99197689d058bb2c79478fa04d82d8f1639ab13d18ae674f
SHA512bf6401c08ae91a13dfea808f7348e0c2cb29f6b71f2f8db56646b308bdcb1b23fa500b41132847f9ecf0e3ba99fddf8d5aeaf9c0ac79ea6719f55ac12bb26a52
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize20KB
MD536bdf4c8b777602f663aabb452f30630
SHA1f43328bc23202f7ac1ed3274e0b7b9d6c9dea12d
SHA256c36f60903818c55fd5f3a593d97b0d01379578e8de0b6c292e9b69c197e5072c
SHA5125320a1233066572feb54ecb40836ce76329f1dc18399f482cdb6f402662e8eb72d4ca7fea8d4254e85611f25bab9648ab351762a63fa4e1060af1e22b17ad807
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize32KB
MD54d44d33c57e2c1be6249cfd9e8d37581
SHA14a01d4ee0434a2cffd158d6c4bea1a16908188e8
SHA25645f73fee45f2033699fdc61edb452d1b914f4e6b7bbc527016c819087c8af3d1
SHA5120138ac8adae5616d9df90015cfc1c32ec37b8c69aafb26c6b7b917289fb5b9b3c702118e7e3d40e93dc425bc18e04244bdee9ff5d5422d34b624aa332fecac40
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize27KB
MD55fbd304e62a281bdfa41b0764d996aea
SHA12eaf71c54dca05018ecf3b427ef54fe9b2ffbc97
SHA256543cde352d60dc25c97569220ebcde7935af66f4ff0ad9bf5af9e2483206deb6
SHA512266b6454a23f61f929dcd9ccf5c1bc82badb00db4efde5c1e584cb3449912c7b9f941534779e061a9deffe1543154036182dba6182a26cd42c8caef93c13ad5b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize31KB
MD5c75cba7afc7449decaa420486964bd87
SHA15efd4f4e64ba47742a5d53af7885cdbc0ff6df21
SHA256a8e94a89682741bfc1fcf4312286f6619cf3d0b217a1a2b4eebf1d92afed288e
SHA5125e5d2f06658c7ebe040a368ad099c4b0adf35599e2edf7258f5189b0e16a14ffa86a6ea2c24a61f19b0e6a50e854643bd30c8f48010609a69588f43a7576c2d1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize31KB
MD508c922053644e2cf71831647c518ee6f
SHA1c52fc43041d58bf190d3f76c61c8458c2a008977
SHA2566cbd91e3bc8af357ec8d1ed4e44d9c062a0a8816b41f3db578f77a0d075e329d
SHA51211e7d1fd3066b29942c701f38ab766d5b788bf6951c4255a73fc3f348435349f10e029057c36217f420201ba9624059e5e8a5f224151e912cf7c87dceb268d1e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize33KB
MD550746154d7218aeb63e35d2e41a17b10
SHA1f25e17c3aaef4da3a643acad25f25c56ea7e1a28
SHA256f36b00f820fa0525677bd95ced3fcae6b268a6de35c519bd859f5e88e2098372
SHA512615a78e3e9e7ca098d49ba22438682b726ad238e9181d68311ca4557f691099db6eb578907be9bcddd4f9dfc186a47a0e34d364fe4f3ffd4a99b87f69008604c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize35KB
MD5da41a8126f353fa853aad3296b7526b6
SHA18b851154186b3549c477292624874eb5940df5cc
SHA25685b932baf162bd448ee999470550cddfe9d7984405f043f18855a1b7f84f94d0
SHA5122f732b1fec547081f068850cac905cea6a9b26c8d186d68990172c3de013929074a84da67b36fd40e6283519a59c3b4834bbb5a11d27c5c4d2064b05f7e3b302
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore.jsonlz4
Filesize32KB
MD578d41d9a8bc3df9b877ffcc3e8fdb31d
SHA181701fe3e44bdeb7e6796c6f83952bf6f654068f
SHA25624f5484ac28d90921837e2c58304054d9d921fd05508ff05b431f09ab9dc2960
SHA5127b47c1ff41c7b3aad0b65bc3b4bc1bc9deca6c0ac079b66029f688a0c67fa5407ce90a62e85530bd54d7b38b301210f24d252774ed14cea55692ec54d45b23df
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\default\https+++filehippo.com\idb\556220133rrae_su.sqlite
Filesize48KB
MD58fc34d73043356c85bc530cd94f340d6
SHA1b55736d49051ca878d77505d06ea126517298108
SHA256f5b6b832e2a500b9371249a6e765dcc2c512b52113abefd3a55318125c1c740f
SHA5124bf510b494a94e08b671eca6254994792f2dd1c4af19cf1aef93e4f6717bf91243938ba2edb649ea83ee3bdcedb19f5223febc744d10649fad298ddfe75fa386
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize192KB
MD5f6fca7f49bb357ec59d51cca28763e2d
SHA1eaf4cc14f9635fc94101e33f5a196b15151fa592
SHA256a76477f9df670d9b81259b88f14910b3f3a0b70b286fe6d134a3774dcf04bc85
SHA512bb41a6acd20ee391a3f942f54a4f58cb726db349ae2cdb4e416be726dd8c98daff18e41e80196ae98708fca5e78424dbea1f37dd7c7ca5c890e7ab1801ff80d4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD5731c0e733fe1e3123d366af7c8e578ae
SHA19756304ea773dd9cd96e5996dc79de2ed6a9ae9c
SHA2568f426b4be5e3440fa14d37480f018b7dc3d1a547b0e91c2fbfc6e31d9054a359
SHA512d29e0f2356a3226f64692b390c122d4d70f09f677d9f5d086f2babaeba6574d670171edb24ff52f928871ec489680f57910e21fac1ca8ec08783a07d21b1f427
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\containers.json
Filesize939B
MD594a3843fad8c45c48b0e07342df3dfdc
SHA1d55b650208bda884d573afebd90830a3f4d7c201
SHA256854ff2076f71097b030c302a1ea71d8e851d2920b9ff5fc8dc8f16c91ba95b72
SHA5124d2a6b2a223ad81bb97195abb27685cf88453caf5769de154b373486d5245f02e0c0f664281d8e3bb33bfcdf1d6f7b3d9602303864d4e56481382adcb0b932db
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\cookies.sqlite
Filesize512KB
MD50a87e624ecf0ff38da148e793087d4aa
SHA1d6ef5eedfba4d837ec0c365213c441a9862b66d8
SHA25668d11a8bffd5ca99f1cbc875fd5074e627eaa52c83fba013dca294cd53bc12d0
SHA512e5ac46cc009cb93f9a48abd0bd267e5142665406777f940bf0250442f2d5935d3066d9255a3e3523639497b10005d85827f438226e6bf3c9c508f95c425c46bb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\datareporting\glean\db\data.safe.bin
Filesize2KB
MD57df2cbd41c320a248baa66d92efb23c5
SHA19217871d391936317daf270f4c805a9ec629b6ae
SHA25666258c7b5e2023cd1699f4a30e13f5bf6ccaf0a44231c5f32e49539b00697932
SHA5129c75f21324df43f5a07e27d47cf6a78aea5c7cbfaa16bf11440cfa9003c13478ad053bce2b33c755adaa3fdd6d102bb916817006de4b22b8d65630f4ac5c9072
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\datareporting\glean\pending_pings\61fac722-4baf-403b-824f-ac643f121cb5
Filesize587B
MD50bee7792ba4c9aa61ff513c337e041a3
SHA1440c0f0044b45f91010a72a53dde5b7cfea4e758
SHA2568321a41a5a2946584cf1fd4ee72c100cc97330525564f965d091fc9bf9d81389
SHA512712ae9b94be9dffccda8d9ae7b223a0892e8b81ca544d9e2db0fd12a629f4dad91e1293fc3d0898316b7e54850fe74ff6953c08756c20b04e9854b29c288a074
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\datareporting\glean\pending_pings\a4db8b0c-ff7c-4818-9a3a-b512e6114513
Filesize656B
MD550f3bccc9a8cc734cc0950956d36bfe4
SHA1ae8be31286dd37868754b53f008d9bdee4886576
SHA25661872748adcc5e3288184990bacb5d46b6fee8209fe3d8229a8c05313f3a3096
SHA51217533a1de8ab6785d54a5869dfab5bdc334185487b6bd666f029431a6dac1223179861b0de8b7d8587298ef03f14f16d407da69b4ad7b9fef18ba2ba85e11669
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\extensions.json.tmp
Filesize36KB
MD5181b5b49e06316bda08f2bde92607af0
SHA1faba354c9c030789c687b3097383926b9674cdf4
SHA256a0881496c912b9ebf38122a7e091133456528af7cd97b0ce573763cdd9abfbbe
SHA51292fa91fc7fc62ec3b25d2246e5e7efa5228273dc6f06955c8bf8d6294cdebe73b521ff9bdff6433132db77492f4dfc0977b37296f382993faca60862f8c6134b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\favicons.sqlite
Filesize5.0MB
MD52a92fdef8fccc4cad9f9859445e48b25
SHA153d08a4e7e045234c73c69d899fa0360121fc42a
SHA256d7d9366cfd0e64cd2ea698f6a2a599589e1c7986577a211a7b6f1e7e831a7535
SHA51232400db4715bb65367508d1c7defa566c167372ff1eea3fdad6bcb2ab8d861d2071c9e86c1a0782856e0e5970ad8becbdde48a8af76d165886fc14e087153414
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\handlers.json
Filesize410B
MD5e7a65c5ead519a7b802f991353c26d3d
SHA134cc3c1cf9bd4912dba5fa422010934e46419fa3
SHA2560e5ce92485da953757f615bad034a43032b220da18f8165dd85347851b56b2d2
SHA5122a6034449ba6f5da8a77870ae665064047cea2460aeb4c8c0b62b308a403fdd30648150209aecc31ab1e50b6d9d94a1f51d3d7d50bbf35ec1b742bff2dbe788d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\key4.db
Filesize288KB
MD535c89b6d37e922dabfa19a36afc07b09
SHA1c228ea4dfb94897dbe0e06428fbe3bbbc285fa3a
SHA2563decc6c2731a4eff5a9c6887bd984e3f78bd78d94d8d7ae227ac686ff9ff7989
SHA5121962813c2961d1d6087fb0b011c39ac86865a22088c92ff17d24be54109792b7a3377b527369ad9d8c700d3f12d1cebb98155f9de764bb90da11a152bb3e5559
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\prefs-1.js
Filesize6KB
MD54116f5a644860f833925db3ec67a5c76
SHA1e91d0d45357f1a7413d4bbb56afd735736225824
SHA256c783f201ad330d58fe3ab76f65c255f4fa97fa7232c6ad1a20bb6be482853fed
SHA512790ab5faff2529bc38ab780e3b0908555bfc22257f3b8d3fa13eef0c9069aa26edc3843bfb7e07776389be29c62aec4e4a57f5dd4a11f2437046ce21444b8d54
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\prefs-1.js
Filesize6KB
MD577bea623bd64c3b8349126e97777cbc9
SHA17ed785b533452faa6e2b8813ea2846fb495d89cb
SHA2566c67874fa56da531faf531b69124a077e54f826eccb6509ac335271334aad6ac
SHA51228a90aa6da5853fddc61198981ed271815540851c0b79dd7b5006c48ac7bd94af20b3aa62a66000dc72ee83ace89c69a1f2ad0a89ae87df789599b4b172e3a83
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\prefs-1.js
Filesize6KB
MD5596497939261b531f5df3ab1e8b2aafa
SHA12550f45ce2f9ff913ec2bb4a3fda4f31c63e3b46
SHA2561b82952e989f1ca5c57c9b624cbe898d92225022ae6c32f5f1219773f931f3cd
SHA512244b41ed82eda57bb27053a6e409f7c8e337206735700ef4cf5edce68e8fe96d883494040409c06141586925d687feb8b91414545beb09451d2707a935dde173
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\prefs-1.js
Filesize6KB
MD54e715f3485e339e9e24bc8e13e7dbdeb
SHA1f56991b450fe610a015fcd3210d876884e6c3e14
SHA25694e529b9ce761696540cb2717d5586c2dbd65984b1d3ec2ae1325a8d8658b4b4
SHA5129da2f685c92b22dd836948f3ad4218b89a4607e409d351bc9003c92f6af0b9b037eae83ba6f320e3ec1f8051fcd781ea11253c63cac70965bd1b6cbc9eca9ea9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\prefs.js
Filesize1KB
MD577fca371c766b912fc371a870adaac78
SHA13fad6c8ead00d440cfea975efe64ca4ae64da0bc
SHA256b2d5c30745ab487d2198bf3fc6565d4ff324e529f9e7d7576f93ff8fd67e127f
SHA512a72cfa02464dff9cecc039f7282ec7f3ef483241a5dfb7179d688594c95e601d767789701c197a6fe3cba699593bb2b7ddab505542a5fe7e7373695048f1d621
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\prefs.js
Filesize7KB
MD5ec9447b8c84ca48eb7ef62b5b3a5631d
SHA18480ebf0ecf30a7a4f83e5c6bf9012ca8e4b4660
SHA256dc75f3651b6686d655496536db8f68cb9c519d74efde24c3eaa4f8ada83ca0e8
SHA512f822c1416da3035a994191bfe51f6245dae7466adcd4e5bc8ef30c7978a4201dfd45ec3e7f9c95f46c88152681515da0427dd1128ea9b80a82bbf7d9995a56f0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\prefs.js
Filesize7KB
MD5cc099b4cd7270c16344ea35b383c9abc
SHA1c003d713060f1263b3b640089f82a31b9dd901e9
SHA256333d6c3b1cfe1278e60ae7e02f1e94a01ce6cec684755119ed1129c08bc4f83f
SHA5128633ed4b2118876c8167b105d9f077ed4937f533c4911d0d83c4ea22c759ec1f280570dd2f13a644c80a574b34f3f591f96556d03a001a4e82bc963c6cfc564a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\prefs.js
Filesize7KB
MD537fde3e1c0206c36b788960aaa97234e
SHA13b4984b9851bc8af37342d3c144227c29e0642b7
SHA2569d0fd35a067dab299c4144ba48d9a2d1165565af3372ddfbfd9c58d4d9dd42ff
SHA512eaa6a2eb42e79e40fec69a6c7d147642bcd50dfc1c005862917b8daf4ef70012eed07d1428af37eee1c8ae479a83cdf3f4e0e61cc4210d21c63be848d9fa13e6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\prefs.js
Filesize7KB
MD558892d9d0d80e0e065e16f4916f43612
SHA12f4deab79b8a674808eee8519da07448fc6ecc7f
SHA256b0644559653a12cee25e8a15f97326f03d4f6029e8f57b936345437d437987de
SHA512d7b5df839864c27c09de21093e34bdf943fe4c31dc01cf46f266fe50c8b4ba7da0e0ecb776f99dbf34ee5cf9ed32fafd73506a6c4fdf40c73ee69afb22354575
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\search.json.mozlz4
Filesize280B
MD541d220d4783f67d2b57beec20c135229
SHA16e97765e77920b6010fac2cb4abf1e3cea106541
SHA2565d1881e74d76b95bad59439bb5c7676258a4ae6b6d853074e93b5247cf1715dc
SHA512dc30ddc4c8cfe598de5e24bc88cebbe4256fbb21a0b1db6c2ec15311053e7d8be6a93a0bcfcfd8a02543f8b9cf9b15a5840154b272a2df71d59d7dfd80984ac0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionCheckpoints.json
Filesize288B
MD5948a7403e323297c6bb8a5c791b42866
SHA188a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA2562fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
SHA51217e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionCheckpoints.json.tmp
Filesize53B
MD5ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionCheckpoints.json.tmp
Filesize90B
MD5c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA15942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA25600ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA51271ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionCheckpoints.json.tmp
Filesize146B
MD565690c43c42921410ec8043e34f09079
SHA1362add4dbd0c978ae222a354a4e8d35563da14b4
SHA2567343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
SHA512c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionCheckpoints.json.tmp
Filesize122B
MD599601438ae1349b653fcd00278943f90
SHA18958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA25672d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
SHA512ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionCheckpoints.json.tmp
Filesize259B
MD5700fe59d2eb10b8cd28525fcc46bc0cc
SHA1339badf0e1eba5332bff317d7cf8a41d5860390d
SHA2564f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea
SHA5123fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD5067d5214ebbe045bd627ac03f64a7114
SHA1629f1b8b6c2cdb840f77f2cb48dfb5c5b5a39e6e
SHA25628ad3f0601f3f167bbeffb96386f1982a9107e720e8ba4477d1a47cd22c48454
SHA512786914ccd786413a13568f0b2e9a74220547590594d4ab86e89e8c2c708b5e54ef65729b5dcdb482ad7a2d5e1bae568e121475e4da671f3c12a491b978ef07d0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD5b5f83f1791270975230e325efa848192
SHA1a1f8e2387a6d27b8274bb78086dcf878a037fd39
SHA256a3a0f5cacbc457658c8a94fb8ba49210a239eabc392843086934104d554911a3
SHA512d5f22aef57130ec8d2d76846d6599b5b8a68cb8e81683c964a1ced02a08c1bd391b6173d5ee35d0d2c4f6bfdb2b43b1ce5e8e93ef4daa00034f91a5b0fda8a62
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize7KB
MD5b95b5864180d0234616743b2d2708c38
SHA154d65afd3b7ee176b4a5ebaa62b5d00ebf1e2705
SHA256a83c03184b5f4cea9ec6852304fd42b6ee7125621d1311eedc5e2a6fffc245e0
SHA512cf73719bbf48c635f51f69f1d4271500108ec5755cbbb3e82291f07d1d909f920290bb1c264e1226897962a8ce289302ac77761d85c1788c4b08bd971438c224
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize7KB
MD51c5ef2dfdb75d1d9f2826d1af6426846
SHA1e4411b744219100bb096549508919b703bb50382
SHA256ebf9155f54ec19c8b3342fbb3311a666706c9ddb0291a696bc60c76a51b3fecd
SHA5126c21767a79892253db9e824b941009522506daf2782e1c3d2cb72f5d57307ee015b6c244a4815a5737925fca0f3d470908a10b97bb160f8e7cde5c04c209afe5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize2KB
MD5bd0571aad1cd621c027860ed371061d6
SHA14f82493939a1685d49c80c453dd26847f0889d91
SHA25662d6304c761939d707fec8c22ffe00300ab34dd6f5963805db79ba501e674724
SHA51278bba5282e0cbcc178a95edb26ef00c17e84ef9cad0332928801f8d982f39897c2c9abf6036ec24ca75c570aa94330c1858e8f609c7b4b4422e3697a0d809141
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5ee671b2af73b4c6ae81c7796b435622a
SHA1da2afb546f227b280abd5474982d3d12da94f0e6
SHA2563fc6b5473e393f84778955e0d639ae70fd081fc4df843ca92d47405ba0f03f75
SHA512bccfc29a32e9946aaa88ca6027b8efefb9cb7db4e2a0f45ed42373753eba8b69a718de830c4a45410de2272e71d45dde5e83aa941d6750d0c309f02023826b41
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD59f931b7901a8f6b1174ccdbefbb16e42
SHA1976ed810158d513e13816684dc1f2ebcd6bd56a6
SHA256e6ab413ee0e8ded01f54b11f3ecfe04502998abd106c3aeebee109065b4d44d4
SHA51281918c0ef7bcd4064a5603e4503dad8a4787c15b34c3ada37edc720b9cebbfb9489297660f517dbc5444877a4afafa6c335f9e9da3d47b099c40e33dc47efc0c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD540cd54a73c5b030ad53ecfc00aa75825
SHA1a54ebd8b9d9cb925f012f2f3ea97bd393be5a1f3
SHA2562ab4bc01a9aa79b99f4af9271c6c5b3a618f5110f4d84f4736937132a3ea5d5f
SHA512a62627281dcdbdb7b6ebc11e737bb3e98fce275be98ff035ea5a3aba7dc58841287c5552b72737314d81e0f6a20e15e95688b3296a49fee1ad2e11107ae3acce
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD5d1fa057dc0aa9ebc4e7c72a550757174
SHA1f53cf46af06396eab6f3e9d8a730351d00a42d64
SHA25643a6cb5349a946074cf0a58d095fde1ec030d6a5d4d06410746244f449d608aa
SHA5123f0052cc61bbd610280ba7d33169d770d44cd489cedb3cf46dc2db60f83e0a398e3abfa685db682705982f9c7fa98e90e5540ff50a3d6d8466d88843497466bb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD59ed465cfd8e3e9e5987013123e2da048
SHA13f8c74ebe55cdcdaf7888d721b154240d498bd05
SHA2565cade23d89eec91a7f72180e8f9f2635ced5976291f1abb5472b2aa65808c5c3
SHA512e5d25e9aa78fd2d43e771a821418797cd2989787f38d585ccb04ef0e84227c6e8eb2a6789c92435f415e714e7fb70af02c4547500cc2363a6b72d466207fb088
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize7KB
MD52b1cf1435bc9ac20f41a9ac598a5ee6d
SHA1d17bcddea4564ed9dc653c1e86641c1a85b6cb0c
SHA256065b9980f2ce94662da4fd9acbcf9ab7c053e8f1dfc7557f17913ee31a1d5d5a
SHA512d9c86795475e855695d0f799a4d511050926fb2bf2f501c2140929568657338932c74326fa84564e9bf9e4345624bbdd4e98b6570c2509d2ab12d6ca04fc8fcd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD568480385ad282116a1aeb24be3989a94
SHA15ac1904f38f06578ce14cdb8b94c8e8354185a5d
SHA25628a474f9277f13997e35658e0101efd076a0e7d2ea9834740572f70761f9b609
SHA512ace6d9bbc16f4262ad151374afb45c136d88b4adbd80934051b7b61808efd3d92876391825dea2c84abe6f893544a0320607bafe1bf927062fba01a4c33dd6d6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore.jsonlz4
Filesize1KB
MD5058424c89d20f7253e61d78a03526f5e
SHA17cf0ea5c3c1b8c3a9026b1fd5d8b3eaa32835653
SHA256a081998cfcbcb34c13568e216a59b4663f565979638a152caad078a79be44873
SHA5127d665f4bd1a2bbcce7aca8b064cfadc277035ee900a98ba7b7b3a534708a4d10d4ea1269929337f240a4bb9c263bbd85ed4e10d6d730d7b4bb8b6d63029bb50a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\sessionstore.jsonlz4
Filesize7KB
MD502ad679ed55a8a0d01476e43634b0667
SHA1369dbe6aa79a94c371b67bb5d5e8acb1759ff52c
SHA2567a5f703565af9fdb3c91a4d2396f3624bea1a671c6544e4fd8117b14d6ad4ddf
SHA512622abb81722dd1c08c0f68c2a488941ecb1d7bbe4226ac88fd0cd70ee63a152d4b2f4de8ebeb3c27442b4b3d9e121d7db586509779b0d036919763e647016d5b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\shield-preference-experiments.json
Filesize18B
MD5285cdefb3f582c224291f7a2530f3c4e
SHA1f816c3e87aa007b6e6d31eb6a4618695a7d83439
SHA256704d28223a4320a853df4a19d48c7015cf79d56a5317cc3475b6305fa43dcc05
SHA5128f1decf1e4b5755fce8f165daae115f45d6890985c9c4bbb33a6f724cbfd26db75f6da06f9ef675de20fe755da9b7f55e5ee37124296a12a520a393da159bd58
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\xulstore.json.tmp
Filesize217B
MD558e240288763218d12bf235d34e5aee2
SHA189135494b57f590011c09668dec3b90d2c5ee9ae
SHA256615f80e71dfde24711e7fefc1b7959f7592c5e5cf9ad0f3aecb4235b93187176
SHA512caed2638902987aead199e73cffb90881bf245bbb616cb38c46b281d4aaaa54dc20a54e9bfe17a8d6e68847394c113fb7606e94b64f44ab0b52bf7846f26e936
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu1ehyiw.default-release-1726642970312\xulstore.json.tmp
Filesize141B
MD51995825c748914809df775643764920f
SHA155c55d77bb712d2d831996344f0a1b3e0b7ff98a
SHA25687835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776
SHA512c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c
-
Filesize
10.9MB
MD569ce08df9b68db84aefcd74e3af918a9
SHA105d47e4c4e22a4c614437be1da597fa7d9434c85
SHA256f460c3b2c3a7943234decd9a9d72376dfbeffb76294f19b3995dc56f268d3fb8
SHA512b424e2fd0c2461aec69237257acec06cfd38d298b54e781502b0ed2b166a5e1e6bea812e72d06ead339e0ad52ef93fbd04615c554aa5a7bf3b04d34f44b15725
-
Filesize
75B
MD5bcab1c5389142cea16546552716cef44
SHA14936f7fc8ff5ae9432917584eaa830abe058bde3
SHA25684f35a07864fc55406846c48394f6689ed6b52f3511d80298cad44c52de22840
SHA5126ed59bbbb36b61665690249b08b3abdc14bb2f8a1eb972c0dc231a91ca1b1af3147d8b5c49d1adc338ee9b3c1ce4b0f12a18360c46552b7fe90b405416c42e99
-
C:\Users\Admin\Desktop\Old Firefox Data\je1358xf.default-release\@[email protected]
Filesize1KB
MD53e97ad71d91f37018f5fcfd981d0350b
SHA1aa548adcff354cb8cb83ff0d59e13325b6ce5e53
SHA25650036568b03ab04197d64347035ac25e720202e598af08a3e93f74cabbe54723
SHA512a7f24c44e1645cbece41055a795b79a632755d2a805e8c2ec721c8d8c76175b6203c8464f96d602847a1a3e7aa470f0e01b121d69c90d9d5a115772678a94649
-
Filesize
66B
MD5a6338865eb252d0ef8fcf11fa9af3f0d
SHA1cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA256078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
SHA512d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
-
Filesize
15.1MB
MD5e88a0140466c45348c7b482bb3e103df
SHA1c59741da45f77ed2350c72055c7b3d96afd4bfc1
SHA256bab1853454ca6fdd3acd471254101db1b805b601e309a49ec7b4b1fbcfc47ad7
SHA5122dc9682f4fb6ea520acc505bdbe7671ab7251bf9abd25a5275f0c543a6157d7fa5325b9dce6245e035641ab831d646f0e14f6649f9464f5e97431ab1bf7da431
-
Filesize
5.8MB
MD50dc93e1f58cbb736598ce7fa7ecefa33
SHA16e539aab5faf7d4ce044c2905a9c27d4393bae30
SHA2564ec941f22985fee21d2f9d2ae590d5dafebed9a4cf55272b688afe472d454d36
SHA51273617da787e51609ee779a12fb75fb9eac6ed6e99fd1f4c5c02ff18109747de91a791b1a389434edfe8b96e5b40340f986b8f7b88eac3a330b683dec565a7eff
-
Filesize
100KB
MD5222916e5847ed076a8503a6b29e7b782
SHA1f69e7d7c67792a86ce46d28eb1d0a8d53e89cb1e
SHA2561b3a418cac2d85bb42e246d577a8f5e5716438c78b36f59a09284778558d8f2b
SHA512f7f5c3b9673814dc3cf8e86b69b2aacd48b68a162c2a355816367b67393046524a7bbfde7fa738b9f92aa9762fdbb11d29b763f0d200b5f275188e0c8345c910
-
C:\Users\Default\Desktop\@[email protected]
Filesize1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
Filesize
32KB
MD566140e921ffc869e5dbd7d0337503f1a
SHA1cc26b0818dbb2a4d3e242fd1caf7b45e036961c0
SHA256d2ef84b42a4358e58f5566d842c389b229ba073fcef20b2a3007b6ce76a06d2b
SHA512eb4a787e76a6700112349b5eba78a4467ba4a2364d30eade70acba480e4df1c5d48bcb31ca136f81b350c466911af97cb1da1ba964c2d35003a4e3e86c738772
-
Filesize
2.1MB
MD5d21ae3f86fc69c1580175b7177484fa7
SHA12ed2c1f5c92ff6daa5ea785a44a6085a105ae822
SHA256a6241f168cacb431bfcd4345dd77f87b378dd861b5d440ae8d3ffd17b9ceb450
SHA512eda08b6ebdb3f0a3b6b43ef755fc275396a8459b8fc8a41eff55473562c394d015e5fe573b3b134eeed72edff2b0f21a3b9ee69a4541fd9738e880b71730303f
-
Filesize
195KB
MD534939c7b38bffedbf9b9ed444d689bc9
SHA181d844048f7b11cafd7561b7242af56e92825697
SHA256b127f3e04429d9f841a03bfd9344a0450594004c770d397fb32a76f6b0eabed0
SHA512bc1b347986a5d2107ad03b65e4b9438530033975fb8cc0a63d8ef7d88c1a96f70191c727c902eb7c3e64aa5de9ce6bb04f829ceb627eda278f44ca3dd343a953
-
Filesize
127KB
MD52027121c3cdeb1a1f8a5f539d1fe2e28
SHA1bcf79f49f8fc4c6049f33748ded21ec3471002c2
SHA2561dae8b6de29f2cfc0745d9f2a245b9ecb77f2b272a5b43de1ba5971c43bf73a1
SHA5125b0d9966ecc08bcc2c127b2bd916617b8de2dcbdc28aff7b4b8449a244983bfbe33c56f5c4a53b7cf21faf1dbab4bb845a5894492e7e10f3f517071f7a59727c
-
Filesize
36KB
MD5f840a9ddd319ee8c3da5190257abde5b
SHA13e868939239a5c6ef9acae10e1af721e4f99f24b
SHA256ddb6c9f8de72ddd589f009e732040250b2124bca6195aa147aa7aac43fc2c73a
SHA5128e12391027af928e4f7dad1ec4ab83e8359b19a7eb0be0372d051dfd2dd643dc0dfa086bd345760a496e5630c17f53db22f6008ae665033b766cbfcdd930881a
-
Filesize
93KB
MD57b4bd3b8ad6e913952f8ed1ceef40cd4
SHA1b15c0b90247a5066bd06d094fa41a73f0f931cb8
SHA256a49d3e455d7aeca2032c30fc099bfad1b1424a2f55ec7bb0f6acbbf636214754
SHA512d7168f9504dd6bbac7ee566c3591bfd7ad4e55bcac463cecb70540197dfe0cd969af96d113c6709d6c8ce6e91f2f5f6542a95c1a149caa78ba4bcb971e0c12a2
-
Filesize
5.7MB
MD5f36f05628b515262db197b15c7065b40
SHA174a8005379f26dd0de952acab4e3fc5459cde243
SHA25667abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31
SHA512280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8