Resubmissions
01-12-2024 20:16
241201-y2hmqs1jbx 801-12-2024 20:02
241201-ysgn3szqay 1001-12-2024 19:58
241201-yp8ndszpc1 801-12-2024 19:45
241201-ygcwrazlhy 8Analysis
-
max time kernel
583s -
max time network
488s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2024 20:02
Static task
static1
Behavioral task
behavioral1
Sample
DONOTOPENINWEB.txt
Resource
win10v2004-20241007-en
General
-
Target
DONOTOPENINWEB.txt
-
Size
449B
-
MD5
b905963e0bb2d2d4f9a0b6a88bb5d04c
-
SHA1
182a1ab984d6a7c0359135de45765b41b7c542a3
-
SHA256
93537a3e7b05f9a7873be00d310c278969de796cfd3693c5e4677898bc638021
-
SHA512
ef0343f83e33cecb95bd5f1d91210e916aa43fa7897175d5b40e0e2722ad50adef28f9dcd58e33961fbea94be8ec886e4a09d1ba167ca41be73d50c30ee2d5bc
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile WiseCare365.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile WiseCare365.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" WiseCare365.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "1" WiseCare365.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Possible privilege escalation attempt 10 IoCs
pid Process 8012 icacls.exe 6248 takeown.exe 8088 icacls.exe 7612 takeown.exe 2620 takeown.exe 4820 takeown.exe 5340 icacls.exe 3392 takeown.exe 6688 icacls.exe 1232 icacls.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AviraOptimizerHost\ImagePath = "\"C:\\Program Files (x86)\\Avira\\Optimizer Host\\Avira.OptimizerHost.exe\"" Avira.OptimizerHost.exe -
A potential corporate email address has been identified in the URL: 67C716D751E567F70A490D4C@AdobeOrg
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation WiseCare365_7.0.9.691.tmp Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation WiseCare365.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation avira_system_speedup.tmp -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 38 IoCs
pid Process 6068 WiseCare365_7.0.9.691.exe 928 avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe 740 Avira.Spotlight.Bootstrapper.exe 3180 WiseCare365_7.0.9.691.tmp 5504 ACSSignedIC.exe 6012 WiseCare365.exe 4964 BootTime.exe 5336 WiseTray.exe 8076 MicrosoftEdgeWebView2RuntimeInstallerX64.exe 3600 MicrosoftEdgeUpdate.exe 6288 MicrosoftEdgeUpdate.exe 7952 MicrosoftEdgeUpdate.exe 6520 MicrosoftEdgeUpdateComRegisterShell64.exe 6628 MicrosoftEdgeUpdateComRegisterShell64.exe 3952 MicrosoftEdgeUpdateComRegisterShell64.exe 6912 MicrosoftEdgeUpdate.exe 1652 MicrosoftEdgeUpdate.exe 7172 MicrosoftEdgeUpdate.exe 7296 MicrosoftEdgeUpdate.exe 7192 MicrosoftEdgeWebview_X64_131.0.2903.70.exe 7492 setup.exe 7520 setup.exe 2028 MicrosoftEdgeUpdate.exe 6896 avira_spotlight_setup_psspdwws.exe 1852 avira_spotlight_setup_psspdwws.tmp 6620 avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe 1400 Avira.Spotlight.Bootstrapper.exe 1488 ACSSignedIC.exe 1552 Avira.Spotlight.Bootstrapper.ReportingTool.exe 5960 avira_system_speedup.exe 3224 avira_system_speedup.tmp 3784 Avira.SystemSpeedup.Core.Common.Starter.exe 6432 Avira.SystemSpeedup.Maintenance.exe 6556 Avira.SystemSpeedup.Maintenance.exe 2640 Avira_Optimizer_Host.exe 7996 Avira_Optimizer_Host.tmp 4484 Avira.OptimizerHost.exe 5608 Avira.OptimizerHost.exe -
Loads dropped DLL 64 IoCs
pid Process 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 6012 WiseCare365.exe 6012 WiseCare365.exe 6012 WiseCare365.exe 3600 MicrosoftEdgeUpdate.exe 6288 MicrosoftEdgeUpdate.exe 7952 MicrosoftEdgeUpdate.exe 6520 MicrosoftEdgeUpdateComRegisterShell64.exe 7952 MicrosoftEdgeUpdate.exe 6628 MicrosoftEdgeUpdateComRegisterShell64.exe 7952 MicrosoftEdgeUpdate.exe 3952 MicrosoftEdgeUpdateComRegisterShell64.exe 7952 MicrosoftEdgeUpdate.exe 6912 MicrosoftEdgeUpdate.exe 1652 MicrosoftEdgeUpdate.exe 7172 MicrosoftEdgeUpdate.exe 7172 MicrosoftEdgeUpdate.exe 1652 MicrosoftEdgeUpdate.exe 7296 MicrosoftEdgeUpdate.exe 2028 MicrosoftEdgeUpdate.exe 1400 Avira.Spotlight.Bootstrapper.exe 1400 Avira.Spotlight.Bootstrapper.exe 1400 Avira.Spotlight.Bootstrapper.exe 1400 Avira.Spotlight.Bootstrapper.exe 1400 Avira.Spotlight.Bootstrapper.exe 1400 Avira.Spotlight.Bootstrapper.exe 1400 Avira.Spotlight.Bootstrapper.exe 1400 Avira.Spotlight.Bootstrapper.exe 1400 Avira.Spotlight.Bootstrapper.exe 1400 Avira.Spotlight.Bootstrapper.exe 1400 Avira.Spotlight.Bootstrapper.exe -
Modifies file permissions 1 TTPs 10 IoCs
pid Process 2620 takeown.exe 3392 takeown.exe 8012 icacls.exe 6248 takeown.exe 7612 takeown.exe 6688 icacls.exe 1232 icacls.exe 4820 takeown.exe 5340 icacls.exe 8088 icacls.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "45" Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "68" Avira.Spotlight.Bootstrapper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Product Avira.SystemSpeedup.Maintenance.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "56" Avira.Spotlight.Bootstrapper.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security avira_spotlight_setup_psspdwws.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\Features\IntegratedIntruderProtection = "true" avira_spotlight_setup_psspdwws.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\Features\IntegratedFirewallSdk = "true" avira_spotlight_setup_psspdwws.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Value Avira.SystemSpeedup.Maintenance.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Speedup\General Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\AutomaticRestart Avira.SystemSpeedup.Maintenance.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\UserInterface avira_spotlight_setup_psspdwws.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\Ncp\SpocServer avira_spotlight_setup_psspdwws.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\MixpanelCommonProperties = "AAEAAAD/////AQAAAAAAAAAEAQAAAOIBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuRGljdGlvbmFyeWAyW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldLFtTeXN0ZW0uT2JqZWN0LCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAHVmVyc2lvbghDb21wYXJlcghIYXNoU2l6ZQ1LZXlWYWx1ZVBhaXJzAAMAAwiSAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkdlbmVyaWNFcXVhbGl0eUNvbXBhcmVyYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dCOYBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuS2V5VmFsdWVQYWlyYDJbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dW10TAAAACQIAAAAlAAAACQMAAAAEAgAAAJIBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuR2VuZXJpY0VxdWFsaXR5Q29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0AAAAABwMAAAAAAQAAABMAAAAD5AFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5LZXlWYWx1ZVBhaXJgMltbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLk9iamVjdCwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0E/P///+QBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuS2V5VmFsdWVQYWlyYDJbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dAgAAAANrZXkFdmFsdWUBAgYFAAAAAyRvcwYGAAAAB1dpbmRvd3MB+f////z///8GCAAAAAskb3NfdmVyc2lvbgYJAAAACjEwLjAuMTkwNDEB9v////z///8GCwAAAAtPcyBMYW5ndWFnZQYMAAAABWVuLVVTAfP////8////Bg4AAAALT3MgUGxhdGZvcm0GDwAAAAN4NjQB8P////z///8GEQAAAAxzaGEyX3N1cHBvcnQIAQEB7v////z///8GEwAAABYuTkVUIEZyYW1ld29yayBWZXJzaW9uCRQAAAAB6/////z///8GFgAAAApQcm9jZXNzIElECAh4BQAAAen////8////BhgAAAASQ29tcGF0aWJpbGl0eSBNb2RlCRkAAAAB5v////z///8GGwAAAAthY3Nfc3VwcG9ydAgBAQHk/////P///wYdAAAADUV4cGVyaW1lbnRJZHMJHgAAAAHh/////P///wYgAAAAEEV4cGVyaW1lbnRHcm91cHMJIQAAAAHe/////P///wYjAAAAD0Rvd25sb2FkIFNvdXJjZQYkAAAACHBzc3Bkd3dzAdv////8////BiYAAAAJQnVuZGxlIElEBicAAAAFYXN1NzAB2P////z///8GKQAAABRCb290c3RyYXBwZXIgVmVyc2lvbgYqAAAACjEuMC40OS43MjcB1f////z///8GLAAAAAZBY3Rpb24GLQAAABdSZWdpc3RlckZhbGxiYWNrVXBkYXRlcgHS/////P///wYvAAAAB1J1bk1vZGUGMAAAAAZSZXN1bWUBz/////z///8GMgAAAAZTaWxlbnQIAQABzf////z///8GNAAAAApTZXNzaW9uIElEBjUAAAAgYmNkNTIzZTM1NGMxNGMxNGE4MzY1ZjVlZDNmM2Y4NzYByv////z///8GNwAAABJTcG90bGlnaHQgTGFuZ3VhZ2UJDAAAAAQUAAAADlN5c3RlbS5WZXJzaW9uBAAAAAZfTWFqb3IGX01pbm9yBl9CdWlsZAlfUmV2aXNpb24AAAAACAgICAQAAAAIAAAA//////////8RGQAAAAIAAAAGOQAAABJEZXRlY3RvcnNBcHBIZWFsdGgGOgAAAAlJbnN0YWxsZXIRHgAAAAEAAAAGOwAAABNzcG90bGlnaHRvbmJvYXJkaW5nESEAAAABAAAABjwAAAAEdGVzdAs=" Avira.Spotlight.Bootstrapper.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General avira_system_speedup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "1" Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "2" Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "6" Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Speedup\Power Profiles avira_system_speedup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "13" Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\software\avira\antivirus WiseCare365.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\BootOptimizer\CalculateBootTime avira_system_speedup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Date = 56000800070006001e0002005300480000000600 Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\Features\NcpUserActivityProductEvent avira_spotlight_setup_psspdwws.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "66" Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "69" Avira.Spotlight.Bootstrapper.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\BootOptimizer\CalculateBootTime = "0" avira_system_speedup.tmp Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Avira\Speedup\Logging Avira.SystemSpeedup.Core.Common.Starter.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Speedup\General Avira.SystemSpeedup.Maintenance.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\Features\IntegratedBackendCommunication = "true" Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "8" Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security avira_spotlight_setup_psspdwws.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "62" Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\Path = "C:\\Program Files (x86)\\Avira\\System Speedup" avira_system_speedup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "67" Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Speedup\DesktopCleaner avira_system_speedup.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security\Benchmark Avira.OptimizerHost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Adress Avira.SystemSpeedup.Maintenance.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "4" Avira.Spotlight.Bootstrapper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Version Avira.SystemSpeedup.Maintenance.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "80" Avira.Spotlight.Bootstrapper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Adress Avira.SystemSpeedup.Maintenance.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\software\avast software\avast WiseCare365.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "57" Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Speedup\\Logging avira_system_speedup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "49" Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "60" Avira.Spotlight.Bootstrapper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\UpdateBridgeEnvironment Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup avira_system_speedup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Type = 00004a0052005200 Avira.SystemSpeedup.Maintenance.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "3" Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\software\WOW6432Node\avira\antivir desktop WiseCare365.exe Key opened \REGISTRY\MACHINE\software\WOW6432Node\avast software\avast WiseCare365.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\InstallProgress = "75" Avira.Spotlight.Bootstrapper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\MixpanelCommonProperties = "AAEAAAD/////AQAAAAAAAAAEAQAAAOIBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuRGljdGlvbmFyeWAyW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldLFtTeXN0ZW0uT2JqZWN0LCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAHVmVyc2lvbghDb21wYXJlcghIYXNoU2l6ZQ1LZXlWYWx1ZVBhaXJzAAMAAwiSAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkdlbmVyaWNFcXVhbGl0eUNvbXBhcmVyYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dCOYBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuS2V5VmFsdWVQYWlyYDJbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dW10TAAAACQIAAAAlAAAACQMAAAAEAgAAAJIBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuR2VuZXJpY0VxdWFsaXR5Q29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0AAAAABwMAAAAAAQAAABMAAAAD5AFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5LZXlWYWx1ZVBhaXJgMltbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLk9iamVjdCwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0E/P///+QBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuS2V5VmFsdWVQYWlyYDJbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dAgAAAANrZXkFdmFsdWUBAgYFAAAAAyRvcwYGAAAAB1dpbmRvd3MB+f////z///8GCAAAAAskb3NfdmVyc2lvbgYJAAAACjEwLjAuMTkwNDEB9v////z///8GCwAAAAtPcyBMYW5ndWFnZQYMAAAABWVuLVVTAfP////8////Bg4AAAALT3MgUGxhdGZvcm0GDwAAAAN4NjQB8P////z///8GEQAAAAxzaGEyX3N1cHBvcnQIAQEB7v////z///8GEwAAABYuTkVUIEZyYW1ld29yayBWZXJzaW9uCRQAAAAB6/////z///8GFgAAAApQcm9jZXNzIElECAjkAgAAAen////8////BhgAAAASQ29tcGF0aWJpbGl0eSBNb2RlCRkAAAAB5v////z///8GGwAAAAthY3Nfc3VwcG9ydAgBAQHk/////P///wYdAAAADUV4cGVyaW1lbnRJZHMJHgAAAAHh/////P///wYgAAAAEEV4cGVyaW1lbnRHcm91cHMJIQAAAAHe/////P///wYjAAAAD0Rvd25sb2FkIFNvdXJjZQYkAAAACHBzc3Bkd3dzAdv////8////BiYAAAAJQnVuZGxlIElEBicAAAAFYXN1NzAB2P////z///8GKQAAABRCb290c3RyYXBwZXIgVmVyc2lvbgYqAAAACjEuMC40OS43MjcB1f////z///8GLAAAAAZBY3Rpb24GLQAAAAdJbnN0YWxsAdL////8////Bi8AAAAHUnVuTW9kZQYwAAAAB0RlZmF1bHQBz/////z///8GMgAAAAZTaWxlbnQIAQABzf////z///8GNAAAAApTZXNzaW9uIElEBjUAAAAgYmNkNTIzZTM1NGMxNGMxNGE4MzY1ZjVlZDNmM2Y4NzYByv////z///8GNwAAABJTcG90bGlnaHQgTGFuZ3VhZ2UJDAAAAAQUAAAADlN5c3RlbS5WZXJzaW9uBAAAAAZfTWFqb3IGX01pbm9yBl9CdWlsZAlfUmV2aXNpb24AAAAACAgICAQAAAAIAAAA//////////8RGQAAAAIAAAAGOQAAABJEZXRlY3RvcnNBcHBIZWFsdGgGOgAAAAlJbnN0YWxsZXIRHgAAAAEAAAAGOwAAABNzcG90bGlnaHRvbmJvYXJkaW5nESEAAAABAAAABjwAAAAEdGVzdAs=" Avira.Spotlight.Bootstrapper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Bootstrapper\UpdateBridgeEnvironment Avira.Spotlight.Bootstrapper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\Download avira_system_speedup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\Expiration Avira.SystemSpeedup.Maintenance.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\General\SimulationMode Avira.SystemSpeedup.Maintenance.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\OptimizerHost avira_system_speedup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup\MyA\Check = 54000b000600060007000200040053000500050003000600000000000700550053000300040009000400550056000500510003005d0006005600080000000f00 Avira.SystemSpeedup.Maintenance.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccbpbkebodcjkknkfkpmfeciinhidaeh\7.21.0_0\manifest.json chrome.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Windows\Downloaded Program Files\desktop.ini WiseCare365.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Avira.SystemSpeedup.Core.Common.Starter.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: WiseCare365.exe File opened (read-only) \??\J: WiseCare365.exe File opened (read-only) \??\K: WiseCare365.exe File opened (read-only) \??\M: WiseCare365.exe File opened (read-only) \??\S: WiseCare365.exe File opened (read-only) \??\V: WiseCare365.exe File opened (read-only) \??\I: WiseCare365.exe File opened (read-only) \??\L: WiseCare365.exe File opened (read-only) \??\O: WiseCare365.exe File opened (read-only) \??\F: Avira.SystemSpeedup.Maintenance.exe File opened (read-only) \??\P: WiseCare365.exe File opened (read-only) \??\Q: WiseCare365.exe File opened (read-only) \??\R: WiseCare365.exe File opened (read-only) \??\U: WiseCare365.exe File opened (read-only) \??\Y: WiseCare365.exe File opened (read-only) \??\Z: WiseCare365.exe File opened (read-only) \??\G: WiseCare365.exe File opened (read-only) \??\H: WiseCare365.exe File opened (read-only) \??\N: WiseCare365.exe File opened (read-only) \??\T: WiseCare365.exe File opened (read-only) \??\W: WiseCare365.exe File opened (read-only) \??\X: WiseCare365.exe -
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 WiseCare365.exe -
Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 Avira.OptimizerHost.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt WiseCare365.exe File opened for modification C:\Windows\System32\LogFiles\Scm\SCM.EVM.3 WiseCare365.exe File opened for modification C:\Windows\System32\LogFiles\Scm\SCM.EVM.2 WiseCare365.exe File opened for modification C:\Windows\System32\LogFiles\Scm\SCM.EVM.1 WiseCare365.exe File opened for modification C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{8fd09d9f-c958-462f-afe6-cef7e5a2714a}\snapshot.etl WiseCare365.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749 WiseCare365.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\addinutil.exe.log WiseCare365.exe File opened for modification C:\Windows\System32\SleepStudy\ScreenOn\ScreenOnPowerStudyTraceSession-2024-10-07-09-03-05.etl WiseCare365.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 WiseCare365.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_3A926AE3653F6808623E655D67F31779 Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_3A926AE3653F6808623E655D67F31779 Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache Avira.OptimizerHost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 Avira.OptimizerHost.exe File opened for modification C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{bec041e9-377d-477b-bdc1-22da7aafc61c}\snapshot.etl WiseCare365.exe File opened for modification C:\Windows\System32\SleepStudy\ScreenOn\ScreenOnPowerStudyTraceSession-2024-10-07-09-06-23.etl WiseCare365.exe File opened for modification C:\Windows\System32\SleepStudy\ScreenOn\ScreenOnPowerStudyTraceSession-2024-10-07-09-04-11.etl WiseCare365.exe File opened for modification C:\Windows\system32\FNTCACHE.DAT WiseCare365.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 WiseCare365.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\resources.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUCD3F.tmp\msedgeupdateres_iw.dll MicrosoftEdgeWebView2RuntimeInstallerX64.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\bn-IN.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\msedge_proxy.exe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Trust Protection Lists\Sigma\Advertising setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Trust Protection Lists\Sigma\Analytics setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\VisualElements\LogoDev.png setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\es.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\Locales\kn.pak setup.exe File created C:\Program Files (x86)\Avira\Security\is-J00L7.tmp avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-QI0EV.tmp WiseCare365_7.0.9.691.tmp File created C:\Program Files (x86)\Microsoft\Temp\EUCD3F.tmp\msedgeupdateres_bs.dll MicrosoftEdgeWebView2RuntimeInstallerX64.exe File created C:\Program Files (x86)\Microsoft\Temp\EUCD3F.tmp\msedgeupdateres_kok.dll MicrosoftEdgeWebView2RuntimeInstallerX64.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Edge.dat setup.exe File created C:\Program Files (x86)\Avira\System Speedup\x86\is-7GMDF.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Wise\Wise Care 365\headers\is-HORGE.tmp WiseCare365_7.0.9.691.tmp File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\eventlog_provider.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\az.pak setup.exe File created C:\Program Files (x86)\Avira\Security\is-BUKH1.tmp avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Avira\System Speedup\is-GG2D8.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-QE2C3.tmp WiseCare365_7.0.9.691.tmp File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\show_third_party_software_licenses.bat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Trust Protection Lists\Sigma\Social setup.exe File created C:\Program Files (x86)\Avira\System Speedup\is-54CBG.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\System Speedup\de-DE\is-8OCJN.tmp avira_system_speedup.tmp File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Trust Protection Lists\Sigma\Entities setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\identity_proxy\win10\identity_helper.Sparse.Beta.msix setup.exe File created C:\Program Files (x86)\Avira\Security\is-0FG3F.tmp avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Avira\System Speedup\Help\is-H14CC.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\identity_helper.exe setup.exe File created C:\Program Files (x86)\Avira\Security\is-N7JNN.tmp avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Avira\System Speedup\is-SV594.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\System Speedup\ja-JP\is-HHS0O.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Avira\System Speedup\pl-PL\is-32GJU.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Wise\Wise Care 365\unins000.dat WiseCare365_7.0.9.691.tmp File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\nb.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\qu.pak setup.exe File created C:\Program Files (x86)\Avira\Security\is-TPO3P.tmp avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Avira\System Speedup\is-INO7K.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Microsoft\Temp\EUCD3F.tmp\MicrosoftEdgeComRegisterShellARM64.exe MicrosoftEdgeWebView2RuntimeInstallerX64.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\en-GB.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\msedge.dll.sig setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\libGLESv2.dll setup.exe File created C:\Program Files (x86)\Avira\Security\is-OKBBT.tmp avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Avira\Security\is-1VOTN.tmp avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Update\ja-JP\is-JV24L.tmp avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Update\fr-FR\is-0EUA8.tmp avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Wise\Wise Care 365\headers\is-CFE0L.tmp WiseCare365_7.0.9.691.tmp File created C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-GDUSI.tmp WiseCare365_7.0.9.691.tmp File created C:\Program Files (x86)\Wise\Wise Care 365\Languages\is-V1P2A.tmp WiseCare365_7.0.9.691.tmp File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\identity_proxy\win11\identity_helper.Sparse.Canary.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\v8_context_snapshot.bin setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\wdag.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\edge_feedback\mf_trace.wprp setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUCD3F.tmp\psuser_64.dll MicrosoftEdgeWebView2RuntimeInstallerX64.exe File created C:\Program Files (x86)\Microsoft\Temp\EUCD3F.tmp\msedgeupdateres_el.dll MicrosoftEdgeWebView2RuntimeInstallerX64.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Locales\as.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\msedgewebview2.exe setup.exe File created C:\Program Files (x86)\Avira\Security\is-8LRGA.tmp avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Avira\System Speedup\sdf\is-LP7F3.tmp avira_system_speedup.tmp File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\resources.pak setup.exe File created C:\Program Files (x86)\Avira\Security\unins000.dat avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Avira\Security\is-0D3LH.tmp avira_spotlight_setup_psspdwws.tmp File created C:\Program Files (x86)\Avira\System Speedup\id-ID\is-LI54B.tmp avira_system_speedup.tmp -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\FontCache-FontSet-S-1-5-18.dat WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearmhelper.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_vcomp100_x64 WiseCare365.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\FontCache-System.dat WiseCare365.exe File opened for modification C:\Windows\panther\UnattendGC\setuperr.log WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\dummy.dic WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ccme_asym.dll WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100esn_x64 WiseCare365.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\Appdata\Local\Microsoft\Windows\DeliveryOptimization\Logs\domgmt.20241007_160331_870.etl WiseCare365.exe File opened for modification C:\Windows\Logs\WindowsUpdate\WindowsUpdate.20241007.090748.419.1.etl WiseCare365.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\logs\edb00005.log WiseCare365.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\logs\edb.log WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDFImpl64.dll WiseCare365.exe File opened for modification C:\Windows\Logs\waasmedic\waasmedic.20241007_090801_762.etl WiseCare365.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\FontCache-S-1-5-18.dat WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\icucnv40.dll WiseCare365.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.log WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\dummy.aff WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AGM.dll WiseCare365.exe File opened for modification C:\Windows\debug\NetSetup.LOG WiseCare365.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.log WiseCare365.exe File opened for modification C:\Windows\inf\setupapi.dev.log WiseCare365.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\logs\edb00007.log WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\QRCode.pmp WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100chs_x64 WiseCare365.exe File opened for modification C:\Windows\Logs\MoSetup\UpdateAgent.Old.log WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\a3dutils.dll WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86 WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100fra_x64 WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100cht_x64 WiseCare365.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Flash.mpp WiseCare365.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log WiseCare365.exe File opened for modification C:\Windows\Logs\CBS\CbsPersist_20241201200313.log WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_difr.x3d WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ahclient.dll WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100esn_x86 WiseCare365.exe File opened for modification C:\Windows\lsasetup.log WiseCare365.exe File opened for modification C:\Windows\panther\setuperr.log WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\comments.aapp WiseCare365.exe File opened for modification C:\Windows\security\logs\scesetup.log WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\tesselate.x3d WiseCare365.exe File opened for modification C:\Windows\Logs\SIH\SIH.20241201.200328.204.1.etl WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86 WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\WindowsMedia.mpp WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\weblink.api WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\DigSig.api WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrord32res.dll WiseCare365.exe File opened for modification C:\Windows\Logs\MoSetup\ActionList.xml WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E39B69A3F3677E14587CF1C3CC73FE72\48.108.8828\fileCoreHostExe WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\symbol.txt2 WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll_Apollo WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100deu_x86 WiseCare365.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\logs\edb0000D.log WiseCare365.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\Appdata\Local\Microsoft\Windows\DeliveryOptimization\State\migration.dat.LOG1 WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\JP2KLib.dll WiseCare365.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeLinguistic.dll WiseCare365.exe File opened for modification C:\Windows\Logs\WindowsUpdate\WindowsUpdate.20241007.093058.014.1.etl WiseCare365.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5500 sc.exe 5580 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 45 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WiseCare365_7.0.9.691.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_spotlight_setup_psspdwws.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_system_speedup.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.OptimizerHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WiseCare365_7.0.9.691.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACSSignedIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.SystemSpeedup.Core.Common.Starter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira_Optimizer_Host.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.OptimizerHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BootTime.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_system_speedup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.SystemSpeedup.Maintenance.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACSSignedIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WiseCare365.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WiseTray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_spotlight_setup_psspdwws.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.Spotlight.Bootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeWebView2RuntimeInstallerX64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.Spotlight.Bootstrapper.ReportingTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.SystemSpeedup.Maintenance.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira_Optimizer_Host.tmp -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 6912 MicrosoftEdgeUpdate.exe 7296 MicrosoftEdgeUpdate.exe 2028 MicrosoftEdgeUpdate.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x000a000000023ffb-4395.dat nsis_installer_1 behavioral1/files/0x000a000000023ffb-4395.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies Control Panel 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop WiseCare365.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Mouse WiseCare365.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "5000" WiseCare365.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WaitToKillAppTimeout = "10000" WiseCare365.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Mouse\mousehovertime = "100" WiseCare365.exe Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ForegroundLockTimeout = "0" WiseCare365.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WindowMetrics\MinAnimate = "0" WiseCare365.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WindowMetrics WiseCare365.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\LowLevelHooksTimeout = "4000" WiseCare365.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\HungAppTimeout = "3000" WiseCare365.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\AutoEndTasks = "1" WiseCare365.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\MenuShowDelay = "0" WiseCare365.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Avira.OptimizerHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols = "2688" avira_system_speedup.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates Avira.OptimizerHost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133775569861708582" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings avira_system_speedup.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Avira.OptimizerHost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings WiseCare365.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs Avira.OptimizerHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Avira.OptimizerHost.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\ = "Microsoft Edge Update Legacy On Demand" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.39\\psmachine.dll" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7931E4D-82F7-486C-9FFB-E44AB90B021F}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.ms-lockscreencomponent-primary WiseCare365.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\PROGID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.rwz\OpenWithProgids WiseCare365.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.msixbundle WiseCare365.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\InprocServer32\Class = "Avira.SystemSpeedup.UI.ShellExtension.SystemSpeedupContextMenu+SystemSpeedupDesktopMenu" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "Microsoft Edge Update Legacy On Demand" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\1.0.0.0\Assembly = "Avira.SystemSpeedup.UI.ShellExtension, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" RegAsm.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.stl WiseCare365.exe Key deleted \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.glb\OpenWithProgids WiseCare365.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7931E4D-82F7-486C-9FFB-E44AB90B021F} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{C7931E4D-82F7-486C-9FFB-E44AB90B021F}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{14CB2BD0-2375-3D10-9B5D-5E18865C8959}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Avira/System Speedup/Avira.SystemSpeedup.UI.ShellExtension.DLL" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\Assembly = "Avira.SystemSpeedup.UI.ShellExtension, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{700866BB-C8E9-3E71-B359-ABB28BAED0E8}\InprocServer32\1.0.0.0\Assembly = "Avira.SystemSpeedup.UI.ShellExtension, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CAB5786-30E8-3185-9B3B-CCEFBF1B8AFE}\Implemented Categories RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook" MicrosoftEdgeUpdateComRegisterShell64.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e40f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a00300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a03000000010000001400000002faf3e291435468607857694df5e45b688518680f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 03000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343120000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 0f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343120000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f2000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c000000010000000400000000100000040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 19000000010000001000000091fad483f14848a8a69b18b805cdbb3a0f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343114000000010000001400000055e481d11180bed889b908a331f9a1240916b97020000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b03000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b03000000010000001400000002faf3e291435468607857694df5e45b68851868140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 14000000010000001400000055e481d11180bed889b908a331f9a1240916b970030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d34310f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d820000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e40f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Bootstrapper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Avira.Spotlight.Bootstrapper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c0000000100000004000000001000000400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Bootstrapper.exe -
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 757905.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 559864.crdownload:SmartScreen msedge.exe File created C:\Users\Admin\AppData\Local\Temp\.CR.13089\avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe\:SmartScreen:$DATA avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3412 NOTEPAD.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3852 schtasks.exe 7120 schtasks.exe 5364 schtasks.exe 7712 schtasks.exe 5908 schtasks.exe 388 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1448 chrome.exe 1448 chrome.exe 548 msedge.exe 548 msedge.exe 3456 msedge.exe 3456 msedge.exe 5724 identity_helper.exe 5724 identity_helper.exe 5448 msedge.exe 5448 msedge.exe 5676 chrome.exe 5676 chrome.exe 5676 chrome.exe 5676 chrome.exe 3516 msedge.exe 3516 msedge.exe 3516 msedge.exe 3516 msedge.exe 2532 msedge.exe 2532 msedge.exe 3180 WiseCare365_7.0.9.691.tmp 3180 WiseCare365_7.0.9.691.tmp 6012 WiseCare365.exe 6012 WiseCare365.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 5336 WiseTray.exe 5336 WiseTray.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 740 Avira.Spotlight.Bootstrapper.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe 5336 WiseTray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5472 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
pid Process 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 3456 msedge.exe 5336 WiseTray.exe 5336 WiseTray.exe 5472 taskmgr.exe 5472 taskmgr.exe 5472 taskmgr.exe 5472 taskmgr.exe 5472 taskmgr.exe 5472 taskmgr.exe 5472 taskmgr.exe 5472 taskmgr.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 928 avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe 8076 MicrosoftEdgeWebView2RuntimeInstallerX64.exe 3600 MicrosoftEdgeUpdate.exe 6288 MicrosoftEdgeUpdate.exe 7952 MicrosoftEdgeUpdate.exe 6912 MicrosoftEdgeUpdate.exe 1652 MicrosoftEdgeUpdate.exe 6896 avira_spotlight_setup_psspdwws.exe 1852 avira_spotlight_setup_psspdwws.tmp 6620 avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe 5960 avira_system_speedup.exe 3224 avira_system_speedup.tmp 7780 RegAsm.exe 2640 Avira_Optimizer_Host.exe 7996 Avira_Optimizer_Host.tmp 4484 Avira.OptimizerHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1448 wrote to memory of 2432 1448 chrome.exe 88 PID 1448 wrote to memory of 2432 1448 chrome.exe 88 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 4584 1448 chrome.exe 89 PID 1448 wrote to memory of 940 1448 chrome.exe 90 PID 1448 wrote to memory of 940 1448 chrome.exe 90 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91 PID 1448 wrote to memory of 2180 1448 chrome.exe 91
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\DONOTOPENINWEB.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3412
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops Chrome extension
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffccaadcc40,0x7ffccaadcc4c,0x7ffccaadcc582⤵PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1816 /prefetch:22⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2180,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2208 /prefetch:32⤵PID:940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2240 /prefetch:82⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:2756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3412,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4596,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3876 /prefetch:12⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4640,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4844 /prefetch:82⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5052,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5060 /prefetch:82⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4960,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5132 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5200,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4572 /prefetch:82⤵PID:6588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5124,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5136 /prefetch:82⤵PID:7096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5084,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5128 /prefetch:82⤵PID:6164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4756,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4776 /prefetch:82⤵PID:6404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3144,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5376 /prefetch:82⤵PID:6464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5364,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5360 /prefetch:82⤵PID:6836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5368,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5524 /prefetch:82⤵PID:1868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5128 /prefetch:82⤵PID:5728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5228,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5696 /prefetch:82⤵PID:6872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4988,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5232 /prefetch:82⤵PID:6276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5112,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5516 /prefetch:82⤵PID:6332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4840,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5424 /prefetch:82⤵PID:7484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5220,i,11402849169078415225,8743805032772106090,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5732 /prefetch:82⤵PID:6892
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3596
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4260
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcb96646f8,0x7ffcb9664708,0x7ffcb96647182⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:12⤵PID:1272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:12⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:82⤵PID:5512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵PID:5984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:12⤵PID:6064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:6072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:1636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:12⤵PID:5236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:5928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:6080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1960 /prefetch:82⤵PID:1468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1864 /prefetch:12⤵PID:5628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵PID:6120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:12⤵PID:5808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:3384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:12⤵PID:5124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:12⤵PID:1636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:12⤵PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6768 /prefetch:82⤵PID:6140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:12⤵PID:5864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:12⤵PID:5868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:12⤵PID:5668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:12⤵PID:4308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:12⤵PID:1344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:12⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7176 /prefetch:82⤵PID:5440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1440 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:12⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:12⤵PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:12⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:12⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:12⤵PID:5864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7296 /prefetch:12⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3684 /prefetch:82⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:12⤵PID:5848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8064 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7864 /prefetch:82⤵PID:6600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7980 /prefetch:82⤵PID:6780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5384 /prefetch:82⤵PID:6832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6896 /prefetch:82⤵PID:6880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7736 /prefetch:82⤵PID:6300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5332 /prefetch:82⤵PID:6820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8000 /prefetch:82⤵PID:6968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8136 /prefetch:82⤵PID:7056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,16319777807169281912,16643315411286610313,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8172 /prefetch:82⤵PID:6680
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3468
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:916
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5132
-
C:\Users\Admin\Downloads\WiseCare365_7.0.9.691.exe"C:\Users\Admin\Downloads\WiseCare365_7.0.9.691.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\is-5O0HE.tmp\WiseCare365_7.0.9.691.tmp"C:\Users\Admin\AppData\Local\Temp\is-5O0HE.tmp\WiseCare365_7.0.9.691.tmp" /SL5="$A01FE,16714807,857088,C:\Users\Admin\Downloads\WiseCare365_7.0.9.691.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3180 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /delete /tn \WiseCleaner\W365SkipUAC /f3⤵
- System Location Discovery: System Language Discovery
PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.wisecleaner.com/thanks-for-choosing-WiseCare365.html3⤵PID:5256
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcb96646f8,0x7ffcb9664708,0x7ffcb96647184⤵PID:5380
-
-
-
C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe"C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe"3⤵
- Modifies firewall policy service
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:6012 -
C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe"C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:5336
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /F "C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\*" /R /A /D Y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:7612
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\*.*" /T /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6688
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /F "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\*" /R /A /D Y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2620
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\*.*" /T /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1232
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /F "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\*" /R /A /D Y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4820
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\*.*" /T /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5340
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /F "C:\Windows\ServiceProfiles\NetworkService\Appdata\Local\Microsoft\Windows\DeliveryOptimization\Cache\*" /R /A /D Y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3392
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\ServiceProfiles\NetworkService\Appdata\Local\Microsoft\Windows\DeliveryOptimization\Cache\*.*" /T /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:8012
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /F "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\*" /R /A /D Y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6248
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\*.*" /T /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:8088
-
-
-
-
C:\Users\Admin\Downloads\avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe"C:\Users\Admin\Downloads\avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:928 -
C:\Users\Admin\AppData\Local\Temp\.CR.28962\Avira.Spotlight.Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\.CR.28962\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.28962\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:740 -
C:\Users\Admin\AppData\Local\Temp\.CR.28962\ACSSignedIC.exe"C:\Users\Admin\AppData\Local\Temp\.CR.28962\ACSSignedIC.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5504
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.28962\be641d13-f0d9-4933-ab25-c86ec1be9fd0\MicrosoftEdgeWebView2RuntimeInstallerX64.exe"C:\Users\Admin\AppData\Local\Temp\.CR.28962\be641d13-f0d9-4933-ab25-c86ec1be9fd0\MicrosoftEdgeWebView2RuntimeInstallerX64.exe" /silent /install3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:8076 -
C:\Program Files (x86)\Microsoft\Temp\EUCD3F.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUCD3F.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3600 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6288
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7952 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:6520
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:6628
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3952
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkQzMTFDQkEtODIzOS00N0EzLTlDNEYtOEQwRjQyNDYxOUI1fSIgdXNlcmlkPSJ7QTY3NzAwQzQtODY1NC00QjQ5LTgxRDctRjdDM0RFRTExREI0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswNTM3RDMzRi05QjU2LTQ5NEEtOEE4MC1DQUY3NDdEMjk1RDh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NzI3MTIwODY3IiBpbnN0YWxsX3RpbWVfbXM9Ijk1NSIvPjwvYXBwPjwvcmVxdWVzdD45⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
PID:6912
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers" /installsource offline /sessionid "{2D311CBA-8239-47A3-9C4F-8D0F424619B5}" /silent /offlinedir "{04C871E9-5B1A-4741-BEC2-B4CC6504A3AC}"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.28962\87ce22d7-7d54-4fa5-aba1-a742e944aebf\avira_spotlight_setup_psspdwws.exe"C:\Users\Admin\AppData\Local\Temp\.CR.28962\87ce22d7-7d54-4fa5-aba1-a742e944aebf\avira_spotlight_setup_psspdwws.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20241201200859570.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP /LANGUAGE=en-us /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6896 -
C:\Users\Admin\AppData\Local\Temp\is-BBA9P.tmp\avira_spotlight_setup_psspdwws.tmp"C:\Users\Admin\AppData\Local\Temp\is-BBA9P.tmp\avira_spotlight_setup_psspdwws.tmp" /SL5="$A029C,34912022,924672,C:\Users\Admin\AppData\Local\Temp\.CR.28962\87ce22d7-7d54-4fa5-aba1-a742e944aebf\avira_spotlight_setup_psspdwws.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20241201200859570.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP /LANGUAGE=en-us /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V44⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1852 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create AviraSecurityUpdater DisplayName= "Avira Security Updater" binPath= "\"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe\"" start= delayed-auto5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5500
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" description AviraSecurityUpdater "Avira Security Updater"5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5580
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Update /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-8GSP1.tmp\UpdateFallbackTask.xml"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:388
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Service_SCM_Watchdog /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-8GSP1.tmp\WatchdogServiceControlManagerTimeout.xml"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3852
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Systray /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-8GSP1.tmp\SystrayAutostart.xml"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:7120
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Maintenance /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-8GSP1.tmp\MaintenanceTask.xml"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5364
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.28962\c8b57f24-2e1d-47d9-b9cd-d4440262bacb\avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe"C:\Users\Admin\AppData\Local\Temp\.CR.28962\c8b57f24-2e1d-47d9-b9cd-d4440262bacb\avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe" Action=RegisterFallbackUpdater AllowMultipleInstances=true UnpackInCurrentDirectory=true3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6620 -
C:\Users\Admin\AppData\Local\Temp\.CR.28962\c8b57f24-2e1d-47d9-b9cd-d4440262bacb\.CR.28782\Avira.Spotlight.Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\.CR.28962\c8b57f24-2e1d-47d9-b9cd-d4440262bacb\.CR.28782\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.28962\c8b57f24-2e1d-47d9-b9cd-d4440262bacb\.CR.28782\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira_en_asu70_346305402-1733083451-1733083451-1__psspdwws.exe Action=RegisterFallbackUpdater AllowMultipleInstances=true4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\.CR.28962\c8b57f24-2e1d-47d9-b9cd-d4440262bacb\.CR.28782\ACSSignedIC.exe"C:\Users\Admin\AppData\Local\Temp\.CR.28962\c8b57f24-2e1d-47d9-b9cd-d4440262bacb\.CR.28782\ACSSignedIC.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1488
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN "Avira_Security_Installation"4⤵
- System Location Discovery: System Language Discovery
PID:4656
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.28962\c8b57f24-2e1d-47d9-b9cd-d4440262bacb\.CR.28782\Avira.Spotlight.Bootstrapper.ReportingTool.exe"C:\Users\Admin\AppData\Local\Temp\.CR.28962\c8b57f24-2e1d-47d9-b9cd-d4440262bacb\.CR.28782\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackUnsentEvents4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1552
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.28962\8759e5ca-7418-46e6-b03d-a903b98407d1\avira_system_speedup.exe"C:\Users\Admin\AppData\Local\Temp\.CR.28962\8759e5ca-7418-46e6-b03d-a903b98407d1\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG="C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20241201200911604.log" /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=en-us /NOSTART /NORESTART /bundle=asu70 /download=psspdwws /Spotlight3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\is-OL292.tmp\avira_system_speedup.tmp"C:\Users\Admin\AppData\Local\Temp\is-OL292.tmp\avira_system_speedup.tmp" /SL5="$8029A,35719479,916992,C:\Users\Admin\AppData\Local\Temp\.CR.28962\8759e5ca-7418-46e6-b03d-a903b98407d1\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG="C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20241201200911604.log" /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=en-us /NOSTART /NORESTART /bundle=asu70 /download=psspdwws /Spotlight4⤵
- Checks computer location settings
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3224 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /F /TN AviraSystemSpeedupRemoval5⤵
- System Location Discovery: System Language Discovery
PID:5076
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7780
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo5⤵
- Modifies registry class
PID:7872
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe" -umh5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
PID:3784
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\.CR.28962\8759e5ca-7418-46e6-b03d-a903b98407d1\avira_system_speedup.exe" "C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe"5⤵
- System Location Discovery: System Language Discovery
PID:7764
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR "\"C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe\" /VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:7712
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -validatelicense5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
PID:6432
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -initbootoptimizer5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:6556
-
-
C:\Users\Admin\AppData\Local\Temp\is-OIPC7.tmp\Avira_Optimizer_Host.exe"C:\Users\Admin\AppData\Local\Temp\is-OIPC7.tmp\Avira_Optimizer_Host.exe" /VERYSILENT5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\is-CNV24.tmp\Avira_Optimizer_Host.tmp"C:\Users\Admin\AppData\Local\Temp\is-CNV24.tmp\Avira_Optimizer_Host.tmp" /SL5="$4021E,1552217,832512,C:\Users\Admin\AppData\Local\Temp\is-OIPC7.tmp\Avira_Optimizer_Host.exe" /VERYSILENT6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:7996 -
C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe" /Install /Silent7⤵
- Sets service image path in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4484
-
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /Xml "C:\Users\Admin\AppData\Local\Temp\.CR.4578\Avira_Security_Installation.xml" /F /TN "Avira_Security_Installation"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5908
-
-
C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe"C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4964
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
PID:7172 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkQzMTFDQkEtODIzOS00N0EzLTlDNEYtOEQwRjQyNDYxOUI1fSIgdXNlcmlkPSJ7QTY3NzAwQzQtODY1NC00QjQ5LTgxRDctRjdDM0RFRTExREI0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MTQ3QTJGQTAtNEQwMy00NEM5LUJGNzUtMjhENzIzNDczODdDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNTUiIGluc3RhbGxkYXRldGltZT0iMTcyODI5Mjg2MyIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzcyNzY1NDU1NTcwMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc3MzE3ODA5NjMiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:7296
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7EBFC2A-6637-4860-9E35-B4D25C55413C}\MicrosoftEdgeWebview_X64_131.0.2903.70.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7EBFC2A-6637-4860-9E35-B4D25C55413C}\MicrosoftEdgeWebview_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:7192 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7EBFC2A-6637-4860-9E35-B4D25C55413C}\EDGEMITMP_6312F.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7EBFC2A-6637-4860-9E35-B4D25C55413C}\EDGEMITMP_6312F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7EBFC2A-6637-4860-9E35-B4D25C55413C}\MicrosoftEdgeWebview_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
PID:7492 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7EBFC2A-6637-4860-9E35-B4D25C55413C}\EDGEMITMP_6312F.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7EBFC2A-6637-4860-9E35-B4D25C55413C}\EDGEMITMP_6312F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.86 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7EBFC2A-6637-4860-9E35-B4D25C55413C}\EDGEMITMP_6312F.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.70 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff618b02918,0x7ff618b02924,0x7ff618b029304⤵
- Executes dropped EXE
PID:7520
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkQzMTFDQkEtODIzOS00N0EzLTlDNEYtOEQwRjQyNDYxOUI1fSIgdXNlcmlkPSJ7QTY3NzAwQzQtODY1NC00QjQ5LTgxRDctRjdDM0RFRTExREI0fSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7ODJDMUFBN0UtQTM0MC00RjkxLTk1MjAtNTRERTRDMDQwNUIxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O2NCWUVZWDg3MXRzR3VLSmFvNjNYalV0NXZKRTlYeENUbkU3SDBQZ1VqS0U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzMS4wLjI5MDMuNzAiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc3NDAxODI0OTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NzQwNjUxMzMwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzc2MjMxNjg5NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc3ODAxMjMyNTYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjgzOTk2MTYwOTEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIxNiIgZG93bmxvYWRlZD0iMTc2NjIyMTYwIiB0b3RhbD0iMTc2NjIyMTYwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMSIgaW5zdGFsbF90aW1lX21zPSI2MTk0MyIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2028
-
-
C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5608
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:5472
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6Software Discovery
1Security Software Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD5b9d53f6dd5b806ba580115242a8562f5
SHA1921905c004ae4dc038fd00d867c1784dfed2c115
SHA2564f0bf6c14e4abd50a3ddaf078063c8168c529e6fb26b258f3dfa05a1722e10be
SHA51272e53484c5405d812ad94aa90a508c2a342894a484af24ed5935683844fad1b1576f8271310128db613ac0a63035dda9653d130a59f034740d24b4a1e188a1f5
-
Filesize
451KB
MD512f5d0daf6da438c9165729cfa3b5504
SHA10b6758c687ebbab02b8793af906d18545dc3d907
SHA256da513b45066186f3771394c37958eccf6decc4a6893ea200b87333a77e1d76d8
SHA512bb91caea8ebd536054b7d8e78eefc656c21368d07c1f57cfe7b90986052479e369405f34c57e18070e33b1091f66ae3a6cfb920823456b10f0dc9b32fa7f3035
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\System.Runtime.CompilerServices.Unsafe.dll
Filesize18KB
MD56cff1bc1824d5a17330e019b4e8052eb
SHA13319a7b426c3290e71d9e662511be220cc24b3ca
SHA2566619727ed1e81f53e2f4fb3ea31c4d73ce5e3174e67d346d5c55aa4438b25bcc
SHA51273b622007810b8a3ee9c517bf6d47186ccc4731ddcabfab92d48c137b61305c0c8505f5c3995f409e65fed97cfcac096497b5653d4f59bebff24a652818b5def
-
Filesize
27KB
MD5e9614fcfdadf7d98b6b478c1001c408f
SHA1d96abdfa11e890e6aac6d6235439b299f4e5ca92
SHA2567a6b76825981010a4943e04f78dd15b4724579b58a1dbce08e1dcf532751c4f0
SHA51241b1749e66d2bb87c08b03333ed61b784174c4deab81b1200e833a6b805c002547ae906e9502554e16a0c59bdc418537438fc54c3e9384ff7953b3f0ec01f289
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Update\de-DE\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD565f5d9db2cb9447d7c202d20d35745ff
SHA1e09975f532877fae556a3df95d31e42be3a3209e
SHA2564129857c1ebc44fe2520c7e18c8d8cd2675cd1b9fd871f3010a863309c149df0
SHA51246d6970973ee467892c08777e724c80a32484850d74b7fcd4eaaa00114ca8f8c610c64547f04c8141dd797f18ab46c76904ee6b4a91131fd8b241fff0fd242ba
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\en-US\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5c9a23c592c13b1fb7a1d3ab6ed46aec5
SHA1de1563cc959b4a1ada4fbf305c7c38d0a531bc68
SHA256a2af3c49043a5cac31389a00e4783dfddece29bbb853a7c1033195bf066ef114
SHA5120289a023214d5d57eeb7e1f3e98ebbc713ab051f87d698b56237c8c49cf20b741cd0c40bfa5cbff056344cd4f4f3acd4302a9befd1edd46ecf670a9230c97c96
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\es-ES\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5fe3af7525146c83aac42f8106af08edb
SHA17e6a4b2497e60e76cf4298f1fad0c24627882f6c
SHA256d13c2f82060e37117bc2811b940654aa4f6d5fe7614cb3eec4441fbf2fede607
SHA5120adeb8afd6132006be77c19d946f01f8c7aec413a0512803813202de51de9980efbba3df02070bf56350aa02aacd527a9a0ad9f340181b2ba9241dd7ae9fd606
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\fr-FR\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5650acbb7c5c30701ff5d6f8041ada45b
SHA1f285470b217abd8f4f355976133be1287f7b2ca7
SHA25666d0da7c1558c17dc98ade5c6165977775ba862d61395de5e78523467e2aced8
SHA512a758464383402f8cdb386f2de4e0ca6c239ae39d7cde90817003a7ebd543ffd592851f2c1f27494b9e15ba2c449a0c365d6b6597267b6297d59c7a515f64e7b7
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\it-IT\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD56feba78b1d4c91e93632a8a0cfdc4d89
SHA1fb0b03c29e9e741f8b3a97133a506df9c8ce81fe
SHA256d3206cc46451bc7e9b22e99f8f63def0b688cd817ddd30b0d2ab4be8f663c587
SHA5127531d43bf95f2a050b3ac6d660dda6478d447e8e394d15563612321bd31d18d066a580744ee75f67ea2e7a2a4bdb359668f54aaf91b68b6a161237691b929dde
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\ja-JP\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5040cea3307599765a48b5c72387329fe
SHA1bccb9b1d9f4a33e5ba727a72bcddbca324c6a4e2
SHA2564565dd3dabcd3311fb36736e8fb7ae9c19638cd83502ece53377986afaef3851
SHA5127cd24225cc7720189556072e37aae16b5c2e1dc73206c28000e68748bb14e74165e507bd45a0012d0f6c153558c965f9ce8d8b32fca90ed7ad83c5611a7a6510
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\nl-NL\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5122701eac2d49ce91a6f10ca83404f54
SHA15d870d3182a11c8b62c6bc53f4bf09df40a1448a
SHA25642c72ff30cc9e5af0dc40d11ac246024fa50befede452e28bd3d088dd365b20b
SHA5125c5a3b2e942f2efc270c3d15cf7ea7f6507ee741c4b5a00e416cd83ddbc54043059ac63614bd23f10c4ea40367c56438d358bcb7f343d8375311a45cb4bfd70f
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\pt-BR\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD55df9d9ee5fbe6b683eefb8b6591b9a38
SHA10056ccfa1b199594f318474229c44fc03aa1ee13
SHA25621532af9e30ce98dcb5fbab874123b237f8966e37dce867e3701e806e4d745bc
SHA5120db3cf25848ecd1d626b6f88837c87ed6091848d09eb67e3abb8ffab5ead7d020bc0b74cfc422cb960935b5d727b0b8f20de18319600d75a04002fc1881ccac0
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\ru-RU\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5fcc375995550d6fe68b197ad8d84e90b
SHA13ea8aee1b0b1cabb08f2e8f3a010ffae819e4b2e
SHA256b46c6744c6d25a790afde591c6b19508c6ece4b55c90964041f3ea42798ab401
SHA512072222fb0fc8acdcad21a4945aba19369386490f90de47395cae1c29f62022d232069238d2c869c33342eaf9494176f696e4a10874c8531f0ae60406f7a34164
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\tr-TR\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5b57782918785c0ae12410ec92d495190
SHA1f6371456a8eb810577e2fa180dde57131d8ea364
SHA256911265025feb1f2d02ff5f7f8b7af0d76e541a417278ebde637005ad75cbd732
SHA512d133cafce2e416b3e76774342e6bfa78eb5f9e0126ec8a6652450388ac7dacf9c183abae2ee72b0f4f585e84b1ac8f4b59d5d7dc1754dc50ba8fdbe76a40823d
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\zh-CN\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5fc3f161ae40282b60c41582331143854
SHA1d6981b1e1e42c38ab9d55eb0454db686672b26e0
SHA25627fd20b141e962fe8054144bbc5759742554033d1fe319a874b831131b1438a3
SHA512d764d489e643715f288ea13ebd20144f0a64eedbd17ebceba4d543e23c78b18a95dc88538b193202b610a16615fb0b18672205ecf0cab52da5def58e35812c16
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\zh-TW\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD56ddfd6064f172197b362087e15fe05e4
SHA1be604c28cd49b673a31d06a75af8c70d53db7e78
SHA2569d10d3acad469f0ed9db4462fed1a523900e703e4a219e42dc6394f8a4e95896
SHA5122002aacde72f31051048bcbb087e05e5fe00766a4911bcf3cd5bcde5d9f3a1125723711ccad0e772c90c49fc6a60435158258d27eb383732b96065da1c48b81f
-
Filesize
223KB
MD555eea39b5da63cb85fbcaaa06a17370a
SHA1a4cb7909bde40d0b88c4d7bca0472cf5a3a1c2ec
SHA256938f5c8e5059c6b55f3e45621e96d677fa4d5012b80b75b37a00ac487f71171d
SHA5122b20e6d964a04b30f7756428ca19dd09dd7442fc3288275123986d0ad3d842b1ee584aa5131ecf8a335d8d7ab6deb1a9f86f05bf6419664a6915b4a7092c2d71
-
Filesize
55KB
MD5902ca6c64ad4f7782bec84b9c4dfd729
SHA10b3eead09a4a5044571dcd10a17668d7cb204cd2
SHA256669c00fddf717dc5207af1ed2284f30e2c3e7419959c7b738ead4d707e13acd3
SHA512be8aef38eeae1899deed24818d71f88b087aadd0034c880af3b443f33aec94d6f2e56678c64d05ea824be8d88af0c2530d7377b888fba66caf52bf0b63ec837e
-
Filesize
323KB
MD5aec1e8329c48929dc49de807840ee690
SHA1bfd6a23f86f135bbf6d6e1a065dcfe18c101621f
SHA2566dcb6bea0cfa4d2fb6feb577831bd4be9df7657ef63be4cdee810b647d00161e
SHA512d5f10b3ce5de09f79120023c66e4fcb7b796d09e7568daddd2f14a11d9225a73b8c1f0bd3c374b51114ca469626cef22f3c7581feb1868c49ceba53a7ebc8eef
-
Filesize
347KB
MD5838c058063b6f2701a247b44c891b6fb
SHA12e29b10344f1706f57d5b5497c1bf24048b0a851
SHA25618ca5660c060f6c1fc14e53b51a9f30ede93a82262f2822468c7e783453efb3c
SHA51258dbc1c516ff05b0299ea05cdc1cbaf59306b5299da0fca325fd702b07b4ad9035d7d9a9fcbc95c6e7a93fdc0dc53e1824ef7cdf326da596d0cdf99b7c281981
-
Filesize
1.1MB
MD59694c1fe6cf1925d0f3da6da11cc44d0
SHA1a6c43512ba7d7dc88c5ee7a8008909f24ca85d44
SHA2566cb71057135bdce45bae960b94777c9deb9d0f9a0132895d7bb8a8b242671a7e
SHA5128f769f19ed0457f5ec774b7a6221c226bf66bba54ed90240cb9f59cf4c6f3035b751ef0f651ae7318abd692e0c9a5487880858371759efdba16d938e9faa06d1
-
Filesize
6.6MB
MD58ae106f9f32723071b7d89c0dd260569
SHA1c66b0f1b5f01b0a6a8eb0dc32842983f05c992c3
SHA256c4b55f6e4150ef16f731a7b10012eecb83b5557ae45ac2b3d37b7865d69d1b26
SHA512e96e3f14239b4fd1c2e6defa65e1eb9920efcf870ad98bee872b6248ab13032976d0340f99b490d6b7034f2ac099ff4d5e613d8f46a812483b1996569bc31dd1
-
Filesize
201KB
MD59da54f5a8726349124dbdca094448a11
SHA1a80642cf316be9570494a4c74949024f5d59f042
SHA256f04efee822f9b2baf2f9b4ea576b9908804b6990497b82c549a34ba54b1b4807
SHA512d84a5ac786f8bd0eabe4b1c50c7cbac8828ed2e3eb9a064936b65f0cf07f30e7362d44bda1c95a6652708ebb94e139781acf9cf7c0bdc642620136c6d01e2d62
-
Filesize
15.3MB
MD52817853a1e88ba09f1efeaa7ef02fe2e
SHA177bae50d6c62ac8b1633a7923f8dd6005297aaf4
SHA256bfa5f787a8f9e82264db941bdf4bc8b4d2291649ff4b15655a19bbbc245043c0
SHA5121773303606420e27cebccb6499ccc4ab5728b6330a2b1e18ca8cfa2f2baf32495db74ff99d47250d36327f5c21e6f233ff795e08a83f360f4b169317955d90b6
-
Filesize
280B
MD5d8ed0b958564df20e4064a7c30c10a88
SHA199b39b1f81c8160653df7d88b0919c97398aef9b
SHA2565a7247c56960f14f58c38542bc82ccc01583d11bcc7e8c0bca3fab71dc7debf7
SHA512e489a5a8d49891cfa398ed163ee73c020437a3a0de2e42f3864a5445f7d1c2b2a293f12e163b9bcb55ef304539f316e5a0a35a108aa4fc19694c78b5684adf4d
-
Filesize
80KB
MD50858e010553615390fe9ce55427f01c1
SHA10590d6e797f39b753f5b40c0ee843ab4b432d3b5
SHA256e7a3e3cec79a67be07541959de1463518d0ccc719464b98b57a14eba149fe6ac
SHA5121922d0994f8a28088b7e17700c44b9e90391002e9eb94f7672bad91bc5f8c5eb1bfe15bf399dd7d0b139619a6737fb67a11fde8731d5b76b0c8d805fe6d538b2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\351b1472-4c3b-4780-82d3-69a66183b3ef.tmp
Filesize9KB
MD5c0a9ec1c3c0c05835d8672f641d6dae4
SHA1fec800f35b923be421168c0249f30aff01d1b56b
SHA256fc70324b8026ee5d220f0ee1dc4d4caf9a83dfc86a812a978294e965fc9e07dd
SHA5120831a07383abd7579930419a0d042c162e6a88a8d448cfe0a65a2e2237a93861f5cea96c48b6e10dac84159350aa00d50f437d92478f364f623e475cbb953cd2
-
Filesize
649B
MD5873e66279f42163e3d4c263c952453ba
SHA17e2fc0162d73c862ce9ff0b08813c2f37a3f6847
SHA2569cafc183b90b2d29c28fd4e139f5779b10a6cbb34dfc351b2ab717b4ff9f4404
SHA512637c7e8f83b60e33864b15ca3996f93ce86504570e87438370ec6e99ea9b0a2d6819c1ada9a5eebab6e77b1a5b960f5eb5b81bffa3d35aebb21afb198fc5d9ac
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\_locales\de\messages.json
Filesize191B
MD5a76f0ce2cdba56b542f72bc6da74c3c7
SHA14a2534ad0bb90b0a63acf722c22ab0cda4d412b2
SHA2565e74fd32b3600cb0123c2b18a5ab1f0bdde061c7f7e89eaa9c8ccc6c5f82773a
SHA512920f498b5fa7d0d5807b43070d88f835b5b9052f072d6cd402167893963d8583e791d6c87958f0aa21dd6fb432844e90a32965c9194f2a6df00fff6986b163db
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\_locales\en\messages.json
Filesize171B
MD50510de8efb19105d9cf1590ee922e1b1
SHA1c634fb455bc0460873503c85885d9e4581d875f8
SHA256a87b5a34595e164a31f4afda3ac03492cf5df0815f1359fa6272b07d16aeeb48
SHA512901369f9462e7f58821a986f8cd016db73a1d353397b3875dda25e0d357213b74d1eb743a9256be32cdf1cba047f9370334783997bc0d3e3a3c6d518910a0101
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\_locales\es\messages.json
Filesize173B
MD558df41f6b84356a4db5abc3d64904387
SHA12f0e3671406586868c3e9f5b4b6f9faa4fc22640
SHA25657f653830c4323726b4fe29d5875254e05ba5e0c1fd5559ed230556b367af183
SHA512e428ae21d22da396a74340ce18724ca85da55aa176712dddf3c1ab0316c222cc19bec60704650bc600fbb72a1ab46f4011d38140e886191f96a93ccb3180fd48
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\_locales\fr\messages.json
Filesize194B
MD5b9278c1b3b38fc0b7d6e020a5fac671c
SHA1d025c241c1f4773e8ce98b6da20842e5f3975534
SHA2562e1df50f291233397bdd0da219c1feef528120957300df1aeb922b8af97a6147
SHA5127b5e85471923c1146614f24343372da7001ce96d2622c2979b195d2dc93aff120f5ccb8d79c5abec752601618172ae06bf4ef13289a6600f0458edcfcb2d0e17
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\_locales\it\messages.json
Filesize188B
MD5eea4a75563337e529ec75932ee78b7b0
SHA1c19464e187f1d04cd77bfd235eda2c3eab14d7f1
SHA256fd4489e3eb61f51ee75a4c28d2e79c6d54e37e65c9b7ab41ce2124c29803037a
SHA512ba0adc29c616fc765242fb9cda17856a0ef589634eba4abd2c28d99531f4ba855f9ca5464232f851b655d9132305ae875c6eadbcad0b3d3a090e8e46d388c5da
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\_locales\pt\messages.json
Filesize199B
MD5f41b68a4f8c9d7ffba8ac5f380dff323
SHA14f33bc48bee69b479507948b973f77df4eadcbd4
SHA2564c5351a9031cd272e336412ca3631643fc82f94befea4a1a9783d2eaaf333a77
SHA5126e01d62c865fabe066ce6a14b3630102b94ff227209380bf0f43b2fc9bf4f85cb7806d92537370aa95bf541d7779cd113d65f1d778235d9c463267a7238f9478
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\_metadata\verified_contents.json
Filesize4KB
MD5ecf274ae68cfc9a8a04b06b6d550b424
SHA130d12e467de297b23e5e2666d56e87b8bf7acc40
SHA2569c7d2e325dec1286d0af305e0d02f4bb259ff7253fe9eea1bcf0b48cd39a1045
SHA5127bb80f862113c05c5e0ad55df0f6308b92588c02ee43829e114f09574ffe9e22eccfa2bfa5d89c826346fedcd5bf14a577f445f630f4b57cd8e57333b526e668
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\background.js
Filesize1.1MB
MD5e55af95b5dc4a259e4bf214ebde6479c
SHA108e67456209389b40bc1ca3f0117902aab750646
SHA256de3556a0287d583f33ce159976c77fbdfc5df41e9745bf42561c4c0951f763b5
SHA5129548373e8162343a3ad59b7c97d85b89c5db9c35979c8cd9b45f602a1abfee2f955cbffb36a512ba398ee6c517d3acc9c36c0bb06aab2996ade221be084b555e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\background.js.LICENSE.txt
Filesize1KB
MD576e4242185e4dc5c685b94177d7ab7dd
SHA1f8fa99ee4b5d70e0f72b61493390fcb4a282c296
SHA2569145d7b004e4f8e7894b2ed612440eb45d756a46b5cfd66e3784b904c057dacc
SHA512c4f6fb1035a25aab15982de501857dfe3bb6c70515303abb598cae9ffc29ca0fcd0eae67bb05340954cfecd80dc9342dd0348cc1afa6882a3b4b3794d4fe5b80
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\contentScript.css
Filesize174KB
MD58a946972598c38aa26640406e30c6a10
SHA1ceb775e5bf515f796f35371eee741b73f3826549
SHA2564dd4df96256ab874f153e2a2f43935a3f63047756af9f10c6d828d4912889174
SHA5127dbb8ce1f2bc3e8c376f45b4ea4c5fd6c15fd3c37e5af19e979f9fd13ddbef1b0e59bb7df1f90700b4b60d60313b38df8804f75158907f605c08c2899a86f7fe
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\contentScript.js.LICENSE.txt
Filesize3KB
MD585d0072ce63601702a8aac69046392df
SHA175cf9b16f86a3de6104d44376bda6c96720c121c
SHA256b420cba7020a3d8223942c1c867ac29f40b917406ea6b722639cb9f3d539f39d
SHA512a5b04a7f191b9203cfc69e39d6535199b79d0f8e2749366c0a4c7427af8dda11dcd9d3954077b4a5d4f1a939ce7cbbd5d3ec98167f5392d8dc61cbb2938569c9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\fonts\OpenSans-Bold.woff2
Filesize45KB
MD53326e4d74d3924ee1c882c29f5b571c0
SHA1074d6e274d90a1b510d6eff3a5f8d26f567c1575
SHA256c1c24d6a7ce4bd24b1f3f51ab6f74667c94263fa4b109cc3ff32f4f22848087f
SHA512b1da8a12df0c4c923aeaaf434667628b305cb85a9bf4496cb9119749fb001eb8b20929043fe1b6fddf9bcd3da68c4d3a9d6a7e8b29103a15244ad104ae64ca71
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\fonts\OpenSans-Regular.woff2
Filesize45KB
MD555835483c304eaa8477fea2c36abba17
SHA19b18ae04f11fc74d27f281737b23b45a4bad5937
SHA2564c1c2e95835201077586a3698cd47806dd18df10d32a1e6cb6aa9e47224a55e3
SHA512e816266c0c453ced7d567a9b7c4958df9c63f740105e4668b95c64a95a9073b5cacc06867e71edd558c8f2f00f289d2440911430b6e8e0f6687e6ce3316869ba
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\fonts\OpenSans-Semibold.woff2
Filesize62KB
MD508952b029e4decbc8ef9fb553cae8cea
SHA1931f5105f0e909f90bdea2e246a1a230809a699a
SHA256df0231affb521137bf135898b6ce4c2ce59a79e3e23068a673868366c7ac68bb
SHA512453eaac7086915ccbc83c9e5a4fa26df5338c149ff80f3ba1d5b0c28ba6eb10696980162ba56430d5b62fa54b5d186cf6cf806084c2f1c944b95bfae6509877a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\icons\icon128.png
Filesize8KB
MD56e424e19ac4989cd935919a904678eae
SHA11275ddc671d892f2a06571321ff1db051ff77e77
SHA256865c026aecf34b7fee40fc464cdfaf0923b79c76c7a7576f1b0f8764dd47df3c
SHA51252ac1366311867f57678bdae6726d8579d56fcb9223adc2f6c9b791f90c7ab03df907d5b0121e3a71109e5dacf900f8e0a244c68260e3b1bc588f5af11e7b3fa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\icons\icon16.png
Filesize597B
MD5d2d34592a14c4a4f546ce263e6c3c0fe
SHA198bb0f219b0007eadacfd0bdadb91c15e9568ff5
SHA25641c8a55eb2feabdd53d8160d4e33ad314ae261609f341719a8e20259d0ca1142
SHA51279df92a051c649f7eeaad7457e97b20599d46cb54abfc7a31a9421fb72ec3bc12a71804ffe55119e8d526cff9192a943d21cf40c38ca69adffa0ad5029ebed8b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\icons\icon32.png
Filesize1KB
MD5f14898a33f5602ef9efe717e157a6387
SHA1f9097ded952e1ae7ac047b1e5122cae3817b2474
SHA2567248df40759b75e84d94c13db95f218b739ecd693efef34a15f242f5254cf8ea
SHA512a15a367a1ae93411e29ebb83ef75c60d4b49ef06ee35f57c7dcc2c6110d54b94ce749293d2dd368c5e9d79e670589600d7aa98f7e797acca550cb3f3f509dc2c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\icons\icon48.png
Filesize2KB
MD5c933f282958d8453a9d9fa0f7153aca1
SHA1c1eefd1ae90b60fbc1f7e3c924bbd6a7b4af0284
SHA25697dfcdf1e3f75665cc94fa35706cdc9e54066788249000cec0681058081ab27c
SHA512fa11b932ab88792d539ffb4e67b67229cdcd4cc216bf67fdf7a4b6c17d0f2ad319d2249c58060aaf8f7a49b1d03508ed95f14fe3f42f57e6d77488bd0a6df36b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\icons\iconDisabled16.png
Filesize599B
MD56320ccc0694e447ffc0982dcd8cc946f
SHA125a19cf9ac46daede3e11cd59e4fc2d64259ac9e
SHA25656b3b78b00474e5297784bef8545272be7b0a154366ffcc48ef8927738930d9b
SHA512a93c5a521de27c9b346391b778f048b980e68815a1d05bb31fa963ef889da32b474556d600acb1b93c6ac93bfcc9641fa83e02a922568f8d1feeefa8715cfaab
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\icons\iconDisabled32.png
Filesize1KB
MD5d87fd83845b05f9a2bab7d649789ee98
SHA1607eb59036192e06aa3dac00a8e4810295254d7b
SHA256601b503e3cdd17df5b10a791e4e1cbac839cbf41ac7d484e972e213c94129078
SHA5123a8752403e36a1fcc7ce165543ecf6c5c328f7da951fd63e2fa89b18de09dd2f256e4af3721e69e3c2ea52978bd64e6743ebecc7b9c306ce48a8641bac07324f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\manifest.json
Filesize1KB
MD50511643d300c1387b83beafa86ef3b82
SHA1da5a92a1660a648d6f5d19a021ebed24a110d017
SHA25680c83ae7ca1b464940724c12d8a9dbf491923cde8ba1f6b69169ab4c5e343ada
SHA512bc6981cc549790ef429f22523647c9362e2bac5195b3d2fd7683e52022d3f52e45ff81f57767f593c3401f962c40910512ab92b62221589c5172ac6d5be8ae8f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\popover.html
Filesize179B
MD549a7b2740cad481349629fdada7cd28a
SHA1c4cc9c878ca6a036ce273ba743ed558a62fc0b83
SHA256d8a1e2839a14509c2f61845849a2397b8ba3aa4762416dc335b879a812a60305
SHA512074dddfea2b17b03d3663257f4bc68912d41fe504526edceab5583499c62c59e83c69d20f51be115b9a9fdb8c4cbc14e3011704d5745b347e83389f0237dda7c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_1436579109\CRX_INSTALL\siteScript.js
Filesize175KB
MD57e197a58031eb1dd421379957e4acace
SHA126891a01c3ac1986a8f095579476f340e4159df5
SHA25614b64d90931b13bc7d46c199daf58ee52a04933cb07ca594626ce97ea2aacae5
SHA5127ea5a8235f56fbe072de30edc4af061d7ab93765063877a66ef0c90aa318934485c16298c3108f4aaa9325b393559973b32e0e3127e1e9f7198a349168de113d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_460271819\CRX_INSTALL\js\content\content-inject.js
Filesize1KB
MD5bd4bb689c6beda2ad56c815d1e2fedb4
SHA1d2e964264b579fbfb69f47abb5bd5a4d517c3b13
SHA256b6481b6bde8523b5884befa2160ee25b353c219945e765dce88926251a76dcaf
SHA5120c2bb6cb1fc49d0274d4cf9aa84bd26fb249adf710e6a656600657746fcfefedefa64528e7070b759ded171d694ed5fee90d914b4a32dccdc7874163a63bbbab
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir1448_460271819\CRX_INSTALL\js\content\iframe_content.js
Filesize31KB
MD5a0259d6fd3e6ca6fc1bb62b5a4c1e54c
SHA1c05ebf04bac7ee20b2737b7f280e76d705d6421c
SHA256d66779199d0f564d91fa0fd56b6bd43d41d75f29be4810f2e8951e7a1214cd0e
SHA5124161d3da7e188eed393e00f0c205baa2ec19668ced8590e124e306bebd5f7e9f51adeba77df389fd341989d45e4072c7eb1f37ecb3058b5ba6e7a140c3bc21b2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\caljgklbbfbcjjanaijlacgncafpegll\2.21.0.4979_0\_locales\en\messages.json
Filesize149B
MD5df3f22c1eaa295e15d92284fa3d018f6
SHA1ad602e6540d59c8e817196c2f70074863ed44a35
SHA256a82bb22aa3fdf01214124cdd56d1d47a9508e57ef05cf64379bb41615a4104e6
SHA5126068ee6f412b08cf81428dee3659cba33d1b5ecddcf1acc25ce2a158c607452dc6961d925df3af83b8766fd817906175594b39b1a396e993589b916abb6aa162
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\caljgklbbfbcjjanaijlacgncafpegll\2.21.0.4979_0\manifest.json
Filesize2KB
MD5810a0cdbefd4b267c54b3a7481290a8e
SHA1b9741fee41ce0b269800676e405300ff280cc95d
SHA2569d9f6e076c983564ac9380aee1af777118e3102f5ee010f6f7f0aa493fd964c8
SHA512aab94be3969ad4dd82ca758e2fc332a3e13fb26d9329b48458b004a9574c2d3925f8053aee66868d055f77abe6c8a35eabee1ddf98218d24f2fbcc98c775e639
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk\4.3.0.2568_0\_locales\en\messages.json
Filesize247B
MD516a706ae1fbc72e86de7cffecdf2c24a
SHA16510e8aaa9b8e5d1d249c4a056255797d9632b3f
SHA256daca358f3c9911fe3d82f87a1544e8265fbd19250f19e84fe43b3ccf060ecd2e
SHA512abfaeb0db06fa8ccc802a0465c0fc34031284c615cfa9682066c369c2a89c19e807c8ab473e888a753d134fcaf1b0521a21c6904d9d4b64655337e7adf3a4931
-
Filesize
2KB
MD51a8d54b90efe840c7691e00e0bb11149
SHA1f95d765e66c7cf7c46567348357a2f71f6bd61a5
SHA256047b9f4ec044b643d7841cebafe6ce5425df3911752e0cf4458770b514bd3ca2
SHA51291cba48f492cd3bd77e0ee4ae74395ec6229cc4678ec2cb92f7328e026a53ebc434f69b76f254467a334b2799bfcf596e88df9bcf44516da8aba236385e0c55e
-
Filesize
1KB
MD542fbf2a40104045e614592a1a2ae7c4d
SHA142649dc7607b87aca67c4d6e4586ae11438568cd
SHA2562ede2591de06ffcafdee58b36e3eb23b038028268155582e8d40ddf15bd205d0
SHA512acc3359088306132de24b093c4e1f88d6b3a1225ccaec6109867062ee3ad07b1e5393337eaa509c1409da58a97aa4558602970040f998073bdb72f1d7d9baa48
-
Filesize
2KB
MD5c791686a2a58344839aa74465425c6a2
SHA10b0a9dfa2ce1ac86d9564343e027f9de13cc97fa
SHA256a2175cf96c465066cf91e61e32f80409a884095a4e213243b3d328a5f9ba8640
SHA512a56eebbd3798009800c6097ed4338c4258202a3e8df869a02e6f5c4f7d54c7403bc7d3fada0d1b9a31fda60eadd6621ad79ee990c22f252bffda5e331d4ace83
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5fc06b3fb78f74c987f15d5a7c36b33af
SHA109ff3198e391bb538d2fe24add4c4a3150a42760
SHA2569c3ea55a710fda662cc33256cd99245d2c01c6b360e8a4439fb437febee43762
SHA512f8e1239995f6408ef55134f409f77df89379f13a0b7f8d9ed3409aff0a9be9a3dcdea7d7b4a6094722f7024ba164a1c80ec44a183ec222144ddf8a415cefc75b
-
Filesize
9KB
MD51d5353c35240beb3765380ee981db157
SHA185bfafb99f15242f827aa3bb06619549ce1affb5
SHA25652b61d4f846399cde76b6072729fe570f32e7e35e2471785911348a134fdec32
SHA5128dcf19406853508e5350f2b035f32356314c3184de529eeabc1538c99499267dd0b2e1678ee78358c4255d5134bcb4bfc480106f672d9b3bc6a8f26e2db968ed
-
Filesize
9KB
MD5f59ccac0bbc8cd3a349ea22dc9f64088
SHA1a13016d99798312914b0cf34586040340d4576c0
SHA256478e4dd63a749b8a910713a3bb482baf594eb9266fe195b557046df0f6b5612d
SHA512469bea8a0ec93a484f12301509e7bf9898ff8bd7ef5bc99edba8ea03188050a8afeee2a0535c4dad24cb17921f8850243e0d89ea723d56e218a5b20c6bc9e198
-
Filesize
9KB
MD52b3f7b2f806931452b239ec25d010bdd
SHA1ad829599778a2895b9e64537d05d8f63a22ba636
SHA2562d01070df0644a03c05f97b97341d8a699712a155612ec89642564238d9641bb
SHA5124cde4e0d7e1c9d8e4247464157681ee05f1898e35ded2bcaa39f89af27189bbcbc87abf7f5717364183ae1cd554b8c4c678d277cdba51a898dc5cef75f96ae32
-
Filesize
9KB
MD5683c2cc82ce35be45f0aaa7d350c6bff
SHA1805384dbc5af3eeaaeaa47856101baf456f17d60
SHA256e5adf54570cf6a8f7aafd2e6fa85133c8bb6855dd11f0f363a61b837cb092402
SHA512e7c3f27e2ecd6ccf8d796138f156fab7189b7195710466d4f8df1d6cb82ca1595b6d2d016a013bb3edc901822fab36d0f749212ccca48717725478aa0875cf0e
-
Filesize
9KB
MD5a423ad9419a38f9adcf243cee394aa19
SHA126100a6ce95d988dbc47219817fb3c791723f6fa
SHA256b9353de7411fe78c7fe37757aded8029055f576760b5b05b64e5017d27467c17
SHA51218edd3821468eb83b5e81055842ab021a336f4de0dc8469a894ad3a5acfc1c0e0089526f606b26d06d4868eaafef27f2991679cec2c503187af1d5567fe9d0b3
-
Filesize
9KB
MD59370396b4308a679093fbe1f77175dda
SHA1df2fa420ae35893bfb9228237cf34fd17e127a54
SHA256720bf143aa8c723f1f9d1eed229a48f047a2a1d405fc42492dff236a104a4439
SHA512c5a0fe7ac9a8a4d351e1cf381d2f638e890b164765fd4bcb9c11d5208f2063cf3b410b0af0a792bc4a28760a1272fe9f0dc51bbbcb90fe27a7bc611562c5f6bb
-
Filesize
9KB
MD5c615f885d7fd2d2c508a9797c5e3f04c
SHA15a072b91835b77ad1bf88690fbfe81385255feaa
SHA25681491ade728751c68a291f532e32e58bec80830d7387eeb6af13bfa9d4c2a9d8
SHA512343eb3bcd27e8df4ce83176589ef4e16d04e42f580086f48cb0cd89b8ac1fb39564917d0f68b8cbc1a4a3619878f387d50108849c3b4b6349644d551f60e17ac
-
Filesize
9KB
MD58794af6f2fec72073722e56899f71d5a
SHA10be0a2bdc6d196b8bfd9fa9385c0f0b74b1ad10c
SHA256023f3ce13f8be1905ae3164754a8c4846920620b3f524ed3d1e117884283ccd8
SHA512edb0fcb021886f196cd96d40c30b64cb56122ebaf4a029029c12c19a699987d82eac0bebcdc9f2547f773e25aab8463a7177a3f53ee4805826f5e59f5f7537cf
-
Filesize
9KB
MD5dd5972b77e264831949048658bb557e5
SHA142a2699a86b86a0c761d49af6df1c687d5543402
SHA256231873959ccbaba27e7ede35b8d5ed3371d38692c48ceedba810ac8b4499171a
SHA5120af33e79763f6aff86d2083f588b3dba4062b1ac5a8de2995c1a8b4e9a13cc317cad34f01e9241811e8c37fc2d035ceffa1561ba7790822f9cbe394cab7f63bc
-
Filesize
9KB
MD5457f19c1f4b9ee1c20a117271f9a0f67
SHA17cb5649156141255aeb8a63584d42f9d61cfa4ed
SHA256efb8c42cba2f036b87e7d457a409ed140ae44041ff9d5c602747c6091a702740
SHA5121145373f3f88c7caa91a6faf988df4f66732edcf244d888b1b604e7a4aa3d03df08ade865d3e84cd71b2f36f942e6826474e4d12f806e36ce99b9fa2a2086d98
-
Filesize
9KB
MD5e5f04b13bda75c7ab22c5754badc982e
SHA191d776296f24bee5a91408c248254856480c1888
SHA256e5e32b60bd8929549c0fdfdca27aa595dfca3fd573bb1c662fcf007086ba2cdb
SHA5127691c538a5b2d31eb3ec4220f6e2252ccfefa051e6ac5bd77dccfed38df9af0425e098dfdacc81d868c17e38fc7673039b23979048cba407db7fe4b8ffae1d69
-
Filesize
9KB
MD5236be728f9d60c48e353708bef3a6f99
SHA1ab4f1016c3c5ed9473c1e0422ff3e0b3e40c0dce
SHA256694343dfe51d1d733537a0a756c7c54c5b73ba83e18974f8d733c28635e7d00e
SHA5126eb43cbd22269953a9a6b596c1c6c3ab3fee67cec702a99e5b13584c3a81ea9c554ed4fdc566b09ebf4a90665ff23d2ade8df4cefc405890f8705d0952889ebe
-
Filesize
9KB
MD54df465f837237eb68f26a0d6e62f966c
SHA18e46e8fa1830fac2648896d4f7051f3da176c883
SHA25630984d1fe09804700c278adf290b90c2261485bcdf9d6d4ddce735acf480e3fa
SHA5123fbcb6e2a0a56fd12700769d821058e86d6eb9ba33a0afa9cbd1f4adbdb01c50b1024b24c23900692912a3ca6ae7a431cecae0b98bb1504cb5b5206949862ea9
-
Filesize
9KB
MD5e9eeb2c15d381df9aeecaf0734a9bfb2
SHA13ff1582feb2af640f40e79cfe526774a421073e8
SHA2560d8574892e0d64dafc35c4cbb0857597a02466e0c084c77237dc1dace21b3945
SHA5124fdac8371a2581e6abf6fef3e3df7f0e6409a4647c34b950275b0208f6f75cae87eb6436aa47c24cd1d3e09efce8b7354e28bf9105c77fa5146dab011b5dc4ee
-
Filesize
9KB
MD57bf4040fc06835b8d6a332f42738fc54
SHA1164285f5601f17674127566162269abb24729c40
SHA256c98293ba2d8028fd72f32171ba5e75d100d3eee650165caea83a8bb6fc8c1672
SHA51200d352b9b3ad6995e64d4b88418f186897ea647fbe68182d7dc4ca4ba0f20350ed345ccf019e44b25d099993dab419d75e8be18987a4e8b5582de64f1fa91a7c
-
Filesize
9KB
MD56003c105d67a0285c235f3a0c7a0b9dd
SHA1d2dc1d47e83f45bf9ceb5d0e49ebe4c75bc83bd4
SHA2560081f3f3a9db46019c71861d1f5e42e6f15049af2f7288d77580d80ec8b5ab98
SHA51265ecc209c9bdc4bbd44f86b64f510184cb2a15458f48b32bb376af399f5a6a48a3d0cdaddf903fa8b11cc3a446651f3c57f491c1b1293e52d56af2fddd7865a4
-
Filesize
9KB
MD51d080b12a948595e3318f78e8107ea97
SHA1c5c9409566f2e21729187fe762fcba8db3c15787
SHA2563ec82141293e45724a6d47d41a604cbdd236f08ea3b0f441a71915334e950c6a
SHA51299685823321534537b7353815b378cf63f00509d502973d851cc95f98910f7ae3783aa2836c83ed92a9942982917ecd8c9b856681508468d645c7f6b64eab452
-
Filesize
9KB
MD5b4ad1ae2cb3603d60a3cdfbd6a9aa623
SHA155e1980825de383f4778ffb5faa315db71603f89
SHA25647eff90a397131d620e15939eece49ef1df61f1f719c0ac7ebc36e734a344cd6
SHA512b1dcf06540938501d445bd41639a848a81676b37b7b5a40489ba7796cdaa3d1755ef5d498ae2f6536f1d6612231bf7a6382d87cfbedb181c109983f5b107262e
-
Filesize
9KB
MD571a5c4651c93f848c5fc0db5bf7aec0b
SHA1d7efb83a76f94faec974bbf0d56dbafaa61d0410
SHA256d6e91d9fda06396104acdddaf87cccc153f07e9d325875db91cd6e591ac9c02c
SHA5126e19edc635931cf1b915a6319adaff5daec197b472b1ecf6884806449bd33479e227cce880cc88d3c0ae1d8700b6f2a002cd5cba9e815d0f7adda809f9a75e56
-
Filesize
15KB
MD56e0ece7de4917596eb2cd4b564ac8fba
SHA1a501398261fdf9f85b60cc652c8073251d417fa3
SHA2566496d24f3f2cf1bec5a75c80b34c2837c0c5f2a8765602c502f1a537f2139a35
SHA5120952728d35328c4d0fd9befb4237de2c18d0bdca513e09973281accf66e7bce8027e830020f6922a5aac6e26b46465218218b484808248ea2808336efb687d7f
-
Filesize
24KB
MD5cb3a7dd693543906eb618a1d7ff51668
SHA1cc5ed0da84d8cd20781d340d52d3a14d0266347c
SHA256bd605b5fa905d19fe493aa738106f7b08c4c11039d4e67fb65bca99cd6676721
SHA5126fdf5ababa0509237249580c82179938ca21dddeb471587fe5801e226ba6ff5f41283e283b58c14a94bf2ec76d10a6f1349a6ed62fe1b40cff255773aeab891f
-
Filesize
234KB
MD50c278a27df853e6f26ae154ea7f9c8e2
SHA182aab9cb20b76999814407b29ba39b3a29556586
SHA256d91752ee886c345e4d3bc66b6b03fc9138b57ba146417e92cd853418cdb01775
SHA51298c4473517cea83e9f7aa6c88d8ad3642abbaea83b046cd40c833b1613726c7893264e2f004922da60b7625e5562d37e43b3acdd7b297eab8ad5b3d534472768
-
Filesize
234KB
MD5a8be8ddb476c9812ace1e677254fd212
SHA1455c2526d55f66272706bd445aa3021aba5ba320
SHA256798616cf0fd6dbafcf22abf01b213722e2c29f2dc0abe4eca16751d375f38375
SHA51269bd1c666cfacaad54bb559c37cabbcaa93d1f3708f72df5a0f2c680ab1caf1924a8c9ebd1ac78dcbfd580181d458e7277f30097af641b966d6a47fd001f4875
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
47KB
MD50d89f546ebdd5c3eaa275ff1f898174a
SHA1339ab928a1a5699b3b0c74087baa3ea08ecd59f5
SHA256939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e
SHA51226edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690
-
Filesize
19KB
MD52e86a72f4e82614cd4842950d2e0a716
SHA1d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA5127a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
-
Filesize
65KB
MD556d57bc655526551f217536f19195495
SHA128b430886d1220855a805d78dc5d6414aeee6995
SHA256f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
SHA5127814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
-
Filesize
67KB
MD5b275fa8d2d2d768231289d114f48e35f
SHA1bb96003ff86bd9dedbd2976b1916d87ac6402073
SHA2561b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1
SHA512d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811
-
Filesize
62KB
MD5c813a1b87f1651d642cdcad5fca7a7d8
SHA10e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA256df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
SHA512af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
-
Filesize
25KB
MD5e29b448723134a2db688bf1a3bf70b37
SHA13c8eba27ac947808101fa09bfe83723f2ab8d6b0
SHA256349cc041df29f65fd7ffe2944a8872f66b62653bbfbd1f38ce8e6b7947f99a69
SHA5124ce801111cb1144cfd903a94fb9630354bf91a5d46bbbe46e820c98949f57d96ec243b655f2edeb252a4ec6a80167be106d71a4b56b402be264c13cc208f3e2c
-
Filesize
215KB
MD52be38925751dc3580e84c3af3a87f98d
SHA18a390d24e6588bef5da1d3db713784c11ca58921
SHA2561412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA5121341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
-
Filesize
27KB
MD56b5c5bc3ac6e12eaa80c654e675f72df
SHA19e7124ce24650bc44dc734b5dc4356a245763845
SHA256d1d3f1ebec67cc7dc38ae8a3d46a48f76f39755bf7d78eb1d5f20e0608c40b81
SHA51266bd618ca40261040b17d36e6ad6611d8180984fd7120ccda0dfe26d18b786dbf018a93576ebafe00d3ce86d1476589c7af314d1d608b843e502cb481a561348
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
20KB
MD54b3121a05808b99aa6e0cc12924f77db
SHA1ee5805bb76c384d1e1667aea2976bd2f4f94c7cc
SHA256e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c
SHA5129b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605
-
Filesize
16.9MB
MD5f3bfe06e0aebddb4ddc385b87f7ab6b1
SHA1dac5a1007ba6701741aa6a600062190175ad00e2
SHA256c93159ed4822d074c1c263a38298f097e400b32173225c07c2b4675e678ec790
SHA5125494634f46411671152812dd97b284ee6e860d5eb61f4cb6280380f4a1ac83b35db7ad09668485b5d8616104dd7bdf0e41f93e16e3212fcc8985ee1657fee70a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD5875f8bf8e0558de02ea0c04b0dfdfc7e
SHA13b8634597a9b55bc69d389eb28cf4933b5c3ed44
SHA256af189baf4f6f579ad233d27969eab1dbb99292308c3cf27413cfa3c236dc2686
SHA5126c5f79db77ca88bfc103c57f29281813c2014fe13e7ee622d8acbc2a28918cc446fedd7d0cde8d39a9fed31f1d67ec47bbbe7ba6b5edca0db91b55b4fc8d35f8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD538749d95580c7c5c52b4ee4a746272f1
SHA1089d42aafbc02c51111dd96dfb5b96670165cbb0
SHA256b2b7a23e033613020ae6fdb5745fee3dd7a7484d8287cf5dad6aab6a541b542f
SHA51297c1dc80f8f9db51a0bedfe6c63f5a4803a26dff775086b417e1d5aa07a2c9bda0ac9ae8f710a095e38278ddae6497ca89523631ba77ca5e6e2209f62f1c98ff
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD5829d45bb14641c03fbf2057668e5e62c
SHA164e940c3e753f438a6a7316b6c8378f7e87ae079
SHA256fab43116323d0906eb1966040ab2497fa5bbc10f206b7c6070f2fa099c142676
SHA512cc4ea7351d4bdae0ec81ab6f7ec247090c60955d94ea98ed664b4cef56dee2e21d58b1bea43369da54ff745541f44922a10f70a46a8151545f8056cc1f97490a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD5c1c6d973ecbd954ac0bbc462972d27bd
SHA12d5c2910d67930e3fe13071778c658d0bb5e45bc
SHA256cfebf474a9f11ca4d0a50ca8c6146ea95e0d32beb3c932d579c15d53f967611c
SHA5127e3820c5af58f14a254098f50bee194cb4ae99f02359a8b52486636a0b0a1a0b563ac4307a0fa4c1c040f3cce3ce0dabc34dd9857455e8c3ebe7fb115e5e9bd6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\caiblelclndcckfafdaggpephhgfpoip\4.2.7.2353_0\_locales\en\messages.json
Filesize235B
MD57d1f1a13ab9860f983720e6fbc3bd93b
SHA150911a792e81c14a376fc32a22ccd22f0e05aadc
SHA2560c27964dbb0e474e06a06cbf50c5720058a9c3e6f8dd69c27350bb47f59af2fb
SHA5129940b947187abec73c154f59915cc36bc916ede860c907bf591fb71696878840eea2d1fc7fe012dd6ca7d7e8a25af545374747226054c877a2704b3e82cfa49f
-
Filesize
4KB
MD5c6fd4550296b4ff8358b8b07ee78da29
SHA15f5ee218c1160e82901c1dd8674e00b79a9d5e4c
SHA256a221880ff980899d1a08abe0f022d70c663f2e455dbfaa585051d34397cc00d0
SHA51202c4675ca1989979bdd3311d3d7b29f49d16eff64afbee39e34c72596bc988a2e3760e0ff75fcab637d1548f379c95de30b24d49fb5d768dce3a9fb8235c198e
-
Filesize
8KB
MD598de15940d151bcdc7e8597574edf902
SHA140cb74c21290619ac76db5af3fced24ce558db54
SHA25627ccb7da1341ca319a934a680ca0f7c5b5ff19b4763fc40d7cfba08e68ee0831
SHA512626a7bfcf60b4ae145552933e6ac41d6528965a2b75911a0cd6c3e2e8736dd3afc39771e6f968fe90d6b0037793c1c7810d4b2280603b4b0a2f54c9df0509c40
-
Filesize
8KB
MD5094aef1184cf95484bac721c91eab59b
SHA1a5863fcc3607ec9ea784c9ed8972d9b17d3eb956
SHA2569cd43fde49d71a24925bcff3bd6ed5350b4f4cbc9b8a93314a5391515880ceb5
SHA512ea84ca1ab2086b30ca95c51f4b8b76d49144fc5f1797b311808f09a2bd84d99b258171c37e1b1fa8a27a2ab69254df8e93566a2f7d46fc6272a09dc3b0f8c02d
-
Filesize
11KB
MD54f53c9b41ca43bbd2915869756787289
SHA1f7e1a37d7f5baa95b58bb5a0a988a285127dbbac
SHA256a1082665eb544a23a732a62a72544a2caa092d66ec9495459ea147a94c8763b6
SHA51274503f8fd609aa83f4ede214c0f0ff49c6cd7b2d8b1f4be31a4f36c014c8b7506e29b5038ba083cc6f061a1e81f384f23abe2f51102e6ad1b546fde453ad5c40
-
Filesize
5KB
MD53da4fa550d5104adde60bf70911b6a8f
SHA1eca8c556275a4b220d8176ed16035d1986ede18b
SHA256c91c175930a69876b60363ded092fa8fd89add5e2e73b409e5957d98723c1983
SHA512bd9b340930d32e726ec0f2ae2e6e93a1659913bb149081242f96d044cc09680a224d4355446626d9f7bfbbdae4399715ba00e60268a60105955ac769c7061600
-
Filesize
6KB
MD5fc77f867c47adfb647974254cf0bdd23
SHA177c4cbb2579d3d9cd588b2eee1a7c12984087953
SHA256675656fdbd4cf9d31c18cc4989bb346a848f1bb8f87fa33227b8b9f60a0c4550
SHA51282ae86f4b2f4a56cb9496a913e3fd08c513a35c4d29ea88b674ff03b7178e6f088f1ab4d089be948b878ac6f9d77c9b0b055e5e06f2d5bfae2f45da1bf5dae1f
-
Filesize
9KB
MD58ca32ee43876b3bffcc677a03da135f9
SHA13125ea4ae33f9716faffb9f318918825cc4a58d6
SHA2563e3bbef7e6f7e8b5bd215fa53d35f256226ed4234615cbedd4bafebb0e614ddd
SHA512f67764ffbadfed66c36adbd2a422b6508dc0ca761c156cdfc8270c2bf9c8e675dd12a66182e805f973c4a9c14886c3d7d09b424489c3bc1685dad52d84baedb8
-
Filesize
11KB
MD5efd812f5c0db379113ca3337f48f28f3
SHA139d5d40e6fe94915d1d7963f282aa92bc14276c5
SHA256c03c89bf4d75d99485d78b64db665dc9b03b8180f7b58246621f7a115342fe7f
SHA512cbce0c90d6603149afe4f4ff2c0c74e82701e818593513605ab783adfb7316f42a9be1cfa336157f88c52132b78158e6d0f8d7aee6c34686eac92046af9fbb4c
-
Filesize
6KB
MD5e812471ea546ea671c32ddba98f3eda8
SHA11e583a6f6f9a5346e6aac2012f36ff9bc8bc32fd
SHA25692cb154f7609ba184e82c36d80b8f3519f050cc94ed56976c4d79a48cc9eb96b
SHA5122aaa7017dc3a3bde76be38880c23e5e8ffa334fc8f531048f5b10178a48166ceb4d9d7de2991344e52ebc5c50c926b7f151b81632ba4c66ab0cfa3c76f23c405
-
Filesize
9KB
MD5af1c5c0873d9884c242d11814d756560
SHA183600697c6920a0a10f46010e30252afbfbde8d3
SHA256ec9d6de8cc8d233d7589504f416c0a4f68e9a52553ce25370b06603437f511c9
SHA512b07ff704cf2dacbf83ab3d6a3894a50174b15c44bc47d5fbd2b6d80856896f69aac3fbe119efe84a1ba2a365a61cd81670379e5cd85d85519c386986091cc705
-
Filesize
12KB
MD56004cd2d070993bf3bd06fddd09cab77
SHA1f73473fe1802b67be4fa82916db5f15e360cb3df
SHA2565e4b90af87c02eb975d849badad234766594f71719494f81e2dc462f9397d124
SHA512a039f5ff50384d20d866adf6f30929ee998e912adb6a853dfc5abeabcb6a69721f2922f6ae2225bc6c8cfc0dd7b703644d7d4a8544d41f9e1ed55cb64a5cb29a
-
Filesize
12KB
MD5a2ab5cd1bd05ba98baf6d67a666695a5
SHA1c7af3962a80d3788f283a694c86d675a567e5214
SHA2564adc25ee6ae531e987693844975ac0bdaf8403db7ca0cc908dc77b4d43eccfc6
SHA5126b2afecdf991bff658a1584e2f6338c0672aaa3f5ed13030f5fd445daa10dbdb19e9ab444a09b6cd958e5601f3d0a2cbff00e5830918a9f919fa5544eb70348b
-
Filesize
6KB
MD580096fbbfdd915b53a80f6362072de78
SHA195de3658bbc23d4307aee944594015b0c67b8a52
SHA256c9109811809cb7492953cb5b4aedb625588fe50f3872e23397824fe2a32bd0a8
SHA512e47f79d8e344eb541df8c8fc51dc013a046f6eed8bc2c4a87d2d08500682863a8590caee9deb66e89045f77d9d3a6a62c548a8af7c0bf5387713adceb2a3a50c
-
Filesize
27KB
MD55af6333ff97bac91b198d72a2168ab50
SHA1f8314fa76bfb06abcd112bfa395e1139d8e3daf8
SHA25659bd65bdf4a252e8b97c1e386b900c2b1052f5ab9834a6bf1e8f2f450566bf1e
SHA512355b7dc6a7d4d5400eb72d8f195ef5376b940ced0f9fde38dfe70397b52426f74a7a960f222d7cb867b1fcb1a06d93cf6be7b8d3a6bef9803723159993f1e33f
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5151f3595e871b8e7aeb65fcd77e4baff
SHA18c4976cf79c05abf87c618ab92e88b4abe537c9a
SHA2567a1dd1b1925937ed586197982ee845092181b4c8dfc5619b365ebf05df967d9b
SHA5122225e342e360166d5e49b0e3a6c7ac5aa5383a4a783aed5e225a06feb145de355ddfc4086424d2ca4464e87dfebfec64b389750a1e8f0e0fb9fef55c87d1024b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD531a860d8d40e290a66c94df87fb12c2b
SHA144334880329998058ec8f33e0d735fb5877b122f
SHA256fbc3e4647a580e85f1637375c2ef19b23914608ffba90fab46ffe470098aa833
SHA512442776b573c3c450d96395b8b85aac7206c85a3526c7ae705d38087d2c051047e9d690682b29c5767057c82f08a4f1fbcc51ef1ad29527134c3dacaf48f7b98d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59166c.TMP
Filesize48B
MD56fc8358402718f2eb779c2802872ae00
SHA1b775d5bbafb46e159d33b21b6b4db93830bd37c8
SHA25671df9a19c1d64f27f0c9327798e3b02ba7acff6443d8440e7c457b7bfb953880
SHA5128f8c532059d8b8ad846e7ddd942ee44458635ce13af4fe8860b1c351eb86fd4681683c75670144f203fafa631d847d8d352f9af6187369b5e5e08ea178efedde
-
Filesize
3KB
MD5a01d84eadca002e3272f9a76343683bf
SHA17fc12329e0f8ff7036292bcfb0a89d5bb9291487
SHA2560f17096aac263196478f19be51b55b909db482f20e49eca4fe559c4f5c716d67
SHA512df3eeb8e36c7c22866919f61b56c7b00fedb1baafe6461b8f3748aa47472ec59763e4c7a0b241ecac64a23fecc0432f77df161945b32d1528214ebea4426712c
-
Filesize
536B
MD5cb4acc5cb1c47f7fa8bd551a52a52f1b
SHA13903b1f345954bc1613246d1f87dc8d996c5915f
SHA256fac4fe3ea78a90334e6e512e73c67cf5b08990fe2fc5a4f06db8cc2aaeced222
SHA5120a99346340d765dbd4dbcf7e910c6936b8fa5946a5942b5a8e0aa0eae35c0247a1a91fd63da372043b4ba1f763670a21639ff0015a4276176500a6c0fb720cff
-
Filesize
4KB
MD5beb07d24ac20df8d6c52a22cd2a2f09e
SHA113bead34683da4b2ccbb65fd34ee583121bbb550
SHA2565757b6e4a2b3db94be7136f61d3a0d73400ea2b7ecdca060a0dfb0505098845f
SHA512a0cd5be153a6cc521497158f276f4970982792b040024d3edfbe10ca36ea48a583a373bf307112391d1b66a457688b4cdf24969d25bdaac551459ec4e1f0a4d4
-
Filesize
4KB
MD51e95fca30c69aef7345cf975da6aab24
SHA15fda2b16b587d23cc29b023309ca399a89d03d2a
SHA25614ff82d3a3458492c6d2bbcd530b10a14d0965ed2146de3640f116bc0e467072
SHA512d1e4010e68bb8f023486790e5b9a107bf9d4a6a6a976496f7cf498e18a018730c0b9f1f587c5b590c3bce0503b35b315a97ce48d83c39849ed0318f0598f4cd7
-
Filesize
4KB
MD55c529afad3449489aa7ec12b27880771
SHA18e91394cf31b553fa583750a018885d9cbbeb12d
SHA2569bd380890ffdf9e2679bb831c49c3cd1fd86a036165679c62bcbd81bcc866135
SHA512fcc5178cb47658b48ba724442950c7c337462d5d135db566921a0a1ac684b73f60c2663328c3e28e9c2daca0c23f4b73004e69c2e91dcbafcea04f47d4eb48f6
-
Filesize
536B
MD522800a45aa86e9d6060547c17ef873f1
SHA19a223a3a2a832be296ebee3a4dab2a59aa7c9179
SHA256df4dbfac55da3130ebd98a08d4edee6cd6335016d81f1bf994fb686b4e48cc26
SHA5127c0ae5f3bf3c0853773e3366fc0b63a0ca26b7a8a8e7ff9a5a554c0ae4fe7c33f0a38baaad0e5fa783d4239c684f6daf1ab771fbe444d6b6b57a2740abf46ba5
-
Filesize
4KB
MD5314c400496f3e8972cbe6e70dd89d014
SHA1b0bb3be2ba4d2d526d0764c7b3c3cc3d9cbe7e4d
SHA256229d89c3a343ccd8c14a0b6e9ac84b2eca0e4c3fbd996ff8712e9337ca96c4c1
SHA5120c4a748e4a65f6276f880724718d56f5330eaef418d0a2ed0a4e8ea1b07767e2be6bc0ccd268776b6af91615326173b7f5fa52438b8eaf8b9d737a05d412b04f
-
Filesize
369B
MD56194c8001d240cbabbd11a26ebe7affa
SHA1a3269577678a4ad3b91e5adc67fc4e94a0f45829
SHA256c3737fe29b78949c0c2f6c0b320e43681953c97a9c00b28f81458fab5b6b11e9
SHA5123013c1c4d78e824acf308b1e4604b292a4acb28e9d943864795c5168dd31d40247d19536d9cb057e1d36818dd5b4b63639630aeac354eedc475b56139f619de1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e6b66378-3e62-411f-8e56-0e589c655a36.tmp
Filesize6KB
MD5fc62c764ff1f71d87a3923d7fd7050a6
SHA14a1eab0d9c3bb83f084aee6e3057c0f3929fc06e
SHA2561ecf009011d96260baefb7cba14065a21b312c443f8621b5be7599a538c6f83c
SHA5128d66d88494dbbe6377ebd781226986dfeba4e27da8ea1f0c971a5fe370e28e178ddd27e53a3805bbc7c2aec1f5bb516ce858712cf1949f282c8627b2a491c209
-
Filesize
10KB
MD5c8d7895abcceee9bc6875d874a4f881c
SHA1287b7fbdf58e24d7c23b29d78901f0a4bd359f2b
SHA25625f284c9a6204ae06d58c2eecda3f2abd1e275a4d44c30269935054e8df74331
SHA512fd4c0b8d52255c68604c4944ada28384d604cb95200b6ff24013d8b66c22cd0e70eacd63d9c737bca9bae51566d9c5f8ea6156a50bda3742cf0491f02fc12630
-
Filesize
11KB
MD5867db8b3f654c665038a394e5c59dcdf
SHA1c507b8d53d486e39d4fca8ea7ce218006b5f4b68
SHA256ec8cb8ce32b6081eb709dbccabfc1b96f9f9066baf0726ad3ef02e43faf81b0d
SHA51241ffb9c0d1fb673bfa5b2a4bb4701066f90eb68ceb359cf013afd8925248581e1d325eb4d81773b5ad107e167caca3463f2a41e2e166ddbf7577e639ca9330a9
-
Filesize
11KB
MD5d243934c7a38f5a7816d831c5de7214a
SHA1232933fd8273e9eb73ad5374f91081b87a2f4e28
SHA2565ce9049681565abb3e28cdd99c4d603de55bc41fed13b3d3cb9a368b6826f603
SHA5127bc57b49feb22697a2ef499bc4a61474835de5f32e332e2d253c3566f20597b219224100b1f5311216628e10649d92632162212503b731808a8d8cb072fad6bc
-
Filesize
11KB
MD58246eb3905def692ee1d82e08a50b4f9
SHA108daf0deefc23ea84812ff5b19d7ed49e1a9585f
SHA256998beb3c7f81a23becde9e9a4b533edfa765f095e856c960ffcd5b734ef08b10
SHA5124de889d821bb486f158477bc715393c10401d3c117aa7c0ff2b23f1259134b5a4339c322e18502c705b33a98873a7cc638722b815035d54ffae8b369add9f535
-
Filesize
11KB
MD52d3c1403e2db26c17b99f3f316398d30
SHA13beee2e2817d5603ef5d52d9daae00a3a4056082
SHA2561c8e51ad4820f92f7b03cef83e663998c991de9ac8c553a7368dc9158b00a44a
SHA5124f925597fc023e7d4a02627db99743c6d3a0d39ad38e6c4f7db613bb5e68b8dba5a9d9432480295b098b937915986f272e3031a2a68d8b625351d37d403a94a8
-
Filesize
5.4MB
MD59b41201bb6d9b439103b7a2fb1d41038
SHA1e5c7f61421be5c5b0115c1be03ef1bbe8570c832
SHA256f6d4a140924af35dfbc63729736310737c6356052094b19fddcb6e88d7e210ed
SHA512b06fcbac44b679dace89ad633269f02117aeef19a9fb1d481d19f8d5246c8dfd305eaf228994dce10c9f3c3151bd4aacf82c44e541ba7446b23f48f0e23c3eb5
-
C:\Users\Admin\AppData\Local\Temp\.CR.28962\8759e5ca-7418-46e6-b03d-a903b98407d1\avira_system_speedup.exe
Filesize35.1MB
MD574d479df6171316a87f012d3266dcfa1
SHA1c80c49dfb63c1ae39df0a41853f021cee171f110
SHA256d8fa4241de084e954dce5c1075bcad11805d0236f7ab87c03a50a042a4f8c5b8
SHA5126983f752d6abc77308d65d2b87c5a249f9844af961cd783eaab9e9c959cf536b65de4c9e13807ac031b446f5114a46e59e38c4080a2ff17116d2dda188120e7a
-
C:\Users\Admin\AppData\Local\Temp\.CR.28962\87ce22d7-7d54-4fa5-aba1-a742e944aebf\avira_spotlight_setup_psspdwws.exe
Filesize34.2MB
MD5972eb9126d92fea2626690bef903aad6
SHA19def5004dc267f77f5cfb7070e85d330b8e33638
SHA256858c355a5723e866dd9379765f2672976b4a097d836e8b5a2cd865f9819492a2
SHA5122283f4ab903c98ccfb0a79154d5ad32b4af1ac4e8e7d71d583bbdbbd0ca866449e6c7658a8ac6b1e6061c448fa34e3b0a84b84efc023e5b2c80ca71c6aeb048a
-
Filesize
421KB
MD50978971940d4d5a4b2f1aedb14f7976b
SHA1490a36216d65f06388544a093c24536a3f176b1a
SHA256b38b05d0e94b7f9083d77a5c19816ef46284aeaeb3f7c52286b010f8e19e42fa
SHA5126dc658918a0e2bc761cf5e8416aafcc92f9583e74a8e08c887e2302f29de729a2909db8f786289ed3ac5ddb54195a6e0a73f9408b6a73d457b8ef7e7121a5243
-
Filesize
1.6MB
MD5fd085ee759a068a6cea1140182991ee2
SHA13661bcb5e0c839891b3781c59a4d5ba93589296f
SHA256110a029e5aef53b87de596baf9f0c50f3a2277aecc23006d2412084575622f06
SHA5121ca7688721be32731043dff66b004eb70ec38c55ff5d1dee977db59694c2a0171e4e14d020fdc2726ad38454bea07e0eaf468021c211f0e27743bfbca43946ba
-
Filesize
165KB
MD5f64511b6e421b0fec09839ac2e6dce9a
SHA1e6606fa0fd86eb5c89b867b45d9062edccdc4378
SHA256ec1f7c34c317d259f080a266edb40c490143ed5562da64dd544b94eea9e34a35
SHA512f385d21f04c5d9b1cd9adf71043c1685faa5ae32dba254f9ee176f96712fd895fee2d9be7548f51c1589d74af7b682f952154f54f4fa608f455a765a8b3689ec
-
Filesize
435KB
MD5b7ce4520c6ede9e9113f70d1eeb5240a
SHA17e5e0e4f28207c4aa8dab9877b94d304a0854965
SHA25630b1e00d898ce47eed2a726692fe72713ec9541fead6b03c36ddfdb354183fc5
SHA512022c30a14a030021b12fbf97013cec5a8a4ea4d533b13779b96b8c900a9041e773cb884b88ba31e6fa0087969541572423ef55c225779b8a32d87345e3cb8c92
-
Filesize
1KB
MD5562542e027ef05cf52e6f730f6767f2f
SHA183fdedd8ec594bfa3211fa96074afb066c0767b9
SHA2563f27265131858e6341e7f9db710de4a7502cf7ee940bf2610335728ae4ad9d09
SHA512842d549c025280d2d853b4768e31f3fb42009ccfe5a4e48983aba5ec776b0310c337f2ea0b976ca91dca5186faf8612b6057374cfa8f812f80c1a489bbbc5679
-
Filesize
1.7MB
MD59d7c85e958816aa0fe0729ac69913e48
SHA19b040582598b2a53652a90401a57b1e54aa73271
SHA256598946ed9524cce117568dafeb7a386c8f498977b2f404745bdd01438548b302
SHA5125c3a9d76c013c8ee9157d7fbca62107f2a04482fda06a5a44f61d109d84e8e8889a402bc3dfcc1e6e97cb5117ff79a9f2930a1027fa54d62747cd7d5bb587ed5
-
Filesize
1.1MB
MD531f61baa8d837b9d1e7ec0ef8e72115a
SHA174cca272931d995abcfd616ab106fe611781f926
SHA25641f9ff28155d2a8083b111333049c82b2899040611507d06ae69a89f635c3ded
SHA512d6e2d7ae60844b7e08756d75c59c9ebb41679a82df50c05720c607b78343537099ebb6b7182296c38034c293781b4467807e284f3d05a7d79109839dd7a11706
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
8.1MB
MD50d3e596c6586a3e9e7b34c3a2ad5e890
SHA15ff349dbf9ba37ec459a954bd7fad7d264c0221c
SHA256ecdd2cdce19198aaa0f43f1c78959edff6a95813c38a6541bdffc69c00cbc452
SHA51262a5a7c8fc75cc4b49088a7a3b86c6591c812e1fa5f04db53530ea125d246911f5567e2c1fa9c1227a36788a58f509bebccf29b3e5d4e423b84cb4b556b08d1d
-
Filesize
2.6MB
MD5a7f5051b66ad0d9965c6dc9df8955ed4
SHA136eb44deb6abbb0a3105f652d003ab0942618ff9
SHA25630f85d8f31a30be60c53cbdceee0bac067e2664bbb090cb102975d8eb8847072
SHA512bae4526b493b353f0dcd3d5712e3161d3bf025f215fba9a61c2c6aa0aa11f4f60aa46132cc28731c1a8560e4ef00168e998ccc889a15aba2c69157d316b7e6a8
-
Filesize
4.3MB
MD5b102cdd8d737a4bbdb6f661361277813
SHA1a66c7d08024945dd18f8eede13781e24289595c3
SHA2561ffbe30a177463c76d6b48d92a0f4c87144d01d7a159463012e1377c36f69280
SHA512adbb0e90ca2e29aaaac7968b9af4984ffc012b7eb79f8d11cb3e1f4510c8a7240acbe75febc651eb489402cac2d037223870e46482bb45cf409242cc3e6daa46
-
Filesize
2.3MB
MD55a0d834ea87899647b79051b170aaf7b
SHA18a3759c32de03d3c551d41e85d1e242516a3b016
SHA256ecc78f79182ce9ce75efb8a2ff9a7fb3fa9d76290837771dc286154fc2d7bc07
SHA512e583f21d661d487c091c98b92d6047e715290dadaf6527812a15635c94e3ebb7736fe85a10c98695faf5a8e1432b2fbf70a14bf7d885798cf3111b9293b2c831
-
Filesize
2.0MB
MD5b9756c80cec2b8391c78ae27aaef889f
SHA1a2200709989be51e6ae5536e7be94275c74081cc
SHA256be79a26cadc9364e486802613da4b7743f64e2890b4ef9e534027614b436c5a5
SHA51272edf119f52eda030724d2e846513998df85e99f5deb3b5c2a3e273c34930524f2f86e3c1ce177d046e7e257242ecca7e95884ab6eaaa89422bebabdc1bb74ca
-
Filesize
884B
MD55a82ac9a9a65b25992a4b8b86d1379e0
SHA1ea596c4f420e9121383b4c1b466f6aa76322d495
SHA25616d9a71e57e3af82d5c961916e5c57b9abf582d0d3d0bc7164402ba585a06892
SHA5127ecbf55d70664c31f759da9684c3086c4c0dfd88a5831924239f7c0428e71048d83ba29fe8287666d1f11fac7a6c0be83106040d973827e2176d20962c2d06be
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\28b9919c-f398-46c9-a484-45c2dc801351.tmp
Filesize8.1MB
MD54e43a46c54869f20c0c3b526fd9e1b2c
SHA17a6af1309fabc697389aa194796d8d0adfc13e53
SHA256f4c9a16ce99825f450edef06b3cc1d547461f4c09f814a8e9e0b1c326d2e7e67
SHA5125afde02008c9c0fcd18690c675703cefa5c0964454755d612c3a7b873963133af6ec8a3e0bdc7b6dacda6529584d4577f0a8c79e0ee00718c96ac8e1b9f9aac9
-
Filesize
139B
MD53103eea64e8e2926c71d0cd8bfbc35ed
SHA182b107fd4eeae9f1276943325159b5741bcd4319
SHA256509d7d9243f217b14f41e71433f2ed5f907680a3fc4e39d73aba696f9bec2852
SHA512009be1a904d41c2e304e2db3bac95189d6fe68994138a31265a5f20110c47a93f4d3644695fbe0a0fbf87a28a42445c79bd3898a84ea5b0d91c90a1656deccfe
-
Filesize
1KB
MD5d06253891e7721fae73666e930ec6ad5
SHA1b46c49e778aaf6f49c526f921612301e13c199c4
SHA2562a9880703870e31eaeb04c29cc18330035ff786deadaa98e2321df6a3a46a077
SHA5123ed0f9581131b6cf6f6cf9b75689672dfcabf258d7156e41eb96d5a3a56b1141ffa21c14cdc0c9dc6aa39ff4b3ab731114a4032dfe205b4e2ba1d1d0ec70dc82
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\css\fonts\KievitCompPro-Bold.woff
Filesize44KB
MD5027ae223979e9aa03a719f287c068e0b
SHA1c8111c572362d877c0f4e32b65e622af44db8cc4
SHA256a233c73dd1225e3275e695ac72de5acd7c9cdf4124c2c1ee56c988068e5476df
SHA512c0a91a42f1b8b4e281d3666dbcab3db1c2c2b6fe46ccd425bebf976774e6f541afa59121c072587e4b8713e2903f918bf1d90fb7902390f3062ea999e2618c16
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\css\fonts\KievitCompPro-Bold.woff2
Filesize32KB
MD5164abe057fc3eb335d3b9c8c85be08c2
SHA151ad4dd65145d426b0303f1fae4220c947ce0d6b
SHA2569f27cca321616c49f43649a9cdf2d37e3087a542227639875361ac516eed9926
SHA5120f8be152d334368dbae80d60c132c4d7fcc76eb7af65911dddc02dbf0875fcbb92c7e043fb76d2f8c428ecc5955a874b64ea041fde953649a04c558faf284410
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\css\fonts\KievitCompPro-Light.woff
Filesize43KB
MD5de8d96c3eee8da2e1c675a421054ac55
SHA12b7e51be3c770624e7716706aedf234e588fa069
SHA256e02e879080b419eb294eeef69d83c696ccbe98e47a39c7bfed11721eb95a4bb0
SHA5127406617240132648d197c1772c2f210d34192a4554858251dd61f999d7df3b8a24d283bedb67be20943c37673437d1658a4af72b5124e665cd6342a0a9ee186b
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\css\fonts\KievitCompPro-Light.woff2
Filesize31KB
MD59c8f40b6938ac2a40f111df86af2f5c4
SHA1b90ad006a6c683a15eceab85dfc75e4650bc2db1
SHA2568815a2acbc58713dfafcba861fa0177390d6046bdc8345ef55fa9c1d21c55a87
SHA512b5cf3dea7b749352ca6b52205c10a5937ef955fad782a982ce553f79f7fef5051d40caad301141162cdcedcb2e8473563b9d6aff74d18de903baf3b3e6b1be51
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\css\fonts\KievitCompPro.woff
Filesize43KB
MD51f390cc4dc99f9b621d4047083741a6b
SHA156b828dd11fa075a136a9726e210f0208ea11b6e
SHA2561a670dd6194158fb7e45ab281c5a4d5ca35ee0f44df5aeea337c9226df6169a4
SHA51211781d41402b3e7e0c211353ae296d69366fc614efaba56f8a69ce0c74d7515fed8fb7bf1c11143f4cb75b333b6480445e8d76e990c2cfdbdd6fa2fc50afbb82
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\css\fonts\KievitCompPro.woff2
Filesize31KB
MD54cdbaf9a71aa7b69c4cbe22595e842f5
SHA159806d172c95a5515ace130d66fd8f87cf4f9fcf
SHA2566d46097697edc09f49b3b3de3841afdb8f6af7b8a8a10a58e9f805bd2370cb9f
SHA512b546f57f9bb27c66a6c2da3ca885f8fa4900417efd03fb5b7f6ff647885945d9b27e82f9d132503f1e5497d6f47ab4481b4bd1576da928612d36852e04ec60df
-
Filesize
42KB
MD52d10c260204ab0b8bbe5377ad3b9c4e0
SHA14128342038eb43ec8d5be5abb603ffe35916eb26
SHA2566e417719735a1c74e2c7140284dc27dd8080c8c75ca89bde1d8808357445364e
SHA5124e37311477f3f150ca8719aa501f47806304651b96591c3bb45c397569bcf4b1d3ae06a4b7db2c3cebfe16989887489be087eb5e4475cb708a2d4867a94efc3a
-
Filesize
7KB
MD5d9cc15c1a22b67b421893d15354a061a
SHA13963215ea03278519013d2070b0d49f5b8bfc006
SHA256af63a31cdbed189f1e77ba74fc3885c9b9db770add6d18771dbfe4cb6b720fcc
SHA51200eb6cea2b78d8cca33b8f31c0115ae11f0659635eba6bd48af49b7c6579b06ab514c57c827a10e8aaff6c4cbd922d708a437c693cc394faf571e729cdab055c
-
Filesize
546B
MD5ec19b50e559a9b27f197c9a451e1b1e0
SHA1dc7ddb18cb9430290ae92d8a2aef35b9ae23e81d
SHA256b1f0bc8de563c329fff4c162c612fb248ca331fc844450839751ee29bfa3d293
SHA512c9456238f3c1453a076e930f9980879ea8f624c1544caaabef0b062f867f3cb0be09bfa18cb9e132fa5a04f418755a37f674bd2d3192d87fb40f6afac311c3bd
-
Filesize
480B
MD58b464e714c1c429156e70120642ab5cb
SHA189f58008fc785be7e0475be7b24e433004d1a218
SHA256618398a0bb7b64a8a40867cc142ee884a6c8862f5c13306fc5f731cc95d4af38
SHA512475185c0d17ab4092da932d64d6c77204dede75ba3390d637623d196f0b0a90d89f25d43c7ea78caf82cf9db222261388b589f80d7e441e695dfcc5d84ea2ad8
-
Filesize
486B
MD5cdee109268f6239f9fa4fb3cea2c7ee2
SHA1a7e80f4c1ae4fab0db6b54958e1e66bd32755122
SHA256727c86a4bdd1a3817f0a43495e42c22fda591213fe167980862cb27e2fe6894e
SHA51276dee3ceed57d4dd8a2b13807c7b3955e9c37f64b9dea264876eaa22946430c168a424cf833e523fda5c4a3b49e536537cf2df5ed07f8f13d4a3a14a00ecd0bd
-
Filesize
542B
MD5d218540ce34212d2aa09f69a74fe9168
SHA12431e40c9d3c06a581d8ae05a045529d4c67d209
SHA25658e62e764e91cdb5d12e0f3da16395ab9e97a858512395362ebe518c63e280d5
SHA512c3890ddf872e588d501a1f5f268e51357d28d512777c945abe3c85776e32446e28b7f68078a4c7354b5e4ed034abdc2135340b38b1b60ef578068e0d15e254d3
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize2KB
MD57652da5a0c8b85bdbe9bdf382ab29ad4
SHA1291b9bdf25b182cd94bbdf8567a567cf404bd01a
SHA256e88cf6b750d4daa997910bc5d021fc4d94588b727b7d83923b3efe464dc77f7e
SHA5122bfebd2f4f92b6ca977dc7c249227f61768171bd88386f6375006165280b5061c6eed57092475afcdd4a3c91bd50d3611e4f4fb837c71eccc4a77c5b4192ed19
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize5KB
MD5036b1eaec26a749d8df6674e243d3482
SHA16e3146bda34f158c206238e60aab3e6b8e2da055
SHA2561b1fb86640ca97ec9512198e4c9f18bf9ca19fda49db01e030b41059258d329e
SHA5129e08a97e0e4017d1f3cce78fcd52e9b29a6ea21d1cb4543eb01754c788214504dc77cb0ffd277d1a7ae8983192dca9f7d84cb9d536300bb30e73da3ff590ce12
-
Filesize
673B
MD533a752211d05af6684e26ec63c2ed965
SHA1298727755cb9a5102a771270b8c2de44b2bf4186
SHA256d24043d57ed7f603eb9fb2ac930b54f6e850b68b27d5cefc2af7b5a6c1ebb9f3
SHA512a796ffd4afccdf327e649b8634fd3d03aec888dd40b0a61080d89e50de766526b2f22f3521fc915f7cdc4582702177fe50c5e3585c690f509013a71e290109ad
-
Filesize
7KB
MD5dd9dd03c6a011d63c70345aa19c4d716
SHA19ca4294206e16a63cbe90e2e870d49a101ca9e0a
SHA256ff0e77ba9532ba1ef559112aa97a478bad2c533731e65165c7b4625a9778d4ad
SHA5127d69f1e41f728485b56d658239464ec24de079619d974763acfe3c44fd2364f966bc48ccd1c48984a56c9cd1dd330e58b9cd4fcce013619d566d5efc2554b2c5
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\assets\icon-survey.png
Filesize2KB
MD503c9972540a5a494890caabbdcf011f4
SHA11daba0ba1f4decd1ee4a5dbb1b013a1f689d8cb8
SHA256b1472f7e76f85f2bdf96783a7bca6e0c7de3476974523cafe5855e87d5aa6eb6
SHA512079a2950fdd78873cdf915ca51f31226599a02a0fef973e12a019d68be489a65c5b28366ceee1f37bf077d1c699af545838581b53d83e0f2364f7f1bb6b40bc6
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\assets\[email protected]
Filesize4KB
MD53ee6c46bf174b899af5ee40231c7b30e
SHA1033384be6267fa40b9ca3e70bcdc936c18b4f734
SHA256ff72bd2553d1dea19ecf3d3e24ddf40c300f15b6d54764c7557d96d754766020
SHA5124d69a50c1e91621bdb0e7e7ee23c50fad0908d84400938b1c3e06514d27fcea7b8f3b5c52fa590abc7ef79f991f2f3a52572363ebe91d5616476e02a796cb8ed
-
Filesize
1KB
MD5bb32c87f325b5ddbfc97b1e58770590a
SHA1f11f0ce4199a8642ea7dfa5a2136f945fc056d06
SHA256c87beabefde7fffd858049d00d4798941e3921ae6b9b9a658255ab15dd76cc26
SHA5122b29f515bb48738213914dddebf9ebe0afc70fbf71b0f72c129ab7c1ed82170b18fb1e91bd568fbe2b44855b9db9caa5201f827e6c84604162fee9ff8fc7e056
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\assets\[email protected]
Filesize3KB
MD5911ef3c054d03cf5328c24f4c6fb7c76
SHA1f258dfffa5d2d0644c2d3bab41ef4fd7c1f8be3c
SHA256eedf80272af3b31075f26bdd310ddb902da84c5e55696e83891e82ac76cf9085
SHA512ae5cf07abe1f7b8dced32e5752cdf06f5daa0bd3bab41447274f1c62b7db7de2010f958d3dab2fa366394dbffea2d0df567c05108b3f994f022e9681c9be2642
-
Filesize
13KB
MD56e16094194823621770d46ebedcbc0fb
SHA118d48ae4ad67ef20e949b58b7e5e1d6dda3a871d
SHA2569b1acba079d3bb0ff8742507cf0555c648065a0f0d9b6ffe3032c010fc16fed2
SHA5127ceb2b2bcefaf69b8173ccbc34f0e7e12fa265cf62a5f3a91b632f425d2cff4dfe7e94a6e6eaf25ddb929f890ca096b2bef87d9d99a8988abfc29712f1aa0790
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize555B
MD590332f9ab72f802645c5ead71e84998e
SHA1c8b076651ad3e1263bf335ba43b460f709a67945
SHA25614b5b257716f48952922e2dc53932bc7663829886ed3b25cf121342259d53201
SHA512f1739e3da9dd3a985013fc790252d34e1179439b5e3f2a30f472d223ceb219d1a4d6fb3be77a04508783f1a51ae3c61d9b06795a074d16c1c5b92c87579aaaaa
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD5cdce2e75f37466623455dcea951eceb3
SHA191d489e0c103ae3fd44ddeb3db8bf823fedfa986
SHA256d3ec2df55e92e295dcb5c6de44011d4b2c7d1581e099d5d9e9fa9b9b26c617c9
SHA5125af971a19d73ed460f4071b8f7027179b04f9908a545a34e8d91cc8a7d32dc68692a53a0f1f3756a9d231e7bee7a08dc059400b134434504a1812459f20d8c9c
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD5b7c315931b39fc667afe206132e1379d
SHA1b093fdef15fc17ea120516a3a5897e60521d2069
SHA256b2d545a1919b6bacb2a0bb656456bbebc173af74cebbe262de6df0afb32bb969
SHA512ee939b628cc21af0d0ab934d61dfb35ccc8b6360d8d644e40aa8e2ad4a31730a10d51de00e78c7dfb18b7d94b2e6dc6d29e0cec0a29db8d771d9a38202318748
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize561B
MD54097562f037c225772d8628b2f85d075
SHA16f6b65646c839166322fe5de1462a5cdc781a61f
SHA25699e7503ccd5371be0075d457e0044317d6d4e81f96ad6d9cf540988cf810fcda
SHA512e8e5ed0c0e068911fd175119a662743c416ea843f076fea423a83e464b397bbae2243a14378ae49ca53bee2bf49639af00992d30b933c5cc152263f27b774125
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD56918d5cc0d90fd7816e9a0257e0fd675
SHA10b18a2d3969e44b7c0f0f6036f7c41b4eb89dbcd
SHA256fcae1a533dcb0aeaafe2f5438f6bb5edc19d5c4332e484f00127095cc5f1ff48
SHA512f72df90e2fc57dd374de9424cc78f4b71c329858624d4b2487e712a3eff7d86d876c0d2c0bc16f12c751a77ea3158e620d276a552ca5f552854085f67d80964d
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD56d548f7002cd22f41a1e7793f94293d4
SHA1ed2af1363946db1b38fe012f7b127afc59149346
SHA256cc82d12ef87806094256cb5838930702acfff74a21ce2f9b5cc1b38cd5f822db
SHA5120c9ca1c9defc1f23173feb04b1cacd245d8a7bfdf2f82cce10b9f75402a214863ed683eca8126c453d03a61343487edd8b5d3a45f1d60ca0de53a8ca47f9f0b1
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize635B
MD58a79ae959608684c5f878d29b32f99d6
SHA1de95f17ad9c2c29363b35f4a9ee304a17d9b50b9
SHA25637554355c4f1f9d8873776ac0c7a515e33d2d1a7ede6607b59aaa9ba431ffd93
SHA512953b8a261377b777213eac224f2d1fadde0537b991232007e375e2981eb5504b852a49eeef0e95614d44190871d0dc7300195a6aa3fdbb69c6bb41a6794402b4
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD560deefa8443b80a2c601d7562973315e
SHA14239782a0f2dbf0b4c7ec0831d3e0fa792df2d51
SHA256534597133f8a7b70e594713e2113d2201945a2f0d35d1d6a1287cf149b08f850
SHA5126d42566230048869b187d35810c484d2daa60b5523d9a17f3b0c1bedab96e388350262b3aedf8c96101e45a2d794b1d0c696cd9b386c86a8d62c622d7dabe96d
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD5db7aab43f6f5e80aecc4281c7019905b
SHA107a524f32dd17378e75e2c7a3329db2baa9c8ddb
SHA256b26bdcd193c190fe3eac9bca542b60391fdad1cf5bcf4e641a9e50d96b99ea6a
SHA512faf8547173f218515a8881ebda38f2a07a416bd37b6b7d952ec4267154c5262cdb66a004aa93656ee8ab50e025d13007ce8a972b150db63324247ff66aab8b40
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize438B
MD571a7d5500cb19b0d3a5a46a3bb2173a8
SHA1135dfeb670a39c5eed6dfebfed38d5b81b3674c1
SHA25613a8f199ca7a4237a548093ba66bf484f42899df90a7f65e200f038021290c6a
SHA5128fd8a5d1979499d45cdcd537ca7bc161261e9d7fcb8e291febd121596fea6a97a6e89a0bc3ff6e7b9112db69fae6e477e8fae0ae5b59aba08eb6a178cc0cb64b
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize689B
MD5b197b19389ab19038fa44047ed6af6b9
SHA13b1b9687c281e2fd4ce3a40de2e845859d903611
SHA2562f0cc1b36542f8db4e8e1d3231cec92b0916e21dd8bde1f517e34359eb2a0dcd
SHA512ab735b35bc2179c44366a8e7b5e799794172aaeb768e88a5d88d69226779f4f99afa8d6ffe7e4687e5fcaf4a97bd4773f06523973b0e9b2c66d58319d08ab7cc
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize923B
MD53a0c12e77ed5e21a8c5dde895fa7da6b
SHA16d7a4f46cdfe65c1b7c28b6248a8613ddccfece6
SHA256e11e7ca727b531e8e13588ee52821cb3087c43fb0018179c1177e1e1bbffdb65
SHA5122871f8e1c00ba38452bcbbe04e6b5c265f7980cc7404eec8ff6feb5e7d15b25d17ba4110e747120b853ed04c9ec8846aaae0440a2aded44278309580e1a03f0a
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize742B
MD55c03928b22388e66bf086cc0642c6772
SHA10ce92d2ce1e5be933845d0c047b6e531131f5029
SHA25635fbf6f9dfebc99c1f3229074ef1f8ded77523ffeb5d1ad600e7b9384b0dbdc7
SHA51248a1affa729e369c7f68ffb72e5d1f950b436c895626afff2948cf6d0a6fc8b0340c41ccd60e86b46d16f9bdd0f9fd4b9713b2e3f5f49de5be68ea84e9a0ab9b
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD51086a4411ced78b186dbc29dc33af96c
SHA17ff3665f9b663f7ebec0827ea27eb24d5c30e0f6
SHA256f726a498648ca6712624456fb3aa6763bcd71f8dc2cd044c664937f67ffe074f
SHA5124d30e09d4b9e586294c2bc53958b49b9d574053a80deef54b82ccfec9ee4221df28c2b3f5c3ba245e37d807d728f33473aa7ebcd18456691491bf534f9166bf6
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize2KB
MD5831749581de068486bfa011c9cf7ddc7
SHA11e16e02303fb85cb4a1dfb64f3bf3c46eea3baaf
SHA25693beb0791d3e6fdde0be76fbc56277b43e93b9db09091f24e3ea0c7c557f2e87
SHA512846d783b25b5d30b1913ed249b00ed12671121aae4a3f8e68b1c98def6f27334c8d1fdd5058abe10e95d4019f588d07ba97227d8b940100526373fcecc1c1171
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD5c72ec46565055c64f2f7b879d980fa38
SHA15a99c4f51e765327792194201f44b2818a031ee3
SHA256d4f9bb4e0b9474b48b2f981cdb0190d8c2c1a8d99e1626094575e955e5f37bbe
SHA5128dc7e988455b66e5cfd70e8f507a84f17775945f96203e03d98af267036a5375e6e18a40ef55d2104cc499c125e227dc2a89b061a1877342a5a8209d5a0e6505
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD537915d8dbe3be6d830084796ad97ecc5
SHA18919349ce9f21746817c0a0c348d496c5f57ce35
SHA256de7ca9705662bc55deb740083b80b663172bc602c58568190186c07142c56410
SHA512d6c1fcd77c5a345f7a726dc64c2f967f44fd54d34a078a86060b67d513ce36a830db8c8aa53e8dd027944d190a41bb64ee7fcb672e84803f232dac08a8b5e54f
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize2KB
MD5bdb252ef973a0bdda897e396ffab97c1
SHA113379786f2af6c322ee6eba895ca20e45216dd14
SHA256ff1547d9cec4c9578e0be3cf4c7eca85f97735c39d5574ab5b0c83b22a04dac3
SHA51297c5aac292bd7c4a067c8941e5a112ada60c7b096dc0324b94a90ac7ac1f600c88dfdd565767488811e5a35c2f64e6d6bf5eabd46af45ce895e5abe8fe7863c5
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize867B
MD5bc2d9b45da4f80700a00ca61981b1866
SHA1d0032e0d26b8cb2b3fe7d2ab6c1da25141d93048
SHA25640aabde8ccaf596e4c41d19e97d087330d60abd7b922f6350784467cc3696923
SHA5127bf7de24ed13bc1ca352cbb1fd6e3c6a0f388d8640412c48af69437c07ce1ad067ad58374a9cb69c0c0e279dcdea4e551b141e450c2747e0eb7e7a2a45c7524c
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD5b99dc482197e200e6c41d63f38719795
SHA1cc2ce172072b27afea290ae997a8660da978319e
SHA2562269010280b9738368bc553f248c9a2c809d2a9b8b861d5ce6d402857f2dde2e
SHA512aa7c493b2676bce605053c87071955bbbd04f2c58a6d693c9a86aad74a5c588c830111c8cb863a0ced44537f6daf949152b302475a8b2bc66c646cec0ddfb8c4
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize2KB
MD5bd79bbcf0e79436dd2dc8d78fa00c209
SHA134b3087cbef903f54301a117fbc383125b05881b
SHA25686ad41ae9f00e0636192d84da1f8faa3a12ff6157d601f000ae4b4d9c1d42663
SHA512745e6e06de157ea4a5db2591440014b1616c2b9d7b61e9f6c15a75a2bb16de4334beec1bf5570b80f6f55275fb6ef5d73075e5b57bad8f88e7e4eaed4bfb2b38
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize550B
MD56953c85f5cb512336d281d542a08f5df
SHA1c067d69525eda6fff9eda1d583c030f893255a2c
SHA256b99349b93302434fa19782bb776eae0827585b5a221a9936a9984561c1a9f258
SHA5121839cd143fed8fe8709d1cc1ad3bbe80a29e9208b7a6b8166b64d80e8bf3627d6c9a1dca9c63d4cb71663d2390e32eda98f4110aacb2c6d7557fff6fb1a964ff
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD557d548eaa32f80f3cbc6e07e32b4f66e
SHA1b1b98482892cdb7d60673efbf578e78963780f00
SHA2564c6537f1e37a31c2101f7b66a9480a9dcd6be01b9a3aa5793c69627cc2f34293
SHA512aa8012221004c4cf697ed86df0ab1ef16bf6140a5cb3d7cedaff0973b55d3c183c83f33ee823ed445b24c9d4a0b33190eaaf17745dd99628fce05006bf57c85e
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD5946529e7328a03dab2eea55c156ad767
SHA155c03835bda0d4253823a432365d808cab904fd4
SHA2566052a3cbd636d8a83d805240914a0e2ccbaa2ac886e58c68f3e36ba7acb2c5e8
SHA5121e00489fe0e0125b425083462a52c2f3d424e46ebbd13d78833da6e2b94ee39641e27089f798180500307fb36bc55b6f7d7bbe3e8ae6ba74cdf3803018ec9138
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD5e8848053895bab1ee7b5763fff7be855
SHA1e06d971dfc8e1ced8f35811b510d14e231b09ae5
SHA25622725a0a3660bf429ba6b94dd2f3e5d55d12c77a51d6716fc47e3382320b6c31
SHA512a8a52991de7e3bf1a7a96983521cd2e3143afe85de90489d8115c7cb21dc00aaa5cd58761f57f197d1f4dd38ae61b07acc606e7c8d807638f157ce88606d186e
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize4KB
MD5d61aec2033cabdb2f2b52b29db9aeb94
SHA1501c95a757469cd7e0a00350789a454faf1f78c9
SHA25686bb978a86556c88a06f45f226bb1377c64dd0d59d3f8212f0fcc29239c65ac4
SHA512268d1c6a094dab0c3f6ad82bb0e18793fdf3a88e4f8f19f4a3922383b5539a3f553f12b267a5f7aba2e0ed12e31cab65f9da8f1a16d8adfda97b24eb3372b242
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize6KB
MD54ddc15183541ce64df7643afedc66967
SHA171bd12e5057c28a657650c585e0930688e5e823f
SHA2560100d00a3ac138934daa169fcc63ea727ed17296b007fa50fe83d5378403d4c3
SHA512ac84edc0359feb146c3649c738aefb28687a11aab02d2f851909f7f2e0271785a04471c95b49e3ae3312af24d88a8f571b3df7d07a278e76a95ba4023152447b
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD54f6d5778be5c9f981c446f27ef612e2d
SHA18a1e4c657fe563bcad9d2249f0d1bf9b260af469
SHA256a29542fe8467c154795244389ab0f5c3a31ee1594d1e83a49547a7906fc18891
SHA5128b0b2c23bc0a33b4dda3c36da43af581ae573c2d073296605119bf76af76f343149d58a28d8a9ba30313a87de95a009f311725d5bd1734c3f20f35d3fa42c166
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize3KB
MD5f036e1e131102ce4ca424b19e2c23601
SHA12c2caa8de3d3fa327fdedbc9676879133ea68004
SHA2566875218a4a83af984a20ba4fdab4acef2af4ad18ec7c651e27af0047df1a581a
SHA5122bedae944223da91949e7d96689ee9503d1cdecf77b170272e2fa335d57a5215c03d684b4db6dd511bc740448226795a8d9bf9789579c36e597638b29d98b764
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize6KB
MD52b0551358a479842832e4184642a9f0f
SHA134d5518b380c60de39e0497b9fcf8ac525f696b8
SHA25613f2f99237cdc2426d9b66386321bd5e130fd98b671923767eb188674bf3204e
SHA512c3268f8fb0d8ef99586366bffb7dde03a42a4f92bbe83aba6cbee906a8f4f2b67a5626306b937d63861e9df3c10faf1cf66000a1eee15a745d2469cfa76fa1cd
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize600B
MD529857003fa3446e68c86682787269587
SHA173e66c08712a637d51bf7662c74705d37368a677
SHA256ff3fac0c6a196bb41c95c992a029fe3ed86b70871414b0616424fe67a151bdc6
SHA512b16820f0257a39705664d294b2ff25b00838f12f31b14345209143cdc298597f9dd7c5d4bf550223ebc69e373822dcc4040207523e68a0075b920dda19b69c96
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1009B
MD53f1278b7f86b05e5b6326986aed280e3
SHA1edbccd632813e83afc0651dbcad1ae6655150936
SHA256da8706087fc1c081566aeee8c0bada7901ba0e54525f6e1b34a0969b2a6b7ab2
SHA512089255d33c459b7182ab373f793ce3205b500e1431256e88bcd3ba78487eee19c130bbcd42c634478bc9903e337e0081ffad159916cf2fd7012d71535fcfef85
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD50d8118e89611afcbba26912026380217
SHA19ba25d720110b55b9df830bc2939064f7f2d240f
SHA25699289a8c96b0a84f67764671192d5fd824c77e0569896bc0dabf425bd1564472
SHA5121b12f57ca37a701093110afa298727a95ec6691ad640eb7dd3df3b36d3933f505bdef5c8b5729492117f8158af2b00a03114c353367986d1d840f2ed48744a97
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize578B
MD5c11afe01ac07127318a98efdaa35d772
SHA1bdd3ec3b284c7355d796d509117583c62bbd993d
SHA2567372064ec6b21fb3a15177184baebf48977c20f6a478003a1e37599912c44af2
SHA5125eb451640669a93a4b2f28930734e8d4b6ebd2675aea5725637851515c063dfef3fd3664e2d5a4f3eb32c27d6367da2e3bbb6228955ce912924d0fd98d5e8763
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize944B
MD58c6e50ee32809166290d6c42cf48db84
SHA1fe9920ce1e56cfa0e97cbc66bb75bdfd24b37bb9
SHA2565283b999f79da00db07da7546f6dbe85d4efd6a8a066030cc1a5df312e378732
SHA512abb728f3092467704db71f39ad6af47d46479761dc4193e05ac0376201b722b9f06f271fab4b2f12ff174faf5ba10ddb5055514b908dbb0b4d0ef94701fba75e
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD51b447b6ab9e97d15c1bbe8a832bcccfe
SHA1e10f76a6b536cc9e3e4d9719b2bf7a1591088758
SHA2565b8619532b5b63b2b10f4af74a34c0d51571279164ef672c6aa26acfbb783c12
SHA5120d06de74046131dfa842dfb0ca6610277c664814c8bae8fb6b8441e13bb9fe01138863b2f6c251bf241de99c37d33f2a5680e3787979dc52e109e0b528bc5b67
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize989B
MD53027c3cd48a8ff569a0b93c75d6e8f5e
SHA10c9f6e5027712d69c35c27c9b602f6228414191d
SHA256d929b3ac7b8e49488faf0f45dd828181b2426f9b7eddb819617ef7a57c9c272d
SHA5121848e5573299928b79f56825909b22a1a54ca02f4a89c60dfc25a145204e9f54e515161c428607ca375b16a6f3addf6d7b8ba76e8ef4011eca5a7792acd6e648
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize2KB
MD50fbc15fabc6f1108a8a5d782b735bfef
SHA1d72afe6d2292afb94f7b91795f30728a81a6fe80
SHA2569f40772044e0dcec968abfdf4d04d6a6f2bf3246d3313c3f77823645a77852de
SHA5120cf5f0a82422bbf7965a758419e58d78f30f1395d28121926956078c2ca4f46c4c9a77be92823949bea00c33ddc7b2bae57f11b859c92f40d8ad626e5dd60344
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize3KB
MD53e0cff1c5b993ffd58b0e588a80b3084
SHA1302a6d238324125db244063c66f089984dc8eca1
SHA256d8b29ac6fec7aecfb6202827f651b799e5d56331bb00f2d381eb32e2120537e6
SHA51256ab20e1dc5dbd1b9faa372d370f7d5c40e2deb88235c36e56f81cfd9779c4f37ffd6b95b2d3172e599b687010361e804336e5c6315657d51f2dcbfacafd03f5
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize220B
MD5ab284461ae6046919fda1ba49037f210
SHA111a1bc6407d08a1f94657ae506ae92270c0e3c1b
SHA25665156714a7a9ebfdd577f48b47bffa6b37bfd46dbc688b5a2289016c42c287d3
SHA512a451bd8c48504000a43a5feacf5a962dc9d35f078d7ea362889a357ae4230cd5dbff97fb49f00bdad760225f61ef40dffd7f2399cffba2c5a378cc64b59ae212
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize394B
MD5ff082a873806b970bad5b6a602a36f24
SHA1bb61991c15e4bad9a889f4ed6a5e1a34ba9b9a2e
SHA256b468ea77af3c97a532632324a092437b405b62efa21a5353b42ce0b4df80e72b
SHA51283858e8cc8ad3b87cd25baa0e6714c45af3c3fa4e72d02477ca0b24a7cd9ddacac2e41443e80492e4c20df0b6d8f52797d63668db66c66a06722cd18d21d4987
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize502B
MD50090628a46913d8f9bacd34b1d7491ce
SHA133e708170a544dd8a6519288fd7b3f84a8c1855b
SHA256c65724ca5c23b02e4cd803497fa342696c2b89787c086c77f220a51ee69e523c
SHA512290b53e7aade7424306cebe4229831a5af2aee375d251b0939e9f7760d49ba9aa45df9736a34fcdfdf12b9be440ca6cbe7a683efbec51488d9495a0ae2ad4b43
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize691B
MD5b29acc56f431d12f16977ccc195ca1f1
SHA14e73aa63eda04a02e5a118dd2da737a7189bde0b
SHA256057eeac5fec64b45a591842333486c6ee363179a021f852f49d97e5fae2ef59d
SHA512dc04087cc515e32939094cdec097a255e62a85e553b2f74112c3720778a9d7700aa23a5a79acfafd0ebdf96b06d86ec966b1875f6a678daddf2feab555475100
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD5aed436c69462418bab96036bd2119997
SHA15b9db67080df812df068f47fa89d71cf3a2f80ce
SHA2567c9ccf319382df776a5af1128c722755b041914c4a44f0b79348cda11669ed46
SHA51219aa2269feeb80f860ee70cacffdd97ec2359034521aa221971b3026a6aa6c5f0288c4b642df80f3cb5c573ac25b077a5b38b256c6d8c0405edde9c669d6408f
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD5206e30f04b1689610f9de339bccc59a2
SHA193c9e20d37d66bd0796711d1cc4fd685e683bbce
SHA2562eba56a6d472163b5dd3c6d8f0b4a173137153cb0f245d7fa69c708c4b7fddfb
SHA512a19a7be301cc01030ba2c7c18e55f30e50b63180bbe0924f832ecc061e25af6caa839c14c726baae22c7b978632f6cbfbcb454bbbede8f5e096ca84c53dd740f
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize808B
MD5aa7524bfa7c2d7f46ebbfa5d3cf7a87f
SHA1e826092a40ad014355a5ae5422e7c8ef0bd9d72b
SHA25662931841d64e59b3eae6a4c8fd9b0a2f9dea12741a196ca389b5229e97b488e2
SHA512e56e0729d0ceb8e67186704bf3b2bae7f36d7a75f038eca65e28f34fd199f4692c825c5cb18d3c7c4c7e45ccf4aa842277752689a382cc8c81771eef5f5c2304
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD50b68f4cb69ce2377624731863234acec
SHA18cd003375e3add0f5600cf9e0540c0b553e54a33
SHA256275337c2b63d14d2f27edfc5390d890efa7578b533976fcb14e90944abd49a2f
SHA512cfe42deada0c5ff743c72317f51e2bbc59a1f1924c661af0ac65defde3bc9006b696161997abd8e665e70be83920f15864840d3e8b6511fff5cb826b607858b5
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize3KB
MD5f4f077144cef59c8879aa736b73f1001
SHA1bc23530090602c617050ff81295e0f6653120be5
SHA256b89deaa23e8738486ed8f7908c2c145ee3eee095bfad9c845803ebcf3c931b23
SHA5129511b5841d23bc0544868a5afd089ed190b2fb3cc2d878888e61bfff774b2fabd05a674e22d76f374c1537f522ecdbe5ee422deb337f68eb749b3b6aa42484a5
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize539B
MD5ac6e811a85c64b90bb3a12226a26cdbb
SHA1f36fe2a40c19f6be7fad84d0dd925b79a43a9996
SHA25622c73e8a87c2b462f13ef7ba4d8f0fbf712f947adc0eee9adbf452d971e967dc
SHA5127c2d8666374ac06a74314681986a59eb6aa32543e909c42c9ea20ab31cc63ba1496f7cefd9c04d79c4069caf793294f44d6a29119035813c1e8e02d1f9e8bf6e
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize951B
MD5ad9b6c3ec6fc679b82633bd5bf23675d
SHA1be96308abbca0005dd9e21f671a33807437dd12a
SHA2566a75b4220861599b356288cca83fe346fac5f63faac49535e09c12d4dcbeefd3
SHA512f5444038c2eddab8ed48e821214d58dbdb91bd4a7c6fecf35ba1ea6480725ba328d2cc13ed1fbcc50d5eb6d3e2b8b77cd709d48ea13a6e2010ba18f181afbee6
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\cardProviders\icons\[email protected]
Filesize1KB
MD59ca721401370229bbe93fbbd7db54282
SHA16b1b46ec7fbb5902b63692676529c6a4edcafeaf
SHA25608474d27d02b202739eb0620aa36f7b4cddd5357fecd7624d6c6f1d55a18d659
SHA512cde3c29b462f6a6514dc713cfa33cafa91d20873d7efa78f7496dcedd5f4751e55ce8d0274034d430c2c6e9fef570f928c3ddbaa94f3091955a682b8367c99c0
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\ftu-animation\anim.png
Filesize36KB
MD597c2ced412c847f5c8f1673d69e802b3
SHA115bc0d31606a349bbfffcecb95f9ad458a451566
SHA256403665a1b3d0723cc096622564d6660dd1e59a375f8c2149d8a71c1eca43b922
SHA5123d9339d243fbbdc3010c997e1a398f68761f740ccaa5ea12941c8ed68798f57a805d86f6e15f4114ccd5ebc46f615f9a545fc1680e10f3ee8ffae2f9e39aa19a
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\ftu-animation\[email protected]
Filesize67KB
MD59e7ccd97af6a47972e2440ed33ae1b26
SHA1d10e51a451628126cb4f37268430a728d0420f46
SHA25664b731875bdac8a842626e991d4ce63296133a82a83910b36fb6b92c88c21a08
SHA5121f56f561a0be966f7a57be15fe13f76cc8c37d11deae9c1be919b2214b64a8dc57b6d898f13f95aee7e4c24217db6bc19969e208e5eb05d85d629281db399d6b
-
Filesize
60KB
MD548ae450a7dbb4ad131d9cb4573f4c5ba
SHA16595ddc89f08caf4ed1507cc3e06083a3c46c383
SHA256e0faf05eaafa0a4362846023b90cb6beb54a5e4591b6152b4d671e6ced095e15
SHA512aac113a381dd9f3db0b936ec0f0a81973b13b79dd9bc4010e790fd406c5ba4bd24b65cb915e08afb07ac836878e803f3c56f42da12e5e7f67dde31d4fb0be435
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize188KB
MD5ee82730fcef8e738a37246f582c76456
SHA1bb1edbe0b4eea672dfe20ed24310f3e98cb46b6f
SHA25606240a958bd8fcb9174bc5853d8359da9d5faef86481f0cd26758d020d6ded98
SHA51299ff0afc975aedc13a9e1a13051b1c0b75c404d1d94553236bd8ddc77b08c05f2043761438d1d08b4d1d49fc3c01f5e7a6fa8a4d3de73282a3669686371e80eb
-
Filesize
4KB
MD54622254c2ec90ccdac3c14b7c2c04552
SHA10285d597063f4648da731b9072086c7c9f9c59b9
SHA256fcdc822baeffdf19057316f6ecf06bc6be8909cd498b2d95c24eb547f35106c1
SHA512bcbef0e105f5da7b1ed7978f9ba577dfbf1c7b11bec663b1aa07be25f9caf681c618f17f7496c7657c9f0c9559cc381020bd5ba2f12a9d90d82d2b634e514675
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize14KB
MD53f0b852f82c36c062b261d843858f323
SHA1a58f32e02f6d90a6fee6c2dc98583dd9fecdb05b
SHA256333e34b4e2c28286a0afaf4e2ecf533193d96bc1c28be960c7922c8f640c2573
SHA51254451d1cada4321e063ccc807f0d8cf3676d6a719fc1f71ec96d0fff073b3db17c489f4a9232bfd066f5c799055dbacb83713f5d15b8dea479a6f5ac0b38e4ee
-
Filesize
1KB
MD57284e4e8871aa13afb5cda71c2b9ef1d
SHA1d7d3a158e119afec0eaf65845b07a0409e759120
SHA256c4ba2bfb68df9c1a10d2225e8b615f9026f7aed8664ad8c5361477e6749372e1
SHA5121b49ae47003a7b7e6a45e76f3092a01f65a13a31c162361ed31e6531f858eca72e580151d75f7dd218f908e923289ac543ec7f4003571b0650fae58c9a40e54a
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize2KB
MD5e5c9c16a3f7252a4e3680fbab599e0f5
SHA151eef6dd16f62c047083b45e4887a0062614b3d9
SHA2567d7b1552797fb09c75b8fcb5ce34b09ba81a3184c5a30541ddb4eba44931d6d0
SHA512b436eb705586a0dc25b7f693775969c2a0c649ab67c511d08e34b4ca3ecc9aeb9cedf3b3c4d2c1b987c91c740c7676554107422fdcb243dd70c1f47ae0934c94
-
Filesize
203B
MD5cee947a245016421ba6718d4502f53b3
SHA1625a2769ebe0ee769197fd8723d54fd311e5098c
SHA256a23bd7f8007b57a3e8a27b00d4bfe37ee70eae74236cf419ba67c6166c746dbf
SHA512751a0b76318dd30f4bfe943bc5a54d36dbc353e7875e1c1428fcfe2ae0525987f83ccafe11c2c7e0828414854808962e6a3d0094d7b2c14be735956936a9713b
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize1KB
MD55349afe9099d5a54d255e09668f98b3f
SHA187a6bb59f22da6bfac260fc71a07617198fde887
SHA256d3f1e1eafa5c7a04d8a5bb30e15b2ef4ec10995f0940a667b9314fb89d0041e7
SHA512c42297b80e379b877a8807a78afb2c4b05d195ac3b029ad1811abd8fcd1a02a74a088de0e13fed28a332be84d7d31a98d23cc29d7ed28580a715153a3028f708
-
Filesize
142B
MD5089526797cd7faed8b89a8082c7dca91
SHA1737bc0c2b94df084051596624556aa7e5d44bea7
SHA2567222b4914554848cee5f6be58b51a81a412df49f511737ce1f62faad1d6b83d3
SHA512eae1d9bbb403ed4b130953e4da6288ea225a458e009afd59012848aa2e6741ee8ead30f56af0e23e4f7ac5e7455ad124c02c3b2d199f6162a24ca0375b2b1058
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize171B
MD5dac8889f0b4465c1b58c76ca434bb0c4
SHA119939a67c9e9cf35c4d26ccbf448a2a27a6d474b
SHA2563e4911709fd9c6639fe9d93186e3c4bceaef4dbd9d9e9a8b3bf4089dfff2193e
SHA512e9fa7f2ce4d642d421274da6a10224ba749b3a814ce7e285a7e9ba281bc9086ad23b2be94244cc8d1635f84eb4d97e09eff8f7a65aeaa7a05231468f496797b3
-
Filesize
928B
MD5a190290305410c98586a54a4e3febea3
SHA1aeaaa600b4c22370cc1b25f2c49078d0ef0ddc39
SHA256e197cbd60518c928159573a8d49a6cfefeea94de62b124272bd2ae2052efd5fa
SHA5125259a1d05a8c7eea18d940198e795c1adaa261807cbacbbe9ab448e8e9d3184ebc0dc3e79c6fcf25b381c8d1243ef598540adc67cc16fde7644eb5b9f286f4b1
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize1KB
MD56680058302015aacbd62ae0357b5bd89
SHA1211b4eb807e102b15dfde6c85b9448aebe84e8d6
SHA25682cfbe50129804b1d647bac2b153559427ab10d63233254dfb528eed59a5559c
SHA512ed8ca0b8c07cb581c17f2477291fb8fc4716359ef0be7950159dcf0a174daa94086511fcc0c79fe0825c7ef8d651c7dac198b6198a4a2bb450c002ae4fd27ec3
-
Filesize
778B
MD5772d1359b09882ae41ab3d3bfb2ccf7b
SHA1f88d35d69682b548f6f4718f7a58b0c8bde638f8
SHA2564811df242745523972cefa1ede313152be609c30e2c94adc276143b47421e522
SHA512c64acfcc0e3a4cef06fd762d3d5a77e11e4e3d20a105b81601c437e3ec503d9a226d77fbb9deec93fadaeaccf2920da955ca5a4e270961edac0ad6ba437093f4
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize1KB
MD5f9bcbe4add4290a1c087a8745a01a103
SHA113cecd3a1277d78422030bb791a97e9607ba103c
SHA2560deb228122c458d9c2c8e84f04b4ae69d5c0322eaab3b570e685e2836ecbce91
SHA5124e754b55aca2e0b50e0397d4cd1e2a43d7424ae20a721efb5bbc5638d9e4450f26078674547dfb867d32b11d0d8697c624bc50785584095c8ce1fccbda70d2c4
-
Filesize
237B
MD5d8dc5c941c2adf4b6e4600d84ee61571
SHA11c32222ce15150798f71e6610de33746eaeea5cb
SHA256fc96ff627e5cc5b12adb131adb2745d4884c0fd05f237808a882cc1a66370464
SHA5127b87ac1abf82ba4291c575b138b8e7ac6d722a05d713f9e2245375cadc6fb515ea144e12055407ce7fb6faf6b259bb52124fb4ce80e2f7d5dbf1d15b51fc8fcd
-
Filesize
3KB
MD55bf73fc5729ccc1eaa81865cb6f491e0
SHA1877489af9c0ff9bced96733107a2c8ca260bb7a4
SHA2562929cf9a58fe263184f9b60d8a9b27af2a4b85bf978fc3bcce8ae05d9c721f0c
SHA512c0246398226ac1f75ab3c628c3b426b89c543eda8f833f3fedc8ed8a90714ae759c6a2ed0c7d36d605e554a7f9aac574ea7228e598d5c7acf1d5e4ba455dfaad
-
Filesize
613B
MD50c5c7af961266d84291146536c9ffd7b
SHA1f51c32e2ce1a78d10b3d6249b616cf8aa0ccdb52
SHA256549365abaf98700b3cae8d626644f052c03e76bc7ba0e96e35602ce5e23f2714
SHA5124a68700266f432c2b81010eec81241e14bd5853436d6dc964380db48c68cd9723ad84d41e61c1d6803e9952b2908d36d3b112d51231cfa40f323af674be59db2
-
Filesize
456B
MD5473b9ee24fce0e320cfcfb4578fe9cdd
SHA17fdba86b9c7211df9eb7238bfa4fe6deee3233db
SHA2567df3ee7136c4fc04e98d11db5bc50aa3214c189b1675892ec82e13f6ab6d7ce7
SHA512d47c8327d10db56dd7fbb50dd7c66d767c7713de87a99892535be7b4eb949f5da1cfcc506aacc6e4f86c780c8cf41ab19174f0c56c0f0a4945cb3aab9b103e90
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize1KB
MD5d6ced79fca409c098f0dbdbb78c6da4b
SHA1cec3f5732e96c1186d8af4a1eeecdb28ae7d300e
SHA2565b3b7df3cb822ef5f823914e10d22f5e2f9f8aeca023f4d6cfbdde970616e415
SHA512aeb01c7121bed5c7e93c367d1b2c05b4f8b1b6c979cce1ff4e765d5418b4ddb0763d62065ba7f9f26c362fc2fd36e1d6f17e89927fa381654da80bad2e07cce2
-
Filesize
1KB
MD507324dd94c7e256df7e728895510cf07
SHA1027f3e06b13bac82e61b28812f2501ecbfb3b9ff
SHA256e69b0ddf22c99f305864581ef06a6f421f753633c77975d881a28e403d22eaea
SHA512c3e99a57043bf892afb7737bc515dd37378a833e59436b16ce8835b7eeb3161f109349a4d12e4a207d6d8200aae361cc8843ee3a6a087f35afeda8accda8b390
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize2KB
MD57c5bd65bf1face43ffd5c0da89a70a27
SHA125cb7f2cbbd01372fe68dfb9cb0544f59f041b92
SHA256b767b5120819f6915a27bdd47cc24d117fbb8e9581be4c7e745970a21b8a1ef5
SHA512f48016e1673f71c4a29a6afcb48d1e45f0d0f483a7219476aa1c8d15c39bf0f79367e8027a210bfd87115a1cd566c113be9bf4f03154b3708cdba47cb043488c
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\icon-lock-open-gray-large.png
Filesize996B
MD5037dbbae97f954526beb6601468dfc43
SHA1613bdae219f7ffc3e64dc125266ba3a1c1b7f5a3
SHA256c104e7dd9b03efd27a1ca85c444a908a72f3cb901d92d5d8c0e22aeab436b288
SHA512f461ef4885965ef9f164959b943f8d4c5f4a908e2aa578fb8a9cf435d3fd1a62eec0468868a7fe9f0b092532b9f3681976aeaeaf58a3362085ee02edf6f2bb9f
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize1KB
MD5352fd72a0fc01552c8eca76d3b09d522
SHA12b95e0a08bcc949444a56416f8cb853f5da44b35
SHA2565a907ac796ae7774f840432e56d44b266448cba1ebdbb1d55ae6015cd1dedb48
SHA512c729e67391e4db3b1d12eb7550b137980fadfa0289cbf8e57c6ce1ef2b5d46f1b9a6dad504a0f3bed96aa40f70accf47f3f0e01b7d89ace0d146e40016832018
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\icon-manage-passwords.png
Filesize721B
MD577cbddf30b5cbb7bcf395a19aaf190cc
SHA1763a28cd4aa9bb5e72528bd1438e5cc64de6beae
SHA256d761d2f60056c0cecd1856a015719aed8f97efb71c42369706169f7dc599d8c1
SHA5120bec71200c3963d426a3d4acd95bee9c984d89f5879e2d5371f329f1ebfe9738e7b489b06d11bef263e1e4a7856ede7720e1cee228c5c7e1f63ac776feb3a123
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize1KB
MD52f9f50c79cd90cf9bcd495cf12591e04
SHA1c31dbd0853a7429a5f9a0760d745b13f054e7236
SHA256605a7465d033e8c42b90705b1ff58e402aff21b368e11c6bbd834c66fdbcc70f
SHA512dd6d2512a13de7425cc74587e5c3e81e1cf06e0dc208300af95624d78118c545ffa0ece0b6c6fe438328d2274ae1573f20fb4e854cdff2748ceaa91c0f47aa43
-
Filesize
759B
MD5660a4e3059bcf02b9609b63037d03d2d
SHA1d0002361f09d63fb8eb7c579e9dd8ec6e1af2744
SHA256a09d4a47317587d47b69de72ef7fa9fa6859ed63bf67ce227c46fd26002747f6
SHA512a59a40fc8d2f509ec1e69aeba77cb859bff826dc0be8be46d53b9de5dd4b3df8eba55e99a6ec3d334300842a545b577189001e8af2603ac43a643e6c383f3219
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize1KB
MD5342f9e6c37d4bb3e5df8e6c6d33be015
SHA113c662fc82dfde2369374712084390aadca36b16
SHA2566f9e35559d16528712d08d849f19769a64a56c6ab0508c884bf830ad2ecf7bb5
SHA5123e5c26466f6b176ac3c73b7c04a20eae85ed61a393023e007f8dd327fcce6794c88c3e04e5ec0b4d4e5ad328836b200e8f869ae38dd6a3de2c69b2d50997d6ff
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\icon-settings-gray.png
Filesize1KB
MD52f455cdcae976fa1ea3de33be7fe99af
SHA13623f8286e0adcaf1a82c41a3aad6260aef3c352
SHA25687e510ddb8454d68d2a62a2baf36369cc1abdea91d972d699781f603f22df757
SHA51237b6e38695aca8a1a72b7d3483d84ff1b12f553ee01a46729c17a13df5912949c4d48e4e6d25c2ae65f0fe2e647d616f8ccfca6bcf816a88119382bf557bb2db
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize1KB
MD5df81fc5582baee6470898c591b566ec4
SHA1393e4174d2933b1ad6d245f362fc4690612a013b
SHA25636018936c2801c5c2f9ec3d5c668967b373961ce8171b8c728423c902616f977
SHA512bfcad186317693efbc7dc5ba42f8fe3394fc38b79022f18772d82dbd6129922a59455b240a415bb87e8133e1fad253839d3c9517c69535874de041dc83f1da9f
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\icons-gray\128x128.png
Filesize4KB
MD532cdaa480de04d055cea8b7f63f24b62
SHA1b5b47fc982bfc40ea275458efd278bef26feadaf
SHA25638bb4e18db551bd40803ee058a68c9ba327c9148884c8104218931832c592ce7
SHA512c818320f311b37907e845374bd68b5653b49b83a4659b3fc4ee3d97eb6d77c6bcbad1397a47c8b7f83911f76c9daee6d44d4da961006fed221845189557cb6c0
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\icons-gray\150x150.png
Filesize4KB
MD5f2311a9535e3c28ff057532706d15945
SHA1143dd0aae49e00ca0c770af34c92cf2e994d22c4
SHA2561edb31afef48db86ac5c5d6dcb62f2ad993e285908fdc01fa3ce8f7680686f4e
SHA51298343d14cbb757b3e9c0df36423762bf941b42a078ccbb6615a1d0b0f1a2d84f047ab428bc6c26a1451e722c4757cd56ddd67fe19adf91c6c2cf89363216f5d4
-
Filesize
1KB
MD584ccbe95bd88005da7ab4ba78a65ee23
SHA1e50f4143f056c81fc944ba642c68c6bfb3754d05
SHA2563901190429d527d427b5e50c35e4faf61bc39ca3229c0e928117afd73c2fd62f
SHA51291b3e278b50983b41a6f6fdd36d3538a987e7480571fa941bac19d0fdae7837e3dc3ce2d16ee8b717b6dd8715f52f8435de1124042c6f93672728479d43a316c
-
Filesize
1KB
MD55db55f0c00bd631a553af0609cfce0a4
SHA14e1629505475d4214d85a9a37ad83ed33ceade8f
SHA256d3d9628db7687be8deff5f25ed67cc2f22d6ff8a76007e352bc85c5f479dd4f5
SHA512a172ed2c29432ca14a9a5fbd4393ad8d66d728ea0212afd361c47713cbdab0b562b4460685b3bc5f272539ae91f70cb16d429037cfa735c56e8548d7514d2929
-
Filesize
1KB
MD5db9ca9127ece67b28d557a57f75aaeb4
SHA1b2d03e0a1b46c4dd88b186869847c662e9bb8219
SHA256af5f32591bf069243c5b7f9c4428cc535ccbe9275035530f27142f6b80c29f8b
SHA5126bc0b8994ddb0e42c08fbe399441cceca1089d4bd60740fca3d0a43a7d80c76865cd5f511f707a25b5d1283d5baa6b2288cad8518760dd4bdd6722cf1ed2e5ea
-
Filesize
1KB
MD58b9c41f6eed3b1621ce81f19fd443555
SHA15849cedcdbc0f3535e3be216934de5adf39793b8
SHA25622b8ce97c45aa129ca843a5755face36e44395e908b663fef5040a3cb51b3cec
SHA51260dfb3bc74f7a02a5b3805f9042a1c68981f3c02179ed140ea5cbba555cf8e37aba5730c96d0100caec190e068956e69454bdddac831da0a0fe7678bac0184b9
-
Filesize
1KB
MD5d4ec84b27c2207faf5eeec5b36379c18
SHA19d30cfaae152bfc32869da96d11b3ed4138754e7
SHA25621e5b64df78f8f1d27656a17eff701111b9b33224a4f383cb9decd952997bc23
SHA5129aa68af818dbe1644d83e5c30dfd6d0f9171bf01f81dd6c6699dc5cf9470eddf65741ad6b39ff8747c9402495bca58e2835a792c5cbcf138b1aab6b1e44dd2fd
-
Filesize
1KB
MD50e053d762ae1b6a5bde27df1e865c1e4
SHA1b164fb688414c7027b257e89ff593a66a347b6a9
SHA256289b845b05106882ea198ee98c583d92287618dca7974282ad9d86a22c5d01a5
SHA512131a824c25ec1c8eda4b3457bccd0a08347e412cca76f200b946ae6367f8a20db73be681e950e3926866b13a88601dbf530220166ea52ff9df084406d9d1d77b
-
Filesize
2KB
MD545e4bf6f710b42bc11893c852727b94f
SHA138a374c9cc64250daca751a1e9869ac7fda951c9
SHA2569107759096cc8eac7a639651b45c8360ddebdf0474cc722ed2d0ba54b58d1e80
SHA51278002f421454ecd7167fa4483544cb7622e22871fec72269f777f77ae7382d4ef14d3d5b5718ae52fbd1fd65a262c70a255fb77f8b66b1b8bc0832d26c7b3d87
-
Filesize
2KB
MD5b441b317356c8ce4f3e5afe170487d6e
SHA1c8b7b9409053cdb61b39b83d41954e408b3a71b7
SHA256458aef4bcddc51de25043d5f180ad0c35da78c6635d7229ea939e49f52e5cf2a
SHA512f6f8f4abb09472ce44fd618ab1159f1b7bb8802ebffb57c50613af3ee726dbde7f031d0dd52825d8ff0c924210e0e8f4294425e3d57132a7f55c98fa0681889a
-
Filesize
4KB
MD5ef8a66f73f643a76960475622736e51a
SHA12c78867ee975f9ea3afc678cbc4027081a37140f
SHA2569bd197aa852b67c241675c8203fb594fa37bdbe92f86e21ede3096f7a61663a1
SHA512b1515862f066a18c958ff9ebb6e55ee1676bb31835533a4275cc2cd29967f4566cb0a7af7237588d27f9a4db519ac1b6bf04800cfd469957d01626414f03295b
-
Filesize
1KB
MD5d357966e2bd37fce2f12516281ffca25
SHA12d04720ae16acd8089e42e53d90d9db0c112311d
SHA256031d16451756a28e098e0de35fafbbbd9d5d6ad85b0104c0a39c285d8f951fac
SHA5124de28bc73fac3e19efe77f8e53cf817d12c0bfa0b5632548abd67600cb376ee18149781b8fee0ef3dff7b26a8920450b5f7049cdd2b6fc7d76cfa5c81ebf688d
-
Filesize
1KB
MD58b4d816ed19a78fb6036264ce3aaf9fc
SHA1707a439b74bd6c433931dbbafed021ea190c7861
SHA2562b82d3d1ac2c9dd120ff0dbb5fcce381c9188c66d5ff5ef9d44d7aa26d02abd1
SHA5121ab1fda6ea07b741c9e8e3ae03463442d65d1256203c8fb781ab01fa2601c93a37cb4762457ba623d308a8bc0bcf99e6d12e486bb7bde604031b93c229a17db1
-
Filesize
1KB
MD59bff062e9e4f6c042ad2e84645667850
SHA13e8161f7089a68bedae43b2eb570e04768658e72
SHA25659844913c14b6a00ee70a399da34049dc8bcc129afa12869fd870e35b6e1ddd7
SHA512839de0c6e0fc46564c9a00c79fead8fc263de31398666f1d8f248e64445ca9bf51ab1c22047710690b3afbaa873f37edd88583fb562fa226e61bd305cb7feed4
-
Filesize
2KB
MD58bbc340dbd9b5f6eb5b42afc1fa60ab1
SHA1a3e1093c173a00559221ca5c97cb4b5e79bb7606
SHA25699266f9e809166bc5e1432fd65e373e178ea4a185fecebbf17d6b17e7d604ca0
SHA512758378b2543b4b840d300088f4cabbc191a41324f66d56e9b23b13ceb1af771f17e2ab88903a3f150d9fc49cd27c4ae52720939ce03d3c26ff3f7b74238e4ccd
-
Filesize
309B
MD53895bb0b2b33935ae386bdd0c8a6dd5d
SHA1168aefa8fb3a8d4afb6c302127418ec48c388b46
SHA256401647f062e788d7569ea2e55836cffbec3bcb71d05b05ecd922e4d8ab8c06db
SHA51281d9af6db2810dd82be3f104eea92b4392a74c27a996f3479ccbcb599285558c9b13d8ee28baf7381e62fcc142ffda6d82cc47448a159a65ce7b4b81f66dc326
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\logo-password-manager.png
Filesize2KB
MD5833fd8f51be1c48926c2ec18bb5cdae1
SHA17b07c0ee94fc37be4681e10b5f218d7ce059eda9
SHA256e023fdf40b211c886d5e3c3488523baf0a2c6451e5c7871951799ca764f2164a
SHA5123c45cac2f4e860d1fde138207049d0ad732fae9f7678036883151748f0ced6bb96e96170cee31ad349db2a6c30f40317a3b29c944b56e8e6c2aed7f7f67ba8d7
-
Filesize
344B
MD511ba61f9f71b440e9e023e86ab8b7bc9
SHA1dcd0d08f83633dfd070a7230733e3bbd591b2857
SHA256e12026c3145d491de0fc047dc521207ca00c9ccfbe22495abc55e7c2ad893f23
SHA512cd43e3781fd9a2136d18329b03658259ff69e68f98b93f30c61e414056bc23054ed0d3751fc0a660576efc4da329a6e2dd420fa332dca0ef7e58e16bfcf6be12
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize496B
MD59349f3c9af653b3b52d4b4e32c938313
SHA1bf6a569d15e6c8316ac736dbb3b879371530fe42
SHA256e6689643923eab2fb2bbac471f36d4be403c99e2e7f880e4f8a758ebaba93e58
SHA5121f3893480da58f34bd0d6701543ebd43a1b9ad62a7bd1f61064e2da586572ce61d326b629b9b9b24cfb2c89698f10d881bffbba306558b39f6b9b1507daf36de
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\number-one-circle-icon.png
Filesize768B
MD5ce42269869ecb32d7c14e5bc958059fb
SHA198c67f94ba00c4ca6b342b3222887c47d6a0bca7
SHA2566aff8dacb102ce3d5fe75353601c32ef35b0bbd4ae5bcd25ead097781f3481c2
SHA5127b98837932ab1924aec3aee82faed774ee0f00eb8b715843689e4cd358865b23ab93854baf7788c3fad03938b395b2e962c38f9419f43778ecb296781e9f8106
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\number-two-circle-icon.png
Filesize862B
MD517da3865e94194650475196d296f8579
SHA1a7d04d7963b39dd624a21a5166032341e75f748c
SHA256f9148660ae04f47352d0fc055c87cf8b46cfc5fc0e9c651a96f9628768e8db34
SHA512dbb3b3f0982f67945e5212f7a1e58bc684c89fee96902f271ec0e08c6a95b68f269032d35447c66116fb1c30e2a4f97be557d4544b4d83c53ebcb6b14436f015
-
Filesize
64KB
MD55e53314ad9c8e93aa8e94c6148864a7e
SHA1af580dbdc785fce57b97a878cfa5e48143653f16
SHA256b4c98920efc1a965a1fb3385342948b174a7074c0e041ab1b93f7fe3cf6f625d
SHA512ea1a77993e5f34e16efc090c377bae1941f71640657f4f054bc2102910d52fd801aaec4812b6ae09952e5adf4bd966078d5f0dd5c111ae0fae7772927c80486a
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\[email protected]
Filesize168KB
MD566040bc85cb7d4f19efba787509ca654
SHA1cf6f64b1868918265f0cace6acd4bb0bdf358e50
SHA256e104ea9a9abad73e07b695bd44ee42aa1092e81464c577cf1e6c404aeade72c2
SHA51241262109e9ab828c407bb6bd696e0a9290c40ea21aa00a4083b66de93be963d0d162f78e59bd0123fba3b7b452098e1d4f3ae0c3e560514de0b3cc17f4d5f373
-
Filesize
2KB
MD59365ddab7dc17fb2e4ad00a8347238c4
SHA15249283e15939cbbaef45119edc92f52ce04b0b3
SHA25623769936799fc95022467f85c9b4acd00995beeb1c36f09aa60ac48fee28c4de
SHA51232a2cdfc52da744a8060604b2c5887f0b7cc4ea18e9476d08937ead71c6ed0eed21d4e211900efea378d8cfa222c7e1f78d3cd6107c21e290b7921664ede9d92
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\tutorial\3-browser-with-extension.png
Filesize11KB
MD53be032160b1046738c13f343e1918b22
SHA1d17316574e26f6ddc9127c3f240f3b2d974143d3
SHA25699fcf93ac11b7726868eea3d72d916ef4a19ba0651b7dd6bcf9a713e9d99a77b
SHA51268d5f1791109039809f4714461234689adfa2f39e0944e222908f78329787797e0939788a6c613da88e69b36b19f2d52a615385707205d93c58925cb1489420f
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\tutorial\4-pencil.png
Filesize2KB
MD5e4a5ffeb1b12314a9051a694bad16915
SHA1c065f29d37bc183fc7e04ef91093e83bea795d93
SHA25672908c9c045a2ad16a3cb1d0c6fb3a7ee362d72c6e4eb90b26649794aa1ed3ba
SHA512e100fe08777c1380f7aff3f6c85ba2b7d41cd0dd6978e3d6dae08c771fee022a7cf5e4d2699da000ea7033eab15a3c5738ed755647e4c5e5908f0775161dfec0
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\tutorial\5-cursor-and-boxes.png
Filesize13KB
MD57a54b0a5c021c0df884b4e66d0848468
SHA1f95f8eb5f3e25aa5132fd5a8964d17d6b6edcbe7
SHA256f61966367ceee7e09ebc804f6420364c17a23b269d6f14a3c3bb701f29166735
SHA5128d8bd87fc2bfdd8f108ca565793bdb29a1b771e1a03e868f9c5ca8ace1984d25ff170302c29b9622c3f8cf07c4c6ff9f43033fad4f6a1a7d7e6186b01adbc616
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\tutorial\6-browser-bright.png
Filesize2KB
MD537d8123ce8ab75a64de4a68fd6fabc5c
SHA19431143b8fec9cec6c9d21ae23c168b4dcfa878b
SHA256095028404641396da92c452797027b4abf9048438f554f53d80935aa7d748717
SHA512685fb91a29fd69934b71e593892e2a5a359abab217bd723654c43caec065acea9d8d23d31d7a4077a641ea51ec37e49748a6d4c97cd02718f164c575fcc8fc5f
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\tutorial\7-allow-permission-2.png
Filesize18KB
MD504d73a77a1ca0464fe041c2a3c505d6c
SHA1849b13fcbe3569bb4ac29a13c0381f24dcfbf7bf
SHA256192e6c03158d0d96fac7dda190ec54945de636e6a032a7d58bfdf4dd5b4f1349
SHA51242e8f912328d0a78fe3f3d8490ff3afe7481b530486b37ee94cca50b56732fc75230d096091def3fd1d447493e6017876132e9e506813279bc67544dec46de9e
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\images\tutorial\7-allow-permission.png
Filesize17KB
MD5eb949169fae4e711f11573ceea7e640c
SHA1a3a641a2e2029ae5a99418d4104580f9ced6ae40
SHA2562ce139fe67123e63c733bd23558b4258d2e783b88a04d5df64f74d7769a891f2
SHA512ed3fb2e58f22ce648fdaa36cea8191b3bd51e58d5b8c8d2dbbb550619a597cac841b1bfb8db0b6db98000fd30d713df60d0373efb1bb97c477f60c39aad9632f
-
Filesize
7.1MB
MD5c8ee9e129356d61f5ddef88ce51c9fe9
SHA14452e1fd66628d843fb1ecc6d1a311071dfabd28
SHA25685c79d6e7a57e86d96d9dd92e3934b8d696b55ed2228200b2bd3559c49f9a1da
SHA5128d663d23e1ee609f9b2ec0eae384797c31f8c4ca7d959f707ffede52bc90188dc461c20da9f359e880dbcf3571bf292511d4052f8fd3fb67f000e9cc00be0e9a
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\js\background\background_worker.js
Filesize4.9MB
MD5e69cb018735555c083f50d395f6a87e0
SHA1a319fecf3af56f91f0c3bde2d2661fa48f82266d
SHA256fb486a4759e71c92af6d17f69a000430a8badbb6fd7acb8c8813b248b1c56d73
SHA512a842165b767c7022c1cbd1210b14d66d10a908d7e4ed5295f5ae5dc428e6ff6bbfb7186438b341a352133338dc41b2ae0ea283aa99264cf830a428fcd09c464b
-
Filesize
800KB
MD57aa9688565d59c89ecc94c98535416fa
SHA1bc0044987c6a42ef18a8061f51945e3846c31e81
SHA256b78ba8f668e25a1575e072742d6922124ccd91431c7adda764cac82e6474b52f
SHA5128ba6a66d9c878659d0347ffb1c8e261e0aa038b48ce97158bba3a787017bd0f313f88c8cf23ef4711e3c4054a713771999e93894bf51464cd38b3796543dba91
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\js\content\app\inlineForm\index.js
Filesize3.2MB
MD5f7bad2c2ea67443c0dfda0e40d51b5c6
SHA1966b18addb7494095eb41548fc01c5c85daab21c
SHA2567ea933b44f7b95601c1dbb5725b393ba55197f5ee18eb99bfd1e9b7ac8f04822
SHA512363b63677e07689d771eb7629fab26ddb5da8000e5d15d3f205d1e1813d135f743535d818f96087c8c9bc36784a08dc9cc38d34b446e177b124defb5499a5e6d
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\js\content\app\inlineTooltip\index.js
Filesize2.0MB
MD563f07ae38e2ab4eade34783fde3d3abb
SHA1ee6e95cf741be30700acf7d9c38af88a2a4fc614
SHA2564c6eb20587d62ed946c5269aaee756e3b47065dabb2681df9fa9207f55fc50d9
SHA512c9bf11f59fd51ee26578ef5e4061a0531f873c587c1f2e525905069122168a382800379a458a6c85ba18aafa9fe56ea0c155ae1add6b1ab2f8bcc3232135a887
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\js\content\app\notifications\index.js
Filesize3.3MB
MD54bc3b1a7eec66142997414ccdf8ba00e
SHA1e9eb6d1eb48f5d62ecdda5a2b36b4a12d37fc829
SHA256dfb3a66fe60487f983036ca648b9e845a4cd99d028b6f3e005ed4b1c3f757c9e
SHA512988e90fc714da617ae775b63c34d9190497111a866f13f0c5357101b8403e568607572cf649e3b899f811b415134ebbeb3bd7ef0263ba7c968ec17bd99adbdcf
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1435400884\CRX_INSTALL\js\content\common-modules.js
Filesize497KB
MD55e09ee7018c05968cf92f27b025d87f3
SHA11b4f2eaabb8132f3398eb3c6c92090085dd7cdb0
SHA256c28c1710ae9dda07899cae302b5b171f27d3aa708bb578b089426c500a4baf42
SHA512611dbb1d3447a81cb3424e2a900ae70beeff32ceeb11f1889c84f472d5c967769249c62b51ecb589b2d804c4a892e81db955497bfee9677a850b8d275be8fc02
-
Filesize
201KB
MD5c300112af808d6bd58bf12a6815fdba0
SHA10b3b6ced549bc93d31c2ebdc3fd98c5d6a2ed267
SHA25615c223fe6034ba5317dfe109f582c0b1f98cf701493278f36665edf21283fd6b
SHA5121d0893c11d4af690fa0ef8461a8370c968be9d1527aa366079b9961dd9b19be9508e5a597e5572b7fef0a3cf41e83d69aa409d766a285be16a0e8769b7794156
-
Filesize
1.4MB
MD51fea1b318f9d06bbde8c7b315033f968
SHA14a27229b3fd092a65a78727be11b39829c821906
SHA25623b308b3af488930789927d038abb41c28f05588b20e2d14b7945fa1c98fa5b3
SHA5125e49e4a451950955456794777746da75c40e3d611328364c069f1811b2def6c01e5e6a9626e553b5c02501b0dbeb9c3cf31f1095a2f57616bfad2fb6e85c6eca
-
Filesize
1.3MB
MD53c4bb24a71e36611dc3e073f3ac9100d
SHA1ba9b39395dc83e52294ae6824c305fbeb0afb49a
SHA256b2e893a8b9f7c68d594524c512d7db3643aa1fdbc9464a00134eef5eb547eab1
SHA51242c70cc8b056c37cad8dbac47b5df8ab430cb71af58e9cb3f43c9e43f5e1187783d49d2cf400ad27d17d69750cad0acbdb269af1f59ae10c2d14105b4fbc5480
-
Filesize
393B
MD55279b5dc70c7652de080320490060f9f
SHA1be4bc8409ea2ce08848dd3ef9bb683657dad820a
SHA2565f9b2e95290286c39777a018a3e0e57d59f091c317056ccf0a9f3d09d64aa9ed
SHA51243aa1070fab2052f36dc3141d7bfb26ec0cb4743e8a872f18a99f0481ddde01a3f1860b3c2cddc95617886bfe62c42a6791dfd636adde1c01d3edbc8ea6cfe9c
-
Filesize
225B
MD581f6005d4e620b21a13cda8c521fb24e
SHA101fe568895993c7b242b25eb7e6e5d1073a82b72
SHA25649a05fc37600b7be604af11cfcc48f017d735ef205f0831208a85f5a51bd6a68
SHA5127689b0069f1be03fdd95cb48f9a5cf6553cd4f496c6226c5e4d2796719a77e626455dc689da5220c3ab7731836d67a85da354617f77d3d275e4071e0dc5d70ed
-
Filesize
54B
MD5b176b474414092f01ce861f9da4bf2a2
SHA1d175c77bf023434e6bdd14697d12653a4d397755
SHA256e61a1a270d678bc281c6d857da661c2b9ab77dec18f2723dcc106463e1911c63
SHA512692fe6310ef028b4ee7fae0d363947084fc1bda5d95b3d9f2c52882e02e75fbeae88b6fcbcf7e954400eda5f66634a45bf2eec022da1cca19cd64cff9600842d
-
Filesize
4KB
MD55c96abf57abfc0c8d233a915d8a45278
SHA1dfb82a20642c8569408cc58e1f5329f4bd530e3b
SHA25698b0a8047168a3c7424df463c1959578103360e8ccddd76575da1ad4addaeca7
SHA512ff6c9d771be44ebbbac173135d86b840c74f0bbb2f72992f2151b9ad034c22a2da4e53c89fedbe68d0a31292b325e255d739d47d291fd3b614d18df9caf301a6
-
Filesize
5KB
MD54672ef0eaf7515a69409c9c0fd3e62bd
SHA1ca920038f11d0ae10069b87f0ee32260a0d0f523
SHA256593ba5536ea92a87e55004874648ff12f096c71bc4dc81c084f0c59cf662cef8
SHA512304c5f7440e6e38127594892d993c740ce338f3b12a64923ab6793936126d0f68df27f83d0213f85926a15564ce84e81401e06448ff8fbb0d92b871db984e526
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir3456_1556892595\78553bcd-da9b-4d34-b0c9-4b0bc2cb5c34.tmp
Filesize1.8MB
MD508526c43dba41d8b40d98c4a33e3850b
SHA1403baa8e261b93f83a22c577d39f53c108cbe9e4
SHA2565616c3955183ef70cf911cb72f6d55277c95dac4cca5fd19edfa14b2d657977d
SHA512a3417ded6762e544faa4519c20823829b7a135fe3fe9643f2d63be1d67adc508b194d7d7672006d24b9b3560be32e0ed635c0b6a1f649f0a96ae93422dfc0ff6
-
Filesize
213B
MD5084e6401c611027c7a37ced03dc4cad6
SHA1fb43defd1877aa79f7721487cc4dea82763e1f32
SHA256b129c59e3a5c93071f454754c4e9c9a985ec86f9426ddc1a781938dbc6047344
SHA512a9c896612d57dee55503869f6e91c68da3029b2b083ce2a672fa1875ed3153bbd71341c4df2a060c17c90610cd403e24546ae364782a62085c3868e118d0a3cc
-
Filesize
455B
MD5d9b9741b02f9ff89f0c1f1a9d3e1b6f5
SHA1613eed9a2b6d2af8f3a4b7708e51a72a2eb69993
SHA2564e090ab82ebf515634a0ac094b61602ed3018fefd3eb214b6d95ba9baab9cd0d
SHA512c7b9c67ed79f697a71a2461d1a23b3769e0ee0bdab02e9e918860fd969515eca1fd49aab65fb7026d6982682cf554928c3d7d99e584125a943fd36785f22c941
-
Filesize
3KB
MD5054c570b61444144ad548196f17861be
SHA12a4c2103677615f3f5ed24befe0f9c84e1176656
SHA2568c7c05f4106156208f836a1e5956cc52edd16d2e609f789a78ed6a24ea5774c3
SHA512af52cba1b4a601ba78451eb1278328b0de55152f4557494648e48c829ec7b190935876da5f0d1de2fa3e62495401eba96fe844e76eff65d8808fc74d84909842
-
Filesize
282B
MD59e36cc3537ee9ee1e3b10fa4e761045b
SHA17726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA2564b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
SHA5125f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
-
Filesize
6.4MB
MD53ad6f1d43acfdb4533ade2e597f09ecd
SHA1295d0c6098f19c81c48a40db7a97a88b4f0632f2
SHA256dba4515014a26c44fa8cf4c7f2502bfc29855879e5c890e037e24d09fc757cf8
SHA512405f9e510612899c1b1a79bcb1846f0c283e173b7a7b57de307a3c72d5462ccc323a7a93d69528bb461cdc24e4e22c7038f17276daa3bb31a8862fa6c26bd4bf