Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
891s -
max time network
904s -
platform
windows11-21h2_x64 -
resource
win11-20241023-uk -
resource tags
arch:x64arch:x86image:win11-20241023-uklocale:uk-uaos:windows11-21h2-x64systemwindows -
submitted
28/12/2024, 16:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/1H1gcW2W7MDjNkRqKAon6ProEvJYx_MLp/view
Resource
win11-20241023-uk
General
-
Target
https://drive.google.com/file/d/1H1gcW2W7MDjNkRqKAon6ProEvJYx_MLp/view
Malware Config
Signatures
-
Downloads MZ/PE file
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 5 IoCs
pid Process 2344 7z2409-x64.exe 1188 7zFM.exe 4560 7zG.exe 1552 7z.exe 2004 7zFM.exe -
Loads dropped DLL 2 IoCs
pid Process 1188 7zFM.exe 2004 7zFM.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 1 drive.google.com 5 drive.google.com 6 drive.google.com 13 drive.google.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7z.dll 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\readme.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\descript.ion 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 7z2409-x64.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier firefox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z2409-x64.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications\7zFM.exe\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip 7z2409-x64.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic" OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2409-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" 7z2409-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2409-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2409-x64.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2409-x64.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications\7zFM.exe\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2409-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2409-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications\7zFM.exe\shell\open\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications\7zFM.exe OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2409-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\"" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2409-x64.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip 7z2409-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 7z2409-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip 7z2409-x64.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2409-x64.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings firefox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2409-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2409-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg OpenWith.exe -
NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\ZERO MB GTA (ПАРОЛЬ - treyz).7z:Zone.Identifier firefox.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 1188 7zFM.exe 4368 OpenWith.exe 2004 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 4160 firefox.exe Token: SeDebugPrivilege 4160 firefox.exe Token: SeDebugPrivilege 4160 firefox.exe Token: SeDebugPrivilege 4160 firefox.exe Token: SeDebugPrivilege 4160 firefox.exe Token: SeRestorePrivilege 1188 7zFM.exe Token: 35 1188 7zFM.exe Token: SeDebugPrivilege 4160 firefox.exe Token: SeRestorePrivilege 2004 7zFM.exe Token: 35 2004 7zFM.exe Token: SeDebugPrivilege 4160 firefox.exe Token: SeSecurityPrivilege 2004 7zFM.exe Token: SeSecurityPrivilege 2004 7zFM.exe Token: SeDebugPrivilege 4160 firefox.exe Token: SeDebugPrivilege 4160 firefox.exe Token: SeDebugPrivilege 4160 firefox.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 1188 7zFM.exe 2004 7zFM.exe 2004 7zFM.exe 2004 7zFM.exe 2004 7zFM.exe 2004 7zFM.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4160 firefox.exe 4160 firefox.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
pid Process 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 2344 7z2409-x64.exe 4160 firefox.exe 4160 firefox.exe 4160 firefox.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe 4368 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 4160 2420 firefox.exe 78 PID 2420 wrote to memory of 4160 2420 firefox.exe 78 PID 2420 wrote to memory of 4160 2420 firefox.exe 78 PID 2420 wrote to memory of 4160 2420 firefox.exe 78 PID 2420 wrote to memory of 4160 2420 firefox.exe 78 PID 2420 wrote to memory of 4160 2420 firefox.exe 78 PID 2420 wrote to memory of 4160 2420 firefox.exe 78 PID 2420 wrote to memory of 4160 2420 firefox.exe 78 PID 2420 wrote to memory of 4160 2420 firefox.exe 78 PID 2420 wrote to memory of 4160 2420 firefox.exe 78 PID 2420 wrote to memory of 4160 2420 firefox.exe 78 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4224 4160 firefox.exe 79 PID 4160 wrote to memory of 4684 4160 firefox.exe 80 PID 4160 wrote to memory of 4684 4160 firefox.exe 80 PID 4160 wrote to memory of 4684 4160 firefox.exe 80 PID 4160 wrote to memory of 4684 4160 firefox.exe 80 PID 4160 wrote to memory of 4684 4160 firefox.exe 80 PID 4160 wrote to memory of 4684 4160 firefox.exe 80 PID 4160 wrote to memory of 4684 4160 firefox.exe 80 PID 4160 wrote to memory of 4684 4160 firefox.exe 80 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://drive.google.com/file/d/1H1gcW2W7MDjNkRqKAon6ProEvJYx_MLp/view"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://drive.google.com/file/d/1H1gcW2W7MDjNkRqKAon6ProEvJYx_MLp/view2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1848 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7c573c2-98e8-4ab8-9628-0590599a6df0} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" gpu3⤵PID:4224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2372 -parentBuildID 20240401114208 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1491f345-8fc6-4cc5-a5ce-48adbac78970} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" socket3⤵PID:4684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2632 -childID 1 -isForBrowser -prefsHandle 2636 -prefMapHandle 2992 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54254c51-16b5-4d8b-add1-61a0bcef60a0} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:3304
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3984 -childID 2 -isForBrowser -prefsHandle 4084 -prefMapHandle 3956 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {952f8217-ffba-4368-a5cb-c1b6d865e0f5} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:3012
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5000 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4992 -prefMapHandle 4988 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ffa1644-3f8a-4eda-aebe-6bbf07b1e670} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" utility3⤵
- Checks processor information in registry
PID:3592
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 3 -isForBrowser -prefsHandle 5680 -prefMapHandle 5676 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b506c4e4-b245-4dd3-96d7-cf347883f704} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:1908
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 4 -isForBrowser -prefsHandle 5692 -prefMapHandle 5688 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe55423d-7037-49aa-a786-7818469968cf} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:4144
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6104 -childID 5 -isForBrowser -prefsHandle 6096 -prefMapHandle 6092 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a841fcf-3caa-4264-bc9a-db7ce9d50a9a} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:3916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6196 -childID 6 -isForBrowser -prefsHandle 6076 -prefMapHandle 5612 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b90ab45e-9919-45bb-af9b-880916f5995a} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:1684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6404 -childID 7 -isForBrowser -prefsHandle 6496 -prefMapHandle 6500 -prefsLen 33381 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {146d80b6-73ea-41b8-9102-8c56c1a7ebe7} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:1032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4636 -childID 8 -isForBrowser -prefsHandle 3920 -prefMapHandle 3044 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34528003-f0e4-42e3-84c7-ccdf11ff078b} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:2904
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1620 -childID 9 -isForBrowser -prefsHandle 2504 -prefMapHandle 1544 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27df3ab1-9995-4ce1-8493-74c61d657689} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:2476
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2688 -childID 10 -isForBrowser -prefsHandle 6952 -prefMapHandle 6668 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1691873-64af-4604-8848-ec3870003d55} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:3240
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6360 -childID 11 -isForBrowser -prefsHandle 5612 -prefMapHandle 6388 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00f31cf7-54d2-40d4-aece-78787e121f86} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:1320
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5240 -childID 12 -isForBrowser -prefsHandle 6492 -prefMapHandle 6440 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1567d482-249a-452a-9c5c-5cf022694629} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:1072
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6008 -childID 13 -isForBrowser -prefsHandle 4000 -prefMapHandle 3996 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5dc2d07-76bd-4a1c-9c70-a4aad7886c15} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab3⤵PID:4484
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4364
-
C:\Users\Admin\Downloads\7z2409-x64.exe"C:\Users\Admin\Downloads\7z2409-x64.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2344
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\readme.txt1⤵PID:1472
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1188
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe"1⤵
- Executes dropped EXE
PID:4560
-
C:\Program Files\7-Zip\7z.exe"C:\Program Files\7-Zip\7z.exe"1⤵
- Executes dropped EXE
PID:1552
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4368 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\ZERO MB GTA (ПАРОЛЬ - treyz).7z"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5c4aabd70dc28c9516809b775a30fdd3f
SHA143804fa264bf00ece1ee23468c309bc1be7c66de
SHA256882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863
SHA5125a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51
-
Filesize
551KB
MD5b6d5860f368b28caa9dd14a51666a5cd
SHA1db96d4b476005a684f4a10480c722b3d89dde8a5
SHA256e2ca3ec168ae9c0b4115cd4fe220145ea9b2dc4b6fc79d765e91f415b34d00de
SHA512d2bb1d4f194091fc9f3a2dd27d56105e72c46db19af24b91af84e223ffcc7fec44b064bf94b63876ee7c20d40c45730b61aa6b1e327947d6fb1633f482daa529
-
Filesize
967KB
MD54eaae49d718451ec5442d4c8ef42b88b
SHA1bbac4f5d69a0a778db567e6978d4dabf2d763167
SHA256dc4fdcd96efe7b41e123c4cba19059162b08449627d908570b534e7d6ec7bf58
SHA51241595b67c8506c054c28ce2b5dec9d304651449464c6e1eb092a049d49326594584900cff4e9b8210ca3ad8a23e9c22d8df1ae8af15f44a69f784cc546fcced3
-
Filesize
696KB
MD5d882650163a8f79c52e48aa9035bacbb
SHA19518c39c71af3cc77d7bbb1381160497778c3429
SHA25607a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff
SHA5128f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1
-
Filesize
16KB
MD5a2aee165e60fa2c7b48fba9cdfcc8766
SHA18ede3b75e841c8e1820e8b40a66ad6cc14d11e3c
SHA256ca1557c69453b1354279682cf1d3e9d65a0fde56189939ec3dc359ad18be5fe7
SHA51210e74e0dcb6ef09b4b9b7ff9c47b915ad6553ed82d7da1970aa7fe95cefcffb5a8e6dd9fbf9d109b65fe03e9027559011a18144f7f936fe504613e092543cd5d
-
Filesize
14KB
MD5e03115ee7530777231a0051667ab23d3
SHA15ded32077cda52b5527f75017552a598b0523db7
SHA256cccf6f489961bb78c5c4baecd964442b14593799403e2b6e4d50082c3e64803a
SHA512053f81c647b55df05bef067f26be1d25b44cdd1d5a59c4341904f0b9173a1ad6cc3209035ed4782626b150f090f52276c7d99e77eaf108b2fed52f2179e959ee
-
Filesize
1KB
MD5800e525e791ce8ca84a9200ddcabd6b2
SHA169800f0c14111fd0ca7f6a41268ad5f4d8ed24f4
SHA2567687c86d1096d2587a8ee0a9e585725abd1ab7a8af98fdf1cc8234ae94624f33
SHA512095a707bbe3af79cda2e77799817ae979f72233c92be0ca2f1b089aa285de6498afcd44f84c328b094cbfc733f16c664135bfcaa9a93e5af73bb90afabcb71f1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\activity-stream.discovery_stream.json
Filesize19KB
MD5dd820997c2911dfe910b5feb8e7aa635
SHA1ea319d96710a9d9ee293e36f67d1489454dd29e9
SHA2560f21427560f06e2fad7d79b68692ffc4bca4bb36364d47e4b581f033c0347508
SHA512d7fc6cd60f3ba685ecd6ed5c17e48e6375b2ce978e8fc3d425ebd192cdbda9e8c2af7d2a6245681f2ebe99baa44789647a0a9b842a86c587ca279006042d8ebe
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\cache2\entries\59FAC720649E6B662B5D8C66889DF84BDC0F1555
Filesize23KB
MD5ca4a6f4ab9ef4ecf1bd2a8f8bd9435e6
SHA17e263ec05b57d23858aa918d43b2abbcf3dcbd32
SHA256baebb4062dc6cb85dcf1032d4d1e666974b312c88d732b1bcc3d971dc7f85ee6
SHA5125e934e9d391ec136e856d27685090f501554d7f6d9f40eeef082ee2f7435735c06f488a2361f23b44a698ebb74ca598eef17fb35331b585fa96d6cab259522b1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\cache2\entries\A8F077BDF6E26AD59C53F5B9DC07F77DDBACEA1F
Filesize224KB
MD5fc34a166ca375c6795293e7c67219bb2
SHA1edb4371d888947b3712c24e0bbecb8647468344f
SHA25612a393f392171c530c0d5be1580eff3c3171089da310f74c17eab4a6f5b4ca16
SHA51259a0398f257f408b0a6a3efd8e3d6dc857a6e4e3df2c01ed5e5d26b6da55500b0f5baa5c228626e1b25a379511f77d1872d4e8e64c60ca4a9c5c767865ad812c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\cache2\entries\C3B6D129A0EA63A35F7956C0F7ECFBB5248DFCFD
Filesize49KB
MD5d629cd9a9435b16c5695b73052015c0d
SHA1d21106cc2efa3d4e9219e3462982de6e3bbfa5ec
SHA2563714fd20f7981894704af993765bdb7b30698caec79fbff47a77ecedded51aa3
SHA51218a21625852bfb0bcd8ebfcfe27f459fe1a73c0fd953c9ba87a04387ef324f4113f37cc8705c1349f76595487159edbf7ca81ec3c3547040a470700693587c6c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\cache2\entries\FAFCDA0063AB2AADC2391EB2BA648C3734154C4B
Filesize16KB
MD577a6142c2a7549382c6b02fb174b09da
SHA19fb8a15a9ea11d8eae363b0596af64770c004ca8
SHA256027854de3eaff93e26057c3a8d8fc9725b11cba987aba8986583dc3467264a3b
SHA5126e281b12d5afd31a098e55f1528f489fe61dc9c6152c04750627f8da1312831b8197f7c3e2acc2fc11b8812379aa05ae515a6c9d6d5b9570faefcd799a7e816f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize20KB
MD5ffcc1b45aeaeb49853543c6f418dac77
SHA1de99f84ab1a962b716b424d34959dbf8572c9904
SHA25676b6f59b9e52da7dda0357cb7618cb323233bcd9063712fd14fc9ab5fd322f16
SHA512d4a4cc653b611056c5800abcca43fc5d6ec34d49f1c57afa4368ad1d25a358ec26e58f7f86c05f421b5bbc7b5c556a8f0c31d6c9f67c04599ae3b3b6e0114eb1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize20KB
MD54c28bdc0c133395dd6c675186065178d
SHA1c4460cfd20c476bb67f8b8cdab75f4c12c502b4f
SHA25661cddff7da8c13a548a45bbffe049c685baf3da22c5fae5600cde242fc80297d
SHA512faaa8417d25c0328e7b3b4466c4385f98511eab60ffde0e50fa2397976383ab7029e5fe04da04d6933739c7bd7eb10bcddb631311142ba44f2e073be92356a1f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize20KB
MD5aac5eac4c70b99b01f71848e7e944042
SHA110e3f0438e7f1943f56416ee3221065364e1c07d
SHA256eaae6887b336ac9da0bec153c3e7762ac050fb96ac9ccfeb929e7a19cd3e5e7e
SHA51226f276cdc4d9cb443c60c09c74b4bb2332ac871921fea41e0367cb61a1dcac91a74430f40595f631e215ee5b80f10712f9835a626f6cfccd01a4f232d7cb19dd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\AlternateServices.bin
Filesize6KB
MD5fd985a899637c6391c6d2595accfd224
SHA18bd6abe24a65f4b8f9f6b7761966b2aaadaf9023
SHA2560486f7000e6d14a69ef7b3f0a7985eecbd4aed037be8c7a2692377d087a2f501
SHA512af5fc779332fbbac820f2df34c94b59927e62f3eb5960e1ff344430b2660747c794fd8e017d21ce62c29799a06d4fccae78ca762e007cc0390ab0304791418e3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\AlternateServices.bin
Filesize6KB
MD57dd5c317d70825997d7882e2bec80138
SHA118b8ca6aa448c73ce1d35d9f41d327d932e5c542
SHA25653d06ea979b408cb99aef4a33023b44b5df229aca39815afaae0a742e8fb8fd3
SHA5126d8078eb16f50771d5633d35fd916216d89f7da91bbdcf97842a0d2c52929d539fe5379803201a7554abd9172c37e21080cd9479ca8523c153f73940b74f65ef
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\AlternateServices.bin
Filesize28KB
MD5a3fe905df729de81135ed7dddffa98f3
SHA14e975ba6181a856b9f2d5b5cf33ffc689e90ed2a
SHA25635dacb2b0971021daaa4ade8f0bc8850e0fdc62e657a7c44b742b5c12d8ac04b
SHA512467584093d10185086efa65a80ed1d73fe91523804b52f44ed2c0f1f7b96bb5c19ef6ec5af9e53f3cb544a93129b9b07fb3be85ef1dfe9c93ba11448a1c7a4ec
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\bookmarkbackups\bookmarks-2024-12-28_11_NI9CendXNAkPMHJi29hZpw==.jsonlz4
Filesize1014B
MD5f17260f6e11781116fc7b81fd6923b8b
SHA16edd220093b30ae7330c255fddb0442196e1053d
SHA256afb9b0b1e7b1a826e88b70c5912df30ba8a404e6c06bf0a0c67f2debe60d8482
SHA5121c5c1676507e78b20df1174ee88172c7a35911cf254be40881c18e3fb58c9ff6355f4637da38585e3e70ce5c0674c08c932eb18b2e6de62be6b73f03a86477c1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5541240a03aab3520d8d1d6a4e8d95a51
SHA1c1d7e3d74d995b10648f2f849f18af8faf590696
SHA25674417e2c0f0ff0eea62317bd0e4595e23e1d8cda12725291aae386eb824b5ef8
SHA512e6bd9e1aba32fdea0a62d42ff9f86f6e3dbc532ba0cd57e8e2a08cc4de0348bc83d625fccae179e252d926b341c3922b9e278fe7f6a94771264157194da530b6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp
Filesize42KB
MD5f2e94cd508d200293dc249ba762c16f0
SHA12c5cb7af015489ea3fa37c1ee1f1bf3796e3b302
SHA25615a1e109d132ea39e9725753c3c035c5866c0bb2ba0207b4c11af12f642ca872
SHA512ed7f380eac6fe517480f689499ecee63d3e1cacc776e79c7ff1fad9b55170e9b2465b1e150c3aff5200708e684c582aeb2d5bac37f7e7aa7dfa36b8e2f9187a3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD58dda9407be80ab647a632e06bdf58ff4
SHA13076ad5179bf2edf1abdba4dfff2263aed2d0381
SHA2565f1e37170caed0603e49da79d7633a14f39ba94d4c08fc83ecde9b2ad196f165
SHA512fcb4c3f068a4011b67c947773128e6c204872f15b91344c999c09e9d5ac0eb09f915e4b5fbc8762ba7e981ae269f3ce83cd2038b8159e88c707a730676086612
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\87e2a793-6db6-4f70-bd0d-1c57f0c823a4
Filesize982B
MD5743c7921a5d181b22fe497385d4ca500
SHA1eb62d90a9be0f4f20cb195bf80e840bcbd9f5563
SHA25615d073defb4049377ed4ae89756f48314c6706d1379a598be661b77c2edc7977
SHA5121db85f2d74dba9eb47d26ba1c9e61dc4c59943b2565ef29137da26641babac6a99cf7bc512bf1d101927c864d002efd4d22d9c461263f5aaaea4752d4b6fe3a0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\9791b4ba-369c-41aa-8ccd-22a352bfe8ea
Filesize671B
MD54bd2a49300fcf0662b94070a4c11f8e8
SHA1165ffb22cad105dd1edaa724b2d5769387731204
SHA25696ad8c2e75d88af8416547aee51c41296963c4d91641383783e5d2983b9358d6
SHA5128221936f13eb63a62f93586c9a4721f83b7b82f64fb8f0cac4417b8c72deb5c29a03046cf85603825263f53a5acb0ec0c0eed76fc8792ccf0b739c01296c7094
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\9e54266d-5231-4a7e-811c-1bee8d674d07
Filesize25KB
MD57685984b6ce117b9b84ff092aac1d641
SHA1e6b30d957b1b921211737b71baa1abebea775e7d
SHA25621e3d048e8c35a1a0203cb94769ed9262618223cda9905a6d2413cf3bffbb94e
SHA512208bfaa6fe5bbb87aee49d33fda1a477017764ea3f02774a59228bbc0f7a1ff95417e0564ea9a974aa9af063ab8ada68f87122a2c0059d44d41557c57edcf7bf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
11KB
MD5d96c768553cb52f9be946b2c6f4b01fb
SHA1772a4297816c66baf4fbe80fc66863ecb66f9cf7
SHA2561151e8b2c82deab5052e000ab54384772721fe9f53502a7a5c15d84246311858
SHA512b27e6315b0577c6d403bef82dfb3418a491c06f952b843cd4cd265ff8d840d5d51f0247685546a868d3c93eb4578666c43d348fd6b85bef0192df6629883fd1b
-
Filesize
12KB
MD5679482c689e049bd6b52d650f09d84e7
SHA1ba55c6341554db75cd43acf315f2c11fc89fcf57
SHA256ef323165426ec0a8c3d7cc828441806d14ca665728a3a6cb15f2a5ca18cf0d31
SHA5124ed0e7805d7e0599d478c28a0207e58a1cba3c04ff4c5cf57b2a68c946dbc393b06a97130cc646cf9a8f3245f2244963276664860552d687565c22b0cd362099
-
Filesize
10KB
MD54fc5ae2e5818e4253ad9aa05d48ad6b2
SHA16b355600df8b0083d7d94a7c278d062e1da7f693
SHA256b476f37ce5055ffe60620cfc741e5df158f40ca76ac8916c762520399e9f3515
SHA5121d28233172d10afb7c9bdcc583fe78db6e5909bdc7764661fad198db005588c070bae92ba2b571cb955b4e48a3c56f688c147c71bc65649e4fc4b47facf3f59a
-
Filesize
11KB
MD53b1689e88564bba3c6577fa60d7b90a1
SHA17a7b04b58ffb7d6e7bd8505268e88d5f29a5bb82
SHA2564df075eebd48ed4fca5cc702a242d631d5a8291b92e02131954798e9539dda39
SHA512e4dba9195317376b6f2957103a8ca7db028c28f2473710b21c368f3e965986916ccf39b1234fb6f01e0090ebe8587932f0f9eb99f4111d7568ad130cbe8b517c
-
Filesize
10KB
MD513eaf229a7c5299844d0a4f769cd0b5f
SHA171201923e818d2bb5af31ead7b7132edc42e253f
SHA256da2b26d90d1f4dca650546bdc7f47c2311d48c79a57012581c44ad91c40b3c73
SHA512ebe4d999011c938311b1f156c8474a25629005364323ab68a16802dba57d859947220c7d7913a84f68369d75b94d637512b02b440507c6e664e424b7f6854f12
-
Filesize
10KB
MD5a9b7bb7e2bb9c55f81b31a487138a96a
SHA162d041d2fd51477eb5518614fb12817c160f49ee
SHA256ff3600891ce9fe833aa852f36c98d3be94196b398536a592573954db35a396df
SHA5129ec17e727efd345f50d68945d349848391d8b6136f7a459d97e72f7c9dc7924bd11748aab707dd53840c7077e80f45879d55b9e828fa94ebba46c7bc5b06755e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4
Filesize2KB
MD571be156a2858cfd3446809c4c461833c
SHA1d1d400c4c0e95af566ba4ed2aa7b9c1f7906d8bf
SHA256cd974289eec7c030b847eaa8e1b609a4f5d2ca2fdac02de5313daa44931d39d4
SHA51253a8ad907c1a732f07b2f49df4d5b534e1e4ce66257750ab27b6518760ee7ea7510930126eb96f59215a789b7904fa948eda5d1959693b8d76eb5b8b1ba6a2e6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4
Filesize9KB
MD5ddac091d64c195a2896fa0bd0494dfae
SHA1f14338ad85e5ba7c197023210883f66a9b68fa5f
SHA2565f491ca4396d180281654723195d9275cf594b149a22af901c677d911f31685c
SHA51250c06f7d5932cc0a6c35dc94e3068486c6c8aec6df6714280e1f991835ca038ffb3d43312ad308a2d4484382429defe922fd38701cb6c10eeea46fac28439ac5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4
Filesize6KB
MD53086b3d18635bba03aa0d8eb9893ada0
SHA16eec8148d47fdb99a350c6d7bda1a56b286f180f
SHA25618fb0c4ba3f1480241b449dea5d579bbfff6eddda624c1c2659391f4c33f7cc9
SHA512d50f4e001b6f5a632316fd6c035bd6cb2c30acbfefd5aed5ae1b5b9fb853af1bb67d14725f0c428f5180190c074c9f18393ae5d731e076710bbf8dfad62e9027
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4
Filesize9KB
MD57cf97d9f49ef65da3f6b5421daad00d5
SHA1b4b812a333f072612866c429b63956d4280a4f82
SHA256a79628052fabfd450a31139b870b287bb23347aa0f4f72a9f9ac5af76ba6c144
SHA512daf71a6b20256f97770664d2d3ccf2d9e58b0cf95c8bf44a844d1fbfa6892e112a48b6c0f068b70b810613beacd7483f2b24cc678e1d9fea37e76bffba2d8a2b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4
Filesize5KB
MD5c4eed3814a2ce076eb6ec1947e06f22c
SHA1290741351cab839b0b9ee6aa6c1f87d092fe66cd
SHA2561e0801f4dd9e42045de05a2b4c76bbb0f299dce8512a386c41b127c31c179165
SHA5124ac8611c5b2fdf3594a0944f686e0844f01a032abb4fb2ddf9c124c4e2569de273e99e799d88ea26ed5ccef17a01618e66a44cd0271541b9e702c2225c466e82
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4
Filesize7KB
MD5efd290c1cb3feb92129570e18ed88dd3
SHA1c8f4029f49280d530b74028f3f9cc9822dc92648
SHA256f1928ee1233ac992b7c97b3cd489add7d69db0fc86181f429b05935cc262776b
SHA512d74a35732d972e6fc113150beb7cb2961d4b4346d3588f4318f0a0ca6a63f451a1a19d102db6522ed521276f1fa438844030045f1802b94594b1a3b2595d7560
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize584KB
MD550c193e472878e42062e51e4e2343499
SHA12fd9b6bbb23ecedc5842d5588c2da2f05dc2ca97
SHA256ac4ed90395fa80c098268e22422d57618231988441efe2964c3255511e22e05a
SHA5120482a41c9c072635b16e4a24ccbb323b95868bb31e3576c5b981ec340e3322dc55dadd4d2c21ac6ee09c7f7b63d1204a841d262213973d863f3b5569e639ca1b
-
Filesize
579B
MD59e099e83aab7ac0f80713af67dc8e531
SHA1e413f2ec6172e522fcbe0165846f39198e261222
SHA25645254a2f674c94199f0400769450ef68a499b336d32dfc8eb218820788de54e0
SHA512165400af5f0bcbbe17b830f655ba0a3929038b8215eb9514485f5dace42ba7d6394deb9f2c7d7a0d5cca36038cb092a3f1f1657700726a489711aba0a036cace
-
Filesize
1.6MB
MD56c73cc4c494be8f4e680de1a20262c8a
SHA128b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0
SHA256bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e
SHA5122e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85