a6d1246d2054da7e30d2d65a8f975b64fb162a501d5967fca963272927a3b41c

Analysis

max time kernel
380s
max time network
386s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
26/03/2025, 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Slendytubbies 3 Multiplayer.exe
Size

635KB
MD5

1fc40e19613ca683742edebb5678dc94
SHA1

5b68b00678c56facd45ff7d8d50ce083a87508cb
SHA256

a6d1246d2054da7e30d2d65a8f975b64fb162a501d5967fca963272927a3b41c
SHA512

80192027ffcf1d6943ba4759051f9775ea22fc5c941530661762ac4fd8829ef9a584461c6c62ed1d2bcce4e65e28fc8d666d18cd7ec078fd80868be19122a0fc
SSDEEP

6144:l/7oYfSHQPWTUg4LXY7Q64EXN4L/WnqPBfxB42AFnO0NFoN4ddddddN/dmMtDJ5w:p7qTUbXYs64UOPpMOKZW

Score

8^/10

defense_evasion discovery motw phishing

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
709	6572	rundll32.exe
710	6908	MsiExec.exe
711	6908	MsiExec.exe
712	6908	MsiExec.exe
714	1332	rundll32.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
1603	5876	firefox.exe
551	5876	firefox.exe

Executes dropped EXE 4 IoCs

pid	Process
2032	ZipItNow.exe
4528	zip_it_now.exe
7596	minecraft-demo.exe
8208	GmingRepair.exe

Loads dropped DLL 57 IoCs

pid	Process
2032	ZipItNow.exe
2032	ZipItNow.exe
5904	MsiExec.exe
6908	MsiExec.exe
6908	MsiExec.exe
6572	rundll32.exe
6908	MsiExec.exe
6908	MsiExec.exe
6908	MsiExec.exe
6908	MsiExec.exe
2032	ZipItNow.exe
6572	rundll32.exe
6572	rundll32.exe
6908	MsiExec.exe
6572	rundll32.exe
6572	rundll32.exe
6908	MsiExec.exe
6908	MsiExec.exe
6908	MsiExec.exe
3960	rundll32.exe
3960	rundll32.exe
3960	rundll32.exe
3960	rundll32.exe
3960	rundll32.exe
3960	rundll32.exe
3960	rundll32.exe
6908	MsiExec.exe
6908	MsiExec.exe
6908	MsiExec.exe
1332	rundll32.exe
1332	rundll32.exe
1332	rundll32.exe
1332	rundll32.exe
1332	rundll32.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe
4528	zip_it_now.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	ZipItNow.exe
File opened (read-only)	\??\V:	ZipItNow.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	ZipItNow.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	ZipItNow.exe
File opened (read-only)	\??\B:	ZipItNow.exe
File opened (read-only)	\??\J:	ZipItNow.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	ZipItNow.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	ZipItNow.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	ZipItNow.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	ZipItNow.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	ZipItNow.exe
File opened (read-only)	\??\U:	ZipItNow.exe
File opened (read-only)	\??\Z:	ZipItNow.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	ZipItNow.exe
File opened (read-only)	\??\T:	ZipItNow.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	ZipItNow.exe
File opened (read-only)	\??\O:	ZipItNow.exe
File opened (read-only)	\??\X:	ZipItNow.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	ZipItNow.exe
File opened (read-only)	\??\R:	ZipItNow.exe
File opened (read-only)	\??\Y:	ZipItNow.exe
File opened (read-only)	\??\K:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
656	href.li
907	href.li
908	href.li
1442	href.li

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
272	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html	5876	firefox.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GmingRepair.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GmingRepair.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCA1A4EFC9F3B4B34C9AE76532176C93F3C\Microsoft.Win32.TaskScheduler.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1A4EFC9F3B4B34C9AE76532176C93F3C\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1A4EFC9F3B4B34C9AE76532176C93F3C\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5A409DC52241C1EB9D24A6F1F2137CF6\Microsoft.Win32.TaskScheduler.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5A409DC52241C1EB9D24A6F1F2137CF6\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6BAF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B3E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B3F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA5A409DC52241C1EB9D24A6F1F2137CF6\Microsoft.Win32.TaskScheduler.resources.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6C5F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI752E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF563A2A61AD6F0CCC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a6ac1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEF68876C36A29F72.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6B6A8825624D7C4BBF7708F947A4E0C2\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6B6A8825624D7C4BBF7708F947A4E0C2\Microsoft.Win32.TaskScheduler.resources.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6BE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CAF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6B6A8825624D7C4BBF7708F947A4E0C2\RequestSender.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6E85.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6ac5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5C202588F981F070.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C2F.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{22B45C8E-3D4A-4CDA-99A5-6864871B264A}	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA1A4EFC9F3B4B34C9AE76532176C93F3C\RequestSender.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA6B6A8825624D7C4BBF7708F947A4E0C2\Microsoft.Win32.TaskScheduler.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6B6A8825624D7C4BBF7708F947A4E0C2\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e5a6ac1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B6F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA5A409DC52241C1EB9D24A6F1F2137CF6\RequestSender.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6BCF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4CCC4E2643F743D3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C8E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CCF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA1A4EFC9F3B4B34C9AE76532176C93F3C\Microsoft.Win32.TaskScheduler.resources.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA5A409DC52241C1EB9D24A6F1F2137CF6\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7686.tmp	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\ZipItNow.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\minecraft-demo.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	minecraft-demo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZipItNow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	GmingRepair.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GmingRepair.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	GmingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	GmingRepair.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Key created	\Registry\User\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\NotificationData	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	zip_it_now.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	zip_it_now.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	zip_it_now.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	zip_it_now.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	zip_it_now.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	zip_it_now.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	zip_it_now.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	zip_it_now.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0 = 5e003100000000007a5a84be10005a495049544e7e310000460009000400efbe7a5a82be7a5a84be2e000000b0b7020000001700000000000000000000000000000009d16e005a006900700020004900740020004e006f007700000018000000	zip_it_now.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	zip_it_now.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000000000001000000ffffffff	zip_it_now.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 56003100000000007a5a82be1000526f616d696e6700400009000400efbe6e5a69757a5a82be2e000000355702000000010000000000000000000000000000004b13870052006f0061006d0069006e006700000016000000	zip_it_now.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff	zip_it_now.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	zip_it_now.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	zip_it_now.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	zip_it_now.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\ZipItNow.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\minecraft-demo.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4528	zip_it_now.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2776	msiexec.exe
2776	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2228	firefox.exe
4528	zip_it_now.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5876	firefox.exe
Token: SeDebugPrivilege	5876	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	5876	firefox.exe
Token: SeDebugPrivilege	5876	firefox.exe
Token: SeDebugPrivilege	5876	firefox.exe
Token: SeSecurityPrivilege	2776	msiexec.exe
Token: SeCreateTokenPrivilege	2032	ZipItNow.exe
Token: SeAssignPrimaryTokenPrivilege	2032	ZipItNow.exe
Token: SeLockMemoryPrivilege	2032	ZipItNow.exe
Token: SeIncreaseQuotaPrivilege	2032	ZipItNow.exe
Token: SeMachineAccountPrivilege	2032	ZipItNow.exe
Token: SeTcbPrivilege	2032	ZipItNow.exe
Token: SeSecurityPrivilege	2032	ZipItNow.exe
Token: SeTakeOwnershipPrivilege	2032	ZipItNow.exe
Token: SeLoadDriverPrivilege	2032	ZipItNow.exe
Token: SeSystemProfilePrivilege	2032	ZipItNow.exe
Token: SeSystemtimePrivilege	2032	ZipItNow.exe
Token: SeProfSingleProcessPrivilege	2032	ZipItNow.exe
Token: SeIncBasePriorityPrivilege	2032	ZipItNow.exe
Token: SeCreatePagefilePrivilege	2032	ZipItNow.exe
Token: SeCreatePermanentPrivilege	2032	ZipItNow.exe
Token: SeBackupPrivilege	2032	ZipItNow.exe
Token: SeRestorePrivilege	2032	ZipItNow.exe
Token: SeShutdownPrivilege	2032	ZipItNow.exe
Token: SeDebugPrivilege	2032	ZipItNow.exe
Token: SeAuditPrivilege	2032	ZipItNow.exe
Token: SeSystemEnvironmentPrivilege	2032	ZipItNow.exe
Token: SeChangeNotifyPrivilege	2032	ZipItNow.exe
Token: SeRemoteShutdownPrivilege	2032	ZipItNow.exe
Token: SeUndockPrivilege	2032	ZipItNow.exe
Token: SeSyncAgentPrivilege	2032	ZipItNow.exe
Token: SeEnableDelegationPrivilege	2032	ZipItNow.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
2032	ZipItNow.exe
2352	msiexec.exe
2352	msiexec.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
2228	firefox.exe
4360	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
4528	zip_it_now.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe
7704	firefox.exe
5876	firefox.exe
5876	firefox.exe
5876	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 5876	3144	firefox.exe	81
PID 3144 wrote to memory of 5876	3144	firefox.exe	81
PID 3144 wrote to memory of 5876	3144	firefox.exe	81
PID 3144 wrote to memory of 5876	3144	firefox.exe	81
PID 3144 wrote to memory of 5876	3144	firefox.exe	81
PID 3144 wrote to memory of 5876	3144	firefox.exe	81
PID 3144 wrote to memory of 5876	3144	firefox.exe	81
PID 3144 wrote to memory of 5876	3144	firefox.exe	81
PID 3144 wrote to memory of 5876	3144	firefox.exe	81
PID 3144 wrote to memory of 5876	3144	firefox.exe	81
PID 3144 wrote to memory of 5876	3144	firefox.exe	81
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 4048	5876	firefox.exe	82
PID 5876 wrote to memory of 5236	5876	firefox.exe	83
PID 5876 wrote to memory of 5236	5876	firefox.exe	83
PID 5876 wrote to memory of 5236	5876	firefox.exe	83
PID 5876 wrote to memory of 5236	5876	firefox.exe	83
PID 5876 wrote to memory of 5236	5876	firefox.exe	83
PID 5876 wrote to memory of 5236	5876	firefox.exe	83
PID 5876 wrote to memory of 5236	5876	firefox.exe	83
PID 5876 wrote to memory of 5236	5876	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Slendytubbies 3 Multiplayer.exe
"C:\Users\Admin\AppData\Local\Temp\Slendytubbies 3 Multiplayer.exe"
1⤵
PID:5320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {d4793460-d937-4cca-94db-7481db566be2} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2276 -initialChannelId {94b9dad7-4463-4261-a578-ba1ad302513d} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3832 -prefsLen 27274 -prefMapHandle 3836 -prefMapSize 270279 -jsInitHandle 3840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3848 -initialChannelId {d436ed05-f81f-42a0-bc0e-d926e8ceff4c} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    PID:1948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27274 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 3980 -initialChannelId {e11a45f2-5050-4d03-99aa-4165af6256cb} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3216 -prefsLen 34773 -prefMapHandle 3220 -prefMapSize 270279 -jsInitHandle 3048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4592 -initialChannelId {fb0a1c6b-b7cc-47fd-8467-65e9315ffdfc} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5112 -prefsLen 35010 -prefMapHandle 5116 -prefMapSize 270279 -ipcHandle 4600 -initialChannelId {90792a92-a4d2-4aa2-8ef1-19207e8a1e90} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    PID:5420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 33031 -prefMapHandle 5572 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {10b0dc23-c82c-431c-b384-25ed8d14c3e5} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    PID:3232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5764 -prefsLen 33031 -prefMapHandle 5768 -prefMapSize 270279 -jsInitHandle 5772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5780 -initialChannelId {c825b075-824c-4ac7-8e24-4cb36f784235} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:1392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5952 -prefsLen 33031 -prefMapHandle 5956 -prefMapSize 270279 -jsInitHandle 5960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5968 -initialChannelId {0924432d-3a9f-4d48-8b61-68e2d6690bb7} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:2208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6328 -prefsLen 33071 -prefMapHandle 6344 -prefMapSize 270279 -jsInitHandle 6348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6356 -initialChannelId {ef97c19a-9212-49ed-9294-eb7bdaee804a} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6596 -prefsLen 33071 -prefMapHandle 2672 -prefMapSize 270279 -jsInitHandle 3056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3020 -initialChannelId {dd475f73-4f92-47af-95a7-b489801b14f4} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 3200 -prefsLen 39629 -prefMapHandle 6280 -prefMapSize 270279 -ipcHandle 1684 -initialChannelId {14fa9a14-8088-46e8-b766-e63e1844b783} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6936 -prefsLen 36542 -prefMapHandle 6940 -prefMapSize 270279 -jsInitHandle 6944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6668 -initialChannelId {7d837aea-8706-4243-9faf-b69f43d681ec} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    PID:5624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7160 -prefsLen 36542 -prefMapHandle 7136 -prefMapSize 270279 -jsInitHandle 6944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7488 -initialChannelId {436043c6-9987-4819-a091-9b7f7ed3ffde} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7140 -prefsLen 36542 -prefMapHandle 7132 -prefMapSize 270279 -jsInitHandle 7128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7440 -initialChannelId {d3a80e38-8046-49a7-a023-75363009face} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7428 -prefsLen 36542 -prefMapHandle 7420 -prefMapSize 270279 -jsInitHandle 7432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7764 -initialChannelId {105aeec7-877d-4c57-814a-c8355098a508} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:1708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7776 -prefsLen 36542 -prefMapHandle 7780 -prefMapSize 270279 -jsInitHandle 7784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7792 -initialChannelId {9a61c8ea-2d1b-4739-856f-12fec7d1277a} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    PID:1240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7980 -prefsLen 36542 -prefMapHandle 7964 -prefMapSize 270279 -jsInitHandle 7968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7972 -initialChannelId {87544cbf-796d-4cdb-a9c1-2b9d38044b14} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8532 -prefsLen 36542 -prefMapHandle 8536 -prefMapSize 270279 -jsInitHandle 8540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8328 -initialChannelId {4ec782df-1f09-4b19-aa42-6176f232b58a} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    PID:2460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6636 -prefsLen 36542 -prefMapHandle 7980 -prefMapSize 270279 -jsInitHandle 8664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7768 -initialChannelId {ef5e574a-1a63-4b86-8c55-9a0ecc398da9} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:5704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8492 -prefsLen 36542 -prefMapHandle 8440 -prefMapSize 270279 -jsInitHandle 8700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8004 -initialChannelId {33ad3741-6e89-4049-b948-b219440ebf03} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8916 -prefsLen 36542 -prefMapHandle 8920 -prefMapSize 270279 -jsInitHandle 8924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8932 -initialChannelId {b254cf65-df86-4156-8c76-9347094fbcc2} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8004 -prefsLen 36542 -prefMapHandle 7432 -prefMapSize 270279 -jsInitHandle 7976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9172 -initialChannelId {ca59941c-596d-4d08-822b-7452dd939d71} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    PID:2608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9672 -prefsLen 36542 -prefMapHandle 9676 -prefMapSize 270279 -jsInitHandle 9680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9688 -initialChannelId {8ffd6bfb-6bef-4ea2-a76c-f753c2001b30} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:5004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9904 -prefsLen 36542 -prefMapHandle 9908 -prefMapSize 270279 -jsInitHandle 9912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9920 -initialChannelId {a048a649-5f35-455b-83d6-c2b0f58ba7c6} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    PID:1040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10064 -prefsLen 36542 -prefMapHandle 10060 -prefMapSize 270279 -jsInitHandle 10104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10116 -initialChannelId {c5dc3e74-5fc3-4a82-9c92-18b4572f7ff3} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9820 -prefsLen 36542 -prefMapHandle 9812 -prefMapSize 270279 -jsInitHandle 9808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10396 -initialChannelId {8924b183-82d7-4d48-9d48-4ec0219ce6ed} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    PID:3140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10072 -prefsLen 36542 -prefMapHandle 10068 -prefMapSize 270279 -jsInitHandle 10352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10584 -initialChannelId {c96c1b41-e5b4-4bd1-9085-b18c8c767be4} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:2652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2836 -prefsLen 36542 -prefMapHandle 8344 -prefMapSize 270279 -jsInitHandle 10132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8004 -initialChannelId {b3709916-5e9c-4816-84ad-d5c52e76de82} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    PID:5644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10564 -prefsLen 36542 -prefMapHandle 9824 -prefMapSize 270279 -jsInitHandle 9828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10712 -initialChannelId {85e5e0e0-1b90-4f98-8d0b-6a1699597355} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    PID:6744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9580 -prefsLen 36542 -prefMapHandle 6560 -prefMapSize 270279 -jsInitHandle 7864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7860 -initialChannelId {20b77ba4-8128-40f1-afd0-cd6a4b3caf5a} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
    3⤵
    PID:3976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8544 -prefsLen 36542 -prefMapHandle 8252 -prefMapSize 270279 -jsInitHandle 8556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7992 -initialChannelId {8c4719ff-0894-4ae3-877d-cc35224c00ce} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
    3⤵
    - Checks processor information in registry
    PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10208 -prefsLen 36542 -prefMapHandle 10212 -prefMapSize 270279 -jsInitHandle 10196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8772 -initialChannelId {7326a35b-cee9-4434-bd99-54de9e9c539f} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
    3⤵
    PID:2668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7040 -prefsLen 36542 -prefMapHandle 7024 -prefMapSize 270279 -jsInitHandle 7028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7016 -initialChannelId {0bde00b2-dd21-478a-b571-6d0ae0c72368} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
    3⤵
    PID:6844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7884 -prefsLen 36542 -prefMapHandle 9576 -prefMapSize 270279 -jsInitHandle 8772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3184 -initialChannelId {09f1495e-5710-44c8-b43e-66bfb09a4b9b} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
    3⤵
    - Checks processor information in registry
    PID:1968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7884 -prefsLen 36542 -prefMapHandle 3184 -prefMapSize 270279 -jsInitHandle 9284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8056 -initialChannelId {0e5dbecd-5d46-4068-a38a-185e5da76985} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
    3⤵
    PID:5316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10400 -prefsLen 36542 -prefMapHandle 9672 -prefMapSize 270279 -jsInitHandle 9720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10480 -initialChannelId {166266aa-694e-4e99-bb0e-c903dbf81baf} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab
    3⤵
    - Checks processor information in registry
    PID:6288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7876 -prefsLen 36542 -prefMapHandle 9256 -prefMapSize 270279 -jsInitHandle 9640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10796 -initialChannelId {f90063cb-2b17-400d-a04f-5d36723e1a30} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab
    3⤵
    - Checks processor information in registry
    PID:6988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10452 -prefsLen 36542 -prefMapHandle 10524 -prefMapSize 270279 -jsInitHandle 10340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6980 -initialChannelId {bbcee677-0634-4138-8d6e-ce18a81d292b} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab
    3⤵
    PID:2412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10228 -prefsLen 36542 -prefMapHandle 10152 -prefMapSize 270279 -jsInitHandle 10148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10160 -initialChannelId {65d542e5-bcb3-4089-8fbf-4f7cd60414af} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab
    3⤵
    - Checks processor information in registry
    PID:6692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6576 -prefsLen 36542 -prefMapHandle 8656 -prefMapSize 270279 -jsInitHandle 8660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10196 -initialChannelId {268b5746-72e4-4eaf-91ad-5722c89dfb28} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab
    3⤵
    PID:452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6680 -prefsLen 36542 -prefMapHandle 9960 -prefMapSize 270279 -jsInitHandle 9972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6928 -initialChannelId {fe5e3ca4-c6ad-4e70-9c94-ba9e4e090566} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab
    3⤵
    PID:6120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2852 -prefsLen 36542 -prefMapHandle 6300 -prefMapSize 270279 -jsInitHandle 10068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2712 -initialChannelId {6d7078da-1226-49f5-83a4-79cdfa49b890} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab
    3⤵
    PID:4904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8048 -prefsLen 36542 -prefMapHandle 9592 -prefMapSize 270279 -jsInitHandle 7896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10280 -initialChannelId {b280e4d3-96ff-43c8-9fd6-3877d7c97e0d} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab
    3⤵
    - Checks processor information in registry
    PID:6360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10064 -prefsLen 36542 -prefMapHandle 10736 -prefMapSize 270279 -jsInitHandle 7760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7436 -initialChannelId {59c6f40e-94b5-4f93-9cdc-a2ab39ad98ee} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab
    3⤵
    PID:6296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10032 -prefsLen 36542 -prefMapHandle 9904 -prefMapSize 270279 -jsInitHandle 8784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6316 -initialChannelId {1b6106c2-de71-4517-a19a-825a72733671} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab
    3⤵
    PID:5944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8564 -prefsLen 36542 -prefMapHandle 8712 -prefMapSize 270279 -jsInitHandle 8264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8600 -initialChannelId {45f22eda-56b7-4ec0-84a8-586e4541d619} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab
    3⤵
    - Checks processor information in registry
    PID:2952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5872 -prefsLen 36542 -prefMapHandle 5876 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10564 -initialChannelId {30654583-05da-4223-9bcc-3ed7065f7921} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 48 tab
    3⤵
    - Checks processor information in registry
    PID:6992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10764 -prefsLen 36582 -prefMapHandle 10768 -prefMapSize 270279 -jsInitHandle 10500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8948 -initialChannelId {a7300c5c-3ec7-49a5-bb81-6e020d118738} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 49 tab
    3⤵
    - Checks processor information in registry
    PID:6632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9220 -prefsLen 36582 -prefMapHandle 9092 -prefMapSize 270279 -jsInitHandle 9132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8988 -initialChannelId {c9b1688c-9e85-46b0-8958-938fd40649f8} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 50 tab
    3⤵
    - Checks processor information in registry
    PID:2996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6428 -prefsLen 36582 -prefMapHandle 6444 -prefMapSize 270279 -jsInitHandle 6448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9824 -initialChannelId {d1e08397-14b3-447c-8fe2-b6f244624392} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 51 tab
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7528 -prefsLen 36582 -prefMapHandle 7804 -prefMapSize 270279 -jsInitHandle 7836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10768 -initialChannelId {d50dd22a-2ea0-47c7-a810-854aa26a1c5d} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 52 tab
    3⤵
    PID:2760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 11084 -prefsLen 39669 -prefMapHandle 11088 -prefMapSize 270279 -ipcHandle 11076 -initialChannelId {020079ef-5b73-41b7-bf78-17e31de00901} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -appDir "C:\Program Files\Mozilla Firefox\browser" - 53 utility
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 5504 -prefsLen 39669 -prefMapHandle 9704 -prefMapSize 270279 -ipcHandle 9996 -initialChannelId {06bc0133-f8e3-44ec-ae4a-7be6594f2ca3} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -appDir "C:\Program Files\Mozilla Firefox\browser" - 54 utility
    3⤵
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10072 -prefsLen 36638 -prefMapHandle 6728 -prefMapSize 270279 -jsInitHandle 9700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7600 -initialChannelId {53969655-3825-4e24-8add-8ec044aa5b06} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 55 tab
    3⤵
    PID:7164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2712 -prefsLen 36638 -prefMapHandle 2872 -prefMapSize 270279 -jsInitHandle 7876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8268 -initialChannelId {8449c04f-aba7-442a-8c44-6c02576c7f71} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 56 tab
    3⤵
    PID:920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6120 -prefsLen 36638 -prefMapHandle 8492 -prefMapSize 270279 -jsInitHandle 6056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6024 -initialChannelId {b4d93ed0-2eae-41b6-a0b3-10251fc441a0} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 57 tab
    3⤵
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6324 -prefsLen 36638 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 6240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8616 -initialChannelId {bcb7f084-839c-4139-a76d-b122f35fc2b3} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 58 tab
    3⤵
    PID:200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10216 -prefsLen 36638 -prefMapHandle 10072 -prefMapSize 270279 -jsInitHandle 6728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5664 -initialChannelId {53cbab51-1ed8-4ce9-bf75-db384e4fea8a} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 59 tab
    3⤵
    PID:6760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5964 -prefsLen 36638 -prefMapHandle 10028 -prefMapSize 270279 -jsInitHandle 5916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1668 -initialChannelId {dd43b525-a287-41ac-9211-02c40aa93295} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 60 tab
    3⤵
    PID:1080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8248 -prefsLen 36638 -prefMapHandle 6024 -prefMapSize 270279 -jsInitHandle 6396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6104 -initialChannelId {fde2a9ef-44bf-4ea2-bf8e-a68c16119ba7} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 61 tab
    3⤵
    PID:7132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 36638 -prefMapHandle 11008 -prefMapSize 270279 -jsInitHandle 6000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6308 -initialChannelId {73d67908-9c5e-490f-90b5-d3aef7ecf7f9} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 62 tab
    3⤵
    - Checks processor information in registry
    PID:740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6548 -prefsLen 36638 -prefMapHandle 8984 -prefMapSize 270279 -jsInitHandle 10296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9744 -initialChannelId {c029a485-da78-4e2b-9790-fb4443a6d92a} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 63 tab
    3⤵
    - Checks processor information in registry
    PID:3768
- - C:\Users\Admin\Downloads\ZipItNow.exe
    "C:\Users\Admin\Downloads\ZipItNow.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2032
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\71B264A\ZipItNow.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\ZipItNow.exe SETUPEXEDIR=C:\Users\Admin\Downloads\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1742792317 " AI_EUIMSI=""
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6452 -prefsLen 36638 -prefMapHandle 2608 -prefMapSize 270279 -jsInitHandle 9732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9092 -initialChannelId {94de2e42-2f48-4c94-8b86-b226237d99ec} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 64 tab
    3⤵
    - Checks processor information in registry
    PID:4880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 36638 -prefMapHandle 10012 -prefMapSize 270279 -jsInitHandle 9956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8336 -initialChannelId {06585bbf-baef-4759-9982-bffc8e6b28ec} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 65 tab
    3⤵
    - Checks processor information in registry
    PID:3636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11128 -prefsLen 36638 -prefMapHandle 11124 -prefMapSize 270279 -jsInitHandle 6392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10896 -initialChannelId {db72b6da-1893-46d1-b21c-1ac7fae25e5e} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 66 tab
    3⤵
    - Checks processor information in registry
    PID:4628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6548 -prefsLen 36638 -prefMapHandle 10860 -prefMapSize 270279 -jsInitHandle 8000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8408 -initialChannelId {43f3834e-b13d-47dd-83a9-095a7455e4e2} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 67 tab
    3⤵
    - Checks processor information in registry
    PID:1732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8588 -prefsLen 36638 -prefMapHandle 8612 -prefMapSize 270279 -jsInitHandle 8572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8852 -initialChannelId {2910646d-875d-490b-8d9c-0f2a4f089280} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 68 tab
    3⤵
    - Checks processor information in registry
    PID:2924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6772 -prefsLen 36638 -prefMapHandle 2432 -prefMapSize 270279 -jsInitHandle 6776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8200 -initialChannelId {b07fb8d3-a941-41a7-af29-0bdf32d817d4} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 69 tab
    3⤵
    PID:4780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11156 -prefsLen 36638 -prefMapHandle 11216 -prefMapSize 270279 -jsInitHandle 11208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9980 -initialChannelId {c1920556-9e40-429d-94cf-297b83474886} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 70 tab
    3⤵
    PID:6868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9068 -prefsLen 36638 -prefMapHandle 10012 -prefMapSize 270279 -jsInitHandle 6444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8304 -initialChannelId {54a3f48d-8a17-4c8d-aefd-9cda8c5ca8bb} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 71 tab
    3⤵
    PID:772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11172 -prefsLen 36638 -prefMapHandle 6312 -prefMapSize 270279 -jsInitHandle 7600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8776 -initialChannelId {fb7f6e55-bff8-4ba6-b465-8026c461201e} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 72 tab
    3⤵
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8200 -prefsLen 36638 -prefMapHandle 3200 -prefMapSize 270279 -jsInitHandle 10584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9000 -initialChannelId {e9dc7f4f-68db-448c-a99d-3c146490ef25} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 73 tab
    3⤵
    PID:6288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8520 -prefsLen 36638 -prefMapHandle 7940 -prefMapSize 270279 -jsInitHandle 11232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7896 -initialChannelId {edc495f5-b64e-45f0-8001-5db5d35f1efa} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 74 tab
    3⤵
    PID:5572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6584 -prefsLen 36638 -prefMapHandle 10352 -prefMapSize 270279 -jsInitHandle 5660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2632 -initialChannelId {2ce9756c-ff7f-46b9-bd5a-d577faa84cf1} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 75 tab
    3⤵
    PID:5828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2712 -prefsLen 36638 -prefMapHandle 4688 -prefMapSize 270279 -jsInitHandle 5612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6304 -initialChannelId {de3cbcec-9fa8-413a-9b5b-1a8c3885c930} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 76 tab
    3⤵
    - Checks processor information in registry
    PID:124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8456 -prefsLen 36638 -prefMapHandle 8608 -prefMapSize 270279 -jsInitHandle 8292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7116 -initialChannelId {f91e79b2-78cf-4a81-9ef4-d569c25aba91} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 77 tab
    3⤵
    PID:900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8608 -prefsLen 36638 -prefMapHandle 8292 -prefMapSize 270279 -jsInitHandle 8640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8184 -initialChannelId {4c43fcea-7f8c-4e05-9c93-6bbd7ee6a440} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 78 tab
    3⤵
    - Checks processor information in registry
    PID:6800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10696 -prefsLen 36638 -prefMapHandle 8876 -prefMapSize 270279 -jsInitHandle 10300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8636 -initialChannelId {6554181c-1fb3-4465-ae8f-4114100db7dc} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 79 tab
    3⤵
    PID:2344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6016 -prefsLen 36638 -prefMapHandle 11456 -prefMapSize 270279 -jsInitHandle 7160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11020 -initialChannelId {3e1e3aed-a1db-45e9-92d3-d4d7665afd66} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 80 tab
    3⤵
    PID:6920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9820 -prefsLen 36638 -prefMapHandle 9684 -prefMapSize 270279 -jsInitHandle 7780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10332 -initialChannelId {f23d440f-0e54-4691-8b9b-530dd38ae2b9} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 81 tab
    3⤵
    PID:6472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11276 -prefsLen 36638 -prefMapHandle 11356 -prefMapSize 270279 -jsInitHandle 11360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9192 -initialChannelId {3b9cea08-748a-4c11-9159-62d8ae4d8728} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 82 tab
    3⤵
    - Checks processor information in registry
    PID:1992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11456 -prefsLen 36638 -prefMapHandle 7160 -prefMapSize 270279 -jsInitHandle 6396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1284 -initialChannelId {850e6e77-dbe6-4437-a20f-3370abfc46c4} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 83 tab
    3⤵
    PID:2420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10296 -prefsLen 36638 -prefMapHandle 10796 -prefMapSize 270279 -jsInitHandle 11640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11348 -initialChannelId {c55eaace-ea08-4c77-8099-5e74825146f3} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 84 tab
    3⤵
    - Checks processor information in registry
    PID:1564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10368 -prefsLen 36638 -prefMapHandle 2608 -prefMapSize 270279 -jsInitHandle 6508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11480 -initialChannelId {97c01ddb-9a7e-424a-aa0d-de94112f5b70} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 85 tab
    3⤵
    - Checks processor information in registry
    PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10728 -prefsLen 36638 -prefMapHandle 10344 -prefMapSize 270279 -jsInitHandle 10332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11664 -initialChannelId {897e5dbb-1c0e-4e49-b129-09526f6f8221} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 86 tab
    3⤵
    - Checks processor information in registry
    PID:2344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2608 -prefsLen 36638 -prefMapHandle 6508 -prefMapSize 270279 -jsInitHandle 6416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11788 -initialChannelId {b37b995f-702e-42df-80f3-0e75201dba7a} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 87 tab
    3⤵
    PID:6732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7740 -prefsLen 36638 -prefMapHandle 10648 -prefMapSize 270279 -jsInitHandle 10432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9112 -initialChannelId {3400160c-b9aa-414f-bc3f-0f0b5ff66f95} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 88 tab
    3⤵
    - Checks processor information in registry
    PID:6848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8916 -prefsLen 36638 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 7736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11300 -initialChannelId {d285c55f-b1df-4c88-ad03-05a8a30853e7} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 89 tab
    3⤵
    - Checks processor information in registry
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6124 -prefsLen 36638 -prefMapHandle 10672 -prefMapSize 270279 -jsInitHandle 11196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9112 -initialChannelId {f24c0749-b956-4510-8f70-4391e330b061} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 90 tab
    3⤵
    - Checks processor information in registry
    PID:1696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10680 -prefsLen 36638 -prefMapHandle 11648 -prefMapSize 270279 -jsInitHandle 11292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8268 -initialChannelId {6bbb0829-b5d7-4e77-bcdf-62684d6a4353} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 91 tab
    3⤵
    PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11932 -prefsLen 36638 -prefMapHandle 11928 -prefMapSize 270279 -jsInitHandle 11924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10680 -initialChannelId {275b9729-58b6-451b-9e13-4bb54a67dcad} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 92 tab
    3⤵
    PID:232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6324 -prefsLen 36638 -prefMapHandle 11880 -prefMapSize 270279 -jsInitHandle 6072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10624 -initialChannelId {97b51592-e1e1-46e7-a415-9f0b7f689851} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 93 tab
    3⤵
    PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11308 -prefsLen 36638 -prefMapHandle 11784 -prefMapSize 270279 -jsInitHandle 11664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11748 -initialChannelId {9148ea06-c733-4718-8bbd-fff84c0c63fa} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 94 tab
    3⤵
    PID:6600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10648 -prefsLen 36638 -prefMapHandle 12020 -prefMapSize 270279 -jsInitHandle 4968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9588 -initialChannelId {dc861373-2578-4e39-bb63-6dafedb76db4} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 95 tab
    3⤵
    PID:2428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3132 -prefsLen 36638 -prefMapHandle 10680 -prefMapSize 270279 -jsInitHandle 11740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11720 -initialChannelId {a45327d3-4609-41ba-91a6-83cdadd45399} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 96 tab
    3⤵
    PID:1732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11012 -prefsLen 36638 -prefMapHandle 11660 -prefMapSize 270279 -jsInitHandle 11844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11848 -initialChannelId {78b5eb7a-cd3b-481a-9707-cc39d1bde6be} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 97 tab
    3⤵
    - Checks processor information in registry
    PID:6840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12228 -prefsLen 36638 -prefMapHandle 12224 -prefMapSize 270279 -jsInitHandle 12220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9928 -initialChannelId {4960878d-9dfd-404b-9b7e-880a395bf6a1} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 98 tab
    3⤵
    PID:1664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12492 -prefsLen 36638 -prefMapHandle 12496 -prefMapSize 270279 -jsInitHandle 12460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12504 -initialChannelId {da10cb14-43a4-44ca-9200-ac130a706bb4} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 99 tab
    3⤵
    - Checks processor information in registry
    PID:708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12724 -prefsLen 36638 -prefMapHandle 12728 -prefMapSize 270279 -jsInitHandle 12732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12076 -initialChannelId {48029726-5f2f-4282-a3d3-fcc8af397d0f} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 100 tab
    3⤵
    PID:2672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12880 -prefsLen 36638 -prefMapHandle 12876 -prefMapSize 270279 -jsInitHandle 12872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12912 -initialChannelId {fd1eb6a7-d8fc-4d3e-af23-8a79c42dd553} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 101 tab
    3⤵
    PID:3304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12184 -prefsLen 36638 -prefMapHandle 12180 -prefMapSize 270279 -jsInitHandle 12176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11892 -initialChannelId {7cc271c0-8bba-4a9d-8276-fa758a8069d4} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 102 tab
    3⤵
    PID:7148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13228 -prefsLen 36638 -prefMapHandle 13232 -prefMapSize 270279 -jsInitHandle 13236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13244 -initialChannelId {a2d023d9-9fff-45be-8b41-c5e8ca367c07} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 103 tab
    3⤵
    - Checks processor information in registry
    PID:6456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13476 -prefsLen 36638 -prefMapHandle 13480 -prefMapSize 270279 -jsInitHandle 13484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13424 -initialChannelId {0f4505c3-88f3-4895-ae1a-8e2076432774} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 104 tab
    3⤵
    PID:1428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13696 -prefsLen 36638 -prefMapHandle 13700 -prefMapSize 270279 -jsInitHandle 13704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13644 -initialChannelId {c423c385-8160-46bf-b88a-5b54838fdb7a} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 105 tab
    3⤵
    - Checks processor information in registry
    PID:1200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9732 -prefsLen 36638 -prefMapHandle 13920 -prefMapSize 270279 -jsInitHandle 12240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13928 -initialChannelId {85bae29a-a7ab-48ae-a1ad-de35d0c38af0} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 106 tab
    3⤵
    PID:3140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12528 -prefsLen 36638 -prefMapHandle 12608 -prefMapSize 270279 -jsInitHandle 12612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12600 -initialChannelId {729f0edc-8b1d-4e47-b7aa-c91ca5b75b74} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 107 tab
    3⤵
    PID:6616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13356 -prefsLen 36638 -prefMapHandle 13340 -prefMapSize 270279 -jsInitHandle 13344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12660 -initialChannelId {a66f6f3b-5601-43d7-9be8-063437bc139f} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 108 tab
    3⤵
    - Checks processor information in registry
    PID:6924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11276 -prefsLen 36638 -prefMapHandle 9896 -prefMapSize 270279 -jsInitHandle 11472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8800 -initialChannelId {48d3c734-7745-4d1c-9ef2-5c2e4546bee0} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 109 tab
    3⤵
    PID:3420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13300 -prefsLen 36638 -prefMapHandle 13284 -prefMapSize 270279 -jsInitHandle 13308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13704 -initialChannelId {43ec7d0c-edef-4b0a-93ef-091ef6ac6adf} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 110 tab
    3⤵
    PID:5948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11472 -prefsLen 36638 -prefMapHandle 11276 -prefMapSize 270279 -jsInitHandle 13164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13820 -initialChannelId {d33e44ce-ee21-4007-85b0-0c8d9bd173fe} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 111 tab
    3⤵
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12576 -prefsLen 36638 -prefMapHandle 12548 -prefMapSize 270279 -jsInitHandle 12308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12280 -initialChannelId {ccde5eda-e305-49b5-af69-c574955abdb1} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 112 tab
    3⤵
    PID:5604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13420 -prefsLen 36638 -prefMapHandle 12328 -prefMapSize 270279 -jsInitHandle 13704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12400 -initialChannelId {46b5c9ae-fca2-45c2-843f-b50cbfd2c7ac} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 113 tab
    3⤵
    - Checks processor information in registry
    PID:6704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12880 -prefsLen 36638 -prefMapHandle 12932 -prefMapSize 270279 -jsInitHandle 12868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13792 -initialChannelId {4bea2a4f-4783-49ae-84c5-e93289d6a145} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 114 tab
    3⤵
    PID:6332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13456 -prefsLen 36638 -prefMapHandle 13960 -prefMapSize 270279 -jsInitHandle 12172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13088 -initialChannelId {040b6ffa-a0c2-4a22-9fa0-c0a240ae95f9} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 115 tab
    3⤵
    - Checks processor information in registry
    PID:4732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12956 -prefsLen 36638 -prefMapHandle 12872 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5368 -initialChannelId {db6e906a-6f0b-4af8-965d-17c46b08b334} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 116 tab
    3⤵
    PID:1252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10064 -prefsLen 36638 -prefMapHandle 11188 -prefMapSize 270279 -jsInitHandle 6504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11276 -initialChannelId {99ed0dc5-3c65-4100-a55b-2f98a50ecb5b} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 117 tab
    3⤵
    PID:2200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13604 -prefsLen 36638 -prefMapHandle 13660 -prefMapSize 270279 -jsInitHandle 13368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12516 -initialChannelId {c066964e-0d47-40ab-ba35-ca0f704e878d} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 118 tab
    3⤵
    PID:6880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12976 -prefsLen 36638 -prefMapHandle 12928 -prefMapSize 270279 -jsInitHandle 12716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12964 -initialChannelId {68548585-a065-480b-9b45-0dc374738563} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 119 tab
    3⤵
    PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12968 -prefsLen 36638 -prefMapHandle 12784 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12792 -initialChannelId {0359590a-ee47-4e25-bfae-90f870b89695} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 120 tab
    3⤵
    PID:6108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6248 -prefsLen 36638 -prefMapHandle 13420 -prefMapSize 270279 -jsInitHandle 11080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1376 -initialChannelId {8a48d01e-c53e-45f7-9123-539a5a4d1378} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 121 tab
    3⤵
    PID:6960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11308 -prefsLen 36638 -prefMapHandle 13404 -prefMapSize 270279 -jsInitHandle 12828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13304 -initialChannelId {7342134f-5f69-434f-8f6b-25bd1e6adb36} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 122 tab
    3⤵
    - Checks processor information in registry
    PID:6616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12764 -prefsLen 36638 -prefMapHandle 12812 -prefMapSize 270279 -jsInitHandle 11836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13048 -initialChannelId {3c23e44a-af95-4b3c-939a-419a2f639a27} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 123 tab
    3⤵
    PID:428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11732 -prefsLen 36638 -prefMapHandle 6508 -prefMapSize 270279 -jsInitHandle 12440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13096 -initialChannelId {df3d7a62-4e20-4287-ad72-eed02b3fa42b} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 124 tab
    3⤵
    - Checks processor information in registry
    PID:6672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12128 -prefsLen 36638 -prefMapHandle 6308 -prefMapSize 270279 -jsInitHandle 12752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7100 -initialChannelId {b83389d9-32c6-4bf0-821e-429d598a94d2} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 125 tab
    3⤵
    - Checks processor information in registry
    PID:4016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4948 -prefsLen 36638 -prefMapHandle 11292 -prefMapSize 270279 -jsInitHandle 9952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10624 -initialChannelId {c3d48de6-09e4-481e-a3c8-c561102ea6a5} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 126 tab
    3⤵
    - Checks processor information in registry
    PID:3240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14056 -prefsLen 36638 -prefMapHandle 12792 -prefMapSize 270279 -jsInitHandle 14068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13572 -initialChannelId {2a7725c9-2e47-4bf5-bf5a-2535d8e4ed99} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 127 tab
    3⤵
    - Checks processor information in registry
    PID:5268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12136 -prefsLen 36638 -prefMapHandle 9916 -prefMapSize 270279 -jsInitHandle 12356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12668 -initialChannelId {51a690b5-7d2b-480e-84f4-eb7d939a90e7} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 128 tab
    3⤵
    - Checks processor information in registry
    PID:776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12860 -prefsLen 36638 -prefMapHandle 13792 -prefMapSize 270279 -jsInitHandle 13052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11152 -initialChannelId {c999bef4-9a4d-454b-a180-944bd561a4e3} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 129 tab
    3⤵
    PID:6700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11232 -prefsLen 36638 -prefMapHandle 3132 -prefMapSize 270279 -jsInitHandle 11612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13888 -initialChannelId {1f9c505c-1cc2-4ae7-9a21-885fefb3af8d} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 130 tab
    3⤵
    - Checks processor information in registry
    PID:2524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13992 -prefsLen 36638 -prefMapHandle 13996 -prefMapSize 270279 -jsInitHandle 11412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6808 -initialChannelId {ff164dba-18e7-438f-9912-14b9168e625f} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 131 tab
    3⤵
    PID:6220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13284 -prefsLen 36638 -prefMapHandle 8128 -prefMapSize 270279 -jsInitHandle 6484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11904 -initialChannelId {5aa8467f-c984-4d3f-8eea-179be0c1ceb0} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 132 tab
    3⤵
    PID:7836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1668 -prefsLen 36638 -prefMapHandle 8556 -prefMapSize 270279 -jsInitHandle 7748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13024 -initialChannelId {7b0f7ac0-b9a5-46e4-b725-83e77c686c8a} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 133 tab
    3⤵
    PID:7588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11408 -prefsLen 36638 -prefMapHandle 6780 -prefMapSize 270279 -jsInitHandle 8700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11868 -initialChannelId {437ea207-2139-4357-9464-e76daa8cbda3} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 134 tab
    3⤵
    PID:7612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11332 -prefsLen 36638 -prefMapHandle 11368 -prefMapSize 270279 -jsInitHandle 11272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5368 -initialChannelId {1c420a00-13af-4bf2-b01b-ffcc836fb5e7} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 135 tab
    3⤵
    PID:7620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8640 -prefsLen 36638 -prefMapHandle 13512 -prefMapSize 270279 -jsInitHandle 11964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8984 -initialChannelId {f03488ee-196c-40d9-8bf0-182fadbff7fc} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 136 tab
    3⤵
    - Checks processor information in registry
    PID:7832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12168 -prefsLen 36638 -prefMapHandle 13828 -prefMapSize 270279 -jsInitHandle 6996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2620 -initialChannelId {0c36796f-cf64-468c-98e5-cc69683b63d2} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 137 tab
    3⤵
    PID:7628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12792 -prefsLen 36638 -prefMapHandle 13992 -prefMapSize 270279 -jsInitHandle 13996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10016 -initialChannelId {590d99a4-62df-48aa-890b-43ee97ae44b0} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 138 tab
    3⤵
    PID:7640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 10688 -prefsLen 39725 -prefMapHandle 9056 -prefMapSize 270279 -ipcHandle 13432 -initialChannelId {aecba41f-9d9f-48eb-8263-1fc68fceeaa1} -parentPid 5876 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5876" -appDir "C:\Program Files\Mozilla Firefox\browser" - 139 utility
    3⤵
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:7704
- - C:\Users\Admin\Downloads\minecraft-demo.exe
    "C:\Users\Admin\Downloads\minecraft-demo.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\GmingRepair.exe
      "C:\Users\Admin\AppData\Local\Temp\GmingRepair.exe" scenarioMinecraft
      4⤵
      Executes dropped EXE
      Checks system information in the registry
      Checks processor information in registry
      Enumerates system info in registry
      PID:8208
    - - C:\Windows\system32\wevtutil.exe
        
        "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeploymentServer/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeploymentServer_Operational.evtx /ow:true
        5⤵
        
        PID:8432
    - - C:\Windows\system32\wevtutil.exe
        
        "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeployment/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeployment_Operational.evtx /ow:true
        5⤵
        
        PID:8492
    - - C:\Windows\system32\wevtutil.exe
        
        "C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppxPackaging/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppxPackaging_Operational.evtx /ow:true
        5⤵
        
        PID:8548
    - - C:\Windows\system32\wscollect.exe
        
        "C:\Windows\system32\wscollect.exe" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\wscollect_gr.cab
        5⤵
        
        PID:8596
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SIH" "C:\Users\Admin\AppData\Local\Temp\registry_SIH.txt" /y
        6⤵
        
        PID:8660
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig" "C:\Users\Admin\AppData\Local\Temp\registry_DNSPolicy.txt" /y
        6⤵
        
        PID:8676
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" export HKLM\Software\Microsoft\GamingServices C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_GRTS.reg /y
        5⤵
        
        PID:8744
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" export HKCU\Software\Microsoft\GamingServices C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_GRTS.reg /y
        5⤵
        
        PID:8784
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" export HKLM\SYSTEM\CurrentControlSet\Services\GamingServices C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GS_Service.reg /y
        5⤵
        
        PID:8860
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" export HKLM\SYSTEM\CurrentControlSet\Services\GamingServicesNet C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GSNet_Service.reg /y
        5⤵
        
        PID:8912
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" export HKLM\SYSTEM\CurrentControlSet\Services\GameFlt C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GameFlt_Service.reg /y
        5⤵
        
        PID:8964
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" export HKLM\SYSTEM\CurrentControlSet\Services\Xvdd C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Xvdd_Service.reg /y
        5⤵
        
        PID:9016

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6C1A5C1BA4253C85FC600CCA60EE8DEF C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5904
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E052144893DF910FB34AAB226B2AD387
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6908
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6B3E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240806750 2 RequestSender!RequestSender.CustomActions.Start
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6572
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6CCF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240807125 60 RequestSender!RequestSender.CustomActions.CreateScheduledTask
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3960
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7686.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240809609 1936 RequestSender!RequestSender.CustomActions.Finish
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2924

C:\Users\Admin\AppData\Roaming\Zip It Now\zip_it_now.exe
"C:\Users\Admin\AppData\Roaming\Zip It Now\zip_it_now.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4528

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004D4
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5a6ac4.rbs

Filesize
817KB

MD5
65cc003b2bbb2fa836bb00b523a94e05

SHA1
379f9b9390a8c1993215e2bd70808a6c3c62dc5e

SHA256
e74a2ed2ddf221d2d2dfab6d319a62b20e15ddfaa83a6eedeb25ec3e6be2621b

SHA512
7d0ee211eeea32fee4d8152e5b90f27830eee9b09476ffd753728d69579f94b79fad4ea376d0e3ae48dd8c9a6812a85d191b3b92e2758cbbffecfe6be6d89b2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_72CCC0C460359CBC0716274BF0FB0BF3

Filesize
1KB

MD5
d1825505953cc3f5b57c52fb18cafe11

SHA1
398ef40646d2af7c873cfeadd384d476f516a6ae

SHA256
26cfa8b32f73857b0d7d7850e92e25e702d4ccff762963b0e2ecf88446d2b796

SHA512
16a7f9907b41b39b02c977ec76f45f7e48cc29395dd4b675229ec2134fc4534bbad34b119badf9a3e962f0b478ff8290fd10220b2cf800a5fa144ced92ddab98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
1KB

MD5
6034b7dada2ce220066ab5b72f2b782d

SHA1
bdbb70d792641e28ce496d78ae4e0e0bda9efd79

SHA256
475439a7bd5d59e7e392635fdbc0f912d6fca61eb76a8c8b0fa2d6b654fa2ec3

SHA512
a028c184906a9224efb353d23b594665ef64763b1dd69f6d278f9a52dc4ecc9cc45115f68f98f86d5a5af9550e7a0f90b3d1d4e78561dfe9883692bfb3723ed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_72CCC0C460359CBC0716274BF0FB0BF3

Filesize
536B

MD5
56b96f6c787d5156de330a3c00b9ed47

SHA1
a82888f01dbc0e26cc4f933abed9ad772ef3b3a9

SHA256
1a0d94b045f99917ed07412f1bca3b9e56e5c2c43caade5811c73c8710c754c6

SHA512
19647cc1acf107d1e7780cc2619cd3760e99038dee243ffefd24c33e1474b117e3ca0c91b11e108563ebc67254571d6fd96cc39726e43f415f02a8e48963f86a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
536B

MD5
1d0e5c55f14b786aab799feec8506d4e

SHA1
3d8b827af71fa40e1988678c4465e3eb950348f0

SHA256
02040fec7d244e20cf544829a52949957f06313deae5ab4ba241d33a737239b5

SHA512
87351b0cb2a39223a9cfe8d3068f10ae73a9bd48ee445b4fb93663eec1e6ac76e82349cdff4195671a1d7ae7f67e6dc8ea07c11401431a4ae67677e45de93db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Filesize
847B

MD5
ef375f28c91db0202bf7db29c0cbc2ce

SHA1
5a3f5d4ec75a468b908c2eb2b9e6f4b1e76c1017

SHA256
f4d1c038db378dec10e7e2fc81ccc2e2d4b8132ef0d66905e3625a0b0cbbde5f

SHA512
f18141e352fcd253e02cb25fa0cff29ab06dec62bafd5aa80ca48c959d1dba97deae830d01bf521f851a8143b9416747eb170d0cedafa32b59155027c02f244d

Download Submit
C:\Users\Admin\AppData\Local\MinecraftInstaller\deviceId.txt

Filesize
36B

MD5
1cc1d7e486b22de2909cc36b4192eb03

SHA1
828044ea9484147eabe8221493c97f0e588b7551

SHA256
b7196b67e464ae982a59f1766d8e8ede4442f0551e0a8ae719fb5c97d90038c4

SHA512
43d8137f57d94eef88d2bdb65f190af4135ec5ca3460c5efbb0adfccb018c9f06f29be940f8245cd11e7b233449fbf307b6fd1bbc55508dd98e69af7c2fa80a8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\activity-stream.contile.json

Filesize
5KB

MD5
b45612c7999e7ace4a779f7ab1628802

SHA1
682594c0e7feb50636af504f724368805e1b8081

SHA256
fa490619a00eab76bb92305d03e8de4c483347806488febb9c918d94cb7dea7d

SHA512
ba7e0611d9d9df895ec37109d348b4bf2a4937358441201c0f27125af3ac73d6ad0a32e93ee1da4cfa040b163493c9f4aee2adcc48ef167d7dda13fe31ce54b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\doomed\23278

Filesize
52KB

MD5
40789c2d1ed824be0ca6ca1e6415f230

SHA1
94d05443cd8d9c85943ac22b7ba3df6931579d4c

SHA256
095a1066d819f4d5d9ae1fb3cf88ebdd6f580314dbe12263ddafb64b535c35d2

SHA512
3f227d95d176a177c7c8640c9b3213b2bde6eb5ac596d7e9441c86ed7ca1113e27d014b330863f7202a9db4a98c85e4cb93746745fb464be19a72649dffcdf04

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\doomed\30029

Filesize
18KB

MD5
17691ac07583736c8e79aa2e467e16c7

SHA1
a521d2dd2cd56c772bce897ece536bcf8c193f9c

SHA256
14bfc7c1f978827830cc9b49b8e2fe2a667c3d54d0ea07f1b510fa46af66d8ed

SHA512
9a6e1b3411c7489b7d9c009d242b0a72b8df3be7842b64fc30f8d6a7389977cbc1b8f54d4491331e4fdecb3e3d80cff20fdafeb1542aa369a0988d5dd36a85a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\doomed\5252

Filesize
15KB

MD5
e9a0bf49992d6eaac06ce1e12c860021

SHA1
d27051ab0742770323fd45ac3e4ccfe72a31e82b

SHA256
da6e91f2aab7311d8a712c7a3ad4f67e854c8940a3350276dd3c69595c5975d5

SHA512
fd4bb56c60917529b130f7e03aac9d34424337fe8e3ebba7a1e2871b446477cd88691aa902917cb6c63da0c0d47a786a2c84fcc756a6a0dcd89823dbcb50995e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\03D74D5ED346B6A425AA45C38A54C3F6BCFF5085

Filesize
47KB

MD5
5cc00ae6f83aba87f9d9eee62cd5b759

SHA1
2c833fae867edac98d1b75e0cc3b2479c8b5a96a

SHA256
aad948b48091bbffa9641c112b02dbb6edf9c8ae33841d035163115436fe3de1

SHA512
acdc075a3578bf309814c2b23ff7a0d8a2463f33b1d7d9f490f9d5437457af3fc7e124e7e18e0da84a42878cc5fdc75ccb6e922a7fdaadbdee0aaf732756b849

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\07FB608C52487F2657D502FD09E9837C819C1896

Filesize
162KB

MD5
2b80b59fb8a33f4a8f236992d8db6ce3

SHA1
9e6c225c6285a166ab029c5dd64934c697c8835d

SHA256
916aa2c21ceb264e3b61d8aa7c7eb5a7ae338ab4110c64df396c6ebe499dc505

SHA512
cfb9c0c27ef509e938bbbcaa03020706a54f1cbcc39dcf793fff50b61c57228dcd67613652d6482044d960edbb79c6ee586c9d46188a3587aacebbcc11a58d01

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\0B732767820D7E7C4C98E309246D7A329ED1D1FC

Filesize
1.3MB

MD5
06c09f0ae32e6863c2362acd26e2d044

SHA1
1e180751c024ff07bbe590b74158e455b760f617

SHA256
bfe64470a7eefdec834931e429219abcb3872c7a9e472184a773eb0ad23caad1

SHA512
41c4031fc1c956368aa2dcd4c3c0fa190cb9dd2247863f1f9e55f227e8c8ca57bc30fd90ca9c06f93d9dd1d68505eeb40d890c63a7c98bc570feeb98e259649d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\0BF216ABA08A834535805F27D58975CBC8FCC467

Filesize
25KB

MD5
04a3f6255688ae4e2bd24cc9da6d50d8

SHA1
69b0735de0c1066f8e766138237970ee7dfd3979

SHA256
a4e6ae7be4034bcad62c50f6be5d60729cc7c4061ef67df7766a06fc8782b819

SHA512
b320f3e3a62f36b7f3f2fad0d133c863ccac59aa0187b430e845148d3e65434ff0d13c3d074842772070f0c266b16ef99c71a0575898b3bc03ba4ac5352c33ff

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\0C42D01D2AB8BF7F9FF5E451DBD7FA3548C3A820

Filesize
91KB

MD5
7e6b1f12c0a648925fea730dde04c06a

SHA1
bc60b189ad3cb45c26392bad7cd2000ff522dfce

SHA256
de80cfc1159a7141ce1a9bed4d86e57311bfc65e066c5847bf7d2704a40404f6

SHA512
96b06f1785b76dbd933ea1b51eb26e5607a9176a9fb6bb3e9162b258bb834a2f4b130e0e6d45828c90dbd8d39af28bf249b53a1108cd15aa12f14f9225b7c3ba

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\0F8E5831ACC6E0A08F6B32BA844ACFC738BEB9E7

Filesize
43KB

MD5
5094ccecb2cda4895984cfda0763582d

SHA1
aecf786e130b5a1d2ed1f186c21220fe433d2e94

SHA256
da30dfc484e1d7bf9fa1cf0687f1e80a89dc902d8bedc5452256dba641a5de0e

SHA512
2605fd3604a7d9833d83ef55c3448e6e02d7dfc86e8c94af5ec549ab6cfbbb13031b682bb445cf7390d5b8430700e90375f137d8e269d698267e5cf1c0bbc936

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\1420764F68DC6644BA10A0C22A6589E1CB164E6A

Filesize
1.4MB

MD5
6e769d97abd0d7c075a1a0cbfa99fed7

SHA1
298be6d706477413d49252dcd935bda661e16953

SHA256
11306cacc850b0ba33a40698c2b418cc5e8c6d8102528c480ab1e7ea155286fe

SHA512
e0b111aa5d4a14e86e5768f42be5a3bd42a8d03ddd3707ab946ec300d65bc1d0421738dad06b585a5317a4cb23d7e20fa5314d5cede9cf65cb88041718e331c6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\1725C3E3EBB9155E2BDC0688607186CEFAE503D0

Filesize
1.5MB

MD5
0ac8c8f7f82b06d40fd9d597715c7ff7

SHA1
20c0a7fa38e55f206c2d24f1930b53edf6838ae8

SHA256
56f38e1f0424e48d126a1047ec02bc701a73429a29ac48d6058c3b78fc8fca09

SHA512
a201e4b47ccbae58eabab375a479ac7f6cdb958244bf12df112082c8229163430d2f37e239d4f05e7955f219994ef24b14307543725e6718011b8c1527c64061

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\21523F461032B1B7D1B31B0084FA42DFBA4ED71D

Filesize
129KB

MD5
adc92c2d53b49ef316e08968cd6f718f

SHA1
ab6839f03d13110475b4a28c43c4b06c35815516

SHA256
946cbe4d6d0e6a01b07a857b980f79d48431fe42a21208e4e4186bf38965f562

SHA512
3fb6642b2bb38209e7f7fccb0ef59a1dd79b3f1bcecc648ec7f5a4a9cc770e6101ce0fbb00fade036a9b07de5c0600e760f8e51cf05f101c6b2f2337f73aaab1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\228633C0EE58A7A20BB454E9644DA2F0C805124B

Filesize
34KB

MD5
49eeb7042e0abc93c92a23f301308cb5

SHA1
fd70ee2a9ba1b1223069fed62eb0b4e59494a195

SHA256
edb267e207b60959898cc4214cac19084e2d021f4f033b0faaff9ac9972146aa

SHA512
de6c919a8953433bdb8cfaff50e43a24efe8bbb13af5acfb343da0bf3f252de705bce12213309c7074a1b047027bcfa76cfb91b0ee77f87342e1e8ad918765a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\232F6B35D66ECD04288AF48918563D68C0EF028E

Filesize
34KB

MD5
0f09c70e0e8b329560025eae0b08ea1e

SHA1
70b2534cd993edaf60fcb55558b8549c8045c3a8

SHA256
a729fefa433491b2d98c5fdef493014e9b86c15470dd9e8e19ee40d773ffcf78

SHA512
08db1c5de0dacff1b73def881e28f9c68442696c25a902c39e7e34abc1d834bf2689e580caa83fa99fe615cb914d2f4d48f0f8d43377d05839cc5878fd90a689

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\26EC1EEC6FB2F02D7228C7FEADFD33EFCD534DBC

Filesize
23KB

MD5
4762a8cce871c2ffccadad6594d76493

SHA1
e64e9984a91a56cb2ab597131a3508e1b9d64ce4

SHA256
3b372cebec55cc43e2d6c27c4523ecd748df13222e095442d102f01e1e2cd339

SHA512
c1148f33babc27d0aa816d4ff73cde1b3466560424ac563b60759e2fd25f628c0a56491218775699643d3ad29c95fa0615d5d3b48d2032d355b389d0581944c0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\27EC7C600C7708F49EC5EEBE512D1F8953C83085

Filesize
27KB

MD5
009e91a0879b61734545df8902655549

SHA1
88c18e59a39bae8bd7c9aaf806864ae4274e743d

SHA256
1407f1dd71c042a7ab2a1ea978ed6ea6cbdcfd3b43145c21553a166a04f3d78a

SHA512
d861084b3fac04dd6095c45bc346e2e98e5f2f67957e90c78efa4d81ace9733528f34b74b4ca528732557d19c2c510629c317c0328b137207dd53c4af13d3c7a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\29A2B581F52755C707BF31DBB14E825EA531B170

Filesize
15KB

MD5
84983a1f7ec85206a0a352f6d5937036

SHA1
dcfbb45c6f49e0a20273f6357ed1faa3a5adefc6

SHA256
52347e2a400753df2cb8fcb3edc9bb50a12ad3a243b1b24bf250d23785fe4e60

SHA512
e6207b0374a957969fc5cc58a5d5ae200ff8157b8e46e6825780279bfe8d197cae769af8545841d27e0d27c09f4014c55b311d602f3c3317efb45ba6634aa852

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\2AF849A345B4F8D8FAE004D3B60ED75A5370318A

Filesize
278KB

MD5
bdd6dea77c02c5f12f3e438b35495050

SHA1
3bb28cd3474e86f9c47ca187abbf61f274cb024d

SHA256
c574bbdb29b6880fca9a183df46642b0fdbe182c926609baff1f7a848606c327

SHA512
8faf06a69dc92117db215b03251eb9458937f225fe0eeec5b56f8ecd4edd514f9d31a9be87a940a818d969bc13bc5907366450ca50000ff8a6a12f0eb6a74822

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\2DE3AE1157103D5DA633229E5B4C3899F0A78FC4

Filesize
25KB

MD5
bbcd5c425e393ca17bbe432efef78996

SHA1
2760e36a7d89e7dac1ae94983e39b526933bbc50

SHA256
21a988a36fb5e4fad846af7164f352726debaf20446866059f2c788d64c57478

SHA512
78a7ee34f5e8a4c333a5d77795098bf9bac1adf178982ecc8e0dc1a27c9bbb222ca12cbdfc957fbfd7f9720996a7b7f9054e28949f66e941848cce95f32470f7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\2E921930B31622D6B9E44825C6F982C4662A493A

Filesize
1.5MB

MD5
2cece3d30f8794de6c994cb0797494ba

SHA1
e9d139b3b922dcae04abd5d64aef68c1397cb35e

SHA256
15dcb71cd8107d89aa5d70bf5b75f38919dbca7b13d716417f4fe5eac5f2cff3

SHA512
95e60bfd69684c2e523ab81058562e1efad0b08917b88d98e4d3a5bde3fc9354fd0605ef3d2e9f9f0656033591b6633b51cc67949737d2a62c6c250af53984d6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\2FC82301C5CFEF1E8CDECE75F6731A62C63BC6D8

Filesize
225KB

MD5
0d1c6772f8a45ca294d524503c5b9563

SHA1
70a48e793624e5ded9db1767ec83a7887a994085

SHA256
d2dd50d3738ab64b48747b88ff3d980bc3a87a546d67ff5f7bc61380fff5c994

SHA512
d11ce3f20206f3ca78690f2cddac4244c3078157069405e0a7797035fbefc841e4ab4c4a3f2f379d278a4d9429384f3bad7dcd3f8cadbd7bca31507e6493519d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\300E9C1FF55E7D847600D9D501834EBD3AF7FEB3

Filesize
56KB

MD5
2a2808c6dc5c0fa57601cdd733eafb3c

SHA1
7671a0a7bc0dc6da871acc547bc611662207b4c1

SHA256
6e556c5112ca5d1bf5a192b0032fd9a47f5c088a32195e86eac9815216ceac80

SHA512
85d0956a366ee0a07ad8cc25dc8ddec47f68829c0531c8fd6099ca31967f9beea90882ae84ec134ebd0edf4e6f83ea4e74d807bd50430201c9b2ab19111b9cee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\3302073F7525348890463FE84DECC59243C5B063

Filesize
197KB

MD5
bb059e8b1f062c6e21c02d13ce7057d1

SHA1
bee57ba41e8d82ad4afc939e3c30ccd76a114242

SHA256
c7c82786a9949b30a62d4509aec627a0d0ed48fdc20cffa03f891e8e3e2d8adc

SHA512
342627c235210dc52b86e4ef1c7dcea7c0269a122bbefd8c7030f531345135cd1d9b937d28e5167fe3952bb63e575fccc0d0e12908bd5336b9a92394ea8fcdd3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\347A110F4FF96995C6F5DE9FB30183CD1DCBC899

Filesize
46KB

MD5
91771b2b1df949c0c9b132f7921443a4

SHA1
312d59265c685104ed98548d38fa1bf7871541b4

SHA256
251d9db049d25ebad8b852dcbe209ab130c0636a2743ee4fd816d83a0b379b6e

SHA512
94a671fa9e866333c8ef3aa3edd1b83eba3170f8923d3e06ab5f7a83eecfbfc6e7dec53af7bfaed2a9c020e9cd910765e86c8e96d34077f4ad7b53fc1ba44f8d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\35443CFA2D783733881662A51C95C25CF32EFB63

Filesize
468KB

MD5
53c9b373774e872ff9207a614716733f

SHA1
b8e61be432c8653a79ffabef86cd9f961ab5f8de

SHA256
60323fdd8b6d2e35293ede3868422b468ce4fc6bd7e512cdc5f318f6a8626392

SHA512
97e4f05945ad8a0b22d39cc036ab96a7c4603c034b08c4e55d3fe5301e2bb309ba1f57db8d405f65d53bdddca79eff69656b0dec85e62d3721f13639b4b639e5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\39774D4336322856898CC576EC8BC457206BF0D3

Filesize
38KB

MD5
8ac63ff837df34ff637f56b1a5b8c9ad

SHA1
4bd6dc2904b9f36b2a71b2c9f79770e4192a2c11

SHA256
e3b51426d5195cadef2fe1e5437f515fc0729da1464cbc8390a916b3d0027888

SHA512
d92ab2f0b88e000f88f06c27ad38f23d21da08053dd2123b394bd8491844f977e7d8d83949804396a5651b5dd0d649d562e42ed69ac288085be9cbc326371849

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\3C63FB74DC9081B435BDA462899E20ED4FAA9A53

Filesize
85KB

MD5
77500f554238b1b7fff234fe1a200bf3

SHA1
3a2f63f042dec25da5af80d71318f90a0faee0e7

SHA256
ababbe616a4b7d8d56ac402e1ebedd317f6dae8d8b350bd9d2c9c84721be2480

SHA512
facc8e52b60634f5358c0a33090ad4285eb64f31ef43ec771e3ec60819b16cd2dd212d82647e311630e39dc6b654ea493e06539b7fd056f676db72f8b0101330

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\3E9D39BC9F5CEB44FDDB5073234018042A182D31

Filesize
13KB

MD5
6e2bca8cd2502795553c3e827873a02f

SHA1
30d596581ea77f85b3086cb474bae8c79eb72587

SHA256
f88411721ee01e334bd02bdacb7d78f2c97ed7fe0ae2edcba4c8a03927ee0573

SHA512
f8582dcc0de3133dfa1b16d34dcdcb2557ccbb71687175e0b843a6fa80803fb5a052151c4eb7cdd7d9e1d7ff464840515e12e6510b74a5ffcbbd44d17985ce24

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\3F97AAA32A79DF3D9C1101CF3D0E8986EE1CFEE0

Filesize
22KB

MD5
454ce2ab8d5f76ef02aa86f42e529212

SHA1
ba7899c9ef0f32095a0d1f1fd187c1e5e14cf9ea

SHA256
07b03243d53ad6962453037e39e9d3d5f1835cbb55c473d260068fc8d92d560c

SHA512
57043becb3c4bc82991df2e7bbdccd1d2e6e3a6834df63aeccc7b6d229b818ef53cf7d4b36e5414bc67d078900c6c32fbd35e883796addc9df5f65eb75560b3c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\4335D8B10301BA138188E6F53584673B5CE50386

Filesize
714KB

MD5
860d0dee18baa10931b33d503450ad22

SHA1
4c5655f1ae269d7d021f0c0a875a46f25e90f0c5

SHA256
92460327de82464fd4540b4058dcdfdc4e6a0dc8b9a5205d16b83b092600c18a

SHA512
7afbec59bb8954303ed5157d20eda6cf2631d6976d9d24eeb1897f2c7cdeb9f2dbac924b1102618a5a0469d2de180d0c6465fed176653d81a0d2c5a16e9ab59c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\4A5B9E0FB792A4FF08AB57D2BE340D3867D9ECE4

Filesize
1020KB

MD5
570f80b9ca856943f76d06b746675ab1

SHA1
cbdcdb3239d40cf39aa4cccb236f42cacbd95e5f

SHA256
d02c86dc029717d62bda5359fe41bfe07794f32fa926b19c955bfc356baa93b5

SHA512
a46cfee71585b718400e7946c48a5d92c4622597c019813f304f6658f221917476f2fcd3c54a30cebc4a7f41dc976d584f96fcb1095b4c3d5a465694a12a616c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\4C3BAACB5222888D0F9C6C99BCB711EEE930961C

Filesize
63KB

MD5
2d611748a884463f389489511eccfa1c

SHA1
8cbe115ae96038aa75421859c89925d5adc033fc

SHA256
295194ff4d03dd9c8722f0bc0ed44eac1c83060e91a58df35c5d6d53f20bb13b

SHA512
4b3ce732a18d355b7abd7af4f648ab8469a2c605c55cf3f5116ac9a80f4a8b72443e166a68e2dd87817391e62689fefe83f04019eeadb1dc3ffac6cbeb26ede3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\4E4AB22F97C3C25DA9A7A2D67544C5D10270B737

Filesize
119KB

MD5
20d457e882338a8725486757cdfac663

SHA1
b7ffa5b6f31bebaaabe449e327a9962bb3f41a2e

SHA256
2b28b15c6d8a0732ccff541c9b2c915fe80c702753a17e5c37fa32f8c6805524

SHA512
936998b837e5ab53e6c477c2ee10362584a437e517a48f2a8ea5ecb38ea5bb4d3e8a0bee4bf01d2d586f56ae942b6db8becf36e2d97174aa0bcfe48ca35f47d4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\517C762C7D4B508FD92E521DB4561380E7606F8D

Filesize
28KB

MD5
be9250ee08804a89cbbcaf0a80c0ccf0

SHA1
321d017109209bde10a16ef957baf4f9b282bc46

SHA256
55512f33929bd319b301f0ea210e45fdafd6a2e8980026bdfe36b98d27bf019d

SHA512
1ae20b9bfa043ca66307266b135834d9271fce11344ad8715ce4cc29996fdaa59a9249c9c6968e0fa5d50b62474ebdde6db3746936251de9e0a31d863bc61734

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\539405D7B63C8E85DCC62EC2DC1538CA1F1963B6

Filesize
77KB

MD5
d1bf0d26067da0fa4c1e035acbe3d849

SHA1
cfa5479320e26433fab8ae20184b0fb9980e2656

SHA256
b52ce32f6553c060315462e38dd6c6258ff07c9bce10b8d1d75206c5b5cd7fe7

SHA512
6d29c4f4fd535508b013321553e6dcf46654dae3bb4e932eefc023ca472481d6633f7a3fb7db89569839dd32e99a1c6bc146ddf537b19c4a37d9f16e224e4434

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\57CCF11036EDE9F6C713101090CF0FF928F654FE

Filesize
1.1MB

MD5
71997e1fe61c5ecba5631de86cf97fe1

SHA1
ed6190f5b9fb36a0db87583b6545fe9dd30d681d

SHA256
049e2e7544feedd3fe09feaa3e49c7e168f4156060b1f5297921bb5cad60f1fe

SHA512
0af5153e524a7601475c49f4d922f1250e1e945b0ac420d1633d038850b544bdcac77580d5c19b5daa5902a9e82fbd78073b6be40cbea35ff21abfb9d11b167b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\58E6E653125EAAA08AEABF2A97382B846935A058

Filesize
18KB

MD5
64abe527bd2c7d6b10bc7b84870e0341

SHA1
f5fdf90ee165775369f08831b1b5a419536d6720

SHA256
26f8149a540478df440b7099b1cb6a54c366209e3bbe340369d614d8403da824

SHA512
a08932b3ac3c89a37e059da57a06cbca7bd69a6435a7ce0b0800291db94c4ab207f3a7a2e2d75eebbb22f5e33822ac4ea69a67a2de731bb47735023b211a4749

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\629DB69F0A997246108A44AD96B5460E4C4ADA8C

Filesize
5.6MB

MD5
200a471bae9fe572518790dee1535454

SHA1
3668fb10e808510dc254615fd03020eee3c8f29a

SHA256
95b871d1277a3a1a9a4fb86a78d27a9025adc203d046cd751eaf5b8cb3a32a83

SHA512
8af307597b21c86f69aa850825c21104ebe59cd94a51915cebb67fa615294bf61a6499f6090a79979fd652840859d6d0d7aa0318e9fdcf679036a41df4c58b56

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\62B833648A7D38EE92F32C192B7BDAEF8DD2671C

Filesize
128KB

MD5
00cee1cb0b3438d9bb7c068282b9ce8f

SHA1
548b3d194dfc94d7286fcf990ff5ff7efda145ef

SHA256
19bbb0334462bde381c753595b0e62682f1a08b705c201ccaff9c9ccaa4f3afa

SHA512
0f81f5acd9a99d7ca941636edbfd889f962f76a828b7bb6492354504e1b27735b763d8a2adb251ffeea1e15297e58ad0a01ff37b6d685b169915c545bf700da8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\6B75780DDA423F0016A5C1C85C47BF01EB3C367C

Filesize
3.3MB

MD5
b208272dbe2fabb7a1ae15ca485ee6aa

SHA1
01b6255ff5d7d6f6f3d12e7710f5bbbddefc536e

SHA256
3bc3b0312713b5ed12113728edf683a9cd1b369201f5ccede3fe96c18cc7ee14

SHA512
994b13b81ebe1f5261d4af238bbab02ed9506baf369d94edf2d0ee950ac02a22d350233543a61d116d82f88e9c7e47e2583850637307c167bb00110ae0cd740e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\6BAD458126384D34C7F568D8DAA40CE7AD031E7B

Filesize
23KB

MD5
c8cc9070491ec642dedb070095f0fa1e

SHA1
56a787cd32ac4e8539778bc7a38038317ed53257

SHA256
943c04da4e05255821d84a757f904fa3a26004a33d6c864041f9a4362ada13a8

SHA512
3d7808a99315a3972db5e03531d4da206879ce08a8578f31994441d901a1a89d8232d373f84128416e63f3df75eaf27550d91f52f22d1eeae9b80f0d4791269e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\6C9C38770F34C1BAA1BF4E4D35A51CA7153E314E

Filesize
29KB

MD5
fd36af5f3fad81b6ac3a563eb464903b

SHA1
0af21b5d989c35411eda26f5ddea118a38dfce5e

SHA256
a65f892372c8c1203075b401d1551cdac48732cd41920733d103a8ca674c1f5b

SHA512
d2665fe9a5db084b3f7a57a8abb067bd67e8c4e40f505be45ee90c31aecd067b56411eaf48646a1fc8a7c7b0666f92be938a29713a2321d652a9f7e5f50bdb51

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\6C9FEC66EAD0C58DD8D27005313BD58D76A114CE

Filesize
26KB

MD5
392e1e4280b6e5949d31eab750dc35ab

SHA1
d438efc588f078613b41d5bd20e9384a299ea7c3

SHA256
afec7cacf80f8556af62efaa9851ab7e2a6d68b9ae57dcd7f1b9d21a87440466

SHA512
10f035f1fb2681f53462600c388afef4dfbe2fc8b965b28d05bced0a6ad83b5623eed7fc6712e3a0bdc16efed28ffb2ebd2b6f9790b8c80b3aa22936fd780cd0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\6D6384CCA11FF6D3BEFD2110AABD4BC2CCCB4C4E

Filesize
24KB

MD5
0ab82f1825b0c50d0b071e5e136c4cce

SHA1
20cf67ecf431a47511e818a58b58caf3bab0df6e

SHA256
158da70e6f056c994cfb9a8a2e7957b6985542a306f7162877577aa86a3a9255

SHA512
7e56c09c69801436d2c94456cdaead781568e77b62d0a3558e808ea087b413a3d6effb72cd981b8f7094369d211ccbafd9ca3d0e725bd601a5a6dcb7a49a1d7f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\6EE6ED429931A86D057DC82B5619B7C5BE47BC74

Filesize
25KB

MD5
3ca837946404ab5ac923a209393d54dd

SHA1
61d2bafe4ff1575e10c2e2ddf5ad31519da4abda

SHA256
18ad115589934698ee1732e752e50c447477d9482716534e3f25b6cdefff687f

SHA512
a7daeff318e5f85698c710ccc3e37acc2a387bf31d3f16004341166dab401e150768340580885b6bdc97650f6c06baee6756391234a3626fd5c91621be27ec1a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\6EEC1A54BB52F35B9C22D9B5FD2A02D131F3F13E

Filesize
100KB

MD5
1053d0a3d94d5798a8ceb4534e31a584

SHA1
50bcd8805d9a2d802299daf04fe546316a0ad745

SHA256
812993b77d8dfbaa51ca8ee9618809bf2e32e8b0f42691de6b4eef3606a3d0f3

SHA512
79476162665e21ed61e72c82d02007cc06e9a6dac7f9263b43164bf68d1484937010d48715127eb26a216b0d1bb9d8eb4e32c938e027a2de64684434bea97cc4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\75CA578BFECAE3602B8B8B2227CED1D64E903B46

Filesize
195KB

MD5
a1ab6fed058406d70ab0834bbb89d508

SHA1
8c3fd3fc0b4c5fed8242fd2a9719dd5886e4ef60

SHA256
91cec4730808eb283159f52c9c6111d48d1c1b1ee36ac853c29744e5ff32e073

SHA512
5845d5c08635fea6337874c28a494447c900319e0fa042aaeb86cc73eeff62c1a1ff28a25a87c1f0f285744f3e50d0d22f9eed07028ce0e03f22f3a9fb78b37a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\7888A6BDB001627A694C5BD896D7F1EC18A8B2EB

Filesize
2.5MB

MD5
ccf60cf2ce27be59dade11015855a750

SHA1
e48eecf65e190b504538b667a28c54e1041adcde

SHA256
bee0f9c364449a7ae90b1213a4bd683d5000b58964da59e9609405c985c22e42

SHA512
f87b7e10177d5d193da576b0f1f8a6800baf066e91cf890e24910ef2ce1c30b61f881a4aa49efd48b5e5e1cf9dc65b0ed11e1b913ff6429ace05d7ab36517586

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\8383ECAE978FD6D72E00D556E195A87D2D51811D

Filesize
35KB

MD5
a8372316602751440dd7480d5943b904

SHA1
471bc1414291683f4fd57fc1b4c5190e13b8e196

SHA256
3dfb464fd375c2fd2e1d3074b2b8620592cdfb5f77884a19fe938eb1418f0427

SHA512
d16a3d1af041d9dfd73b211199be4b93834793a26818798ef049cb35872bd52476ac31c3eb463d8bcebfa28cd86db6ad303163472a8fdfb0dae30f0d0c3f6d6d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\83B923A534E6B9B7A8033D210D29EE6613DC59AF

Filesize
85KB

MD5
925cf56e8a36d1286787b95f59309bbc

SHA1
c6276af76013a747e75bbac51106dcf9be1ddaac

SHA256
9243062e043f877daa66238a0e16ec3547bb7176cfe75c73f150b763fba7aee7

SHA512
68f798f0596358bcf871407839759bd6042221b9fc11252ef1eb7719e9e303c87ac453439c1327eebc61301cb2a98c036cfb034fea8f61308c75bf8c0b7222ca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\8536D13D594340AD0346CABBD98D9365D6ABE23E

Filesize
1.0MB

MD5
b85ef8f4d04e243aa5502307a5abd2e4

SHA1
e10b1e0b891859b7e20f820f6971f6fcebee7f40

SHA256
7bbfa96c0933aad95ce82212e8337ea57e3080e29216df376eaa21d62089e1a7

SHA512
4af1abb67cd6b9f09e4c99e8c2b5be758a0940fb8ce4dd1429519e64b75c5ba0403174b47a5fac0d42f1566695128310dbbc4517f08446b6390910fe5bc84cfa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\8589DD1EFE86170AF2525CF056EBBABF4A666D8F

Filesize
283KB

MD5
432a4e9f0db3269f1eb2d4d1076a6661

SHA1
3fc7d23889a0c69bd46550d48bcce23028b24d3e

SHA256
2478c3fe367e66d35d45dc2e425caeb62615123ec0a3ff5ecb3aa570e9a15bd5

SHA512
09daa0a961c4bbab5ffe222c0c9000c15c35a787e67216613ed233f81f85376b8a2c9b2185c43e1f057c51ac2a3fd2b16880852c41f7f8837b0ceae6c6d477fa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\85E1FE84D175FFE094D9D8132CCACACB22BEA24B

Filesize
44KB

MD5
86073763bc1ea9971a79dc08b5c50abf

SHA1
5d3223463cc44c6a66f19fc1bfaae5cf8d57c29d

SHA256
e30988c774f0cb0eca0b3e56ece029846f5fd2a37e80b9d5ddec73a498ed06a0

SHA512
4d76fbabc12de1ce4ac2c0a5373767bc3dc4b770969a72d121f080ad22a0f676d20a4032acfb020a58043be291ef78ae94f97683dda126d53612d07c16bc9de2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\87764B78E5181604622DD603969523CF0B2534B1

Filesize
635KB

MD5
ea3bf710ab1a21a65b4845dc858b162e

SHA1
896c19a2437f26e1f5970ec98117294c81c6c545

SHA256
e7df147757b84db2fb675cc3c686744b4d23f27ed4f759c95962befebcb2a586

SHA512
fc989c95e755c3336e80a074fda6dd6ef29e9cac89d08e43d6cef9ac043fd73be58522dc6bb70331e198380d355f551364281e5a54ae73627ab1d736ed45ea2d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\8D64BC72666122D4127E52F9A2CCB9951063F9BC

Filesize
14KB

MD5
e96bb8ef4ab76fef73d642117b9e37c6

SHA1
6b644da6fa5b65022edc2f1f69d2672f55ab9694

SHA256
dfadab8dc8aa4ca1e71d24cafdef53b979e72cf08448e7d1a575f7439c8e5066

SHA512
c16e7818bce03c466a5423312b32613608b188dfc1be2831a69be471a400da68aca477ef275471cd6df4e1f4eb6ce729b6e6d1d77dcdf70ec713c4186620d2bc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\8ECCB102D069CD0F4A6FAC7D951CAD55679D9660

Filesize
134KB

MD5
6af08694b73150df3b87b2f78036025b

SHA1
827b3341e4a3abb8cca8f195d918d4ad8447db7b

SHA256
2a300e4536a89d2bae60e0d4c4bb23bb0ce99afa31085d38a06023eac6424e62

SHA512
0e9a994640ec7b7cb026f38ec3cfcfec73863d4b8b1341944d14074648a2e10b4fac8e72cd6bb1808a15b52ff8dfd41fd6ba66708e7ece9090ec6d90918136c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\91FF37A9F07796CEE425754558997FBC234E8275

Filesize
31KB

MD5
39a4191c9ff399ba4d46c1fb58042544

SHA1
a9fe82c7cafb76728abd72709beef59ae85b8085

SHA256
181984b0a4347fc96e8b58e98837d617adc39ea0a48b04ad772d8bf5e3ae94db

SHA512
cb4242e405f152f6681755801bc9d4e5258aa4b3637a6042eaf7d3c2006c1539d3d14636207e178dcbfa054e5b826cdff2b5ddc498e9c331406c3f1aefd78014

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\92A6A8BB0DC70CC86F8C8E2F54888F4B0467DC79

Filesize
17KB

MD5
a79b5dd5a49aaa4ddf8564bd02ccc64d

SHA1
259377807f9e084599d572c259939b9168a8a63d

SHA256
c47001cf2c587ec2663e038893120cc272eccc2401878989719725615dc18c79

SHA512
2f75af0ed563a6ef865f1fd4bd80a9416dbcf88dba3c92770ccb1eb1ca0b7eabfaeba34151be0ce7c0ced25a9b1458091f678bb6037c3b8ed2966c67f1ff9fcf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\93F0E22C9241E615AA86B2DD8A5F8E9E221AD246

Filesize
56KB

MD5
243ba88ea66d9cd1bd7edfe5c1aa6012

SHA1
5d2a6b792fbb98d9aab53f9aa060a5437e2a36c6

SHA256
e782429fedb012d221ec6936923d854f30b3604b1f37380accf767e625ccb76e

SHA512
04c6eb8afc98a1f6670be76a9ada26090736ee8d4e873159b852ce88598d650bb0a581c3edde1cf4aa115983d66241c939b5fff694091e5fa9f7a92b4b984fab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\95C1B57B3A080B7A67661AFA5146BA307BDA5A2D

Filesize
31KB

MD5
6f01258ae0102f6c370fd858f6d4ba93

SHA1
4ccdb6204c22cbcdfca604366af93a3fb7300e70

SHA256
340eadb6c31b10b654b84ac344c4406371c16e4dd723eca281adda99fd4ee2a7

SHA512
f01dc119d6753a320489266add3d0c655cd9072b89aa55e37c426c86f677349691fa230da72393f10fe798766ce089804ce6753e1e7da19b5e57b63ee320ccad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\964786BD113956E547633BF9AC1B52B5394F9D2B

Filesize
28KB

MD5
e86f7b4b008a0bc5f420c6ac470ee0ed

SHA1
7f8488ab463eef5376d36f16f0ff83a7a5c1bd70

SHA256
b4aa27c082a46a8b5ecc2e53f7e413699b08859073b8d9ac90b7ca9b689a77f0

SHA512
90e05871236766b4d6f8e910864bf9f2b1dfd6b687b9d4b0a0ecd7a810fb61841b02c32ff514cfaed4d29a63d9ccdae5d48213317235291992ae3716a1528bed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\966B4034CDAD13C4518E45DCF811580A09F8C324

Filesize
27KB

MD5
82fd4a65bb8a09b685108a504e5b1cf0

SHA1
234aeb200a9ac6653ca2bc6ce3e4f54d56dd6785

SHA256
a29674e65af929f9d7ee13c0653b1bc19fe25ed2cb58d3cc15b68b7654bd166f

SHA512
8e0b3325222a7da8f95edb837337727186c3eedd7e8cb2b6c279116ee1c35dba6155049491a20d38497879231e2548c6d52ecfd4fa8652b62d3bdebf65441f5c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\9EC69E4E535C502FBB50CD9E4081A619737AB941

Filesize
98KB

MD5
c494a0e48f7852b13df92e8f7fd2bda7

SHA1
8d810370e0d2b74065bbcc5ffe4967159c22c6d5

SHA256
7675b757baf141b146d84dec605d287e49f58f5b7aaabdaf14290ffccf41b969

SHA512
18295266c57e5ba1581793133d1d1e44f0767b5fe0309de0ee03ffca814d29bde9f01089dd34c77b064e3256fac552590a54e2671ea324be26453a112e9dec04

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\9F1FF66E612BA8CC527A79AC033C20FDACF34A6B

Filesize
23KB

MD5
b481db738e4227ee94588501b775cf8e

SHA1
01ddf34385f2b95460ae9653c25b9308641ddacd

SHA256
0ba7b82cdd753ad1fcb3a460c00bfd64586e31c19163b1e5ab847e12643ee07a

SHA512
f5b581873e738291dee39aa396baf49ab8cdd7c9bcd8c1cfbb429a4239a0755ab758f48606660fc248c1f2858e1b7fc47f18bf07da248f4b76e2560b5a270114

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\9FC8C85689D31525EACE26158B83B464F43A027B

Filesize
23KB

MD5
08427023647634362849505794daccf6

SHA1
644288760ae2394db6ec89a6fa15b6671ad76b48

SHA256
9aec5daf855bb4f9ba3ccef599e90897c8cc6c5fdf4d63f715f001df355120d0

SHA512
6462421dd29392cf11689cc871f95e0a797dac3915fe4506982c489804d0d1ba314040a2b49ae897be8ebd29c5b6667a7f4d0889228a6273620c82fd36883acc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\A0DC28B37E10510B6BA8372DB400FAB26664B55F

Filesize
578KB

MD5
94f264b4870a58de9b0fe8b1a56ac158

SHA1
d4735764c05657aa9f3f4e226d1fd4e9244c8761

SHA256
45bcdc4f3b220b14e1b3f3c261e36b6d2dd825e36ff8629b9dbb567039f6516f

SHA512
de707f6cd6630ec3b92e62d016d59dfdc3a00ffbf34b39d686bffd776499b1062952d724ed6b16690adb50dc1d92828417ef944bb581e04bd83235ecde3d5792

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
2e5d83d82c4d162d74e866fc30f31e2c

SHA1
2cb7690fd645af557b11fab33a1dec4fa8365958

SHA256
226c82de2907e2169243afcc03dd9074823925785bb413bf2e7fc99c35de9e77

SHA512
1d4135d7fe14f21f510ad8854897fec497bcc3e63d134768863c6b62a4619546403aea6fd1c183d2f23078218a607807ee1ec3b2652515796e53f0825c9873b4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\A752BE816C32A166B4212612D41570FEFDA0B4E8

Filesize
23KB

MD5
77581539fe4307271eee9047bc39bee9

SHA1
349eb1c207b8a4589e331cc8ac0954cc1ba8d771

SHA256
74ccfd8fe6c869e42790e853169ada4aa89214b63ff9ededc1edc108b8b98e6d

SHA512
61cfa794bf097bfd6f69c4a2f774f5581c6b7817007a59456e157393715936d24f69dc819930b99f4d53b59e1afffba5a0a6e1f08f14a04ca7868011f68bdf6a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\B3CC56FFFBF8D3D80C42A069638CAF60434D369C

Filesize
24KB

MD5
07e631adc0ea2e01e35e74ff009a0267

SHA1
cfdbdd3c22ac4658d52dcc000bdba017e74e1deb

SHA256
abbaa5ae4e3b3088157bb69c98e123096de31408e9b495172b894d796fa82831

SHA512
90d6ae3be13bb54e91d42feba15ba618415466f61fd91056aa7b76ec9b7a16590bc2bb224034dac5ea2aacec5c86f2c5ff46db5b504da1a07d61c1d62cd6415d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\B555C62C056CB135240287B56BC960DB7AB32456

Filesize
57KB

MD5
50be4f519ad7b4e4d662a663411abe75

SHA1
0de7e52e04ee292b98f347ee86088aeecbf1f120

SHA256
b7cd663af07e391d4ae6067f510bebf8052950b5d3141c897c5c2cea3b2658c0

SHA512
e13ac545bcb7b091f8ac65891b1e7a29bd3acd2cb56918a169fbbda0651ecb7937f8bb436152a8ca76cd1815a1590e4cf913d6464d13795febcaae83e0b5bfe0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\B5F8E3AADCEB23288F21FC55A02A214FE74EC111

Filesize
10.0MB

MD5
fd1f6770b87f088df1c8a8e69d686012

SHA1
4ffbe9137d96035e3a35c40d133fe36117efee5b

SHA256
4f0141dc521467c8c2f0964a48c84172917635883bb4cebb8a5fe5193d62b73c

SHA512
c89f7b4ac07c88e8dd4faa67d9f0ae6fc038c3c7dc3e2c9e8bbe477a2148793d5c2a82343dfaee8443ac2628ca735b6d104d0083dec887017655bd58b0d04d01

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\B71AB99B61562D6061F92BC957C42D3899A125FF

Filesize
99KB

MD5
45132358d7c20892f75b5856e82042d5

SHA1
c23bbcd5137cb267b81355a62d419b53f3451151

SHA256
3f5fb84f8b0bc7f3b1f903bab3cb34e2f1e43547a9c188b6ef904b2d9af54358

SHA512
ca7c82de6b0806730a2addf0230239dbd250907d0fdcfd2dcb51793cb40cddb12f1e0043d6c4a97507f5b637ae83aebfa3b490d5e7e079557d11ec930ca3d8f4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\B765363E9B617EA83FA71254B3A657AAE933E52B

Filesize
1.1MB

MD5
c8cb6920f23bd03f855fac1a027acd07

SHA1
c1cdb22705c98112167dc76348ab96d9adf2343b

SHA256
a7c41898b4dd117f2f3ada7562e10bfc135e0f69221f995f3eec7dc60b75dbda

SHA512
978c768657442e46ffca8195f78205158605b7cefb6ecb4ce293520cb577eada7e3f4d9ef2c5d5baa08a860e054ab5df7addd86a9dc9ccb9ccb61720b7791aaa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\B7738875C7427DBE6422F9BDED9377E15F1659C9

Filesize
42KB

MD5
56f3372f05866a62131f52a6ec654f5f

SHA1
0cc6389585c785bb4a01c237dbbc44be94e8350c

SHA256
87bcc44ac836cd170843bb2029021919475748eb30a963f1c1ebb98a19216d53

SHA512
fb60e9720274b6aab81e4305aad31101407b33053d3785c32c52ec173195c0dcdde0384c729f53db67240df6e0c481d355e3ab588dd5ba46327a0cec05a6fbd4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\B9B0B36787141C9AE04AEB44546403D613BF6113

Filesize
47KB

MD5
43a03a18f6900e0de0186f4a650abe95

SHA1
11787ed403e5480338c5fefbdc1e4b0c71b6fb71

SHA256
4d21ebdd48679a9f2982ae94a8bbc5bed56a5e772dcd2a2be26ec5d18fd4753c

SHA512
ca7a3a8d1d6622d448a5692d8061e0615c6c6fa0823a8670034445d83c629611409d9468656093685c31a45f8f1c439e4fd0b1c854165e0b958ef82ad90a979c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\BDCAA9FAA2E3024C75EAADC8BCFED06B49513616

Filesize
16KB

MD5
f2665b264a3cfa65c17619113620a96d

SHA1
54e65dbd41f82509a46e36948a0a581fbf6c7aa9

SHA256
c50baa4c778178459b008f2a9b40dad1e7ede8d3dc2120461f2de57fb689a528

SHA512
2495d4aeaef50f3f35a625959bcf8eaae7e27c32093f127cadf47d655b9dcc21953db5f0192acd829d670e98e5af87011666c07b4c27016860dc5ce9dc0aa975

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\BE3D5F70A0BB5DF1C2D2E96910887912700C2729

Filesize
18KB

MD5
5937e46311961a7a178b5c791d9f31ed

SHA1
746dfe701b0c081e31088f18adaabc607aca6544

SHA256
6c4c9458a15b990c1c206fa5c3b487ba67adc28bad5ef8a794f6b8ae54084fa0

SHA512
9700b020d612dba24066867306349ba7423fc722f0045422029f9bd500f2e840fb1782cba848e9422365d312660a5bfc23cd6a79ce705d72bf809eb17465391b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\C3982E88A65EC6B5436E0AB22F833C1E54836F1F

Filesize
11KB

MD5
f4ad19db138b1b2da67a01fdeef6777c

SHA1
5e292b98671b83e2cb2e10809bca1ce2e6355c87

SHA256
e32db3614d504ca31d6f55b13e8476b1a1baa113cfae3a4b096eb47acb8cd938

SHA512
61f01dabe1cd3e5a3a9034e219e0b71ff9728e603005a0284f46ae3a313aad69639d4cd6323a585b142472f283fb4ac3cb4645138b58ddb969ceee56da06a0b5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\C3982E88A65EC6B5436E0AB22F833C1E54836F1F

Filesize
11KB

MD5
6e162360bfb69486093f0746d6ba3a34

SHA1
07e387596692fa6e9535c3c6f19551f1ecf15641

SHA256
5d41e206711ed2e071a5a0f3133e16c37c2b3287b77828c0b8ed33ec9123210f

SHA512
47e88b20b207132486e20a80f1c1cbcc45a03c0fb039a4682809f1867d8cb360234671d9070742619dee17458cebbc92f5844b1377abcdf2e4e151473715bdd0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\C4B97FEFBED2A3E822809431DB8F63D2F72DB669

Filesize
38KB

MD5
e8313936237e555da02b65f9ee7ec9c5

SHA1
63142511cd1a015adc60afe60072874d09340932

SHA256
fb60bb982f224214e595f7ffdc630ccda2a95b9adff62d0fa2cbc91136aab83e

SHA512
fbc40190094dfdc68e0db062679a37c52c9c348f28946a40335bab4b3dff5c32d5558c3423dafe37611125f69afdf1231e7016dbc9d717875fcaec6b244d3172

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\C624A799FE444EA2F0F299201D6C66720DB295F1

Filesize
70KB

MD5
b6a69168106624e5d465a5b4c3e94f79

SHA1
69efa480c639ec735ad56361ffdc7995458c156b

SHA256
21dea2866f9afe53d008f43ca63b3cd1277ecf9bcdabcd2c91c7cd448a18efc8

SHA512
82bc8f1c6124f91cd0051b4dfc1474172f8bcd03fd04d3c56a7b93367ba1e8b48772cb9afed23ca037cae4a97e4890e3c34139b0ca9fe73d4799b137d9bf197c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\C8038262F3592DED8DCE67CB10E6EC6E092F4519

Filesize
31KB

MD5
c90f24347e4d691b56bf66c45ee59946

SHA1
f494e781b72a5bbc8bbcbada3ca1603c2a6833f7

SHA256
45c7490f70676c648081031eeb53d47f1bbb2f752c0e5ca5fe9873a6cfebe88c

SHA512
bba52f8bd3d4b8c8ef176e640c099a586dec13cc85cb3ca786392df1b406efb6059d809904a78bd2be9a3e31886b6ac26bcfeddf6214146e5c64ff65d6418142

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\C8893AB9407FD56069E3FAB580822C0EC30B6DBE

Filesize
2.4MB

MD5
386ad68efd1bf8c673aca7681385a14c

SHA1
7c4eb77260154883cff993d7291495ee89606eef

SHA256
110b71eff949978c528ab563cbf35d877a1ab7a80262d27bdeef8b8212996a97

SHA512
b4ff747f37881fb5036e1db0d6ffb8057eed4d84826d6eab3d368b55a676bafdd346eb9f22dc48dd29438cb68a9a14474a0d534978e45ffc6ce9382013267a9c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\CDE0B95FCC8B34B6A736620563CC50088EC64533

Filesize
76KB

MD5
8edbebccb85e890f93e1a197907fc51a

SHA1
52d94fe629eaf8540a5aaf964f1aae0079bb2b97

SHA256
e513ec9aa8c46893dc62c3ea15de2d0ae06f0c6f57426a4df9cb7e9485b7a704

SHA512
3617ee81b9a9b0c1b77dfad35a30a057ff7b5f6338a6479a1897e8b10229c926395d028c893a345cd483a035e8d1edfc601b591841e51bc74b1ed7f60978ce2e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\DCD978412EEBB7A6AABB33C23B7414008C7732F7

Filesize
2.8MB

MD5
b2091fe20f81acbc1625e15ebfc82f90

SHA1
4d2a1faad5a1a61d2e081f1edf067d02c6308153

SHA256
fe3cc56a97026e0053322b17460c88cf9623830bdb093fddd1ce69bc3b9c86a6

SHA512
0a95a8c3951c968c101e742e59019493cf70aacad0d7b4a9910f8a4815162710cacb01332767348f738ad99bb12e8e6968ff708db286ebf73ec3890525821f0c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\DE9C16037C272D3CB4D98CF9CAD7D055122A5293

Filesize
16KB

MD5
7e156dce81e884c7272f64c166e92064

SHA1
e5346e644804ba3072630159c0885443d1ae5e66

SHA256
39ea858bdca34a1e4a05f270682c25ec81dccf922d13d369823ae4defb3c3976

SHA512
b148bd5a9ea9ca0a0d2935f7850565a175ee118fd0b64411eb901278db61505e0250249a8002afc630ffb26c9360519c2b91454f41948552eb245fef81ccc2fe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\E0BED5F2FBDC43506AA41E13F3DD2E2B0E4CD351

Filesize
255KB

MD5
21855da1cde4d6ebb887e458fa516cb2

SHA1
fdd9a532acc80d80e9e80175e7b270682be9c225

SHA256
6c7a0384b54dfa62faf551dff2a6c602454f5f3493120b4a41bbbb5a818612b7

SHA512
351eddb75d3875ea003e2ece105df7251a1c08524c87eaa1f2d2846dd4c4b34a95b930a25ef435cb1c84743986751ed98290b8944d5445319884e8b434cfde63

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD

Filesize
13KB

MD5
38fc91f5cdb60c2b281c1ccb0bfed947

SHA1
96cca3fd19990d2ece93566c46a400df6a74bbd2

SHA256
32c60ec914596908d6260ce57640bc24caf0068bed9cb26cbce39e843251decb

SHA512
6acd981bca997be10941472951c3a8039ccd98a4d08bebe14677a1f4d19bdae8124273ce9d471189b067d9042b017378fc438ca9673bf77ccb372cb9f1666a8e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\E61E3517D2223E4E245E92BB37C0A0B93D36E299

Filesize
465KB

MD5
9337577576323d0203707175290f9700

SHA1
71bbaa957a381545e45e57a42ef71d8ee0491c1b

SHA256
66049b9a62c797bdc1223a0090410decf1fe56f9ec6f5a2ce4d1c1ed2a5936bb

SHA512
56b3938725920d0e7ba4db652b19798cf9abf508359dc17065717c5e05b99ad67bdcf02f55694d4dca86ebdf55558e08569cfca8e506edec5c86391d9c01437e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\E69FB6AF6CDACAB6E5821EC5A10791E61B7139E7

Filesize
2.4MB

MD5
895cacfef63e38ae16f8557497627d78

SHA1
e4325005b2b95e68d1c238fc0d294dbcd21de5cd

SHA256
2dd0c82d36bb0d98e83e472a63e29d3c40598fa715f63b21ea8cabcdbc14b914

SHA512
a2b6a19de115ef025c059894fdca03b1315deab570c06ddf3b0079b341feca8a041d46aa261a0e31040f9884c75bf1b745a7240167d3d0cb4b913515ccd00121

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\EA87465A6B977981215042B94E7AB9FECDDEE708

Filesize
20KB

MD5
3c8cbbdb14618191058f43118164e927

SHA1
b219b3f79507f9248bb3623641f898ad30ffcb7b

SHA256
035eb4041acf50ac4b59803154b66bfc002cee4663745aed7666b5d3e669cfa9

SHA512
f2f0f5ce1526fed2fbf8a83b6e77b963b6196c360176dd026da4166ff060b1978b63061422c350054e339bc50e3bffc5fd78712381e4af3d7c4fdefdb0cfcccb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\EB808344780C340681F8052A0BFE51BAD87F04F1

Filesize
16KB

MD5
ec804ec5b606321dc6bf1d3edbb868c0

SHA1
f209455d0d6c678f9f09d65ece5e743599c30971

SHA256
1d0ad75ffb2e20d81cf1eb709eb14bb52593ba2d34c09b31bad1b7acf653ac32

SHA512
47e010c296397ab1ac9232549e8856045531a0a41696b935e2c6c623b096f1ee5442f31b1163f0e7c527acc115ae9cb6a9ff03083c3ffff1be0692128104648b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\F58867ACD07D5F2A49115DA6A8DCC00D3EDEB5D4

Filesize
58KB

MD5
a5fac9e59bc8bd1205035d881114dc6a

SHA1
3b5fdfbb64c239afc6c388192183652698a03a27

SHA256
ae8c727d09d7165c4033bb7256b3a665eafb75fb8e272dca2307b0a3079aae6d

SHA512
9b8f1b67047cd438beeb66406ceba93ee2fa8bdd80207d13277103f22586efb115c35752657611b5046471e424ccae5e8206d4eaa2516d40ba21e7f18d629f83

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\F59AA9A0639672A796D47B8C1BAEB92A43E4E732

Filesize
797KB

MD5
e8e451174a13db8d0134d7a75837830a

SHA1
671987d34469c45888623d5a786df16ad55f0fab

SHA256
4f270b1cdac440be23807962924e8120a318267d92a596fe1e621aa4c7de9abe

SHA512
664b7a446b61bf2df5126bb5997bc54e2b630f9cc241a97a0ddb88f73493bef5bc7a08ede2e9e4f8d96902635ba04e40c517b69553273e507f1993f1451aa1f6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\F8621FF6A837237A7FD50F21B27DB8A9545D6F6F

Filesize
1.7MB

MD5
bbebb3d463bc9cb02a01456f598c01b8

SHA1
0b4eaa5fb6df79714780cc32a1e78f6c5468a14d

SHA256
654afe73627dbb96554dc9f92e0e26ca4eddcbbb028ec348827367639ecc3976

SHA512
c02bf8be651869092de4ddc6001a65e4b9b763fb8d89d10416beb389eaaed720fe81de36df856da0269db21e10f756bf49161c3fdaca0d4e878b077dc822e8a4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\F9FB26C3AEFFA94AC5EA6F2FD7329000A28D1024

Filesize
77KB

MD5
96c5c9840127852eddcb1d102b9a7b8d

SHA1
01da06fa678e8418d6a5f653af44e5b43b3c4d41

SHA256
c1ab4e4b2e29fb7486e82fc981ca065536efd1fcdaba832f3495f4baeaff8e40

SHA512
e2e23eaee3b3ff395d41f55c19406491bc8875159b79759e94d65a8c8f6c51d6f098a8bb158cac0f951f44c7f650b19b34498cc547a76ee170c8ee36d4833139

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\FD43CED106F0F93750D5D1BF519018E6F86C6FD4

Filesize
2.7MB

MD5
6bcaf47d62f9dff7dc3ca7cf3c7b2621

SHA1
a95be5729a3ca087150ba02f3876d4a47ca11805

SHA256
25734594794513ac04b1667dc4c1ea6571569d43ae9cd1fd920b86fbe2268d22

SHA512
7e2676c8bf1a002fb9314861bffda84619c7a2a5b4c6a85ad7f2723b359ac076839f63a629ff8f34d67abe9ac5fb404c59f6c5454c6bc62c3afa745fccaa6398

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\cache2\entries\FD6A8EF4EC02E7A8ACF6503849F186DB048E99D1

Filesize
30KB

MD5
0325fc4c92c3b20240a657c9787be3f5

SHA1
a061b4f5fbc6d5b57b4abd0284d42168b47ad80d

SHA256
f02abf08b05630b432c16c5e07961cecdab68042addd713e9b5053d1b9d29482

SHA512
be14921f3c0865d57b25f560f3debba72f58ac9587bd2b7eddd799710dd5a08449c984c177746916fc16bea4b2e7cdd647744e033615db553ed401d72778fc69

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\90bkg1w0.default-release\thumbnails\c2bc9c76bdf3f482d395336a124cecbb.png

Filesize
4KB

MD5
7f574766ef9e19e15a0f1844c390c7f7

SHA1
879cd6a0f2c684368d381a4f5c908a803657441f

SHA256
5fe3bc7854a982cbd353aa57b9cf4898c1fcd56d3de06ba8218a6e23b9238e10

SHA512
04691b2a0adbd9d649bec7264680a7a847a0545a116e1340f31fc600996fefafea1c21f15e8acf756146a9f3f71f872638b2bf8cfdfc7d375e8160735506d7ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\GmingRepair.exe

Filesize
461KB

MD5
4c15abea139342edaf5cf161fc1100a9

SHA1
498225859a606fa7162317b150b43185e389685c

SHA256
604bd7e4b0395b3424bbc8e82f52248fc5ff0d33349d07fe424f6301a089d939

SHA512
818f01f8925f2b625cb4a894b1ee073ed92675079b6d6ac862f579cb5eace8e0490fa238175fabc105582b6addd7a369dabe3055674f8938759e8913e83e0553

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6999.tmp

Filesize
386KB

MD5
72b1c6699ddc2baab105d32761285df2

SHA1
fc85e9fb190f205e6752624a5231515c4ee4e155

SHA256
bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

SHA512
cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG8C06.tmp

Filesize
270B

MD5
edcaaed49057b04d804ef38622dcfeca

SHA1
200458ae3a380983860136acca9b18d62c5bac76

SHA256
b9532ca922a984f207d3a82499308fa038e1d78169b534b8d7fc116aefe5a05e

SHA512
052065767b3bf96cf1314dd8c42940ace0d256eb7f536de0b642f5816dc0b5e6db3ce9a10450e9564b7c932e9261a9d78ca7929a4537646cbf7d5ee8c363b5fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\REG8CA3.tmp

Filesize
660B

MD5
c7dcc299a068152d10451b80a57ab19d

SHA1
ee31ed1b5a44ed8c7703cd1b81c6788cd49c9fbe

SHA256
0b0cf4c6b61af4dbef5261ea22a35dd8a16958e80260c5f5cc096a71581c2f27

SHA512
589a33d5cd6e729573dd1ddf3b6ed9ad979a04156c72a3bf3e9ff2390c7518062b40ec3c377dc10fc7fcb0a39d9e42560347f52f37fe6114288cbc79989c2310

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
e48be82448d48b7ddb5e473c7d697649

SHA1
ea32f5abb4b3d4f3800eb3de472487abec1f596e

SHA256
3fe71ca616323b0bb1b77d9f2f1cddb80999978ee5c7ac19a278b07d016a1954

SHA512
6beda2bd3bafbb825b6d3d4972561aa3dc89f3a57f870e75b0c678d0697656a6d9d4a94c0e4764f1200ecc98ca8fe7f551c64b783cc5e03a5f05f9df4b4f9abb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
398b6b51ae65f289eecc3ae9d690234f

SHA1
9fd6b902787b1ff6b691d68e6792268e613e64c6

SHA256
ab7f09ae6a29b9c7ed7e392b9eaab8b2e9a00b391677f1da5699191bee503f7d

SHA512
cd32cda77955f091e9253802736b9e14e54018f9c93050af9e5aa20c1ce935469310d030e69a358f8a2e5131a0a270a9e3ddf1cad07f116745c9b08f2a5968c6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
44f30a72d0c38694814fab131a41431d

SHA1
89d8b689c2cc878f68c455a9ede2b424d6531d74

SHA256
76382d393095441032932a1a1f245cce6203cf8c67cea3c27ac660c8e3baaa65

SHA512
e69670d7cc7a065d470e545081f94402dffb250973799e3cd1aa7778b684dba372e300998cf0618228e1ee74ea815008fa26edc8e865fad0b566073814143dac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\AlternateServices.bin

Filesize
6KB

MD5
bbed401a8261a130d6d325cd778e2ac1

SHA1
68c8b45d6419d7b7f2dcb92977f2815ab7faecdb

SHA256
69bf50608b5f2958d799cdc58621af6bb45056b687f550f2eade281ccc11974e

SHA512
c3824919663075549148ea4f00bed8a56781d7e6e61dec697032881d94b3ddec78178118c8801353f81fb209ef3ba5d8c314ea00de66e2e1aaee22ce2e73cc68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\AlternateServices.bin

Filesize
23KB

MD5
8ddf15515153c73eed17f199b269a28e

SHA1
baee401434b6766f91413cc4e5f0145c84f4ebba

SHA256
da73cc17de9f7ce4ad064774e4631032a2ac11f576c6b8f75e365565fbab5c9d

SHA512
998aaa706c5d937dc6f6c9265cd1d4ff3fbf1e393150264a04c0da2221d9f5c2bab63878ea9cbe66d77c82b6f9720967641d92099e8ff3a3c9c3aafca6704837

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\SiteSecurityServiceState.bin

Filesize
5KB

MD5
991a905af6ef85f601e7924750b52cf5

SHA1
2774e789274164269cf15c03bcee952927d6d558

SHA256
6350a0a430cc848cd3cab33eb91cd475e413555bbdd92f822a06734bef584adc

SHA512
4699416d93a30397a61bda7dc658fa55e12dfac7120eb8d4a8ec21787f69e31d2960b2dac866147fe5032a9045787f6e0055264c3ae7a419b47b3596af682508

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
b31153098424ce715204ee22afbdd727

SHA1
b68bd59cdd77979222f03db53761427160a2f3cd

SHA256
160502b3af82751b6b8f621b00ad36b0d327bbb06071725175279469a21bfba7

SHA512
d5dd352ce83e849ebb218f319797b353868647b5aa5c667952b7652afc43c72cc53a5ba7427c8d740f5d040a78e0e49aa7f220e926417a01a86503a3df4bde7b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
d01e24c25e7da82fbe402497b8d86f30

SHA1
4c91bc997daf9344bb75ad2f569ee12e4144019d

SHA256
7d47aaa6647a0dd5aeb4fd96dd2409b6e3dd90933bf2ffb8f627b0541e36a009

SHA512
0ee73dd3ddaadf0854ae6be5201278c26101ecd62915133a35f91212698b025770adc4e629e617139cb3dc4a3863418e6fe27e2b163ab15610f3321e7db42955

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
4d7a2b3187344db9d1efb9250fadaf9a

SHA1
40de667206fdcb343a2cb1caac5c2a662a0b8bc6

SHA256
3809f2535e61976148a52504d32485221796924027835b9d5440229fba814f7f

SHA512
e9ec0d62bf5bc2ed09db2c1e7ec6f497660dbeafbf0917e8ecd34927217e0ead5a8b01d0f0fa1374e657a240ab1b80e351cb97f7829458d0f8ac6bc69514bbf8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
2f9cdbe5bdc8b2f402b1564b766bc4a7

SHA1
4fe04385835f5a0056b1e187ce577de269099d94

SHA256
ed9fc19961e86c7c02436c0f235348e69243a01306c06f252032bcbe0ff4009f

SHA512
8268a959b2335fa9260bb4efe332b8b47915a08e35e6765998aaafdda5a1232f6ad7c93c03f85eda45b945b8e29363026848ea64215de6bda5ccdc97fcaffec7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
54c75735f4a34be288020a176b79e33f

SHA1
4fad0e49602ae656c9ee45f90a2e90516ba3d8bc

SHA256
6dc67186161559acd2a23a991b664fe7b085d4a75ef8c729b02aeaf4a582ceec

SHA512
2002fe000fc000fc3773353b999434f64627067f7042b493bb6fff29e60b4142d7e2a4c38c940047494ce36db33f2a6ee5487ee5800c0948b505790afeb6fc12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
9961c72a94782c0881616eff38de373a

SHA1
abfa171d2914d8e1846522449ee5deee7131c8ea

SHA256
412372aee83e6d353f1cb7c7a018f4a14d59e2c66efd0332a3c115e4839d067b

SHA512
e8e26c70201cc63d7eec1d0b62b88b02899f40404aa6cc009e871c99afd263db4ac9fbb9527c5da6d86ae24978e82268ebb08fb3443b9862f20ee9fe185b6f4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\events\events

Filesize
5KB

MD5
a1ae82355196f5b278aac5427869befb

SHA1
72b9ac401f8112dbaa728b66b2258d116002198b

SHA256
8aada5ef94ad311dc0e84d101034a4e03f536456a0e18e3ae73cb8e8b3b57fa9

SHA512
15e88c42e62c630ce61d897f6191bbeebf259fa40108961f911d8e73508167f5c2d3b406e8f7fac106fd6ee51972c5b1c41c986e5f82e0a36b847602f5c38fd7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\events\events

Filesize
5KB

MD5
f3a081acbfcc104e78aec27f8ce2eb82

SHA1
56989220be5c462f2a2ed6af08615b6022da109c

SHA256
ff283489ad8cb62d9b118ac035f156dc74bb6769101db785873468aca2daea89

SHA512
0792987019365e9e57ad2ebb9924e91d0c09b85db6ea57ecd717c12277d09944be09684871c7f061ebfa3d09dd363efecf9cd8c7276d84ff81e9e24ba6c7b088

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\events\pageload

Filesize
5KB

MD5
5ec5a98a6759a65fe3c89a6d79c0ac53

SHA1
98e94d41052b62887a8cfe30c0d6958524159413

SHA256
0eaf5530b979921a3a8318508fa6d0cdbf4a45e1d3d833df56d0601fb2c13e09

SHA512
19802d2e2f99c5f4c4887b77fe52bbce9a68c64d9d51fb65155c6cac031d396dde79b312587ed126447109270646775275a01c059fb9427a30c596082c659431

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\0283d41f-7808-455a-859f-3a0fa2e25d2c

Filesize
11KB

MD5
cd4a1ff4fd89ab2a4fe126930f488a7c

SHA1
140dc246c70c1e1f98e3b353a9f98651b44bf442

SHA256
083896b9525d59c7a6f555ff6f1fd5e10970b81402bbfc782a1c8a89180622b0

SHA512
0308bf8fae3311e64d5a29ebe67feb2e2efa38de841919b4ba1ceb478c41f205419fdaa8d3e7b42be812e20b680d580c57135767ca111a8cdc6baa4f6feb01b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\0a7f2587-2674-4a1f-a919-79adf6bf6955

Filesize
1008B

MD5
e644a78345ec866ed740b19db7501b76

SHA1
a1431492d9531ab6ac43bb4f2063ec36dba813ac

SHA256
28dccbe0436730225a91f05636668733c10a2e672dd7d77e846e77b1b5b5379b

SHA512
d4f85996ddaac02a11a87a87ee6954386266547a1106b0c98ae02878ca2284ce28afa4a153974451a468e722f91593a15ff4a9230825938ceaee7fe1f08a3b7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\2c40b2a2-fe81-49bc-8820-3269203ea65e

Filesize
235B

MD5
ae27a8447121a95bbdc966d4ee310b39

SHA1
9bd33bb8bb0cf276922e76d6687f798d41cf1ef9

SHA256
e727e96f6038c64a64ed85f45161dbbce6537dd7e2a77d12206d78db60436aa1

SHA512
3a3a921bae7a0a057652eeb10b6f2dae1e3822055e9778bff5e4216839a855b7c11e057123aedbc728217f301c87f2d74b788b509be9696750c2984c409d053a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\79364f78-d612-4228-84fc-7a06328f4934

Filesize
281B

MD5
32cc2776527a267d193fc7ed701de9c6

SHA1
436115254a3394b58bfcd0604bd5ceec73f3dc36

SHA256
11d42d5c9767cd20e37470163dbbf767e4e2b1e4aaf4c4d57fad7158a8652ff1

SHA512
70fd851a32d1f9380706c0def7b6820fadf62e537153804db0da64ac328a99cdebf92789364ef1b5263f6d89eba512b3bf7f52d420ccb9d9788c73a39fd99e55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\897327e3-f75d-4b75-b1e6-76c085cc3b39

Filesize
16KB

MD5
ea742e5a2db3473193d141e1877b0062

SHA1
1b8b6770eef48b79456b916c0c58a7656b0ff8fb

SHA256
6bcec60ebecc2da693de79bb3e2832b8125c22cf4f774f4479e5038d96846fc3

SHA512
7adb595a44e920329b85dbb869be3f26b0e4664651c6fcf6f125e7fd8112d81cfea32745257ab0dd64111eb6a08157e811aafe2c451251a7896069d475b0f93e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\970a7239-43e4-45af-b723-353398cd170d

Filesize
883B

MD5
919d2b2d411f2eec82d91e140559b9ec

SHA1
42d71769ce2b76b2182421bc0df369f1c759e089

SHA256
e70817e23177e28112909729829c411605b6aa1e12174d6a2d3a7d2185b5a55a

SHA512
96ecabbeb882544ee7ada9185d1be9c9de09bce8cec3bc7c4fa88cc928ef87c624b1f1536a953a8d317ed30ff19179b77cb797de1f010da505b96c4282b711f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\a9f6d3e2-1048-4f22-8428-60783b4122de

Filesize
235B

MD5
d54f1b6408e20d1396e91aa009c18105

SHA1
e10b22639f836229fbb0580a961bb1f25b28fa92

SHA256
50ecf7cc9d512afc2ae0f78f65c7b133d5982fb4f153a4f74b67f04e99740c1d

SHA512
1a77db3630ac57ec5df01304d311966c9498c6588df13a1195487f1ef6178f3c1546119d66a2107993266f2294f3cd77f1e3df7f1b6717c5b5e0c65882c02703

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\c086e394-b2c0-440d-9282-4d59f263c5bb

Filesize
281B

MD5
d8efa981192ad42f793d2b9a79d332da

SHA1
0e0d6799d8ab5de1afffad7bdf14b3b5d6dddd09

SHA256
0f5b48541a63b71e78a50f2ce2ba1df79530a19fc64426b9fd0068670ae0fdff

SHA512
4cbd4243cf54e42e3d9505f8f2e2ed832a44ff7c254276322dc881db64ffd501b9964f81f4aab8096b8cb1d380be341b568c5bd06ce7fa25007cb5257b57e22b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\c0e145ae-6bb8-4703-9baa-fd4cde20c568

Filesize
2KB

MD5
13f16bca6fd73d7e25ef0238676616de

SHA1
161f366ffcef74eb4ec32e6aebf80b31a74152bf

SHA256
bba5d61a86222221ec3ef87e368f2da5a5e080646532387a3474b4b8f3859c2b

SHA512
a827bd611590ca6577e7a7009b0c5ddd964ea1a655ff4f264ce2cd26c23008706dafb9bc82a711afbf489fd6902dd5d5837ac4ca3ecb7e59e90f56775ea56ace

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\c75a1d82-c94d-4e4e-8b5a-20f81cb53fe9

Filesize
886B

MD5
63235ce9618cafd92d73bbd712885c49

SHA1
1bc33041c4c169cbaf6e317aa1acaa8b9fc1fa96

SHA256
21edcf4bc2e4d72331c7bc0689b3743289e3ff6178b5d8b127d8c456092b3d98

SHA512
ce18012e78ac45f40eb87a64c1831390be6ccc210df7d4cfd3e619f8738152d1adaadd29601b69f46ba23229129f975d0ea29ae4a46fb39cd2fecc9a74c3f4c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\de8140d7-a91b-4436-a40e-84c86dade462

Filesize
1003B

MD5
f0319efd9435be947e724c106256c26d

SHA1
53fa86598b1ab8d34ee5ac381d75d8874d495035

SHA256
3885900e032e622b1321c00a81c006f856141a1fe6c8eee3f0f35a3ac4956831

SHA512
59c40ff6330150b3c71951eb9f2f9ea8fa078d1676012c090393b29b6d18e3985416ea72e6990464795f63027b3f7a96ca9cc593c69297455cd2a9e7320655df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\datareporting\glean\pending_pings\ecb07588-8255-4021-82cb-4d67f6073d4d

Filesize
10KB

MD5
98f437d027b076002d027b71349b9a0e

SHA1
824ec5f19778bac60de347984bf1a6e5e0688475

SHA256
18ddca1356370e928ceffe575c045b7f6ad5607ad686c3dda090a1e75b926800

SHA512
bb87283b8e850bf45b017dfefb332f38f117290fd5e656e10579c1bd5633c41d6bfdec9f5ea2e0b639394948478550fd368e9500a183e8bc8434a23323f1d038

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\extensions.json

Filesize
16KB

MD5
0579636ee0812efbe93e0c934220a3de

SHA1
edfcf331f0cfbfffacab04482b20683314c0783b

SHA256
4d9a8ecc3a1df1199c20774dc8cdd83ae54515ec8e64a790a342224b6dbdee1a

SHA512
a2174891c279825d222ff959e22fd1d2ba1c48d1dc0b97137cd2db97a6776e3502b48af81437abe686e17775b90f76249a10d177f76a20ede43c909af07141b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\prefs-1.js

Filesize
11KB

MD5
f454c6c7ac53252afcb9d48873d62072

SHA1
25e214a0421ab9a3d9b4bddbc97acf8dcfb136bb

SHA256
34bdd4bdcc26a3734f3623acf3236e7f3e3f12d4b0a752dd3ed23c4eeb0bcc9e

SHA512
fdb6c6188fc48a516bd2a716aac08ce76d0144da9f59a74186484e715c4c91e893c755fccb08569a57edac846107825d5442676c8faf9d02677a360a7dea417e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\prefs-1.js

Filesize
11KB

MD5
be39d6324c7db62699f69d9db562142b

SHA1
e3a7353b7cd75003d2e1ba6545d2341a05045c58

SHA256
62299d0a6e141e70b3d6c6ccc2a6b530456acc9f6085ed70d24a15224dbf5890

SHA512
aeecd63094e36b89b5e50ce7c93e269bd8bfae87e8c9b2a99aa264e63e8d18f15182881fd79649180e192e8aa1a5bb23b1ce282d32a7c1ac47285eb7aff4dafb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\prefs-1.js

Filesize
9KB

MD5
c2ad2f6ed97010ba09ae51cabc4fb843

SHA1
1146515cdfb944774e5e845cf371aaca7e7c5d43

SHA256
ff91ccfa7a2ecf8df525c532d85a42dff1b1be2caacc3d909557d044819d1ca2

SHA512
adf0ab57e15d91686c70f7d494df76c4bde2ded9236de671943648fcb1afc3f3d44e0601af04a680d5053f246666bd52f52ff500fade861b8a19ac832d8c35c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\prefs.js

Filesize
6KB

MD5
726edfbb71894c15d612834df8a76372

SHA1
cf93a42d1676922b6dddaabba53cbaa07b8dcc41

SHA256
8aea8765c208f86b775ae0bd5a44c8c3cab06e6142917fbbe9d12ec0cac822d5

SHA512
d0dd07e02241b13f7aea93ae361a4639af66cd180ce01c7b5e06c19e72afd28983d867970187c0c65eb38a06fb2d9bf7873d40e3f72cfd07e24af8b849c75ba7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\prefs.js

Filesize
11KB

MD5
c58735ecc27c5d0d2b32cd3abe5ad3e2

SHA1
b1567c3cebe438b3936c8f6042a6fc5dada0db23

SHA256
c22307b66d3143eaae90ae84fcbb8d31b067c7679fb49f0abc7846bbd8a3f41b

SHA512
8f7b3a56ef5ac6ed86bf7d97ed902eda7731837bf55f52a0c9284bb45bf230511c07ec25eb86f5464e4ccda178264c63c5ecda61b7664410b53b941837bacbf9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\prefs.js

Filesize
7KB

MD5
2943927db219ed2a19fd6ae700ff82d5

SHA1
4472853e5aa7e15f2b68f9df0767b8dc3bc3798d

SHA256
42267f34297243bfd3ece53bda4c7953a566bbac74712615016ed1e1db247bdb

SHA512
15ea31fb982f1916e22bf40edb559eb41c21deeb9772ed1385272541d14bb01c070ede67c6e60c3eec61c4c05e869101ce53e54c569992844dfef27f147b0891

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\prefs.js

Filesize
6KB

MD5
8462c323f6418b2e62e742896b77cce1

SHA1
7d10bf046b39f9e7e30e04d56e96b7715534949f

SHA256
b7fe1aa035bbe8aae3b0ad1146a896a1f6c89a4bfb16116db783073f4915b2c8

SHA512
b7571c3e76c8e0f61039dde5ec0db90e8756395d342342900ff538fdab01127bd41f61ead26c34d8deda0d4de97eb23a29c72e637c316f52c142f9d74276b76a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\serviceworker-1.txt

Filesize
1KB

MD5
30490eb5817e68ed8fffd661e7e963a2

SHA1
be8a49a7d2d98876154d7ce28e48f829da42c789

SHA256
bf15e015d22df552d223794d853cbeff5e1f09a0024326bf552f2f28a1051a52

SHA512
ad7c0d13aae4f925cb1968b9036af47003e54bac3dab8a260a3c777092c6e4f6b48117e3508af57c61a4fff3195ccf7a93653a0789693833de8cf0ac5f390cbe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\serviceworker-1.txt

Filesize
821B

MD5
66fa8de6b6aa60f4a33a7e87257ed749

SHA1
babc83f9f92b8163956d252fd9cbbbe24b5eb255

SHA256
3c36f1261ec908e8ecbf8e61f033f995affe67186c918f7e7bb184fe7d0efcaa

SHA512
a616874bec0be138e972a539eb26d3d8f2426f4c247293f72a25d869c8ae8fea83673f419b5e7bbda12572cdfa35aaf2218b9bb2d423a055b56c3b94ef0c9a43

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\serviceworker.txt

Filesize
1KB

MD5
d05946eb66c009b15740f9ae2092d9a7

SHA1
19fe7803435f9f7c2a8e59edffdb3dcd388d3aec

SHA256
ae14b0a4704e07dec481e08fbae90200c7ed767701bad0031d8ed8b1a56448eb

SHA512
f8dc1a03d82293a69f865725db0acd8a71f8dd48ba66a4fdc60f7be1f130d573beffa666988729b3fbcdacf2136953c233f1b812a65f7eaddcca5fbad8e0523b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\serviceworker.txt

Filesize
633B

MD5
d66295cbcc335933b87df13b05b3794a

SHA1
32afc8381dfbf9c20124df396bd4f6ee2ff86a14

SHA256
edf38928ae0df7e323fd9763fd28bb3cc8791ff44a4e1a5a0a825f30b6199d0f

SHA512
3893141537f47029ee24377a73eaa65f7f69b52d00045237d6696bf0d08a73974403e9b175c0f51de1fbac4eb7d5b2fefa59d62c4ed41d8034d5e748918ca753

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
4dcd38b219bb8191fd9cfde8b28d775a

SHA1
3ebfeac6e88549d9954b77e78204b79b12e2ab32

SHA256
85e20ba6eb75c6225d07510c3219dc3f4141510c5c32bcd170dee96ac66f7376

SHA512
b9943aff088a03f1a9c70d14d41282ab3c4e479b605542fc7014d700f526014497735425c036e57bec0d9daae83789c5a235863f6b5b00cc4939f01cfa5f6a49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
2db5bff18eba649241317422f0bd97fa

SHA1
25fbae5f4748a3c57ccca77aef96058adc79ad1c

SHA256
5387d8202d5e25b41afc7e480f7441d0db2844d0ed0d8d6ac22ef8112184d125

SHA512
374881a5092937fc753e18cbf6df644e809ae2a97ca20e11a87591a3e719b53786016087a2117ebd836f990e85719d5eb0c61d7f41c08a329ee635eba9052876

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
db1d8bffa04c62557ee216f2a1de82f2

SHA1
636e628916f7cbc00b71071b2bb4c935355f2fda

SHA256
0dd9e26288fe2c7eaa1b00790b25cb137dc191a38b9ca2fae8413a16ed1bee7b

SHA512
d3cd997aa7ab3cba884ff646be47f6996da3b24cb84176278fa182a10c5eff260a91772670ab3d972989692055fbd3bfc0b2eea7c082976b8d9ca5b15b5836e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
85b0d381513ef954befa5ee42c823464

SHA1
47c65b7fef61113368063d1074e3afe9c375e68d

SHA256
9bf4329ba4856b5a11c7492f44e6d3238ebad3c9d99c0136dff9522d34e41ecb

SHA512
2781da9b2f695bb51940f527928fb8501055048210caba860305bc23eaef9919de33418772d322be663a2c7f6dba5e96dc5d107c60f2279e3f3596f29afe4998

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
22122da7dc23789b21a1fd88053b7151

SHA1
41e29bb58f23bcafdb523fd08f7a2b0410c9baba

SHA256
35303a4b2766b5bbbcb30cad54c9af5d43b7d50ed2399797ad986bb3e24c928b

SHA512
1fbbcc27e8420a72250aa80367f002e46e8e48b5ed39c1aaf4edc297a520fc112bf1295488ba507c8af6d1a3513f2e687b78e02714eeb513fef7cea0e4817b41

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
23KB

MD5
42c447a082347679f9b240edbb1ccaf9

SHA1
7cef002c6031993dfb0915aaf2c57b86ff675969

SHA256
a52680722957257852a125d51b8430105bf7c8312d2b2a1329a67e041a85420a

SHA512
380cf24e6485ecc90769ea61d463e4319240278d130bace2cc5914011e581b5fc14664329dec82454b21e6e1f9e40fc503b02c8613f7ae63f952d7c576f2a82e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
23KB

MD5
e2952bb99abc74c5108cb69ce2a937cb

SHA1
b74fca2385e921dc757d1db2e7a050939fad51d3

SHA256
1275831ca4f530e5af5dedae5f7258a283a56fd72a226e451a4bc4a34611ab49

SHA512
98e7c11ed2c61ee91e089232bdebb21989dbf32507cbb12c541e46737dc77d40c79ac832a81f4ad1935b5fe64b9df9e374b1cb2cdc6fede571fcb5ca5f4e5570

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
25KB

MD5
c7de231b2fc8511be314617c7d0298b7

SHA1
63c13b1ffdd57005592079c7237ea1c97ebafe72

SHA256
9cbd1f6db1e2dce4e2eaa34426c629bfe9b1821f4f29ed87c42ebc719134fd07

SHA512
46f279116d89f6348c0a0f42ce7219eb315d0993140fa0159bf274a5dd382d5646511b1c52b0e07b50f9bd37e776d60b47a2d670c32816fdc3e690c1ad1b5ead

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
28KB

MD5
73bb9ac0b574066eb1e4bc455c4783c1

SHA1
4d27881c4b73669170d8276b479406dbf6ac1e9a

SHA256
8cdf8d722046556cea4ca9eae861cf9cf2dfa1acbe4ea6f62a2e43454a4177d4

SHA512
7c247516aeb036f2b2e250e37ceac8d9b5eb3285c5c969ac1fff36853b57603efdcee69bfb6b11ebd9c26da912f9672d2108cc948091a53d05c38838b2e3a7e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
28KB

MD5
dc1735bad8df38ead99ccee744f4f9b0

SHA1
95a1e357ec01ce8d79c22a1bf16943e3249c193f

SHA256
58492ba3e87f5fe4175e873eeb8d98a3ae9666997c2187679d954f30b6b75282

SHA512
823b5af66df9a32ed3470733215fa6affd2e6446130467a9c6d50671b8f556b64cfd88e2e8f0366ec0564559fbc0ad69df130b68eaf46147ce980cd26cb49a71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
29KB

MD5
5eb0f9e146e71fc9180a00c522c97ae4

SHA1
ff27fff3a3cc42d2a3a54a64e18021d65c30ce89

SHA256
1fd137913ccb02eb9babf5f2e46f615e21f91a66079b9b47b683fee562cf82b8

SHA512
00a051c067fb646307e532d8b3bcd71c56c968bfa355cb7b4cbbcb958c74dbe0cc558a1a57d20ad9c28a43318b0d997b4419849c6f123286641d711ffe1fbfe8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
28KB

MD5
78621a33f27f95fd07d4a647aca5e202

SHA1
7736cd0b83dc070e90842096ad0d3c724cbc9ea3

SHA256
8673711b2d7d827a05280e85d927b78ec9598484396dc47dfcdedea296a237b9

SHA512
e146a0f7e30e8b5af72197c288166c436da2bf268f0feda0e97925b12b3d61772d9ac4c41dee24209ed481a079a60b3e637e3e6fd0d2da72e0740a269832b83a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
27KB

MD5
1f49c0c2857617a8e44f316f810d210e

SHA1
6bfcf87d961065d37c81acc0d36b947afb11c913

SHA256
39465e1b84edaaeb22ffe08f367fc6f6c1b49df00fb82c23812ed654825a6560

SHA512
86931e60a67ccea277c8d93b35869b1c6b3ba62b45f8630645ff4b93af7b90abb9a4ac749c2a401d83466e1b25e49f2432ddf36294a5d380e5e27f73d85e54dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
38KB

MD5
48ad5a50de7faacc5ae176bc509fa443

SHA1
ecbc95c467c350c927ae35e3ee9d1e03f8bc1b01

SHA256
ae7db1e59958e3901fd15be2c815f9dfbe3563e1e0e3382dd2fbe71791a2155d

SHA512
597d60badf4d713fb483b03f0f0db504f015d13a4868a4fa48af42cefef52cc35a11eebe4cff2349dd72080a2b2c274dffcf125481be32223ba5b80ad7635f1e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
40KB

MD5
10e3d85a79366646844e83a6605fa82c

SHA1
50876f10ec64586caa70dcca8de88d8f89acf4f9

SHA256
e6d915965061feeeeff90acbb5c51aefd4814a60b4b57bc849a4ea7bae7fa2d4

SHA512
bab5d4b2590767c4e96fddf2d0137e68fbada9867e020b293a38f1375c749b60bbbdbfa6c8e62f7b4f6c04962a6de593f01dcb34e2809b8bf476c30cd64434b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
47KB

MD5
7322c5143e1d65290e689916ffa922e1

SHA1
782f4faa0e3856ea1984d3b12f4e97a3a931509b

SHA256
c04d5f601f1ced15d3f0f08e176afe6175449afcce347d34cf99532fd2454712

SHA512
3694a39b6d082fb4615f92a312228f69260fab251387918948cbc69e2392678a0a9ed61ebe2798fa5b44add4a4a0dd56de62fab4c07293951fb9d79eaac70b83

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
57KB

MD5
f5403f5c2bce0bd2c5d452ad8ffa3268

SHA1
1dba19218fced6980e8fa6a4aba738c6ece990d4

SHA256
2a8efcd90af9b4a4a86eba4fd9a7341be25f98d135406a5e8a3723f3fa44d185

SHA512
ee5b77ecc7150447ad0b05851e2350c31560457b3ad9570d8ea91f4ff12ecff2ce5b33689199a0cf8b16b01e5b8503208a9bd97f22c5560db038d4297f048195

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
54KB

MD5
f792ff0968a6413a49951dff88bcd530

SHA1
12d38ac90c6d25fd8d32476aa1dcd299c673aed6

SHA256
1fa4465b51b118e7285f9d24f51b7473ef93315d23f5c78933ec7ac517d39ff0

SHA512
e4f79382a764026ec1fe46c590d1cc49b5e921792a07324c354dfb557abb36242e1bd41a72db405e67506b3928466bf40e5e1a3a4b6407d412edf2d2e4f27b15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
55KB

MD5
280c029beaeeffce5107519624a7210c

SHA1
e05419dc3ce0c229f97d75b57ffbe412431bcb95

SHA256
32bb24142b0f6ae33206e843711092b97b956363c9841768e02ec3c53eab7495

SHA512
574cdc2cc253737b1ced03b38533f1098c2b1857d85a3cc0fa2f7eec5a1b3bb46c2f4d0f77dc752ed520c307cfcc024f18f4438708fe1c6645d2f3c3c715793a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\sessionstore-backups\recovery.baklz4

Filesize
63KB

MD5
e9f3722decf03a0fac1716b402221c91

SHA1
bcc24b261fe875c7a777b312120071403afbe2e0

SHA256
14e128368a104d88f6650f5060eb2a49466f5d2b8e71b2bdf64f9e47bfda6f3e

SHA512
ce44d654185068599ccc710b0ece638299725abad37481b03cda6a4fc84cfa7998d3020e77847ae2825213cd374f394bddeec99ea1efc5c753b093d4fd551766

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\default\https+++an1.com\cache\morgue\56\{5359aa4d-0e81-4403-b1ad-807153734738}.final

Filesize
177B

MD5
6f4c31548e281045014ac2144354a332

SHA1
118a3b1eab194b4d4a76ba6f99001e3946113a95

SHA256
fe4c8c4a24aa8d91b2e04b827cf919c65419468434232d3b2de067c430eb040b

SHA512
5789e1dfbc866fb11c9398a6e7ff042eb42e230b8b9c78a378f1a5743ca0fc7ad881b0967906d500a35b040b8a027996abd8404ebe23a872645b493f298e1c9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\default\https+++download.cnet.com\idb\4219944671rlaa_rgeen.sqlite

Filesize
48KB

MD5
93b7382daafe8c74108745273cbbf005

SHA1
6fedd04ae69e1d7366caa32d48d047961402885c

SHA256
debf926016783dac4e572d2cc90967d1624e929618d9017f1fe156e774048c06

SHA512
2740aa15a6c14d837745d9b635a4a22775390380149d15621b5f02269d12b2486e444566e5813d092e61411ba267063ff26100ac8801fcf0bf8fe7d1805b9324

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\default\https+++mega.nz\cache\.padding

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\default\https+++mega.nz\cache\morgue\221\{77a9d73c-da8d-4b05-8a3d-d764d0c51edd}.final

Filesize
1KB

MD5
f452a91d1d0c47792f0ad99b3d27d017

SHA1
f02f18b4692d98326a4bb1f699391be16d70b24d

SHA256
4564b6c7621a5c0e4bbd0da9845cad643d999e43c4446a5085085625681d8065

SHA512
9cef88f5cf989a1ef118b33046012aa6b34d85b9fb31e6a6ceeeac5b19d1b07965998a215b201e6c33cc4eb88393eeb16050a4773ab50cf339dbc0b66c45cef0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\default\https+++www.google.com^partitionKey=%28https%2Csoftonic.com%29\ls\data.sqlite

Filesize
6KB

MD5
fcb971d48d94e145571e5aae65ed523e

SHA1
3da6fc68a306ea990cf99c9d2d6c929453b66dde

SHA256
a490bf11ad777291b294f95d9811158db493cc77e338236cc3bdd7aa47a9beb1

SHA512
184bbba2f6d20e0b8706adc163d57c0d3d6df63981e953858bfae7a78e2c572250965d29a5e82c8aaf0ff99812d7cab712b86f1bfb81e941e0a8d615d14f708a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\default\https+++www.googletagmanager.com^partitionKey=%28https%2Csoftonic.com%29\cache\morgue\148\{14731f3a-1357-46a3-a00d-b44094835894}.final

Filesize
10KB

MD5
be4b8d06204faba090b711ee174418e4

SHA1
8b60f0834f1576a131c10514e10f7508db287153

SHA256
1f38853b4f515c0aa982835b112cd20e62e9ced63ee6d3ac80bb0a6b08c24cc6

SHA512
745f17334e1b89d6227068f926cc7f2ad518a84460575029fa3314fbee86bdd77a3fdec81475f3a5b6f52a7fedb516e0d3ccdd72fd8a30357ff22b759328ef0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\default\https+++www.virustotal.com\cache\morgue\26\{e1cd4f01-f596-4f47-8953-3773aa13311a}.final

Filesize
61KB

MD5
92fd2eeea8018af11dec43e7a90b9986

SHA1
b7847c990797fec55fe6b85a090f15c847431700

SHA256
9daa053d131f78a26415b8504f42af296a541b75c27050a26174752589b0ffbb

SHA512
373d28e5f830c6151359d44213403e9e130a9fa4f947db92e2d64459009c4174240d4f60a9fdea9460b44af67554f402d0bbd0f0f88f293aca7ab5dba42133f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\default\https+++www.virustotal.com\cache\morgue\41\{c0aa60af-fadf-4766-8bcd-87f2c225da29}.final

Filesize
12KB

MD5
c4d0ddc4a5515c9c571d1d0441c5e450

SHA1
b6fdadf5ccd4598e26b27346c91511e4391babe0

SHA256
9bca89c75718392403060c8e29d86b36592ec941a5c6624a9d9bfee6077007f2

SHA512
666b1eb94661f4af6772c76e333ef0402d5f24d4675e1ec7d055247b28cd375030e471db00d8377f6cd41b251f9103d26402ffeb6971b9b61066c98272d6f312

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\ls\usage

Filesize
12B

MD5
a4b57866747aa8bc0828ccb259689903

SHA1
b77c045f5580c81a6cd07a5e5d2271064aa52233

SHA256
395c2160a5f25f4ebff4939482f032465544c7d1105b8f93b529552a1f8f7b88

SHA512
f5e9b04e525e1bb7a913c3e02504f98b1f860cbc487029075c668cfb560bcf85855d7e48ad19586368becbb6157872b70a083a40081c2c109314ccbe9e5825b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.8MB

MD5
753a8910cde7216f8e3353a58f9ed24c

SHA1
a97d7a28079f9da08d6704bed7b3db1a36895bf9

SHA256
bcc0f2bcc4e20d8d2120fdb269df27e02a519c86a02c777edeb0777e88d57b8e

SHA512
7a64f39a1788a179ff0098c00ef685d4963b1542dcee21581281c5e009afe5cb0c8d8fd27673b747c7af78175f78a32fde9ec63d2a121ef4462e9f1eb054782a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
2.7MB

MD5
2abcaed3aec2e39ee3b3b78d36ae5e9c

SHA1
a973ee3665d5afeb88be04f35ab61b4988f3981c

SHA256
4ac492ccd25287da822dea71ac3723934f2f9b833e991a7297a73f869a5ba652

SHA512
31e81de1af1f57ea9be27ba94f1e806ab4df87493de06f20a3978e745145dffe62012346771490564c526b8fe65523dceb97454a4fb91c305294837c764f6096

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\90bkg1w0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.5MB

MD5
6e4aa445c877fe76a40a670c596f563e

SHA1
8571540ceaf29cae62acfd6bfeff6b0cfa8d6cab

SHA256
ce78ecc7726519d2bd9e67fd9f7b58d60abc8a5fd9cbf55f858281ca7694d693

SHA512
ca784909a1e89a52701e4699844ff82048f2318a3c98a63d0783ef4217f9c0cebd949c59d9ebf9deb03fb23183f7eb7850bfa8b3d64dda32d15f08d45c95135c

Download Submit
C:\Users\Admin\AppData\Roaming\Zip It Now\Qt6Core.dll

Filesize
5.8MB

MD5
928709b99a4c567e5b377cdb025d7c91

SHA1
c9d3ed5d55d9b08ba7918fdef0babf1d062b4f64

SHA256
05982ff42ba7ae3074badaee1a09ff7f45e694de815bb06b514b28c28cfe0500

SHA512
3d3f70d3e08cb9a942273bbf78acd0ddd8c498c0e3f8b8752f212c2f1d9dd5ec57a5c4d7b11dc621bc8de2860e05247435c0d89a13a8b8d6da6e8d4b360f64c3

Download Submit
C:\Users\Admin\AppData\Roaming\Zip It Now\Qt6Gui.dll

Filesize
8.6MB

MD5
84632e762ae7601b8c45b5f48e3c7531

SHA1
0b1c141f0468b3f07f511d70f8fb414b9103ac0c

SHA256
ced3aef690624b1186660baa85c7d2c3319d46f5c0194eeafe39e2377643e1d4

SHA512
9a24a4ae623deb2b5a87d0ba9ddf17fc643c918b96e9aa84a93c7538ec88fe608a266c28e9b1bc21ba0b41cd148eabbd4290dea7ec4e37572d4c9612a00f8721

Download Submit
C:\Users\Admin\AppData\Roaming\Zip It Now\Qt6Widgets.dll

Filesize
6.3MB

MD5
1da8e191c6d2ed3935791f816a829b77

SHA1
bf899e74f8108e9aa490d910cf538b57e18affa0

SHA256
3fac74f2736ee0850657005ceade2a4edef6e97d58c764e77c2e39e629e04e82

SHA512
553fd9bb8ae8b0ff2e1bd905f0cf920f4072ab832dd96b1ccb3b5e2234a5c3c974d91af2685d497c38063ccc8d5492686fa7f6af45ab604e374a158933831da0

Download Submit
C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\71B264A\ZipItNow.msi

Filesize
2.6MB

MD5
25aa22de2dc8a7de9402561a6c2c5f82

SHA1
5767b761de2154ccff4849f1e10c3ed5acc0af49

SHA256
e8e2b205c1baddc765b4a3b84c5cdea4150cd70efade4dd697da45125c312f19

SHA512
74c936d8c85dc812048180697c5001f0a0ec3eeed6a479f3a957d793394af6b54c1156d9f092f6910e5b54302d36b70e7dd044787b360c4e7afa142a9c4d9236

Download Submit
C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\71B264A\upd.exe

Filesize
1.6MB

MD5
b5cc47e206cbf1245a7f1e82fa554fbb

SHA1
868658c696addb246ed6861cd820ea5734371967

SHA256
12048f08e270981ccdb044f8c4668016cfcd398fc4864b37f0beba5dd67902d5

SHA512
b498873d9c722c4659bde8a0b3399fea1b4c82096e8f6ef3fba9693e59b08f972cb2b02d28cec436178813b847fc66a0f8de5232b01980711ad3220674465bfb

Download Submit
C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\71B264A\zip_it_now.exe

Filesize
517KB

MD5
b6d88022d754bb8198ded941901ce580

SHA1
c31195860caef0bfbcc758bbeaeede9734e2f43a

SHA256
c1105f1baacfdbaf1e3c11b4c9859abfbd25bbf8f08bd3145860f421e11eec8a

SHA512
872dbc053cc8a72d8096e77f0f1c79dfa9c4f796ac9f4af5cf9125e223f712860e961fa30af3c47e2e6664a6789ebe1f46caa21ecf28d86a5602cdaac8c9098b

Download Submit
C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\decoder.dll

Filesize
206KB

MD5
9d45f2790dda55df2d99ef66dcb2019d

SHA1
f2a369c1b82476e2e0641f95394dd4dee8223f01

SHA256
9b7ff49f7e1d0a39826ec458c8004b20a65a4bd0592b083f38b01e2dbc2b510f

SHA512
9bef561ec6908dcd7e75f5f63cff8b1ec73e9be2b4e4aa5602182cde18d691cc28259b980c87246c5d27b4284bc783fba44d92a202f77b15f3e65c89dd3aa069

Download Submit
C:\Users\Admin\Downloads\ZipItNow.exe

Filesize
4.7MB

MD5
772ca85e1738dbdea0592d9b68cbd7db

SHA1
2bb401b6ea73e0b2dddfce0b7f65949a10ef17e7

SHA256
7a3a8c8112cf25ba9a6b43098a60a81937edb89d5b15b10a79d8b2598a434884

SHA512
c65718ade4f8eee5123566d0298d3f41ab3e26291dce569850f83c8715082fb27907deec55fa10fb04fa6b26f2f9702e858aac5653ce95cf82121815d365761e

Download Submit
C:\Users\Admin\Downloads\minecraft-demo.D6I7yCyo.exe.part

Filesize
32.2MB

MD5
d03193d3a30ceb126904df28abc953bc

SHA1
9ad806e2ebe4a6f6dd2d48cec1b598505d6e53ea

SHA256
df166846ab3a86b2a797e81ee48377ee5dfb8a2f3091e6344816cfd63316e72b

SHA512
a51d29b1eb3936fa3447aafe365dcee28f18fd6509cfe5d83e66b5ab7f1e0029ef8367c1203944ec93e1289570cc42b656d2c74b35e003b841f43efd336987eb

Download Submit
C:\Windows\Installer\MSI6B3E.tmp

Filesize
416KB

MD5
9ed8eb7ee9f3662d558a713772b18895

SHA1
eb9b7e208bef4df5691cf8b687e7e774f36ba7c2

SHA256
d828a10dd019afe6d2a6f4fbdc4acd8beae618664cb8eee3d34c6541d7902d0c

SHA512
9d9b902d10cf74ff20d8706aac5523189cd2661189a4a1682dfedb38ddbae06de55262f964778f045d15a3f85e48947c023db575c012e8505f00eda8b43c2a54

Download Submit
C:\Windows\Installer\MSI6BE0.tmp

Filesize
544KB

MD5
40117f705bff008c3d96a73162dad044

SHA1
2735813836f36b5de83a745c47628053a0f61f66

SHA256
32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad

SHA512
eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4

Download Submit
C:\Windows\Installer\MSI6C8E.tmp

Filesize
401KB

MD5
ec4cd2159189ffa5d293a24e92964b6d

SHA1
d16bbb7b4504afa4d70442e051e548372586b5d3

SHA256
8a77ed5526ecf88b81844993b5c55bdf6e056aade9c8cb3e1fd89a3b4d41a780

SHA512
099663cd0584dce7ec17322fcecef330341a711a1d6854f57eb852650ab8272b44708f18ebf6ca0e42b2ca0ed10ad99ea7729562de553353afb615604ea19101

Download Submit
C:\Windows\Installer\SFXCA5A409DC52241C1EB9D24A6F1F2137CF6\CustomAction.config

Filesize
959B

MD5
ee9a8381338b060d86c58e2415f481f3

SHA1
200f3ed7c773f50c80644f3976e09e876f45993f

SHA256
7e1096d6f39ebe04d6e38bc714983af05ed92cc2bb4d3365ed4c85e733cb145c

SHA512
26b9108b9522574e08560bc45a6470f85ca149317bd763f3a357040e0f0e743fd7bfc05e0ce2d9fb52bf89e22c61d221ddf8a7163f5143848717ca3d56847ef1

Download Submit
C:\Windows\Installer\SFXCA5A409DC52241C1EB9D24A6F1F2137CF6\WixToolset.Dtf.WindowsInstaller.dll

Filesize
193KB

MD5
ef8d5785ac8669f5fd54e22f52770e6b

SHA1
4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c

SHA256
a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75

SHA512
ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a

Download Submit
C:\Windows\Installer\SFXCA6B6A8825624D7C4BBF7708F947A4E0C2\Microsoft.Win32.TaskScheduler.dll

Filesize
325KB

MD5
0616ea42b68a8f5f2f01bcd985bdcbc7

SHA1
88d6aae1f17b00f4391e0e7b17e98c494be73ba1

SHA256
ea27c65491119eee5c8e87ce3d470783580db8fc5bd141c496768d7d0cce779a

SHA512
ce4657908615c4837084c75d806c083b8f7e63965a2e7866b8c96de7c0278a0857235b74cd9443769968165db250eba042a5b05927febff5bb70bebb7dcbd814

Download Submit
C:\Windows\Installer\SFXCA6B6A8825624D7C4BBF7708F947A4E0C2\RequestSender.dll

Filesize
13KB

MD5
208affd76ff5813c6ffd74fe02780953

SHA1
2edf070cbbd4031d470db0e68af7f36c7c68c3a3

SHA256
a3f2df576e23e27904150abe24b4a03c7dfa2fb52bb847ab54e8b4cd0032103d

SHA512
9bab13a330e00a62e20957e4508e7ef2cef00187783363fdcdb23ce257e48d3ceb4a9b830f6e1b6021ecabdcb3bb3d2852b8d898b32bc506d30e7848c7fff51f

Download Submit
memory/3960-3762-0x0000000004FA0000-0x0000000004FF8000-memory.dmp

Filesize
352KB

Download
memory/4528-3920-0x00007FF979A30000-0x00007FF97A079000-memory.dmp

Filesize
6.3MB

Download
memory/6572-3739-0x0000000004A90000-0x0000000004AF6000-memory.dmp

Filesize
408KB

Download
memory/6572-3729-0x00000000049A0000-0x00000000049AA000-memory.dmp

Filesize
40KB

Download
memory/6572-3715-0x0000000004960000-0x0000000004994000-memory.dmp

Filesize
208KB

Download
memory/7596-8619-0x000000000B1E0000-0x000000000B1E8000-memory.dmp

Filesize
32KB

Download
memory/7596-8624-0x000000000CF60000-0x000000000CF86000-memory.dmp

Filesize
152KB

Download
memory/7596-8623-0x0000000007C40000-0x0000000007C4A000-memory.dmp

Filesize
40KB

Download
memory/7596-8620-0x000000000B8A0000-0x000000000B8D8000-memory.dmp

Filesize
224KB

Download
memory/7596-8621-0x000000000B860000-0x000000000B86E000-memory.dmp

Filesize
56KB

Download
memory/7596-8600-0x0000000000560000-0x000000000259E000-memory.dmp

Filesize
32.2MB

Download
memory/7596-8617-0x0000000007F30000-0x0000000007F38000-memory.dmp

Filesize
32KB

Download
memory/7596-8615-0x00000000072D0000-0x0000000007492000-memory.dmp

Filesize
1.8MB

Download