Analysis
-
max time kernel
822s -
max time network
853s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-02-2024 17:55
Static task
static1
URLScan task
urlscan1
Errors
Malware Config
Signatures
-
Downloads MZ/PE file
-
Modifies RDP port number used by Windows 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 31 IoCs
pid Process 4604 Delta V3.61 b_93347128.exe 680 setup93347128.exe 4980 setup93347128.exe 2864 OfferInstaller.exe 2268 OperaGX.exe 2296 OperaGX.exe 2952 OperaGX.exe 3252 OperaGX.exe 3056 OperaGX.exe 1632 Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe 4424 assistant_installer.exe 2356 assistant_installer.exe 3140 Delta V3.61 b_93347128.exe 5792 setup93347128.exe 1988 setup93347128.exe 780 OfferInstaller.exe 1092 zjpd1lfh.dj0.exe 4980 zjpd1lfh.dj0.tmp 3036 qdu.exe 5480 saluygba.etw.exe 4512 saluygba.etw.tmp 3168 qdu.exe 4776 23yl44np.h35.exe 2308 FreeVPN.exe 5356 FreeVPN.exe 4660 FreeVPN.exe 3036 FreeVPN.exe 5616 Rbx_Error_Fix.exe 6904 qdu.exe 1816 qdu.exe 772 gyqhjw51.hju.exe -
Loads dropped DLL 64 IoCs
pid Process 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 4980 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x000100000002a9fe-1760.dat upx behavioral1/memory/2268-1763-0x0000000000DA0000-0x000000000130E000-memory.dmp upx behavioral1/memory/2296-1765-0x0000000000DA0000-0x000000000130E000-memory.dmp upx behavioral1/memory/2952-1774-0x0000000000B30000-0x000000000109E000-memory.dmp upx behavioral1/memory/2952-1780-0x0000000000B30000-0x000000000109E000-memory.dmp upx behavioral1/memory/3252-1784-0x0000000000DA0000-0x000000000130E000-memory.dmp upx behavioral1/memory/3056-1787-0x0000000000DA0000-0x000000000130E000-memory.dmp upx behavioral1/memory/2268-1827-0x0000000000DA0000-0x000000000130E000-memory.dmp upx behavioral1/memory/2296-1828-0x0000000000DA0000-0x000000000130E000-memory.dmp upx -
Checks for any installed AV software in registry 1 TTPs 16 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir setup93347128.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version setup93347128.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 7 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\D: OperaGX.exe File opened (read-only) \??\F: OperaGX.exe File opened (read-only) \??\D: OperaGX.exe File opened (read-only) \??\F: OperaGX.exe File opened (read-only) \??\D: sdclt.exe File opened (read-only) \??\F: sdclt.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 353 discord.com 357 discord.com 379 raw.githubusercontent.com 395 raw.githubusercontent.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Quick Driver Updater\dp\difxapi64.dll zjpd1lfh.dj0.tmp File created C:\Program Files\Quick Driver Updater\is-AVTMV.tmp zjpd1lfh.dj0.tmp File opened for modification C:\Program Files\Quick Driver Updater\Newtonsoft.Json.dll saluygba.etw.tmp File created C:\Program Files\Quick Driver Updater\is-ICRB5.tmp zjpd1lfh.dj0.tmp File created C:\Program Files\Quick Driver Updater\langs\is-HTEIK.tmp zjpd1lfh.dj0.tmp File opened for modification C:\Program Files (x86)\FreeVPN\openvpn\liblzo2-2.dll 23yl44np.h35.exe File opened for modification C:\Program Files\Quick Driver Updater\dp\qduverif.exe saluygba.etw.tmp File created C:\Program Files (x86)\FreeVPN\html\html\images\closed_selector1.png FreeVPN.exe File created C:\Program Files\Quick Driver Updater\langs\is-947GC.tmp saluygba.etw.tmp File created C:\Program Files\Quick Driver Updater\langs\is-Q0CFB.tmp zjpd1lfh.dj0.tmp File opened for modification C:\Program Files (x86)\FreeVPN\notify.json 23yl44np.h35.exe File created C:\Program Files (x86)\FreeVPN\proxy\x64\cygwin1.dll 23yl44np.h35.exe File created C:\Program Files (x86)\FreeVPN\svc.dat FreeVPN.exe File created C:\Program Files (x86)\FreeVPN\html\html\fonts\7Auwp_0qiz-afTLGLQ.woff2 FreeVPN.exe File created C:\Program Files\Quick Driver Updater\is-KC7Q5.tmp saluygba.etw.tmp File created C:\Program Files\Quick Driver Updater\dp\is-HSNS4.tmp saluygba.etw.tmp File created C:\Program Files (x86)\FreeVPN\openvpn\paexec.exe 23yl44np.h35.exe File created C:\Program Files (x86)\FreeVPN\html\html\fonts\fontawesome-webfont.svg FreeVPN.exe File created C:\Program Files (x86)\FreeVPN\html\html\images\menu_btn2.png FreeVPN.exe File created C:\Program Files (x86)\FreeVPN\html\html\images\open_selector.png FreeVPN.exe File created C:\Program Files (x86)\FreeVPN\html\html\images\twitter.png FreeVPN.exe File opened for modification C:\Program Files\Quick Driver Updater\x86\SQLite.Interop.dll zjpd1lfh.dj0.tmp File created C:\Program Files (x86)\FreeVPN\html\html\images\PIE.htc FreeVPN.exe File created C:\Program Files (x86)\FreeVPN\html\html\js\common.js FreeVPN.exe File opened for modification C:\Program Files\Quick Driver Updater\TAFactory.IconPack.dll zjpd1lfh.dj0.tmp File created C:\Program Files (x86)\FreeVPN\openvpn\libssl-1_1-x64.dll 23yl44np.h35.exe File created C:\Program Files\Quick Driver Updater\is-F50IU.tmp saluygba.etw.tmp File created C:\Program Files (x86)\FreeVPN\proxy\x86\vcruntime140.dll 23yl44np.h35.exe File opened for modification C:\Program Files\Quick Driver Updater\Microsoft.Win32.TaskScheduler.dll saluygba.etw.tmp File opened for modification C:\Program Files\Quick Driver Updater\TAFactory.IconPack.dll saluygba.etw.tmp File opened for modification C:\Program Files\Quick Driver Updater\WPFToolkit.dll saluygba.etw.tmp File created C:\Program Files (x86)\FreeVPN\html\html\images\warning_icon.PNG FreeVPN.exe File opened for modification C:\Program Files\Quick Driver Updater\Microsoft.WindowsAPICodePack.dll saluygba.etw.tmp File created C:\Program Files\Quick Driver Updater\is-DEVCT.tmp saluygba.etw.tmp File created C:\Program Files\Quick Driver Updater\langs\is-BED03.tmp zjpd1lfh.dj0.tmp File created C:\Program Files (x86)\FreeVPN\html\html\js\start.js FreeVPN.exe File opened for modification C:\Program Files (x86)\FreeVPN\proxy\x86 23yl44np.h35.exe File created C:\Program Files (x86)\FreeVPN\html\html\images\facebook.png FreeVPN.exe File created C:\Program Files (x86)\FreeVPN\html\html\images\question4.png FreeVPN.exe File opened for modification C:\Program Files\Quick Driver Updater\dp\qdureppath.exe saluygba.etw.tmp File created C:\Program Files\Quick Driver Updater\is-CRK79.tmp zjpd1lfh.dj0.tmp File created C:\Program Files\Quick Driver Updater\is-DB0QB.tmp zjpd1lfh.dj0.tmp File created C:\Program Files (x86)\FreeVPN\html\html\images\help_img.png FreeVPN.exe File opened for modification C:\Program Files\Quick Driver Updater\x64\SQLite.Interop.dll zjpd1lfh.dj0.tmp File created C:\Program Files (x86)\FreeVPN\openvpn\libcrypto-1_1-x64.dll 23yl44np.h35.exe File created C:\Program Files\Quick Driver Updater\dp\is-JUFG9.tmp saluygba.etw.tmp File created C:\Program Files\Quick Driver Updater\langs\is-I49GP.tmp saluygba.etw.tmp File created C:\Program Files (x86)\FreeVPN\html\html\js\bridge.js FreeVPN.exe File opened for modification C:\Program Files\Quick Driver Updater\Microsoft.Win32.TaskScheduler.dll zjpd1lfh.dj0.tmp File created C:\Program Files\Quick Driver Updater\x86\is-G89R0.tmp zjpd1lfh.dj0.tmp File opened for modification C:\Program Files (x86)\FreeVPN\proxy\x64 23yl44np.h35.exe File created C:\Program Files (x86)\FreeVPN\proxy\x64\vcruntime140.dll 23yl44np.h35.exe File created C:\Program Files (x86)\FreeVPN\html.zip FreeVPN.exe File opened for modification C:\Program Files\Quick Driver Updater\System.Data.SQLite.dll zjpd1lfh.dj0.tmp File created C:\Program Files (x86)\FreeVPN\html\html\images\enable_vpn.gif FreeVPN.exe File created C:\Program Files\Quick Driver Updater\dp\is-99Q35.tmp zjpd1lfh.dj0.tmp File created C:\Program Files\Quick Driver Updater\is-2IF7V.tmp zjpd1lfh.dj0.tmp File opened for modification C:\Program Files (x86)\FreeVPN\Release.7z 23yl44np.h35.exe File opened for modification C:\Program Files (x86)\FreeVPN\FreeVPN.exe 23yl44np.h35.exe File created C:\Program Files (x86)\FreeVPN\html\html\css\menu1.css FreeVPN.exe File created C:\Program Files\Quick Driver Updater\langs\is-N6N9I.tmp saluygba.etw.tmp File created C:\Program Files\Quick Driver Updater\langs\is-TNV0I.tmp saluygba.etw.tmp File opened for modification C:\Program Files\Quick Driver Updater\Newtonsoft.Json.dll zjpd1lfh.dj0.tmp File created C:\Program Files\Quick Driver Updater\unins000.msg zjpd1lfh.dj0.tmp -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\INF\c_volume.PNF qdu.exe File created C:\Windows\INF\c_display.PNF qdu.exe File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe File created C:\Windows\INF\c_monitor.PNF qdu.exe File created C:\Windows\INF\c_diskdrive.PNF qdu.exe File created C:\Windows\INF\c_media.PNF qdu.exe File created C:\Windows\INF\c_processor.PNF qdu.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File created C:\Windows\Logs\WindowsBackup\Backup Files 2024-02-14 180922_error.log svchost.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 232 sc.exe 3360 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5760 5356 WerFault.exe 199 -
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 sdclt.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 qdu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags qdu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Driver qdu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID qdu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs qdu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs qdu.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName qdu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 qdu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags qdu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Driver qdu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 wbengine.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName qdu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID qdu.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f3fdb5e6b36120f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800000f3fdb5e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809000f3fdb5e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d0f3fdb5e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000f3fdb5e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6508 schtasks.exe 2964 schtasks.exe -
Delays execution with timeout.exe 4 IoCs
pid Process 3464 timeout.exe 6128 timeout.exe 4932 timeout.exe 1656 timeout.exe -
Enumerates processes with tasklist 1 TTPs 4 IoCs
pid Process 1056 tasklist.exe 2424 tasklist.exe 1744 tasklist.exe 5384 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Kills process with taskkill 2 IoCs
pid Process 5552 taskkill.exe 4784 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies data under HKEY_USERS 17 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "20" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34582 = "Camera Roll" svchost.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "6" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).top = "26" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers." explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Opera GXStable Delta V3.61 b_93347128.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "8" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "2" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874385" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox" msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings control.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MinPos1280x720x96(1).x = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\1\NodeSlot = "10" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed." explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 0000000001000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer." explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).bottom = "672" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 1e00718000000000000000000000ea2b8ab9427d58458bd1832f41bac6fd0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).bottom = "626" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer." explorer.exe Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer." explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff explorer.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 setup93347128.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0400000001000000100000004be2c99196650cf40e5a9392a00afeb20f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d4190000000100000010000000fa46ce7cbb85cfb4310075313a09ee052000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 setup93347128.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 5c000000010000000400000000080000190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd940400000001000000100000004be2c99196650cf40e5a9392a00afeb22000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 setup93347128.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 OperaGX.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e OperaGX.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e OperaGX.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e OperaGX.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e OperaGX.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 26809.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 526628.crdownload:SmartScreen msedge.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2428 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 5396 explorer.exe 5396 explorer.exe 5396 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2452 msedge.exe 2452 msedge.exe 3012 msedge.exe 3012 msedge.exe 4532 identity_helper.exe 4532 identity_helper.exe 364 msedge.exe 364 msedge.exe 1164 msedge.exe 1164 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4108 msedge.exe 4108 msedge.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 680 setup93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 6564 OpenWith.exe 5396 explorer.exe 3892 sdclt.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 50 IoCs
pid Process 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 4460 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4460 AUDIODG.EXE Token: SeDebugPrivilege 680 setup93347128.exe Token: SeDebugPrivilege 2864 OfferInstaller.exe Token: SeDebugPrivilege 1056 tasklist.exe Token: SeDebugPrivilege 5792 setup93347128.exe Token: SeDebugPrivilege 780 OfferInstaller.exe Token: SeDebugPrivilege 2424 tasklist.exe Token: SeDebugPrivilege 5552 taskkill.exe Token: SeDebugPrivilege 3036 qdu.exe Token: SeDebugPrivilege 4784 taskkill.exe Token: SeDebugPrivilege 3168 qdu.exe Token: SeSecurityPrivilege 4776 23yl44np.h35.exe Token: SeBackupPrivilege 4660 FreeVPN.exe Token: SeRestorePrivilege 4660 FreeVPN.exe Token: SeDebugPrivilege 1744 tasklist.exe Token: SeDebugPrivilege 5384 tasklist.exe Token: 33 3168 qdu.exe Token: SeIncBasePriorityPrivilege 3168 qdu.exe Token: SeDebugPrivilege 1136 Delta.exe Token: SeShutdownPrivilege 804 control.exe Token: SeCreatePagefilePrivilege 804 control.exe Token: SeShutdownPrivilege 5396 explorer.exe Token: SeCreatePagefilePrivilege 5396 explorer.exe Token: SeBackupPrivilege 3892 sdclt.exe Token: SeRestorePrivilege 3892 sdclt.exe Token: SeSecurityPrivilege 3892 sdclt.exe Token: SeTakeOwnershipPrivilege 3892 sdclt.exe Token: 35 3892 sdclt.exe Token: SeBackupPrivilege 3892 sdclt.exe Token: SeRestorePrivilege 3892 sdclt.exe Token: SeSecurityPrivilege 3892 sdclt.exe Token: SeTakeOwnershipPrivilege 3892 sdclt.exe Token: 35 3892 sdclt.exe Token: SeBackupPrivilege 5380 wbengine.exe Token: SeRestorePrivilege 5380 wbengine.exe Token: SeSecurityPrivilege 5380 wbengine.exe Token: SeBackupPrivilege 4248 vssvc.exe Token: SeRestorePrivilege 4248 vssvc.exe Token: SeAuditPrivilege 4248 vssvc.exe Token: SeShutdownPrivilege 5396 explorer.exe Token: SeCreatePagefilePrivilege 5396 explorer.exe Token: 33 6628 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 6628 AUDIODG.EXE Token: 33 5560 SpeechUXWiz.exe Token: SeIncBasePriorityPrivilege 5560 SpeechUXWiz.exe Token: SeBackupPrivilege 3892 sdclt.exe Token: SeRestorePrivilege 3892 sdclt.exe Token: SeSecurityPrivilege 3892 sdclt.exe Token: SeShutdownPrivilege 5696 control.exe Token: SeCreatePagefilePrivilege 5696 control.exe Token: SeBackupPrivilege 5328 svchost.exe Token: SeRestorePrivilege 5328 svchost.exe Token: SeSecurityPrivilege 5328 svchost.exe Token: SeTakeOwnershipPrivilege 5328 svchost.exe Token: 35 5328 svchost.exe Token: SeBackupPrivilege 5328 svchost.exe Token: SeRestorePrivilege 5328 svchost.exe Token: SeSecurityPrivilege 5328 svchost.exe Token: SeBackupPrivilege 5328 svchost.exe Token: SeRestorePrivilege 5328 svchost.exe Token: SeSystemEnvironmentPrivilege 4248 vssvc.exe Token: SeBackupPrivilege 4248 vssvc.exe Token: SeRestorePrivilege 4248 vssvc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 3012 msedge.exe 5356 FreeVPN.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe 3168 qdu.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 4604 Delta V3.61 b_93347128.exe 680 setup93347128.exe 2268 OperaGX.exe 2296 OperaGX.exe 2952 OperaGX.exe 3252 OperaGX.exe 3056 OperaGX.exe 1632 Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe 4424 assistant_installer.exe 2356 assistant_installer.exe 3140 Delta V3.61 b_93347128.exe 3140 Delta V3.61 b_93347128.exe 3140 Delta V3.61 b_93347128.exe 5792 setup93347128.exe 1092 zjpd1lfh.dj0.exe 4980 zjpd1lfh.dj0.tmp 5480 saluygba.etw.exe 4512 saluygba.etw.tmp 4776 23yl44np.h35.exe 2308 FreeVPN.exe 5356 FreeVPN.exe 5356 FreeVPN.exe 5356 FreeVPN.exe 3168 qdu.exe 3168 qdu.exe 6480 OpenWith.exe 6564 OpenWith.exe 3460 SystemSettingsAdminFlows.exe 1596 SystemSettingsAdminFlows.exe 6056 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 3216 3012 msedge.exe 77 PID 3012 wrote to memory of 3216 3012 msedge.exe 77 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 3496 3012 msedge.exe 78 PID 3012 wrote to memory of 2452 3012 msedge.exe 80 PID 3012 wrote to memory of 2452 3012 msedge.exe 80 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 PID 3012 wrote to memory of 2360 3012 msedge.exe 79 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lindo.com1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffccdb83cb8,0x7ffccdb83cc8,0x7ffccdb83cd82⤵PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:22⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:12⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3516 /prefetch:82⤵PID:1404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:12⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:1216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:12⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:12⤵PID:4084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3940 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6096 /prefetch:82⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:12⤵PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:12⤵PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:12⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:12⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:12⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:12⤵PID:3232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:12⤵PID:576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:12⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:12⤵PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7536 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:12⤵PID:3248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:12⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8052 /prefetch:12⤵PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7560 /prefetch:12⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4680 /prefetch:82⤵PID:3056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=8104 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4108
-
-
C:\Users\Admin\Downloads\Delta V3.61 b_93347128.exe"C:\Users\Admin\Downloads\Delta V3.61 b_93347128.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4604 -
C:\Users\Admin\AppData\Local\setup93347128.exeC:\Users\Admin\AppData\Local\setup93347128.exe hhwnd=524510 hreturntoinstaller hextras=id:ad413892c2b60f5-RO-KA1rz3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:680 -
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\saluygba.etw.exe"C:\Users\Admin\AppData\Local\Temp\saluygba.etw.exe" /verysilent /ppi=1 /ppinag=2 /ddtime=500 /delay=10 /source=lvstqdu /pixel=LVS5091_LVS4980_RUNT /pubid=ES5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\is-SBNEP.tmp\saluygba.etw.tmp"C:\Users\Admin\AppData\Local\Temp\is-SBNEP.tmp\saluygba.etw.tmp" /SL5="$10362,5773230,1034240,C:\Users\Admin\AppData\Local\Temp\saluygba.etw.exe" /verysilent /ppi=1 /ppinag=2 /ddtime=500 /delay=10 /source=lvstqdu /pixel=LVS5091_LVS4980_RUNT /pubid=ES6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4512 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn "Quick Driver Updater_launcher" /f7⤵PID:2388
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "qdu.exe"7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4784
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /F /RL Highest /SC ONCE /st 00:00 /TN "Quick Driver Updater skipuac" /TR "'C:\Program Files\Quick Driver Updater\qdu.exe'"7⤵
- Creates scheduled task(s)
PID:6508
-
-
C:\Program Files\Quick Driver Updater\qdu.exe"C:\Program Files\Quick Driver Updater\qdu.exe" cntryphnno7⤵
- Executes dropped EXE
PID:6904
-
-
C:\Program Files\Quick Driver Updater\qdu.exe"C:\Program Files\Quick Driver Updater\qdu.exe" silentlnch7⤵
- Executes dropped EXE
PID:1816
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gyqhjw51.hju.exe"C:\Users\Admin\AppData\Local\Temp\gyqhjw51.hju.exe" /S /subid:ada2_ES_6273d6513a28b609872699665⤵
- Executes dropped EXE
PID:772
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""4⤵PID:1908
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 680" /fo csv5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
-
C:\Windows\SysWOW64\find.exefind /I "680"5⤵PID:3056
-
-
C:\Windows\SysWOW64\timeout.exetimeout 55⤵
- Delays execution with timeout.exe
PID:3464
-
-
-
-
C:\Users\Admin\AppData\Local\setup93347128.exeC:\Users\Admin\AppData\Local\setup93347128.exe hready3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4980
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt3⤵
- Opens file in notepad (likely ransom note)
PID:2428
-
-
C:\Users\Admin\AppData\Local\OperaGX.exeC:\Users\Admin\AppData\Local\OperaGX.exe --silent --allusers=03⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2268 -
C:\Users\Admin\AppData\Local\OperaGX.exeC:\Users\Admin\AppData\Local\OperaGX.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.76 --initial-client-data=0x32c,0x330,0x334,0x308,0x338,0x6cc1e5e8,0x6cc1e5f4,0x6cc1e6004⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2296
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGX.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGX.exe" --version4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2952
-
-
C:\Users\Admin\AppData\Local\OperaGX.exe"C:\Users\Admin\AppData\Local\OperaGX.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2268 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240214175849" --session-guid=fc6ff131-8924-4680-a0bc-aacf483aff37 --server-tracking-blob=ODFlMzE4M2NjODgyNDI5NDI4MWViZTlkMDk2YzNkZGZmOWQ4YzQxMjE3YTY3MTI0MTg3ZTJiMWMzNzdkOGI1Mjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0xP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD03ZjI2NDA0ODMyNGY0ZTUwOWViZDZlYzRjMTA4ZDVkOSZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwNzkzMzUxOS43NTEwIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1BCNV8zNTc1IiwiY29udGVudCI6IjM1NzVfRmlsZURNIiwiaWQiOiI3ZjI2NDA0ODMyNGY0ZTUwOWViZDZlYzRjMTA4ZDVkOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImY4ODg4MWI2LTcxNzEtNDNkMC04NWE5LTlkN2ZiMmY5YWU1YyJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=B4050000000000004⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:3252 -
C:\Users\Admin\AppData\Local\OperaGX.exeC:\Users\Admin\AppData\Local\OperaGX.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.76 --initial-client-data=0x31c,0x320,0x324,0x2f8,0x328,0x6c21e5e8,0x6c21e5f4,0x6c21e6005⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3056
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402141758491\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402141758491\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402141758491\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402141758491\assistant\assistant_installer.exe" --version4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402141758491\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402141758491\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x4d4f48,0x4d4f58,0x4d4f645⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2356
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:12⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7960 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:12⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:12⤵PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:12⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8100 /prefetch:12⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:12⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:12⤵PID:2816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7580 /prefetch:82⤵PID:1100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:1256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:12⤵PID:5748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:6140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:12⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:12⤵PID:5556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:12⤵PID:5596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:82⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:12⤵PID:5332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:12⤵PID:6044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1272 /prefetch:12⤵PID:5796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:12⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7960 /prefetch:12⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:5956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6980 /prefetch:82⤵PID:5944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,16101142573440799470,16674157864733942122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6908 /prefetch:82⤵PID:3236
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3960
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4196
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5012
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3804
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:2020
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5152
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2148
-
C:\Users\Admin\Downloads\Delta V3.61 b_93347128.exe"C:\Users\Admin\Downloads\Delta V3.61 b_93347128.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3140 -
C:\Users\Admin\AppData\Local\setup93347128.exeC:\Users\Admin\AppData\Local\setup93347128.exe hhwnd=262812 hreturntoinstaller hextras=id:ad413892c2b60f5-RO-KA1rz2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:780 -
C:\Users\Admin\AppData\Local\Temp\zjpd1lfh.dj0.exe"C:\Users\Admin\AppData\Local\Temp\zjpd1lfh.dj0.exe" /verysilent /ppi=1 /ppinag=2 /ddtime=500 /delay=10 /source=lvstqdu /pixel=LVS5091_LVS4980_RUNT /pubid=ES4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\is-GQ2B4.tmp\zjpd1lfh.dj0.tmp"C:\Users\Admin\AppData\Local\Temp\is-GQ2B4.tmp\zjpd1lfh.dj0.tmp" /SL5="$202FC,5773230,1034240,C:\Users\Admin\AppData\Local\Temp\zjpd1lfh.dj0.exe" /verysilent /ppi=1 /ppinag=2 /ddtime=500 /delay=10 /source=lvstqdu /pixel=LVS5091_LVS4980_RUNT /pubid=ES5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4980 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn "Quick Driver Updater_launcher" /f6⤵PID:5528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "qdu.exe"6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5552
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /F /RL Highest /SC ONCE /st 00:00 /TN "Quick Driver Updater skipuac" /TR "'C:\Program Files\Quick Driver Updater\qdu.exe'"6⤵
- Creates scheduled task(s)
PID:2964
-
-
C:\Program Files\Quick Driver Updater\qdu.exe"C:\Program Files\Quick Driver Updater\qdu.exe" cntryphnno6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
C:\Program Files\Quick Driver Updater\qdu.exe"C:\Program Files\Quick Driver Updater\qdu.exe" silentlnch6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3168
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\23yl44np.h35.exe"C:\Users\Admin\AppData\Local\Temp\23yl44np.h35.exe" /S /subid:ada2_ES_6273d6513a28b609872699664⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4776 -
C:\Windows\SysWOW64\sc.exesc stop FreeVPN5⤵
- Launches sc.exe
PID:232
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "sc query "FreeVPN" | FIND /C "1060""5⤵PID:5824
-
C:\Windows\SysWOW64\sc.exesc query "FreeVPN"6⤵
- Launches sc.exe
PID:3360
-
-
C:\Windows\SysWOW64\find.exeFIND /C "1060"6⤵PID:5228
-
-
-
C:\Program Files (x86)\FreeVPN\FreeVPN.exe"C:\Program Files (x86)\FreeVPN\FreeVPN.exe" -in5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2308
-
-
C:\Program Files (x86)\FreeVPN\FreeVPN.exe"C:\Program Files (x86)\FreeVPN\FreeVPN.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5356 -
C:\Windows\SysWOW64\cmd.execmd.exe /c chcp 65001 > nul & cmd.exe /c netsh wlan show interfaces > openvpn\dat\tmp_check_WiFi.dat6⤵PID:4384
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:4216
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 24846⤵
- Program crash
PID:5760
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""4⤵PID:5960
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 780" /fo csv5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
C:\Windows\SysWOW64\find.exefind /I "780"5⤵PID:5500
-
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
PID:4932
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 780" /fo csv5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5384
-
-
C:\Windows\SysWOW64\find.exefind /I "780"5⤵PID:5396
-
-
C:\Windows\SysWOW64\timeout.exetimeout 55⤵
- Delays execution with timeout.exe
PID:1656
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""3⤵PID:5200
-
C:\Windows\SysWOW64\find.exefind /I "5792"4⤵PID:5076
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 5792" /fo csv4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Windows\SysWOW64\timeout.exetimeout 54⤵
- Delays execution with timeout.exe
PID:6128
-
-
-
-
C:\Users\Admin\AppData\Local\setup93347128.exeC:\Users\Admin\AppData\Local\setup93347128.exe hready2⤵
- Executes dropped EXE
PID:1988
-
-
C:\Program Files (x86)\FreeVPN\FreeVPN.exe"C:\Program Files (x86)\FreeVPN\FreeVPN.exe" -svc1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4660 -
C:\Program Files (x86)\FreeVPN\FreeVPN.exe"C:\Program Files (x86)\FreeVPN\FreeVPN.exe"2⤵
- Executes dropped EXE
PID:3036
-
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵PID:3572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5356 -ip 53561⤵PID:1944
-
C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\Delta.exe"C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\Delta.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1136 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/4TfpR6wUUu2⤵PID:2584
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x12c,0x130,0x134,0xfc,0x100,0x7ffccdb83cb8,0x7ffccdb83cc8,0x7ffccdb83cd83⤵PID:3712
-
-
-
C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\bin\Rbx_Error_Fix.exe"C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\bin\Rbx_Error_Fix.exe"2⤵
- Executes dropped EXE
PID:5616
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:6480
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6564
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:6856
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵PID:6892
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" RemoteDesktopTurnOffNla1⤵
- Suspicious use of SetWindowsHookEx
PID:3460
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" RemoteDesktopTurnOnNla1⤵
- Suspicious use of SetWindowsHookEx
PID:1596
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" RemoteDesktopSelectUsers1⤵PID:5596
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:804
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:2120
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5396 -
C:\Windows\System32\sdclt.exe"C:\Windows\System32\sdclt.exe" /configure2⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3892 -
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" /name Microsoft.BackupAndRestoreCenter3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5696
-
-
-
C:\Windows\speech\common\sapisvr.exe"C:\Windows\speech\common\sapisvr.exe" -SpeechUX2⤵PID:4460
-
C:\Windows\system32\Speech\SpeechUX\SpeechUXWiz.exe"C:\Windows\system32\Speech\SpeechUX\SpeechUXWiz.exe" UserEnrollment,en-US,HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech\RecoProfiles\Tokens\{11ACA2B0-2ED9-4ABC-B2B7-1AAFF540FCB3},65552,0,""3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5560
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:3160
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:1552
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5380
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4376
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4668
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5328
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:6740
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F41⤵
- Suspicious use of AdjustPrivilegeToken
PID:6628
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup1⤵PID:224
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:6364
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3902055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6056
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5af9edcfd1e485e836da3f710ca00250c
SHA15983c0012d00f1852c2655e5be8f208c614ee2e4
SHA256fa2f4fa99f4c22818bf1ec84873fa83c6b2131979e5026b51546f9c00ab2ceee
SHA512621149f083cea990d464f803647421ae49196ab336301c6c00cdd3ba79bd1ca538b042da6dd709a4f255601424a54813127e3ce17b464d47143a25fadb8f4295
-
Filesize
14KB
MD5588dbf045d50f9112c27939dc871f945
SHA1902d7c3193de6089aca524522182c200e9229575
SHA256035c4f41639c7345265adc1773cca450cb7302a66ccd5da3af8ec944d8bcb549
SHA5129b3f297c17d42fa7e75de8e03062a0cd6ab73936c90e5e3d0c4b84325833a7a0a50fbabd12488f12262ce38e9596cb8b49f054134bb979243c6d2166a42bdb34
-
Filesize
17KB
MD583d3e73a6dda956d580b52fc0af66d29
SHA1f0f4c92fb48a268de029b69ce35d0e0a4a6acf48
SHA256cfa21734fd30286b01f3f1d14ef0ebcf6bf0cfc405eeb81a5a135bf2f7e03aca
SHA5127e3a64f3414522d88f82f2c5f38e6a68092beb8847c6c217af677036a84aa2dcd99f31888f309fab2c16964a11245cb57ed01484548dc6ddd13c0be80c463c14
-
Filesize
907B
MD555676a73546194ec7f2726c822a38ef8
SHA103a49198801126b9007a1a630219ccfd09f84a27
SHA2562750b37f1de4b507c3224915c6cd82751e22d9468ed850ad429693ae3ff3a871
SHA512116f4658567e4ca5a841c4ad4eea177a3590755d18d7cd6e1ba6e89bfea96a83e06243b2c545092b1e159f1e0e07e0b62bd5efd6e0412631293a260f1e444e94
-
Filesize
93KB
MD54dc834d16a0d219d5c2b8a5b814569e4
SHA14fbe0563917d6f6289e4e1b4a0a8758e4e43bda9
SHA25691222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef
SHA5126fbec4785a21520fa623d1a151c6c8b64baa1321ac6918a127bcfc22e49ec2e3bcd161af9c237bd5c70bc4046eb12cf434563f86cbdc9876eb67fb2dea87034b
-
Filesize
3KB
MD5b11fb9ca40b8a96223ed68b125a363bb
SHA1803ff400435fb26eb8b9d897304c7ae137d38524
SHA256043a52046d1b30f71c08c605e234ab63cf5640588c60684fc9c68409fac267b7
SHA5121e9aa6da700f3ef425a389221a7bf3f0681232d882b0637aa09e6c4a7d1a51c8a078259f30d09abbf6559395166dd07ac16ff7ffcffaee329c553747c168f26b
-
Filesize
279B
MD5e27da5923d406d2511411ad8751bb5d7
SHA1139248551047139448ec3796d3446936376537cb
SHA2569542edd77ef43717b58b4807233eaf6f6ecc0bf9591a88396dca97d7d5c1e4b8
SHA512f130c0a9d46729812230497764f247b6802265539da54c3ea57facca11ef421065a32bad5e10d71ed0a7242071064b46f2a3e80f197dc927dd5e917292702172
-
Filesize
3KB
MD5e0ce0eb6bd1d0d994205abae24f49053
SHA193bd2449e9eba136a752cd6f70167c003faa6541
SHA25629c5adcb958b5ef17c547215eab05499661322b2882ac393a6a90876f8a379c2
SHA5129ee8a0a0c8aa3729e41db0399c414d347aa87980417052c1ae5ded1cb637cbf9c5c1485cb08b373228436f7de1255b8d38707c4585b54a9eb0059df990affe6f
-
Filesize
3KB
MD53e9b0fe0129ceb5a5e3ad70306161feb
SHA1fc9bbcd2134ad800a8792fa5d444fb5b0076271c
SHA256b9e51ad5f5a3bf91fff75c216c59666c2252ee0bdff0bbb1f1a903c115642a24
SHA512d4b5fb7be3be010c8d598035acccb93570b22939c08ba8a6a7ae492aa1cd4b90ac5da8991a0c79716dd37269ab1b5eb6493d7720e2f360a08c2fc022c99b597b
-
Filesize
2KB
MD5bedd076083d00950b7cd4b1b2815d772
SHA16660f46745f4c123f1bc9247c290bcc24a77cf9e
SHA25624cea0b2ba80e67411da1f8f962bc61fb6eedce5e520a665f6ccbbf986ed05b6
SHA512318ce1476b4029ff938e86994076c05fe10a07923688d879b32f9266fe927b362f418184188c46d15abb90fd07e6d62908df232303968740a1421dfb8160efd5
-
Filesize
733B
MD5cb9875dc95f477d423347fcddb6660d6
SHA177df51093b09b4240f2908f755e4f1124cf9bea0
SHA256b02514b8b5f817655ea8f1ae6d4d8d497ab7f1974cd60b5da944802aeec09541
SHA512566debe10225dd072ab6eab8c9b90b5bb79e203704395d375b07724b846fea9f6a830553c29a8fee8455e12fe6e003875fac038ce2efc24aed75b7a7f1ff9b50
-
Filesize
4.0MB
MD5dfe06df90a37a45b23e33f510dda9554
SHA1370edde62c86c1cdae423e966c6e31d5f0bffb58
SHA25668e15d06d36f57bb45c819e0a3aada7023493bfbea1d2cbd1f3c1f421fe4b546
SHA512c3a5589006c4e194f2cc7d5c053cd1ddcd4f0a4cdc76d104c0a32c64f0fb0103755523c90e8cba4c3818b49f0b9e144d010d4b97003cf66b9779e0e776220d70
-
Filesize
2.7MB
MD5348e9aad9e445392ba5c9fe96daf6f8b
SHA1e04d450778d05cabb111903892dda0cdb288cd98
SHA2565bae7f43baa254ce2eba9018e11c575730427d4fdf3146165755cd4bb07c3e53
SHA512c19e21b4ce0908bd5b0d7f606f6ee44d0b8839ddcab7067933092a707d21131b7379a1850e35475e57be62cba1b61abde61331bd1bccdd875e756bb296f34024
-
C:\Users\Admin\AppData\Local\Adaware\OfferInstaller.exe_Url_1hem3jux35iv1vzfopbi55gu03hcnxpl\7.14.2.0\user.config
Filesize798B
MD5f3da41e2f01ec12a28efa662df2fa963
SHA19760227f497132829ec34fffec6184969043bba1
SHA256a4544f806b5637e45e2e702c7997d0b6a52b805670a72aac518d189c3004d1c2
SHA512ae4f56f93a2386abe8891ba5ba1cc7de166a28c6a2f3913870bed2926ac43469bbbf0b4b18acf2fce7c7f120056e36b3777aabbdf9715cc12d2159403e392e59
-
Filesize
152B
MD5fba38883c4ea1c000dbd9c38d017e733
SHA185e0906708a55073287ddfa21f757162b21c3573
SHA2569e233584c57cb57ff648be1beaa1fff2112600fd78a0be082476c9ec5cfc5972
SHA512a832dbfc9ed009c686cbe003fe04a67898c37f6cd3e0c19ff8a6d4af7649a8c7e36eeb2e2e4c4206752da80fbde7c26c7241a472d4098b1edc5ab4057d54f1a2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\286fe958-7f1c-4c6e-851b-bceb94320867.tmp
Filesize5KB
MD5ea5774b6a29c5f21a37092cb59e0ad4d
SHA115727a946390538632f22176d7c4909a55f899f5
SHA2563e4b6baf2571ad5eac0519338f25dcec0689229ca8d047fa29f78a22fc34f338
SHA512bdca52ec6fcef84e8bff6fc51be3ec2a0df0a45d2acacea674995da497e5643c328b6aec47c760f96b9cd84c4c75ce8ca76b26aa5b39f4f188456b317148bc66
-
Filesize
86KB
MD51ce7e23a7d1d14ba430ac0d5e0d6ae7d
SHA15f8dc1545bd68988d6f878f43450b686ea71f917
SHA25636791bf8c5c870d51fa88282ba54c2297fcbf029beb710c6cddea2b9a4ea6a5b
SHA512d65d71faf3bcf6531b00556c6f34b02a62a9feabdeaefc490e9fe4e30c666782b4f7d657cecdff24a1eb194cc3f65809202604334aba5cdcda21f1e8725d15cf
-
Filesize
49KB
MD54aad0061edda8bfc3e8e6f534aacb929
SHA17868cfbb05f4c3fcdb560a172c070ddb2f88beff
SHA256c5b2cc4a6d932afd24e80a44cf631f432d2dfc904f6e0a82f09083cd829a5ac9
SHA512d2000e458f50793ebe591f5b7be42c1c29e78b874112de14d60261370d3c6e2d2c4b52a118f9a643bf9483e97f2ac02f14eb3483d3b9ce8fd2976f0db201353f
-
Filesize
22KB
MD57a204d478c8dfe822bf86f9103bbd9b3
SHA17114b36ea1588d9372d730b2ee5dec7a3aee36d1
SHA256d9134e3cf60db564c49cc181251c7308bc568acf060444c443a90c0f464ebfeb
SHA512f5fb06a9808e9370a5fb3b926ffa27746ca7942eba36a2f63135168218e326abc74195453b9bcd8a045d5870a71b7f250dfc281515c7fa51857410acb316763e
-
Filesize
203KB
MD54441dcffff82f71f58e356982a17dd0f
SHA1e4ebbba7b2f75194e272c50cd030ea8e60f8543f
SHA25688d15b09c358aff9cb98722b2ddf51c54904358b5d6803e24bf2d42919f59b36
SHA51291979179f1974686a6fb5cfc6b798dacb0a3bc315163c9b95fa43870610ad8db5bb252ac2d2ae53c4a7a877ffa4848f98a054be896de044d2aa7e721dee8b4bd
-
Filesize
1.5MB
MD578ce367b18fb959090ba95dc12aa5495
SHA15584b000bcf77916370ecff2f44c8acfe6c03f32
SHA2566f62c6740f7cd0f95cc5d827c3dce9460a322d77eb526fdfcdd86596921f5836
SHA512e1f716cf51b862c0e728d7f85fc9e516f33d274e7eab0dd619fcce973e5dc47128dc227d400c3134728582c11d5055bb2377ed829bd5fc67eb2113045451b06d
-
Filesize
47KB
MD5709f7544bd3e74c424113e6853948595
SHA1a8c1d9e6c8493091727f0e303e45ab92b773343a
SHA2560f2a35c8b824d54b483d0b2ea10964bb7af8eb6b1c86d40efbac4c55e1123a2f
SHA512c2ed4cbb5e48d04eeb63c94d7d88acec5af101c2da003a34379023d8454d810ae357d0b4265da7027af38889fe307ca597f815111295ed62520f39aabeb2020a
-
Filesize
776KB
MD594585245360d4f588e7abe5c273fe498
SHA171861aa7610cc05c9054f42c0b041a00a7ff2882
SHA256a7032193f8e1315fcbf2c2ffcac30da577003adf52aef7e11bde38c64c0889bb
SHA5129417974854909536519de899e68e2d8715dd74e40d87297f6895ff8955c24569d00113b13e648d0f1391e4dd3991ae644545c2b8cafa549706094383fde44bad
-
Filesize
32KB
MD5dab18909cbfc7553c4cd7137fd8cb99e
SHA10242b0bd384f326a0244d70921a150f98478712f
SHA2568cfd496342768285385d564fc1b3719c2c980daad3f260efbada6e77ce39efbd
SHA5121dee34653f3d013910ff3090c9d8089196e8f65d5cfb4bb4c0d53736c0a32f7ac9c0059384d5d46d98e98c4a44b661b25dc3e9c8597ce087973b759a7ec66b02
-
Filesize
21KB
MD572e940023b5b347d5aff9f07ccbbcef4
SHA18de509a0269cfdb4125d80316b12e9063bbe2807
SHA25644f1f27f512f8913750458f3f147b890c5f7842dbbdf8ba3fb4f8fb1d5b1105c
SHA512529e21dc8be92e46ab2459231159599be072f4c12558a78a372f5c96ada60a3a0773a6df39fec0ce9e2d0690e48bd330e8af8e77e7f9fdd07ef1226773840ee1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD51e509ae35fd0530129ea30f497fe264f
SHA1303aaba398811c8face35ac5ca580d65119b7b27
SHA25614ee685ce4fb323dc2e761a213d639009d50013b05d20456dc62c80962f7ff09
SHA5125134d109378a1165a41a0955c2691608b84658a3a22693ff9e51f7b36daf42ad8e47367cd91cedb66010fcfb5218552873286f2c52d4e90d3e54c111b2a9f56d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize7KB
MD5b3b06b946b419463aabcdb9dcccf7ce0
SHA1ea2a0405335257fcbd86e9283154fe65070c1847
SHA256c2feece770c1e4454e9e17a0fa77d1517a22e9767694c300155e5a6fbf15edc2
SHA51248a3f1d6f74291316722546e0b1e2f2aabcacfb797d7a348889036bfff61acc027efe70ae0a23323eeafae03968360123760a8dbecbbb6fe2129ef3d9435eaa3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD587a44afb88df6d6946b9b4216a782197
SHA1f3cb16359eb3bcf33c754853853961d443cbcaa3
SHA256fcf8742e4889f56e0a3d151960af59b70dc1789069a92ee3bb81f17b4443b252
SHA5126e2a4ad5536386abe31ff28762fd673ff82e3fbccc719f8dcc0a5f08adb93e1076f74f5b67bca2ea4447d5a489bb1fb3950f15a29d2729934c9b04ea7a32ffd2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD5983c931602fdbd4fa045fd917d4715e3
SHA1acbce52f0dbcc86ec5c5fd38ed9aacb6b45783b2
SHA256dd594298abb55a68173234f70525afe57e243d9b3237343069af7251415237f3
SHA512a35a973525a1cce237e2e9035eba1727154bf7bd1257b7b2d8015401598d44c7387d1b47ba7ec15b74b3d8e6c14ba2174988285d93acfa8241554f2f9fdd055e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD5b2a3d61eaca0be5a972762f4c0d51e81
SHA1d5c43862c7803e57eb2eb35b10044531dd2233fa
SHA2564162c72c4f922d6d146a3469aa8cabfa62da15c1b7fefcc5b3e42208965a0016
SHA512cf66c420c02d2c49a96cabf2126768c333bc88f89b8c417fbfa476b7f9f1bdcb816091e375a6b0e899889d833520c216efbcb3d9398bf8b54d148692bdcb4805
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize10KB
MD5d689cde08c58a71b8b00bc4863eff2a6
SHA17a0b84be5f37b15912309cc79a008eee7abb61a9
SHA2560bc4424ff73ecdf8e8ec9985c6e97a718e0869a83329cd71fcc6364a88d2fbe1
SHA512a393242bb02da182ff2a142ccd4b39dc238a6f3d178dcdaedf47abd1d91ac304df58b130a7947a7236c7b4930885b21e17088fbe6c8939db30a3f67f5510fe3a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Filesize746B
MD53aef9cfe14655d97afcc38c9bb6c85a4
SHA1caca4103b2e5c494fe07c4ad2f4d88d05fc913ab
SHA256d47d37c9b114af787c84563e061a80295672737d69d27b6d5777fded855a225e
SHA512f387f2d55c15654769ca9aa26f261c6f6da5c34383679df7470dbbfd387023f0d1fb87abebc4d2ff74afd7425518b62ef0b1f7a82fa0d8482d2219d98712285f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5dcd36.TMP
Filesize609B
MD5ba878bd7d60f835e3486a9cb83603c45
SHA191991bffc17b9b1d42c8f356d7abbffd636741ca
SHA25637dddf4f84c501d758872800bd6ef75e60ef391273bbcb106cccc6444f21898f
SHA51220018ed0ffdd7d9be16c51df6f869a7b23edf8af098ce98d787674b5e23e2e3d7cff7d2ee09074bb478aa23213c904802a7aa26261660c74daae68786ee4fd76
-
Filesize
7KB
MD5a51d9e55ec5b318a463f0c8000092b5e
SHA1bea9e9e35f9a8d92e2eeeccd14d80a236882764d
SHA256e913f28086b09792198ad968ea87d973c45ec2e1b391350036bf058bd823f4a8
SHA512ab0c4c109edab4db7d14b7fed0c2bcc774801d263bbbdd7f79a779ab90a1dacf264dd3032804b51bd0e0e81d5d6ee841f3cab5ecf9d31d226deaea5f6ee92251
-
Filesize
7KB
MD582bfb03f620f3061201afabb9ac61df9
SHA18343902df66ff57379a8c27c0ec6bf9a3e453b9f
SHA256308d74f29a3bd78e97ef386f8a1e0bec1b01b45348b41bff06599b2b155e635e
SHA512652400f95c9589b50d43e68c40b5a2799cf02438437e7550d7f55a5f9a05fee783f53890bee49fa77d177c4edc93dfe7c271348628f418c3ebee8582e8790455
-
Filesize
3KB
MD5f3966e0027a05c4a42764534cec8e80e
SHA1f80c4c014cb4d14d944d0f4597730b7f19a109b0
SHA25668dca678fcc780c5e948b140de31010d3d5a09ade62227715deee644abc2e7d0
SHA512be9c107a68a5a54b344d0d89ed09f18bb02929b3fc85df75f3b5a9c6e2ef639145afec9ab93815d25723d774eac2328326a702ff5e5130376c702a148aff8e47
-
Filesize
7KB
MD519cd912335d0b038bddec2b045f897f2
SHA17def843c1289c0ec1ac1480d7b6982c119e0d6a0
SHA256f9ea570e57e8c821e90a35161fc99dda849f3d24209816e45a988c90dbabcc29
SHA512983fb2f5586b67e933eeae21d77ea3ffdc37baf2ba3cb13f7e9f16b6450f1b48cada2507d922d492b9b404cef33e070e2f37c73932e0096ecc652b4419fde9bf
-
Filesize
4KB
MD56ec057c08efe020cc538a7bc7660aa55
SHA19737020d2a8db1f5432c5031641ffa45479eb04f
SHA256313bf1806935de739c148a90d9131b8fe5f2defd1aac25ec0fb979f397f2b800
SHA512337677062a3307ee8d367a50fb1d091ec895a72a4989e1c941dc65d34d4fc3e0eaf6933937facd59667cef7630d67d93a02c903c223fc9a8cd66107d4d089c5b
-
Filesize
7KB
MD5a902b97252dcf08171d4763269a3bf73
SHA185e11068a6d748e2d93a18f31be846e5b2367bda
SHA25612ef852577075fb6a6187815e2d0c38d335347f92c80bbae4720e71c34fb93c5
SHA5120144534f83996a16838cfa10ab084dc0325b1674308ba5a5d9369da73407c188e6eaa1b1156a3a95ceeeef30c6fca643d3a42028cfebe4b681948665cf8f4cd5
-
Filesize
8KB
MD53791ea6d71bf2d74b71f30c65169fe56
SHA1fa8b48340db0e2ea9645c0bb477f6d99255eb8a0
SHA2565aac32b273dd1aa21e3c3f993f067d473ec2158e52e6fcd923412f804bfe7927
SHA512b035d1b86bc40fc225b22a378122b2c23b816b7b4844bd28a37758fd644f4b55a2e121756f2c4655842e86cf369eac7a17f81f7a714115dae8cff7a751838122
-
Filesize
9KB
MD512cb28ae01fc322f5e6debaaded4d3f6
SHA16355f6e5f039088ef0e33b60f20c842f28718f3a
SHA2566ffbbfd5b6344b3513b8c4b10be153acef0e6463827461872e53d6b651549798
SHA512c2bfffbf45a2f2c2774537c64e8e9f4fb48ba7a75d5a1da3e3a43c654e05d1509d7b5b81c5a5d364ace51ce482f1c7a91b2a3ed5dededd22ec1ddc7da7317cf6
-
Filesize
9KB
MD5ff51948222a1a37072c952228f906b56
SHA1f111d1b92e71f3ee66e47f7a57effd9d46db427a
SHA256b1ddec6f1b9da0a9d4abd54c9f3dc7cc7b7e98d2899e5fe11551af312e8ccace
SHA5122567f7d9f63fa6c402a911166b805716c90437c90aaab39477f288254b623cc52cb343cbc5d1f3f587f14709cf8f7223cb872e7ed293dafd63fd3f607b9bbd2e
-
Filesize
10KB
MD5867c8872343030677fb8871933e05c81
SHA124a99cdabc152325537cbc61dcb7fa7806142584
SHA256e5d8b4744b03166ad15e85236682643dbe891c9e98522d57e7b7e23f47dbfc9e
SHA512a6dc053f39af07dff80b4251dff11e0811fdbf10ea977732dfca5dec77e2310ded3169f3b05e64036435458a2e025716d4f8554d32208d3f876d726dbb4316a6
-
Filesize
7KB
MD5a5f7e71bb80484d2434ea5be9b844e6a
SHA1c6231c4f783f13d78d0f018a3512e09143c3a9e6
SHA256267e8cf6986c04fc524d905a7572ca7952fbbcbf5d9b516456f50bc571cb4cb0
SHA512d5e1320e1647d2b930496a1b18f04946b23dc952763905a13d0dba277919f53cf91a64e243f2c4ba1ba68f2b288995bc4ce09950effce39700198a4f1e5f4871
-
Filesize
9KB
MD588c05a5646c73e50c70d43843c208be0
SHA10ba0b280d63756784828cd2fbb63c3fbb7d500d9
SHA25621cb4123abd53b29431bd7f2327fd4a2a4072f9a58d8b727c13d75f317f8681f
SHA51240f675b901c0fe9193c35b85ca0dda5e0973eebc8888557251dfad133ef496872b5c0ddba94adf7e2ac74a7e9b7ca70616dcad48723c028c39f21369f048866f
-
Filesize
9KB
MD5c143dd7cd8aff620941eba5693e95c27
SHA1602c8ca13031233547b8066e8c6c312236517484
SHA256d900130561d984c581902df8185e0db24845f94f7db5677d3cdd985faeb53d68
SHA512adca549aa39c75349041d07b5c08b08a1674104c95a1e6c1d4773133d3a6ed426f271f98653882c9ab5e142ec44be359e8a3513be14163cf8c316f33d761d2a1
-
Filesize
5KB
MD50f56cffae8ef6b44c74bc60937c8c910
SHA15b138e04e19c8cb280761cf9c669b894658cd174
SHA256a6ae9413b38464312013e22f34da7d94f46f55aa55093636cc53f5ab9bcf0f1f
SHA512a34b5a17d199f50f4d68179f6eae64d7927c486cdc91f28bca7c541018698d9764c82c24105aa43c0b9d6d3de97b5ec12986542321f79cdcd30558f8039f4f39
-
Filesize
10KB
MD53fcce0be234a3c7e58ab76c1de802dea
SHA117c4ef691a10f444e3cce98f7d3a3ea119fd8971
SHA256b563402d0e3cdcbac6c283cba8661c6500b13fc301bdeff859630264d2f814f6
SHA5127eafd931048ac7b78fd678c9b8c213fe6a189ef4919fd6aee7685bdb443bf8cf082d7b1331172a376808195d5867c74fc7a0d66943cf036da6c41eff26bfad23
-
Filesize
9KB
MD5e0d993b4a497faae030e8993b30416be
SHA1e18ded2b1fcd7660c56a2d0f7deef95cae394e09
SHA2561007abe794d0422282bd491869df827a05d2951ebc20ee3c34a96bda401e5e82
SHA5123b48996479bc52b85b0141364129a6b9d39347861e802ef919790f0b2620f5c6b9c4c8291dac580ec8ebd4e0e848d24f567c99314f6385b8f16731951dab8f10
-
Filesize
9KB
MD5b5f009d930017f702397347719267bfa
SHA1a12bf12b8447b96543b8de2fc8b6e3baef67ceef
SHA256ad2c8f0a43dccf38ca6558c6c7566035542b90f9dbaabf630038f6a30529dbd6
SHA512954431f1d9c8e9282e6ff744cd8129a792aafec766eceaa6052eb7d9351ec695f112c0eebbbd104efa83303a5b7126dc8d01f90f3af38aa7f409ba1956a6b7d4
-
Filesize
5KB
MD58b7b983dd16b53990a52475a8f4f8196
SHA18087d7f0a5ae6f261f512f3e9c7b7e0a99456bd4
SHA2564e56f474feb157dc0116e954ab14ccb7b4abc8fa0848076593cc6ad781a2c445
SHA512eb29acb48acafbfaf578f0256656536575ada5440dbe318e3b262f5748288da180643ee33b8d039b9e81e67978e00dec87ab62867f45563f422410cf2e97944b
-
Filesize
9KB
MD525e00b4ccaa1f452c17cb566b63e7ae7
SHA15651ee053d02bf6dc6d9fa15909c4cf2ecab98bf
SHA256a334d27f9d3ce0caaa4b7e1e8ad5e18025343df32e4356563af30d8b3fcc3e38
SHA5124dae2936322cbb01672702c0549c36389d7e518811cac6fff40de8e36c78fa2b89476da26a5acf2282f8b45f062889cc419d780bcbf7758417e5948889ab88a3
-
Filesize
10KB
MD557a1d7c6b1f54626bd94eb2b05615c95
SHA182b59e76c0088efeeefe0398f343ab0a7129cb6a
SHA256e9291098a68554127cfbc7178648721286b370dd0ab6d376c0eb0dabb310aef5
SHA512340f4d3613aee387ab30b711c3a554c8535ddf16efec7433869ff24fb4eca8dfcaac6fbe5a8cde15411d386900563695ef561be29a663cac556e2a25f3ba4272
-
Filesize
25KB
MD5de8827d93011d8af360f82cc1f8ce73e
SHA187774343c086d15d6da295268cbca6fed80b621f
SHA256511050e65ef86e0692adf41262e7be695993b28b629ba66f3e174e27d78ba6c5
SHA512fa0527111401d82e4e05a16d1908ff9e149d396ff088d970855755ca5a8589476b19a96746c445284b803f3589f1544a02b4d67e31bb56c596a3b79f49d7948f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4cb606d4-ac0e-4178-8bff-4ac5ec96294f\index-dir\the-real-index
Filesize48B
MD54ff78f3ee43ba7fa0dd7075c626b2321
SHA1b4bb56c6aba1a950d9ae35a03bcbee8ef15e9959
SHA2561de6a3cfb3a3a4445cd79683c0dc9323901ce63b4f132f8bb51101fde2cdb327
SHA5120eca4ef1b598d6588d68b53b78fe352dfd1a1ecf49e362878f562a926cbf19e724951bdf21fbdbc63f5ae15f7e48f2e5387cbdbc438d86902bc4a843aac904c7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4cb606d4-ac0e-4178-8bff-4ac5ec96294f\index-dir\the-real-index
Filesize2KB
MD5f39f9c31e78aa9a673d5d5538ad243d3
SHA12f04a96cbd36fc68cde583f12993c766f52b0c78
SHA256c71e9b0842ea5e8bd9fe8278ad182c9b4add679d88c9473e1378ebec66c24eee
SHA5120ef4f1c76e203c1913ff2191afd36188a84a09b564a6ffe17736352966e200f09b921f957492d9e16dd3c523627fd17ef3c948751497d2a21822d942f3bea412
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\78edf1e7-81ea-442c-ba46-a7634e261beb\index-dir\the-real-index
Filesize624B
MD54ced2019e6ee1f6583a4b9e6da9c163a
SHA1f56fd8f645200637235070d60072f70b8260d4ff
SHA256ede77f80f759c5a3c5ba197a35a1fc051fff875a5a3e693178cb654fc3eab1f9
SHA512b114fd98843f44bda82a723d92ff307441bccb6b2de7c1d6519acaa5749fde2290985cff1dd151b36d9539af0df581a96b7506734f67eb2f9c9a3218ab7a26c8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\78edf1e7-81ea-442c-ba46-a7634e261beb\index-dir\the-real-index~RFe592d6f.TMP
Filesize48B
MD5c9d54ef55d5fc1d4879b6931d159a15d
SHA1e7e1aa09cf34a2b8e3471403cba36cffe35182cb
SHA256798a240bf9fa025dd96af69f5cf233dd7da0b0ab3b2af8674d9cda206cbb3c82
SHA51253bb97aeda3b3617439edee579091c9d5067f98bf6ba0c87424d9c9e3dbac868b274637be68a33482e0cca93446bd6a9237b610bfde1b43b24033e7e50a41235
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize89B
MD5c6398546a692a5c19f999972daada2e3
SHA18a6e9aac163cd61355cb4c3c9662b3f3e7ba7946
SHA256e2e180b2a6c723c53f4895c7ff8466fd6264662280c93ecb40ca79fe3346316e
SHA512416e1242c5cacba274e252a05bf4d37914aeb70a3fb354bfe94231d190275d98dfbf492202f6c6f6bf022cf8d0fcd803399c7652bf275d5a86394f79fcacb392
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize146B
MD57f083e1593fa9e30aa96c254ed046b16
SHA17f89dd9898f48a35054512a038f32bcd8685f0db
SHA2569d26a012fde2633a0abeae4c4fee94db789558b76bc59f548f85b42440110cc3
SHA512a0f68ec3e5c187891ab0438a02ff4f2cc1816f8eaa0259f0219ab288ee06da1bf7f95059686fe56387435e1f7678dd04d78582b9e383d3ce25e97bff2d3dec63
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize146B
MD5d3ac20f462f488840fa8f2232c17da14
SHA1b1d066d980f9a9c9bec19efb3491ea55cc0d6363
SHA25654c2de67c13527582fb5f29f480ee817bd2b42c72b5c7eec3b962560122d99d8
SHA512c8ef68b2c066f2bd0805ca51213878507e2b2a2a0eb290168f868797bbbd7ff4cd30a0e4b4bea029c1a1104d37a34af98e0051ded33b84676daa130292b740c0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize155B
MD5644814017e4d22fcb45dfd7dbfdc15c0
SHA144aa56880d6b1af7866cb4a4777dfca210ecb012
SHA256365f9aa409534588b8b8ae3fdf92a3342ffd54fe212a004035a37c438bbfb6ec
SHA512b8b1aec77495ce040d72875f7328ba7295b85c09bd659c1570cc90e8c7e74114a71a0d8c595ee00000bd590d28fe5d9ad42b26cc544bfded924308a130ed8624
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize82B
MD5015947612abc58d9796fa18b6065e48a
SHA12debe27a6406eb6ad2101ee94eb99b26e53e4fc4
SHA25636084b4241a86d7300ecb7f26209593f436260344dc24b0ae26c830551a96a76
SHA5121d188474956e9fedd2a1b92d6a74ec022d9c366f0f9153c2000da012c54d703d94f4ffde78fb473bf0d11a1b21c3ee7949b83ff4282175dd4183e8982a08322b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize153B
MD5e890ec30220376b9a8938bfff9b7fae2
SHA1496c3a8f2ec1b506f4b3dacd292dfccf60a4ad7e
SHA256a9b88c14fd7bf2609ab0661bbba638aa39fc20471aa302468bf6a81ca938100c
SHA512bcd18fae857724389a1c6b70560c4c9ef632b050a9c97393714be4ca5adbaa437afab8722653d163eddc3a7004ccfb868275d64111a78c87c6367882842b221c
-
Filesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD5194c3f2cc2418da68d658f48aad6d8b5
SHA1dc4f7da8787b508567c46bbe4a54f9fbb5c6ca48
SHA25627c36987ae3973bb456f8c23dbd0a5d88cef58ba1c923bdf3ba1a1a900f14720
SHA51294a102ed817de8f0ee82e77871c5078a83d92a982181a6ee6236c0e129b9c578e75b71145270def0212fc9a31eb5c5b4619a529062bcf13dc389c31ac632736d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591ed9.TMP
Filesize48B
MD5a7c2875968090fc5f300159f2ed8a857
SHA1a1b2e2cb034cef06f0cf2e51d5f71e27550d6b45
SHA2560ccb8ee97b43a1364b34b72474917478179b68843513ac264276cf5833ab9101
SHA512015f3537235c6d1bbe1eb1f54e5d41402f26634b5396c29e14745fc06e5e66106cfc7f78b4700f5555acd84c34de740cd042785ace30135eb1447d1ca43a14fe
-
Filesize
2KB
MD591cc4aa3d9117faf3ed43176d4295429
SHA156b60e569fca0f9fe44029e0e0790fb35105185f
SHA25677d09206da1d416b70fb1122765cb134cc76159ade1addd0edc01f6c83a1d3da
SHA5127157640627c2208e38ea96be8fd5c4c09adebbc4e4ef51436b45b4a3838103fc7d024ec6e8b97b5f0fcc56bba8e80ef9e689c66c7c40376162df32fd5adaa52f
-
Filesize
2KB
MD51f95985c5474234a1912c0d568b8485b
SHA1d4a8966261743bff59bf943e73eac649023ad2ae
SHA25602548a98e7068669d41bd34fed7178e2aaf0b7d5f1ad13157d47ad7a80a7cd44
SHA51272d1688cc2e0edf872d61f9ccb5e8d68cf72c823c46b38a43f5e200b9584b67e39317a795c2d4567d9caa36d5fcf23e74db10f0af50768034f239b1762b0962b
-
Filesize
3KB
MD5e51913e61fc451c0bdd43a3804e93fe8
SHA14623a595cd3964c492cdf14112513e3646701435
SHA2566b9fc7606f399cd79bcd73315aa6716309f3d6afadc26fc9b6789391cb1dc88c
SHA5124ce05ee4837555fd0857099f62e71914646c71e543a62d1bc7f17ead813d6e54ef1f09623f4e91d9cf5b057fc5d1487d3cc1c6b044a05cb36e04b520f76c0b8d
-
Filesize
3KB
MD5dbf32c08fed9b32ab092b70d1713af19
SHA1fcd74325d25f6e18be2e7ebcd2865b0810dfcae0
SHA2564ba5e6bb9b1b44e9bb729d264e88a8ae81e281de8c7fd2120aff66363cf37853
SHA5121607316a927cce9e78b0b68f5f9b0753ebadd02bf40718b6620b925c57fd847fc33ed8d0fed9f76f897f41edf88a2e847f016377917a82eb20f312d215841fd9
-
Filesize
3KB
MD54ed68ed385ca55b6516a6037e8523862
SHA1adcb1a2175ba4f602ea331eea8d24bc2c339314b
SHA256a65720674f63e3c6efea358a807ef6d0d3f8a678c225285e6e4e304056755583
SHA51290a38f770549d7f632e95b7cc4e9b6ddfbeebc5324a30ccf429cb6054060ae2ddf1ea7b346c6bf62ab0e39ac69d63bc96d9d7a22b1dbfb4777c1f3692e7313b4
-
Filesize
5KB
MD5790c4791d33983a784d043bf553ebc5b
SHA190ffb087f115b0a53da92590da7eb8f0588a3009
SHA25665337969d3e802ab62d27017911f5d2ffb3348093389ae3b47180de271f7218d
SHA51213cdcbf96a2b61023c3004aafdcdec0d3c5b62146ca992a07bd4ec946328c0a857677b1f79f65bd98a6d60d3b6098c0b9eb4e40a07d94c86435c2fd8c1e9e44b
-
Filesize
7KB
MD5832061553ecdf197aa184c43efc7ee95
SHA1036b20526f9f1cea7c8b33f9fd02f96f30aa8473
SHA256bf8886a34a150cdf276cc097df79fb8c879f7672b53a7a939eae8f26d3094a2a
SHA5128625dd0141eac4bfa1d63d5f9e5750ef2a6b15a8c482692f568ba5dd94e2ee3de192c3e1c39d6290da2fe7a81f1bc160d30f18082ec09d3908d303dad9a8634f
-
Filesize
7KB
MD52074e806fb53e382ed581f91121fa5db
SHA11c340e22cf5d0a3a655d2107c75730c2100cf687
SHA256a6b66ba79e1161eeba6008d31f5c7e7eb016671d480c7cca6336dbfdfb31a3de
SHA512a0203bc8fe478cb4e1f9c37d0d9128c9b944feed707c05dff9ddfbf0de81dcd7e8731b42455dbb96907b52c81cb08548053d43c045fc5c61a6d82ffe8fa38be7
-
Filesize
7KB
MD5d47100b720c696436ddf0225fafaeac6
SHA177ee6ec8add3ece57454461250b301149f97da11
SHA2567e083a39f233d3cd11d79f1943b12e35ed94c2eeb90f7362096e264fe2355b48
SHA51265d44dfe0c3734ef01020b332f2b386bdeda5f05566b7ddf011835c61773cf2201ee44fd3a82cff3fa810ca7e062425264086de37318820600c4ba47590d80f8
-
Filesize
7KB
MD5c907e2a018387c594ceb8c5db665d269
SHA1a177df1a5b6be888f7b36440b9fc3e2662317011
SHA2566e038cb5b780af9c8d8e4ff57790ab9f83c98fc65c5429e9dd78d8f346f01e7c
SHA5128303e88b5cba8e84b33c54812b9c0cce36f53d02ad27d3b52c839cc954be29004c7bd67708ab292fd7182c4de5d24f3dc66b89c745e0c9e4786997e8a631a126
-
Filesize
7KB
MD5074b4fd834dfa6961b1015e9ff278199
SHA16a9766c057d121972291198e37fe5a00d9561a9d
SHA25698be023616d736fa671b254d0157b3dff71265b53ec74471e8c4c86b1ef982d6
SHA51229fe35dbc9b7362099475bb70878444e3214dd17d1b237993375484f526d7fb09168bb7a8287cd89082b9dac839116fe0a699cc1c14bc6df3d853a2a72692246
-
Filesize
7KB
MD524252229f51062394cce0e5d1776f0f1
SHA1f0779adc78bc17186d878f731745bd1eed3c8977
SHA2565af82396ae829c9f8e62900276050193ad3f748ebdee5b23cb18cc4919c65ca7
SHA51202cac5943794b62173ff569145116c0fe7154f8394e72d8dfab9ae37fbfaadbbf5852c9ae344266fcfa2867c966e5b93bd197a2e787dce44c1b6bec21d955eb1
-
Filesize
7KB
MD538c80af7dfbcaeb777edac380b4ee0bd
SHA1df2dea8c7096aa9626574b2ba60a1144dd7fbb41
SHA25637ec23de23a24faf84dc58975e1c71822cbc16e7e9fe9e37ecaac36e35c555cd
SHA512816015639dffdd56c8c48bc01670b18f6bd636bc1a2b49aa6678feb0286979bdd3725f144453e28d191398c00f80dbfd1e127b28fc9e65cd191f03098c3112fb
-
Filesize
7KB
MD50e56cf95814c6fb5edc79db91a118718
SHA1484d48bea5386e6170c108f130cb94f70829eddf
SHA256e5daf8130ea7f815b9bf1a318aa81400e25b682feec5fa7e3bc087eb21e4f7ce
SHA51279f9ea25bcdb1c154dc19be021bf807f01f44e5c25b11e2fff66d17d2514470e15528e8da059977de52d6fb5dae155c1cc121ef5156d0262844dd4593392c4fa
-
Filesize
3KB
MD5310197cf8b62cacafa9998d915059205
SHA17d572aa2562502114a2aaa8207da2e6817df8e06
SHA256dbddc50b8698b8837c916799b3ac2a13658719f227920eabe9146f79167fca6c
SHA512a8143b202d4c6c8acd0466fd1de2f686f2781d604326ed15453d1ebd494b41b0d73f86eeec6155687088c4b917753a656ccb916f971ce9cba5a314444ff226be
-
Filesize
3KB
MD5b483e1acc1bea61193053acc8d418c16
SHA1d8ca459d2aa4f31a27eafdb485507a268fa5c06e
SHA256bfe5b509c94e3f33d6c22181206acfc213a125d010a5b5dbd9c135f657c83f14
SHA512753abdfee3167c4fd6682d2f86afbefacd5e7ebbf3b0ebea947859d295febd2c1b69a35166658bb8da2a9ac11765816499db14deee15c72ab5b221c16c92599f
-
Filesize
3KB
MD54cb3edb9ae8e87345dfad50712b2cd62
SHA12211f9a0029e1d16b5dda2f1ddb2546f573b1c5a
SHA256baffa56d1f3c9e4e0914783daecf2ff63aa087ce19bfb5e8bef0b80be390aefb
SHA512e6788384d4b52b46ebba30dc12ce1ebafe1ec32c8a4f725bdff3e75d18beac7b9467398934e9c1cc90708e7d70e4b2477da2b771c523aa1a7e140d1ec160339d
-
Filesize
7KB
MD598c2ee4c823c119f1697b946c6ee2de8
SHA1c1c86c9e75497a68e87962cc45fd01a0366daa19
SHA25668f802d2017c796ad6cb4171e5827877e2d257b7ece1b38bc80cd547fd324397
SHA512429a7b0c358a9ea7f4f2cd618b16c094b7475adcac4c3d60bab6b503d0312ba11ba0b39136d0aae3b4ea0a1719a00756e244ad75eaa0432b60af5480e28a4a6e
-
Filesize
7KB
MD50bafd45f81949f5eb362214a37ac4632
SHA11051e8bbadc793aff2f0a185549b28b99482161a
SHA256a4962f096918e72eed8332d0704fd70610efd9fd3cf0e242d3127e2c79d71e9a
SHA51265f1794d4a8e507a714cc53f565aedcd80b74911900b9be7eed40d4c773e4b4e00f9d4418868d722e963e3d72859525ca3050b581648a8c82fa08b6f1dc84129
-
Filesize
5KB
MD5010ac063a795d94853268e25c3eae71a
SHA1a2f5ba2419f9190f263a8735312674b83990a660
SHA256c9a459a7e6fec448d0af4866a957e5ed0719881a005bc0d86606678d41615774
SHA512bdd760de70653ac8d9822cc58d4076561e2dc71b05ba667f677f7afc57a5a428fc92f349dbcf7e81820efbf91740de459d0ee49d0a816d00d416036c8df2c6d7
-
Filesize
7KB
MD563a8d0abf18e2f379402e0a2b960c3de
SHA102e04490ac5f2b0ea0ba10a8f9973096bc49bdb8
SHA25670c577e638c9b1e441fbddd23feef122380fbacb119287200fcc4a68d22fb1d1
SHA512f7ca3a47f32135f8eac221b47a6ee4a5f20a5b123b9d020b6a19d3e38f2a9183eb163d83556941a932e312e99e9b65c402f7893fb740502288d5a3f510f0fd63
-
Filesize
7KB
MD56f406b9aed6d2b61d2d2bdbb6bd786d0
SHA1f34ec8c6e6c1b263d9fb9a0054e8080b85100d2a
SHA256ee67cffec3cfcc509fb62e3db0f525830f8aeaf7a911847dadbe27a29ffeaef3
SHA51246eb5694c7cb9ca407e00c0e02732b51275a70b4b35d07ebb41e7cae9cb2ab1494075aa6f3d4006d2d3656cadc88b35e5ae7442818ad78cb5a815911027caba7
-
Filesize
7KB
MD5ea61e4fec3067c3ba973fdc69bf3ec8d
SHA1294342cd640ea32e1e1e6a3c35ce6ea1f21cc194
SHA256a2c6e85baaed171dcbd69c619e70ca7030c6a8cd3b25f96340dce913e67bdbf0
SHA512844a1e98b0d2075a8e0bbe5ca5839ab48fb111bee845caecc23308661ab010df9c73c370e6479d38bf2b5b4c614cd3d031da6ed8edd072aa5968fef1da29be1d
-
Filesize
7KB
MD59b93460f96292b6d7380868571afcada
SHA183a812d6bf77642fced73c4efea5ff250e0421b8
SHA2569c2a3e1a73c3af843f2710d195faa52da4cbf1bfb56d6af0e65dcdbf1e112b39
SHA5124f3741a04aa07f9f6f4f7129639d29876c0021d23c29c1caed8063dd9d9057dc839c0b3e97a664aca5d9979ac812ef2528d6acd785fc77ed55a5d5a19df89b73
-
Filesize
7KB
MD58d7b41bf60a7d22d15d1351ee4b7d711
SHA17b6cb4868fec52586269817ee170fe54a6de829a
SHA256ea98b8b5045071f087ee9efb0d06eba022d0dae4452fc45bd31ec5411c47c22d
SHA5125b7ed4f1bf33888d9f90913edebceb7cce90072bbea6c40160144c31b5b7bcf89f103c2208aab0bd6b561eac351515382d9838b0718d8efc79eaf610170c3b5c
-
Filesize
7KB
MD583859a57d8f1d463dae85693965f6dbb
SHA15c6fbc5ac3fb9536d4b8b80bef654291d0bb3e0c
SHA2566881f416ea6900cd59e39162ebe6b4592972e3ee8d79f415cdfbe58faf83d230
SHA5120011abe258a8181737b41d17a14b0c8d03844afe9711864d4e37dfba8624d63edbce58a3ae2fca6e7896417d8bc94cb5901e6846e957afb7af09735acab8cb72
-
Filesize
7KB
MD51b31ad8a74379e5476c2da21679376e3
SHA146e22829eeac0e92eced0800a8fe0f846a38f250
SHA256cb8a5a3fe427487981ca530f85c9a4f4e7260c191e00aab3407b502c95a72908
SHA512d2e07907d2538d967d4cc87e0209e3addb7c1bbdf3e9830721fcf71abde94bf02ab824bfdd51f4ce815b9aa8008340fcc0641d213890e07b2d79f4a5a9dff648
-
Filesize
7KB
MD5a1c4a946476ba426a3ea554017e41cdf
SHA1c75dbf396a2972d966c844b1ccb3c6f8e960c842
SHA25625e2fa949d262a24bb3126a04ea12856f80dcdd676681ea5fa12498fc1cb8834
SHA512d924c81ac7eee885872432680eaf9b9077e34c5ee55f66ad6328b6863f146f00829aced92545df96f8d4cfa7c6ea6e28afe46c8791d98e3a407e555536b8908e
-
Filesize
7KB
MD5f65d308e44a482044c2f23f5ab19494d
SHA19fbf16333dff9e2515966df0eb2401f68e6f2641
SHA256100328df969a841f36775d1ab166db03607504119e46c93c8b449ec430a26658
SHA51280b7244809b7d51a271f2982810e39e4ea7d7dd349914ac406adf22293d906ae580534c881d06e4426a021bfddcee93b463c256510fc2aa24ecfcfcdfcc3405f
-
Filesize
7KB
MD5766c54df392b0ad4bf6f8c8fbee07ad5
SHA1795bb579fcf6db075e4a35865b3620a672900640
SHA25630a5a040c8c19cd20b5e4949f2b7616b71739e04de467b1d5df8a97ceb54f66d
SHA5126d3e377aa54583da4d8fd75dfc1338940641828b983cfe52a21590259292036197d0403692dd17b42d90c8b2a68d4dd9cdc46c7201eabc9f4c07a19a76664cc3
-
Filesize
1KB
MD57654214586809779b9ed84afe5906e91
SHA16b913734694c7f8f217bb3e2fa020a2580f1c545
SHA256e661f0c98f91283da43c5a9382b520e83144f232663dc9d91edee645c24a7078
SHA512a7761a78dd13d695bd192cc1774527b10a27c32464bc6ec245a5559cf33a1ec7e6667e9d582c1ad3e79e37207b80a2a64eeb5e94cb201fc3fd12443c1f7c611c
-
Filesize
3KB
MD5165572db986ad7142ac639e845c5bff4
SHA142edd68dcc820571c6ce8c9b372ec9e18781205b
SHA2560111b80ef2ad52830032790dbf5d2e9a3b5f0faa3e0413d353adadd1cdf54275
SHA5126a98647b16571afd8d563d0ca5c91d505076675bc5ca49285aebcaec9e5e5967135c5dd98e42a64ea8599d8bf6a429cd092d973b85ab240aa83948ab84a2a88d
-
Filesize
3KB
MD5beb1db6160d4b2cdb9c5c90f58b64832
SHA1ccc66ae890b6e7c72a40fb9bc0f7ca7bb46ff407
SHA256363b0547073e2708f39ca978ebce871c8b21b57b9e7019d185321fc84f4854d7
SHA5121f6063fab30bc918aaf595b3b8be7394cd6b8eac04ccf3599d223c278001214f77b9ddd176b519a69ec875cfeffd4f64119ff065f527db8290233cb7c39360ba
-
Filesize
3KB
MD5c5192f96e4f9cd7e66490a9560038ca4
SHA1867f9a98fa317e9deff091e381f9721a9c4f7508
SHA2564d14ed39a7f19e463c828d93d76550b3f720104581ad471a49627b8fa57b5d7a
SHA5128c1f7332b914a3c262b84353f3efc68a7d44c60bac37b8c787b09b7e4f23a1a005a9a4e9e979ea87abc87e1634b683ba838cd94d1ffeeedd46f9ee15bcce7913
-
Filesize
7KB
MD5e0f6939fcf389f93191c27c34c6b77b7
SHA15781adde78e6ef7b38d8c12463c3bd5bcf9022ef
SHA256175ba71ce34e1e0bb39e937a6050650bc73fa469272120aab9733efc1c586209
SHA51294e5a4970b80ee71d08e9de3677ff10e9bb13920bef3b7a6571d76fb6c3bae2222229dfdbc5a101186807b503085c8884be8d1fb28627d879745078fceef6f80
-
Filesize
7KB
MD5aaa72506c0d268942e5e4d296b8c69d4
SHA127ebb98f3f3f94d695ce84132407f3fc392dadd5
SHA256b647e1280817ca4f6df78dd73d5a281f3d7c48fdd879d7852bb2c10fadb6d36f
SHA512e47b53ccfcf759148582c3b73297fcc4e6513dd6f06ad2b7b209af5d71ab2c109985ae97f27540812da915e59ac5b4402ffa8bfcf14eb2413bddf2d907bd5641
-
Filesize
7KB
MD50d87a76e15ed38257159c39f8a8a03e5
SHA1db280f6ecdd8bb7158675647e1bd05e162811b61
SHA25621dff4dc701d0ae591ab10f254b4b6ad15b010dc210398783ea96dde41756fd1
SHA512fbcd4ed48c07a8cc1688a84a0ee7adb99285fa937bd046a2eb6e11c4ade7e637af6c135025749769a52f21fddffd0f883c0a522ed373bafe5bcd503962f54c14
-
Filesize
7KB
MD5226bb3c2ed237facd063538c4b3e7439
SHA19ec3c682fadaf72477295a099f9b2f16e58808ca
SHA256c9e101490b3263b15c4c569b9a74b055fff285dd381768922bc77818f17a60fe
SHA51201d7e260dd0d516ed57f877eb9df9eb1a2de33b84db27e9b3650d481433006381c5298d72f750b083b1c9d428bce610385657422741be318a81283e98d1aed87
-
Filesize
7KB
MD5b19a52be7ef3107b7943e8d9ab378206
SHA16e2999be9618ab699ff1a7f7e1ae8874be51865f
SHA2560f8f4dc0f8bc15b4c4b09c29faf2259e01eeebf3f29cb944c146135a2b5938f2
SHA512465560ea4cee81ca2e316f8c538c2db71900f12546ee8ca3c74b4f3eb078bcd530262471e75549c8044fa434cf2de3fab933711678e25f6401c7e835cc9b64e9
-
Filesize
7KB
MD53e420fbd915011203b022f6771a38a1f
SHA16ce59b61aa303c3f6318d1a040dac21459387d26
SHA256720a60ec9fba53319d3b7d56d3115789499e75647e9807af4d6252ff65c6b89c
SHA512d12e429cfa5eb4bdb24e5209f064f97a7096d8a1afece8e4d359360722bd9793b7c324035d09e958c244733fbf2a57d3eec24e9198060907ece6cbef0cdbed51
-
Filesize
3KB
MD505472b53e41953733c33e140cb443c39
SHA1345bae2620cafe08a75725be6d0cb2669fd35412
SHA256559e0adcb79b998c93e347e74e8c6f249afe680a1b6841bf9745a1291c08db3d
SHA5124c2e066c6428cd70269ee5d82431793fe269b7db4348f699f388fb2b528aa127a231469d43431518cf40cf3c5b716461db7aaf7f6bc8599733f875a7274a0223
-
Filesize
3KB
MD5cc4197571f174fc6d0a6ddaeab2e9d68
SHA1d125a3bd4b31d73457978ff3a8db43ce017389ce
SHA256dccc38836e8d15e1000e9e48b9cf7152e3880902616bcf8404acf70e359c5e69
SHA512d3cc03de047f81ecc35c0fe5a2a34151698472c4f4e5d0f80d687360530490e26f58c7029251ca5a7dad252f21b9295409b87d505cf5bdd6c18013b8fe340bfd
-
Filesize
7KB
MD5a079c5450a991579e93e5ecbbb1d2ea8
SHA10bb8fe8f094207506b3bc84871f8f597ae0aa5fa
SHA2566e69f93cfe85e161c3dc80da88265e7593d0eef83ffd23d20e917966ecfa8516
SHA5120d4acb6650ddac984a655ec9cef4537c1bd382d0dd9bf5a2a91a4b9e63c256f2314dbd75627a77d116ff84d810afda36698ec6f64ecdfdfdfd0fd87f99bfaeb3
-
Filesize
7KB
MD5b18d56ae72b11c47ce415e4dde1087f7
SHA1eaf9145da31e372f443f64ebf7cebf8e9961f18c
SHA2562357193eae152471dc5e1b89d5073181bce5b44a3497e7764980af490df33d79
SHA5122657089e3214fe6164e2f32e2f44ed369b668e6c6271612d4d3f85af55d9ba32cc7d8ac90b59a7f721b0f7584027f26ad090070ce313b3e663cb79b4858296ff
-
Filesize
3KB
MD5e3aece0516f64ffb30d9aa8c50f3464f
SHA12193d9e080fd0e633d3d659339b61d6448153f32
SHA256e8ee9daaaa93c81a061676d36637f06d178d80d72f8cdfed25b888af01dfe4e0
SHA512f7b5c45409318e36b4141504359c3a29ce15f126c4e6248a7a85ed0cfd4e8f01299c13271663ce587d40ce05536b5430a65309d3f1c13446fce776edca115ee9
-
Filesize
7KB
MD5fb646c1904372ffd9e3e8f3ce0bd741a
SHA17572af7d8c42435f37691d39649566dcefac122c
SHA256a198ed6aa9d4bbc8524602801082f1f1f299b2445fd545663cf87df9d7355d08
SHA5127ddb27b855d2a3cbb23e739863e6ec7dbf6d0448211a88e1b7115c850e02c85694f29b9446e7a634e28f63ef31ffee01435e94d1c9f5bf1f27b6207ec600b40c
-
Filesize
7KB
MD58b3fe0f1d2797dfa105afb732c72a79d
SHA178fa79ea85de24fc93ee4703b48d77f4d029c9ae
SHA25613b897ad8582a8ac74c63bea0e881e71f302e8515bd34043790439430d37912a
SHA512e58494f9516918a808f978304e6cff19b947f6bf324eb0e094cbc9ba79770593399dea538cfdf37a508c35dc84e6856971eab1ce10bf3ae3e18a22e401724832
-
Filesize
5KB
MD5de431e1a985411ba2f087a0461788c71
SHA1afa16900480244c51d1bb8bb52372ac1708adc3a
SHA2565dc8ed859c91c4a5de292f940eee5bb963578762f3c3317de1f2fcf2240ff572
SHA512cf6a81e26061f99844a80454b40ace009af1a84f7d79b18ec6257be62ccaf9d790ef7d67009387c49a1d79ed80b633a2cab3902501640665825790898d0b205f
-
Filesize
7KB
MD5b015bbd47ea5bc06f1e1ee64cb1bb070
SHA128ed0b1f964bb16e81cbbbafbc7b152e300f6775
SHA256c08a595e4ce1514c99b99003645f6bf0eb49e8cf95613cd2b85f743e7f5f066c
SHA512c96bf9698b1513ad54a305c2a5c322ceafca5574c961685afad3a4df4ccdbe57e22cbacbbf48e7c174399fd320deff7678595fb8d9ba5b5dfc93f2c6d2132252
-
Filesize
7KB
MD53a2072ac98e4e3bc5da642aea7861758
SHA16e51847898d4300cbc9b535a6ae73435624ebea4
SHA256a87ad7f9e4a6633a6b9e1731961bbce477f3ce8244894561cfa418d73787673b
SHA512496830deae94427c7b48ad5c658203fb88c5f87ebb24b1ca5d07cc2bb0de49818247c8f3c58233beba8d999baed0a218989edb01a9c5c73dadf0c04381dc2da9
-
Filesize
7KB
MD5bbd15f81d9ebf6b7b1ef410adbd21521
SHA1e08c7f26d6b894338edd86ccf7ac1931a23993c1
SHA256390ae9cef8120d1f6eb4c4d50ff6fe36719524175f24560b16c0ff9ca830ed9b
SHA512dc40746b1a363975efd92bb185172ef1a01bccbb5b7268126a7855b9a8c345933fe3568cf4d3767f7700c5b2330aea6b6f65e6906971b8756a9bef30004d61e9
-
Filesize
7KB
MD50d1fb69d093efa4a4ff0906f3a23dc35
SHA1fafe63cbf1edab5762914e336df51102e23290b6
SHA25632dc375d9b11bdedf320eee59936e902689c86fb26d7a1a537e21bab66bb2a78
SHA51216c6df714d35e129a8a4bbfbcec564d61ededbca4c2ace9d2d6fe268dbd5093844381c6cfedb7b5957ec604cba4b4b925f9bc29f1d6a4a5de99447ef9b2015fb
-
Filesize
7KB
MD5d2c49a83217b97450a04b46c6f1bb537
SHA1f76bf39f1500fb7920f2d8be5b8013ea8ac2627c
SHA25681dd9515e64242ceffa179fa69e5037560820cc34497c97ad76479c439e2cc2b
SHA512728aebed1036e0868a17488a8cf67fe501228cfd2763a2b3983075a9e44860f25f19dd40be24695f3ad81b3a3fb2fe3ee5d016bb6640ccfb7b38564488655154
-
Filesize
3KB
MD5b0e54b95091798523e0a99051b98a1c3
SHA14137c4a43bddf3f568865de27ea057c1a51f93b9
SHA2569dde4148994fe18b67549f78e8e7c7416c8691c7f93af48f9f6413c3c9993400
SHA5121dd78f230d2d87cb6bb04c8706573901d4c913d0d858a00f28ab7592fffc3496007d99368928e6d2b9350cb3fcaad88a5dd2b214dfd13a2ad9e72a0afee18c6d
-
Filesize
204B
MD56c9eada7d7654d7b94d4c7bb8ba5f130
SHA1966682727eb429dbe83be7e64a15f3f24d642814
SHA2567740f64b96e8d03c746705dd7b2151ccc0528da591f23441df0a54c0f7f748a7
SHA512ff18cb5a5a9375cd655970053430be4871a8b7bc45354cf3afd234718947fd860283e4e3a9c2e86142c40c07a6566a7fb7cc7fb26bdc04066aebe214ba9c1ed4
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5cedc00dd34d126148218f60ae7bd3765
SHA12a928285f82d62b74c6c678b61490cc17a5ca8a6
SHA256185036e5c0240daa73934fa6c25039e67495ee3a18b9ba055ddd417aa44a6cda
SHA5128ffa7ea5707e30b87e2d8dc050c90ba8cacc30061faa226918dc0fc574a3c3280553ea5934e253970195b5e5a9f2cba49f5d012e161adf0d7ae3b01d19071f05
-
Filesize
10KB
MD553ac494a342a1f31f0ef1ac9a9eedd43
SHA11d4b3b10ec1015a8f18f53bd03923f92148972ff
SHA2561a87f127fd96deb79bd6171cc2306340fb565dcfd537f3911bfb059d684f4110
SHA512a0c90b9373591a5eb268a9221540058d528eceb2f394364c655a43d015245d5eef381ee60aa6d3e561bd9dbaab549e3968541bacae1e6852c987bb49053c66fa
-
Filesize
11KB
MD5b46ffd4f32078f9dcc453cc47b86c150
SHA197674826467b28acb80acbeed28faea997241557
SHA2565d4bfec3789617e403058a3fd3efc08d6e9144e97457570d66dda05b7018672d
SHA512dc1f2e6365707f1843fbad13bca19657a6488c8e8df53817aeb77649154a4a8cf48e8601bb39b652f2bbbfada8138d42b5125b73d456cbcaf9e11bcb1f08e8c4
-
Filesize
11KB
MD54bce0634389d8e18e2c0b8b3e607d663
SHA171c124df2fcbf1bf02e2d5b4c5ee6daeac535985
SHA256e2d76df1309070d510461a8871082c767cb30a65303c259551d57b8cf4314402
SHA512b73da4c8198a01f436ec6dcc2cda8f7ce2d8c49ba63d44fd70a1178d9f08fff85f9cd9f7a9e04b851aea07613db7854c5ffbe293a15e3fddc91ee5d0beafcf44
-
Filesize
11KB
MD527c586a6fedb6fe35cb169e8e5c3b8fb
SHA150ef53f8c3e177c4704a752d6bab554e9bc8ad99
SHA2565a3b80a9d8272fcbe2cebae1b3cfd643c22a8e484fe77ec352fdc79a743eb67b
SHA5123fe2443f917c72ee3f008c7957c2e7889269520bb73d13f0faa1ed5923fd0ba6b06fd7d10f3148635f49fb1813e46a94bb3dd583307b5bec3032504d672ab5ab
-
Filesize
11KB
MD52f4a87be9212ae976de323aa0585b847
SHA1eb89f586419a46638af0fcaddb564fc6b968a664
SHA2565595399b640aea9ed91c43af04de8593fe5e7914c54e4664eec142b3c5dd6339
SHA512888eecc2e84265434121624af9ea0bf6528d13d28e11d621f32b2857969f4974533ae71a323ecd72d4e81f93360a5d1159eaa9c3511c6751a18e43b5950d49e3
-
Filesize
11KB
MD5b60116342dcb9b2cf50f5d859b8b1139
SHA159c715214d3bd711842ae736669b30cf3e95b149
SHA256b78d14011d7add2c8b342da70b25ec2c0b92e8f07cd985f9533ecf4dbf171ff6
SHA5124867c3301b63b598486101bf82428383504205f1fe9a2b9025d715ad7ae960e7e8d881f2d587c3bb5b6afb9c193906ff877b933228faa22d38e283bcfe9eb4a6
-
Filesize
2.8MB
MD51f115db2c8fbf1277d99cbf034970e76
SHA13585f6588901cb7748160e119f115ca8487f59b4
SHA2563153a57a4570da271b8f861c8494052cce84fca545d0a3fd911f604ae629c6ee
SHA512e5e4b19b63f0473844d0e6a25dcd689b0ce22f358a7db51defe5866c30f7f4c2e78b42309bc51a35bfd4be44defb570fbb82994a7a4783189aa1b55711bd5c18
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402141758491\additional_file0.tmp
Filesize318KB
MD5d24f60d26974b9534825e6b1829fd08f
SHA17f8558578d566a9be1134e15db44b25392a66f7d
SHA256cfe8dec37fa4012594f3f36ec0c22488154d60636d08750ce96a2eedab7a83d2
SHA512ab0a14c8d176b73867cd95060154d51e5ec7d20fd75a045f93b74ba98d952807cabd4fd222183a8789d70b91d6a49635d8d954d6dfaaeaecc29aae7f8e7dd138
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402141758491\opera_package
Filesize10.2MB
MD5df2d44fb51500d88388815aa40463551
SHA191dc7f147b1bf4a13c3ab0ac7fbbd07ca901f94b
SHA25687899fc79beaadf83ffeb650253daecf11f3a60d35f27f5f5d99fb26d12fced2
SHA51215a098264f7ac6f9993d30e4558353b7968e040a9a1d1ddf1d2ebc49b48035357b9f03ffb0e2c5c4375056c119675a5e678e08a496a49641dc7407d16cbf1581
-
Filesize
57KB
MD56e001f8d0ee4f09a6673a9e8168836b6
SHA1334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38
SHA2566a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859
SHA5120eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6
-
Filesize
117KB
MD508112f27dcd8f1d779231a7a3e944cb1
SHA139a98a95feb1b6295ad762e22aa47854f57c226f
SHA25611c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa
SHA512afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb
-
Filesize
576KB
MD59015cdc83c2d0d384271bf72cc68d80f
SHA17679743734295cbc110d71b2496f109bec984906
SHA256cafdaf62965810c02f9caeb795d24a5a0b289f3794adae43c82f7f7f114ddac1
SHA5123cc103717f66826da9e0665894dcaed763a9c529609030a02ecd8686d6ea0097b7da404cea9e71f8739797f2382dd7b4e5d943f9d8e2b1fd5256ecab90439699
-
Filesize
15KB
MD5422be1a0c08185b107050fcf32f8fa40
SHA1c8746a8dad7b4bf18380207b0c7c848362567a92
SHA256723aea78755292d2f4f87ad100a99b37bef951b6b40b62e2e2bbd4df3346d528
SHA512dff51c890cb395665839070d37170d321dc0800981a42f173c6ea570684460146b4936af9d8567a6089bef3a7802ac4931c14031827689ef345ea384ceb47599
-
Filesize
75KB
MD5c06ac6dcfa7780cd781fc9af269e33c0
SHA1f6b69337b369df50427f6d5968eb75b6283c199d
SHA256b23b8310265c14d7e530b80defc6d39cdc638c07d07cd2668e387863c463741d
SHA512ad167ad62913243e97efaeaa7bad38714aba7fc11f48001974d4f9c68615e9bdfb83bf623388008e77d61cee0eaba55ce47ebbb1f378d89067e74a05a11d9fe3
-
Filesize
19KB
MD5554c3e1d68c8b5d04ca7a2264ca44e71
SHA1ef749e325f52179e6875e9b2dd397bee2ca41bb4
SHA2561eb0795b1928f6b0459199dace5affdc0842b6fba87be53ca108661275df2f3e
SHA51258ce13c47e0daf99d66af1ea35984344c0bb11ba70fe92bc4ffa4cd6799d6f13bcad652b6883c0e32c6e155e9c1b020319c90da87cb0830f963639d53a51f9c6
-
Filesize
160KB
MD56df226bda27d26ce4523b80dbf57a9ea
SHA1615f9aba84856026460dc54b581711dad63da469
SHA25617d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc
SHA512988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5
-
Filesize
119KB
MD59d2c520bfa294a6aa0c5cbc6d87caeec
SHA120b390db533153e4bf84f3d17225384b924b391f
SHA256669c812cb8f09799083014a199b0deee10237c95fb49ee107376b952fee5bd89
SHA5127e2e569549edb6ddd2b0cb0012386aed1f069e35d1f3045bb57704ef17b97129deb7cde8e23bc49980e908e1a5a90b739f68f36a1d231b1302a5d29b722e7c15
-
Filesize
8KB
MD5be4c2b0862d2fc399c393fca163094df
SHA17c03c84b2871c27fa0f1914825e504a090c2a550
SHA256c202e4f92b792d34cb6859361aebdbfc8c61cf9e735edfd95e825839920fb88a
SHA512d9c531687a5051bbfe5050c5088623b3fd5f20b1e53dd4d3ed281c8769c15f45da36620231f6d0d76f8e2aa7de00c2324a4bf35a815cefc70ca97bc4ab253799
-
Filesize
154KB
MD517220f65bd242b6a491423d5bb7940c1
SHA1a33fabf2b788e80f0f7f84524fe3ed9b797be7ad
SHA25623056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f
SHA512bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e
-
Filesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
Filesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
Filesize
256KB
MD582fdc4008311c016338fbb387b182536
SHA14356c2a3861926e3f6d5f359a6e3c7d7e5b3c519
SHA256bbb786d2a7bb6e72b9924a24fcdac3d1c6eba330938d7a13b444fbf9d7ca0255
SHA5122228ce2db37391d793571f0924bdefe6fe2a11bbc02df879de56b9d9bb2d7ed03592dc1f69347b785140a40a96a5335b27c21b4004c00771070724ae0ea2bce4
-
Filesize
133KB
MD58db691813a26e7d0f1db5e2f4d0d05e3
SHA17c7a33553dd0b50b78bf0ca6974c77088da253eb
SHA2563043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701
SHA512d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f
-
Filesize
26KB
MD5cef027c3341afbcdb83c72080df7f002
SHA1e538f1dd4aee8544d888a616a6ebe4aeecaf1661
SHA256e87db511aa5b8144905cd24d9b425f0d9a7037fface3ca7824b7e23cfddbbbb7
SHA51271ba423c761064937569922f1d1381bd11d23d1d2ed207fc0fead19e9111c1970f2a69b66e0d8a74497277ffc36e0fc119db146b5fd068f4a6b794dc54c5d4bf
-
Filesize
172KB
MD5b199dcd6824a02522a4d29a69ab65058
SHA1f9c7f8c5c6543b80fa6f1940402430b37fa8dce4
SHA2569310a58f26be8bd453cde5ca6aa05042942832711fbdeb5430a2840232bfa5e4
SHA5121d3e85e13ff24640c76848981ca84bafb32f819a082e390cb06fe13445814f50f8e3fc3a8a8e962aae8867e199c1517d570c07f28d5f7e5f007b2bb6e664ddb1
-
Filesize
1KB
MD59ba0a91b564e22c876e58a8a5921b528
SHA18eb23cab5effc0d0df63120a4dbad3cffcac6f1e
SHA2562ad742b544e72c245f4e9c2e69f989486222477c7eb06e85d28492bd93040941
SHA51238b5fb0f12887a619facce82779cb66e2592e5922d883b9dc4d5f9d2cb12e0f84324422cd881c948f430575febd510e948a22cd291595e3a0ba0307fce73bec9
-
Filesize
16KB
MD52b26f73d382ab69f3914a7d9fda97b0f
SHA1a3f5ad928d4bec107ae2941fa6b23c69d19eedd0
SHA256a6a0b05b1d5c52303dd3e9e2f9cda1e688a490fbe84ea0d6e22a051ab6efd643
SHA512744ff7e91c8d1059f48de97dc816bc7cc0f1a41ea7b8b7e3382ff69bc283255dfdf7b46d708a062967a6c1f2e5138665be2943ed89d7543fc707e752543ac9a7
-
Filesize
5KB
MD5626313d8f4c859ba6473a8d94dfea5e7
SHA1142a57c5e31d7317b7d52b2d4435df53d4123663
SHA256989e5474b74fbdf5abe98b607870bb7f4757967c51412bc940ecab7dd9babd54
SHA512dbaefd7f7409839971ec87bc0e49fbc4992de9dd319e28bea401b35b0a7952e56281084b123b6bbeb06080706ada0ffabcd0cf2fb3f75986d34f844d8cd50de9
-
Filesize
291B
MD5bf5328e51e8ab1211c509b5a65ab9972
SHA1480dfb920e926d81bce67113576781815fbd1ea4
SHA25698f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b
SHA51292bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928
-
Filesize
10KB
MD51116d7747130f4552a91e61a3a6000b1
SHA1bc36996a664dab24b941ec263679c9d6322e61a2
SHA2565c09c6784f3fdc4a6b2998c4c9e02e366265ee5314c0f982859825576dc0eafd
SHA512af34413f242b64737ac9f7076e449b0d0485842d653d1cad12b54b868f09817d3595cd935ad7e03003d536127c173d624dd9a031c079fdb8f897ab0b7b9474e8
-
Filesize
1014B
MD5cef7a21acf607d44e160eac5a21bdf67
SHA1f24f674250a381d6bf09df16d00dbf617354d315
SHA25673ed0be73f408ab8f15f2da73c839f86fef46d0a269607330b28f9564fae73c7
SHA5125afb4609ef46f156155f7c1b5fed48fd178d7f3395f80fb3a4fb02f454a3f977d8a15f3ef8541af62df83426a3316d31e1b9e2fd77726cf866c75f6d4e7adc2f
-
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\TranslateOfferTemplate.tis
Filesize2KB
MD5551029a3e046c5ed6390cc85f632a689
SHA1b4bd706f753db6ba3c13551099d4eef55f65b057
SHA2567b8c76a85261c5f9e40e49f97e01a14320e9b224ff3d6af8286632ca94cf96f8
SHA51222a67a8371d2aa2fdbc840c8e5452c650cb161e71c39b49d868c66db8b4c47d3297cf83c711ec1d002bc3e3ae16b1e0e4faf2761954ce56c495827306bab677e
-
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\ViewStateLoader.tis
Filesize16KB
MD585c33c8207f5fcb2d31c7ce7322771ac
SHA16b64f919e6b731447b9add9221b3b7570de25061
SHA256940ef5e9f28da759fbf3676fba6da5cc4199b78ffc4fefe078ab11d53e70fb0a
SHA512904188ab57cfb4f3d8c51eb55746ae2589852f271b9fa3840b82bda93f69c9f985e65f67169302d08818b707f36246f83f245470d5175dba5f0ad3a2482740c4
-
Filesize
134KB
MD5105a9e404f7ac841c46380063cc27f50
SHA1ec27d9e1c3b546848324096283797a8644516ee3
SHA25669fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b
SHA5126990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940
-
Filesize
101KB
MD583d37fb4f754c7f4e41605ec3c8608ea
SHA170401de8ce89f809c6e601834d48768c0d65159f
SHA25656db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020
SHA512f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f
-
Filesize
151KB
MD572990c7e32ee6c811ea3d2ea64523234
SHA1a7fcbf83ec6eefb2235d40f51d0d6172d364b822
SHA256e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3
SHA5122908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682
-
Filesize
766B
MD54003efa6e7d44e2cbd3d7486e2e0451a
SHA1a2a9ab4a88cd4732647faa37bbdf726fd885ea1e
SHA256effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508
SHA51286e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198
-
Filesize
426KB
MD58ff1898897f3f4391803c7253366a87b
SHA19bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA25651398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03
-
Filesize
5.6MB
MD5b431083586e39d018e19880ad1a5ce8f
SHA13bbf957ab534d845d485a8698accc0a40b63cedd
SHA256b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b
SHA5127805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b
-
Filesize
74KB
MD51a84957b6e681fca057160cd04e26b27
SHA18d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA2569faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA5125f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
93KB
MD521d805663834f61cb443545b8883faf2
SHA1b222c5ca1e4cb8a7bff7eb7b78d46b8d99bf71e1
SHA256c18b46a68436d164c964ba9b208e5c27ccc50e6a5a2db115e8fb086663b5308f
SHA51237836150ef2837f69b82399024d0b93dbdac992971c7fe7b50959107c0520f5874d45f4230f08554514e3bd6a76d6e35c55c8afd53f993aba18f77475ef02001
-
Filesize
12KB
MD5792b6f86e296d3904285b2bf67ccd7e0
SHA1966b16f84697552747e0ddd19a4ba8ab5083af31
SHA256c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
SHA51297edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
-
Filesize
6KB
MD55aa38904acdcc21a2fb8a1d30a72d92f
SHA1a9ce7d1456698921791db91347dba0489918d70c
SHA25610675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
SHA512f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
-
Filesize
403KB
MD5d3850d9ef1d81d2ee2e0a1583e3292f8
SHA136a88c987ac8fff6d97f5eea9af5c7421f0496ae
SHA25647ee083861b20a03a751593073dfb533a0aa447833bfb190a73732c7efb2a2b2
SHA5123af395aeb470f4f5f26d2072811be2d15e90597ed40d5f1a6ab53e6b66f8a143785868db0476cbf129751cee2ae070ddad179848830e1215393c826101f9caac
-
Filesize
3.8MB
MD529d3a70cec060614e1691e64162a6c1e
SHA1ce4daf2b1d39a1a881635b393450e435bfb7f7d1
SHA256cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72
SHA51269d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize12KB
MD5256da67f702bb134262f9f2c6794eb5c
SHA137100b4f9b349299d8a54868f360ee7315e2423c
SHA256ea62d83c41b54460a4b8f2dab384262e6d98e8f3e1523fe0136ac57f34d65c33
SHA5127f06c81aac222fd10044395648cf3dd05cc778b8f430dc2e967f8d133ae678e79c443847a8d97c96e4f68569bba87b2e187562876bc06bc0b4eac5cc37734349
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize14KB
MD53211fd142bfc4a97087fa34728e9d007
SHA1dd03a3a801a06dbbd135f8ba50c21ff304bdb1cc
SHA2569546aced41693f61f7b21c12d3826441773a2ecbc35cfb3412edda94caf47ccf
SHA5125e5622ae94bd0d94f441000c404398548a5f1e4f5dabb5687bb254b6aed562ffef478297ca654856d56e650e7a63c9f5f9cdd97cfcebcf8f5afc869d65f7e0bd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize14KB
MD54f2d82900684d4e80ad189b3ef03a50e
SHA101049b0fef04ebc38eb5e674c89ffbb5692c2373
SHA256747a293f3fd83fab63e642ca87ab71f3f17e83bc82fa2fc384e02d214b00559c
SHA512b08d5ad184653b6cd60f14bd0319ec68b7324b527987134395203f3e8fcb1bc649ce03402cbb8c88c13b3acff02a70d322f5ff175b03d2361d2df53c93cc9f87
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize14KB
MD5f079eba94d4009702114fd97678c5edf
SHA10eb432120ae205c56aaf922877431d3495d9a702
SHA2568dd4a3cb49c76aef7fa199ec87ad9f43e0e609f66e60af4819606a40b9ad5f1d
SHA512f5892f300fe168a780cc43117474398d15e718f51cb438661c0ea384844e25a188047f7dbef150e2828881c4c79d1e6deed108c43c5d538aa545c9179d3d9bf0
-
Filesize
2.9MB
MD5b705173f1879bcb97ac8e5ce236866b2
SHA166893afcba9a10b0e6453bec55c60c5256001d85
SHA256f2455a08fec0d05c3e35528d364c173b1f90af87eef95824e374315979940eea
SHA512b908e24e01e6b15a93dcbe4f62ed5215e9fcc03436888457f1855833f135d320d73e7138caf413a8b65d406b56d69dc3c88834ff3c62b050ed98483d5073d6a5
-
Filesize
9.5MB
MD593d16508432c3ff3512eb9de584f48e6
SHA16ed9fd4d190afc6c5154730d85cf883fd3ad4d2e
SHA256be5357f63b036da79d198978cbc5b652ea02b1ccfcb1538352442cdc7f4d5549
SHA51208ad71f9b6b3a65cb22b6a65c8e44d4e004de2d10683dd89a8eac5af67127b126db301ca55e00740e7342c2896cf4b7178257e9d4e446a03db13e122c4116338
-
Filesize
7.6MB
MD541e2d668faae43ea0ec6421118269cd1
SHA1fdbda1e5585e43f55b007caf99c32512efc89c98
SHA2563f88c121aa5fe1683896a689eaa8ea4af461566162e8e02d3283563722718069
SHA512a64e9474fc1c9766221ed10a4b90776fc61e97e34e739cfe04c594214b5dd9b84952c686e419572a00a5cdc9a719d7a4d92b67394788bd17fc949329b159e09b
-
Filesize
7.4MB
MD52cab3fc40f604740b1971e5db8212da3
SHA175014e37692396b8b50d12b96a110a7281f52d1a
SHA256ba2a9c7587656a14500ae5b784217e5752507195aacea846e5329e8ba117f0f4
SHA5128395e47db27a091208a51321d723074d383d1ec5128cb5303323faf754b0ad8d4d7fe821118ce5a413727e6206bffa86929f2db4ab2536a4c811858c77b9588b
-
Filesize
4KB
MD5b51be19095bc72c0d98992d49662ea60
SHA1eb70d3d6311e5d6556079c3d6c628b37d5bc8b17
SHA256f69d9f1301921bc5dad0ecb69adb6eab0d9d10382351a8375bb35179fdbce7a0
SHA512d995833caa7e09babb4222d339ea7bdfb04d411a44faac5a4ce1e5451b482e086eff354c5bb175ea1a65d1d0a425c51cdf57d027a535a6e23337b4a6e566cbd6
-
Filesize
528B
MD5d60593dade86ae20409fc0bc7aee27c2
SHA1c692b23b0c43457233eea86bbcf40b523a2f6104
SHA256817dff305897778c14738e10ca22a13a8a941ef327d9e1364d86f80b20f8af97
SHA512bf36d6ed3071b786e485b2fad3ec87ffae0e2f87381b8589b725f1381b33a969324b9f3114b6a82fe32e0470c0cdebe537682ca39042ea69708aab12b2990e11