Analysis
-
max time kernel
494s -
max time network
495s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 09:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://operagx.gg
Resource
win10v2004-20240226-en
Errors
General
-
Target
http://operagx.gg
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
NoEscape.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe" NoEscape.exe -
Processes:
NoEscape.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
NoEscape.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" NoEscape.exe -
Downloads MZ/PE file
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
MSAGENT.EXEtv_enua.exedescription ioc process Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components MSAGENT.EXE Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components tv_enua.exe -
Executes dropped EXE 13 IoCs
Processes:
OperaGXSetup.exeOperaGXSetup.exeOperaGXSetup.exeOperaGXSetup.exeOperaGXSetup.exeOpera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeassistant_installer.exeassistant_installer.exeMSAGENT.EXEtv_enua.exeAgentSvr.exeBonziBDY_35.EXEAgentSvr.exepid process 1924 OperaGXSetup.exe 432 OperaGXSetup.exe 5264 OperaGXSetup.exe 5620 OperaGXSetup.exe 5660 OperaGXSetup.exe 5964 Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe 6044 assistant_installer.exe 6072 assistant_installer.exe 2604 MSAGENT.EXE 1140 tv_enua.exe 4636 AgentSvr.exe 3868 BonziBDY_35.EXE 1664 AgentSvr.exe -
Loads dropped DLL 42 IoCs
Processes:
OperaGXSetup.exeOperaGXSetup.exeOperaGXSetup.exeOperaGXSetup.exeOperaGXSetup.exeBonziBuddy432.exeMSAGENT.EXEregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exetv_enua.exeregsvr32.exeregsvr32.exeBonziBDY_35.EXEAgentSvr.exepid process 1924 OperaGXSetup.exe 432 OperaGXSetup.exe 5264 OperaGXSetup.exe 5620 OperaGXSetup.exe 5660 OperaGXSetup.exe 5904 BonziBuddy432.exe 5904 BonziBuddy432.exe 5904 BonziBuddy432.exe 5904 BonziBuddy432.exe 5904 BonziBuddy432.exe 5904 BonziBuddy432.exe 5904 BonziBuddy432.exe 5904 BonziBuddy432.exe 5904 BonziBuddy432.exe 5904 BonziBuddy432.exe 5904 BonziBuddy432.exe 2604 MSAGENT.EXE 3220 regsvr32.exe 3988 regsvr32.exe 3868 regsvr32.exe 1488 regsvr32.exe 2220 regsvr32.exe 1664 regsvr32.exe 5336 regsvr32.exe 1140 tv_enua.exe 5328 regsvr32.exe 5328 regsvr32.exe 4540 regsvr32.exe 3868 BonziBDY_35.EXE 3868 BonziBDY_35.EXE 3868 BonziBDY_35.EXE 3868 BonziBDY_35.EXE 3868 BonziBDY_35.EXE 3868 BonziBDY_35.EXE 3868 BonziBDY_35.EXE 1664 AgentSvr.exe 1664 AgentSvr.exe 3868 BonziBDY_35.EXE 3868 BonziBDY_35.EXE 1664 AgentSvr.exe 1664 AgentSvr.exe 1664 AgentSvr.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Downloads\OperaGXSetup.exe upx behavioral1/memory/1924-320-0x0000000000C80000-0x0000000001240000-memory.dmp upx C:\Users\Admin\Downloads\OperaGXSetup.exe upx behavioral1/memory/432-326-0x0000000000C80000-0x0000000001240000-memory.dmp upx behavioral1/memory/5264-339-0x0000000000390000-0x0000000000950000-memory.dmp upx behavioral1/memory/5264-344-0x0000000000390000-0x0000000000950000-memory.dmp upx C:\Users\Admin\Downloads\OperaGXSetup.exe upx C:\Users\Admin\Downloads\OperaGXSetup.exe upx behavioral1/memory/1924-396-0x0000000000C80000-0x0000000001240000-memory.dmp upx behavioral1/memory/5620-398-0x0000000000C80000-0x0000000001240000-memory.dmp upx behavioral1/memory/5660-399-0x0000000000C80000-0x0000000001240000-memory.dmp upx behavioral1/memory/432-397-0x0000000000C80000-0x0000000001240000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tv_enua.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet" tv_enua.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
NoEscape.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini NoEscape.exe File opened for modification C:\Users\Public\Desktop\desktop.ini NoEscape.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
OperaGXSetup.exeOperaGXSetup.exedescription ioc process File opened (read-only) \??\F: OperaGXSetup.exe File opened (read-only) \??\D: OperaGXSetup.exe File opened (read-only) \??\F: OperaGXSetup.exe File opened (read-only) \??\D: OperaGXSetup.exe -
Drops file in System32 directory 3 IoCs
Processes:
tv_enua.exedescription ioc process File opened for modification C:\Windows\SysWOW64\msvcp50.dll tv_enua.exe File opened for modification C:\Windows\SysWOW64\SET9D3B.tmp tv_enua.exe File created C:\Windows\SysWOW64\SET9D3B.tmp tv_enua.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
NoEscape.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png" NoEscape.exe -
Drops file in Program Files directory 64 IoCs
Processes:
BonziBuddy432.exeBonziBDY_35.EXEdescription ioc process File opened for modification C:\Program Files (x86)\BonziBuddy432\favicon.ico BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\P001.nbd-SR BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\SSubTmr6.dll BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page11.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page2.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page9.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page8.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Apps.nbd BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Options\bonzibuddys.URL BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page9.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\j2.nbd-SR BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Jigsaw.exe BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\msvbvm60.dll BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Snd1.wav BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb007.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb011.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page8.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\T001.nbd-SR BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb012.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page3.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page13.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page14.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\~GLH0046.TMP BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page0.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page6.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb015.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\j001.nbd BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Runtimes\spchcpl.exe BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page13.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\book BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb001.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb006.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb010.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page14.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page5.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Reg.nbd BonziBDY_35.EXE File opened for modification C:\Program Files (x86)\BonziBuddy432\BonziBUDDY_Killer.exe BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\j2.nbd BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Runtimes\actcnc.exe BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Options\AutoShortcutsMaker.vbs BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page4.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page16.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page8.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb002.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page10.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp002.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page12.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page13.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Bonzi's Beach Checkers.exe BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\MSINET.OCX BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page16.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page2.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp006.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page1.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page17.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\SSCALA32.OCX BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Options\ManualDirPatcher.bat BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page16.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page2.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page12.jpg BonziBuddy432.exe -
Drops file in Windows directory 58 IoCs
Processes:
MSAGENT.EXEtv_enua.exeBonziBuddy432.exeNoEscape.exedescription ioc process File created C:\Windows\msagent\SET93F0.tmp MSAGENT.EXE File created C:\Windows\msagent\SET9404.tmp MSAGENT.EXE File opened for modification C:\Windows\fonts\andmoipa.ttf tv_enua.exe File created C:\Windows\INF\SET9D1B.tmp tv_enua.exe File opened for modification C:\Windows\lhsp\help\tv_enua.hlp tv_enua.exe File created C:\Windows\lhsp\tv\SET9CCA.tmp tv_enua.exe File opened for modification C:\Windows\lhsp\tv\tvenuax.dll tv_enua.exe File opened for modification C:\Windows\msagent\chars\Peedy.acs BonziBuddy432.exe File created C:\Windows\msagent\SET9437.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\mslwvtts.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\SET9459.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentDp2.dll MSAGENT.EXE File created C:\Windows\msagent\SET9402.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentSR.dll MSAGENT.EXE File opened for modification C:\Windows\winnt32.exe NoEscape.exe File opened for modification C:\Windows\msagent\SET93E0.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentCtl.dll MSAGENT.EXE File opened for modification C:\Windows\lhsp\tv\tv_enua.dll tv_enua.exe File opened for modification C:\Windows\msagent\AgentDPv.dll MSAGENT.EXE File created C:\Windows\fonts\SET9D0B.tmp tv_enua.exe File opened for modification C:\Windows\msagent\chars\Bonzi.acs BonziBuddy432.exe File created C:\Windows\msagent\SET9401.tmp MSAGENT.EXE File created C:\Windows\msagent\SET9424.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SET9437.tmp MSAGENT.EXE File opened for modification C:\Windows\help\SET9448.tmp MSAGENT.EXE File opened for modification C:\Windows\fonts\SET9D0B.tmp tv_enua.exe File created C:\Windows\msagent\SET93E0.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SET9404.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SET9424.tmp MSAGENT.EXE File opened for modification C:\Windows\INF\agtinst.inf MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentAnm.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\intl\SET9449.tmp MSAGENT.EXE File created C:\Windows\msagent\SET9459.tmp MSAGENT.EXE File opened for modification C:\Windows\INF\SET9D1B.tmp tv_enua.exe File created C:\Windows\msagent\SET9403.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\intl\Agt0409.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\AgtCtl15.tlb MSAGENT.EXE File opened for modification C:\Windows\lhsp\tv\SET9CCA.tmp tv_enua.exe File opened for modification C:\Windows\msagent\SET9402.tmp MSAGENT.EXE File created C:\Windows\INF\SET9436.tmp MSAGENT.EXE File opened for modification C:\Windows\INF\tv_enua.inf tv_enua.exe File opened for modification C:\Windows\msagent\SET93F0.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentSvr.exe MSAGENT.EXE File opened for modification C:\Windows\INF\SET9436.tmp MSAGENT.EXE File created C:\Windows\winnt32.exe NoEscape.exe File opened for modification C:\Windows\msagent\SET9425.tmp MSAGENT.EXE File created C:\Windows\msagent\SET9425.tmp MSAGENT.EXE File created C:\Windows\help\SET9448.tmp MSAGENT.EXE File opened for modification C:\Windows\lhsp\tv\SET9CB9.tmp tv_enua.exe File opened for modification C:\Windows\msagent\AgentMPx.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentPsh.dll MSAGENT.EXE File created C:\Windows\lhsp\tv\SET9CB9.tmp tv_enua.exe File opened for modification C:\Windows\lhsp\help\SET9CDB.tmp tv_enua.exe File created C:\Windows\lhsp\help\SET9CDB.tmp tv_enua.exe File opened for modification C:\Windows\msagent\SET9401.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SET9403.tmp MSAGENT.EXE File opened for modification C:\Windows\help\Agt0409.hlp MSAGENT.EXE File created C:\Windows\msagent\intl\SET9449.tmp MSAGENT.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
WINWORD.EXEmsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "156" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe -
Modifies registry class 64 IoCs
Processes:
BonziBuddy432.exeregsvr32.exeAgentSvr.exeBonziBDY_35.EXEregsvr32.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\ = "Toolbar General Property Page Object" BonziBuddy432.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BD1-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\Version = "2.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C8F-7B81-11D0-AC5F-00C04FD97575}\TypeLib\ = "{A7B93C73-7B81-11D0-AC5F-00C04FD97575}" AgentSvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C8F-7B81-11D0-AC5F-00C04FD97575}\TypeLib\Version = "2.0" AgentSvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A031FBF6-81A7-4440-9E20-51ABB2289E4B}\ProgID\ = "BonziBUDDY.CPeriods" BonziBDY_35.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A981630-37C3-11CE-9E52-0000C0554C0A}\TypeLib\Version = "1.0" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DAB85C3-803A-11D0-AC63-00C04FD97575}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FDE-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSCalendar.SSDayCtrl.1\CLSID BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6CFC9BA1-FE87-11D2-9DCF-ED29FAFE371D}\ProxyStubClsid32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSFrame\CLSID BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{972DE6C2-8B09-11D2-B652-A1FD6CC34260}\TypeLib\ = "{972DE6B5-8B09-11D2-B652-A1FD6CC34260}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCE47F78-8A6C-4C6D-A6F7-8BE4427127C4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7B93C8F-7B81-11D0-AC5F-00C04FD97575}\TypeLib\Version = "2.0" AgentSvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F21-8591-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" BonziBuddy432.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BE8-7DE6-11D0-91FE-00C04FD701A5}\ = "IAgentCtlCharacters" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BA90C00-3910-11D1-ACB3-00C04FD97575}\ProxyStubClsid32 AgentSvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.ComMorph\CurVer\ = "ActiveSkin.ComMorph.1" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl.2\CLSID BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22EB59AE-1CB8-4153-9DFC-B5CE048357CF}\ProgID\ = "BonziBUDDY.CPeriod" BonziBDY_35.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\ProgID\ = "MSComctlLib.TabStrip.2" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B1BE807-567F-11D1-B652-0060976C699F}\Forward BonziBuddy432.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A20-8589-11D1-B16A-00C0F0283628} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7AE601-0142-11D3-9DCF-89BE4EFB591E}\InprocServer32\ThreadingModel = "Apartment" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D41-2CDD-11D3-9DD0-D3CD4078982A}\ToolboxBitmap32\ = "C:\\PROGRA~2\\BONZIB~1\\ACTIVE~1.OCX, 113" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TreeCtrl\CLSID\ = "{C74190B6-8589-11D1-B16A-00C0F0283628}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE3-1BF9-11D2-BAE8-00104B9E0792}\InprocServer32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FA9F4D5-A173-11D1-AA62-00C04FA34D72}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Programmable BonziBuddy432.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5BE8BD2-7DE6-11D0-91FE-00C04FD701A5}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}\2.0\0\win32\ = "C:\\Program Files (x86)\\BonziBuddy432\\MSCOMCTL.OCX" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Program Files (x86)\\BonziBuddy432\\MSINET.OCX" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD2FF-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32\ = "C:\\Windows\\msagent\\AgentDPv.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl\CLSID\ = "{BDD1F04B-858B-11D1-B16A-00C0F0283628}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FDF-1BF9-11D2-BAE8-00104B9E0792}\InprocServer32\ThreadingModel = "Apartment" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A981630-37C3-11CE-9E52-0000C0554C0A}\TypeLib\ = "{643F1353-1D07-11CE-9E52-0000C0554C0A}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveTabs.SSTabs\CLSID BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D41-2CDD-11D3-9DD0-D3CD4078982A}\TypeLib BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55DD814E-A1B7-4808-9625-4F75A3FAD8A7}\TypeLib\ = "{972DE6B5-8B09-11D2-B652-A1FD6CC34260}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4900F6B-055F-11D4-8F9B-00104BA312D6}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" BonziBDY_35.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\ToolboxBitmap32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE6-1BF9-11D2-BAE8-00104B9E0792}\Control BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1B2D240-744C-11CE-9430-0000C0C14E92}\InprocServer32 BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DECC98E1-EC4E-11D2-93E5-00104B9E078A}\ = "ISSImage" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.COMScript.1\ = "ActiveSkin.COMScript Class" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinScrollBar.1\CLSID BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}\ = "Tab Property Page Object" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\TypeLib BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22DF5084-12BC-4C98-8044-4FAD06F4119A}\ProxyStubClsid32 BonziBDY_35.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE11629C-36DF-11D3-9DD0-89D6DBBBA800}\ProgID BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Toolbar\CurVer\ = "MSComctlLib.Toolbar.2" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F050-858B-11D1-B16A-00C0F0283628} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FE5-1BF9-11D2-BAE8-00104B9E0792} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE3-1BF9-11D2-BAE8-00104B9E0792}\Version\ = "3.0" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{643F1352-1D07-11CE-9E52-0000C0554C0A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BD1-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\ProgID BonziBuddy432.exe -
NTFS ADS 2 IoCs
Processes:
msedge.exeOperaGXSetup.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 342148.crdownload:SmartScreen msedge.exe File created C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe\:SmartScreen:$DATA OperaGXSetup.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4188 WINWORD.EXE 4188 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exetaskmgr.exemsedge.exepid process 744 msedge.exe 744 msedge.exe 3896 msedge.exe 3896 msedge.exe 1380 identity_helper.exe 1380 identity_helper.exe 440 msedge.exe 440 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 4744 msedge.exe 4744 msedge.exe 2388 msedge.exe 2388 msedge.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 868 msedge.exe 868 msedge.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
Processes:
msedge.exepid process 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
AgentSvr.exeAUDIODG.EXEtaskmgr.exedescription pid process Token: 33 1664 AgentSvr.exe Token: SeIncBasePriorityPrivilege 1664 AgentSvr.exe Token: 33 4120 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4120 AUDIODG.EXE Token: 33 1664 AgentSvr.exe Token: SeIncBasePriorityPrivilege 1664 AgentSvr.exe Token: 33 1664 AgentSvr.exe Token: SeIncBasePriorityPrivilege 1664 AgentSvr.exe Token: SeDebugPrivilege 1088 taskmgr.exe Token: SeSystemProfilePrivilege 1088 taskmgr.exe Token: SeCreateGlobalPrivilege 1088 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exepid process 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exeAgentSvr.exetaskmgr.exepid process 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 1664 AgentSvr.exe 1664 AgentSvr.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
OperaGXSetup.exeBonziBuddy432.exeMSAGENT.EXEtv_enua.exeAgentSvr.exeBonziBDY_35.EXEWINWORD.EXELogonUI.exepid process 1924 OperaGXSetup.exe 5904 BonziBuddy432.exe 2604 MSAGENT.EXE 1140 tv_enua.exe 4636 AgentSvr.exe 3868 BonziBDY_35.EXE 3868 BonziBDY_35.EXE 4188 WINWORD.EXE 4188 WINWORD.EXE 4188 WINWORD.EXE 4188 WINWORD.EXE 4188 WINWORD.EXE 4188 WINWORD.EXE 4188 WINWORD.EXE 3656 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3896 wrote to memory of 3992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 3992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 992 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 744 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 744 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4132 3896 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://operagx.gg1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbca246f8,0x7ffdbca24708,0x7ffdbca247182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5040 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6684 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\OperaGXSetup.exe"C:\Users\Admin\Downloads\OperaGXSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- NTFS ADS
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\OperaGXSetup.exeC:\Users\Admin\Downloads\OperaGXSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.79 --initial-client-data=0x30c,0x310,0x314,0x2e8,0x318,0x7564623c,0x75646248,0x756462543⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Downloads\OperaGXSetup.exe"C:\Users\Admin\Downloads\OperaGXSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1924 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240328090650" --session-guid=a36f3a70-c0c4-4a0e-977c-18b221f01ae2 --server-tracking-blob="ZTkxMDk5YmYxYTZiMzU5ZWIwYWQ4ODg1ZTY2ZDRjYTE2ODRmMzI5Zjg1ODAwYjFhZjI5ZmE1Y2Y3NDM4MGJjYjp7ImNvdW50cnkiOiJHQiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT10d2l0Y2gmdXRtX21lZGl1bT10d2l0Y2hfaW5mbHVlbmNlcnMmdXRtX2NhbXBhaWduPXRoYXRzX215X3N0cmVhbWVyJmh0dHBfcmVmZXJyZXI9aHR0cHMlM0ElMkYlMkZ3d3cub3BlcmEuY29tJTJGZ3glM0Z1dG1fc291cmNlJTNEdHdpdGNoJTI2dXRtX21lZGl1bSUzRHR3aXRjaF9pbmZsdWVuY2VycyUyNnV0bV9jYW1wYWlnbiUzRHRoYXRzX215X3N0cmVhbWVyJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGJmRsX3Rva2VuPTE3ODA1NDU0Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzExNjE2NzkwLjM2MTUiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBTYWZhcmkvNTM3LjM2IEVkZy85Mi4wLjkwMi42NyIsInV0bSI6eyJjYW1wYWlnbiI6InRoYXRzX215X3N0cmVhbWVyIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vIiwibWVkaXVtIjoidHdpdGNoX2luZmx1ZW5jZXJzIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6InR3aXRjaCJ9LCJ1dWlkIjoiMTI3N2RiYTItMTBjMy00NTIzLWJmNjktNjUyNWMxNWU1MDQ3In0= " --desktopshortcut=1 --wait-for-package --initial-proc-handle=F0080000000000003⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
-
C:\Users\Admin\Downloads\OperaGXSetup.exeC:\Users\Admin\Downloads\OperaGXSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=107.0.5045.79 --initial-client-data=0x2fc,0x300,0x304,0x2d8,0x308,0x72b0623c,0x72b06248,0x72b062544⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202403280906501\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202403280906501\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202403280906501\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202403280906501\assistant\assistant_installer.exe" --version3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202403280906501\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202403280906501\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x11a4f48,0x11a4f58,0x11a4f644⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5296 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5960 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4932 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1724 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7344 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7644 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1372 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7408 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,4313547549895690381,10652678251861253786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7124 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Bonzi.zip\BonziBuddy432.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Bonzi.zip\BonziBuddy432.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "2⤵
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXEMSAGENT.EXE3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentCtl.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDPv.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\mslwvtts.dll"4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentDP2.dll"4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentMPx.dll"4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentSR.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\msagent\AgentPsh.dll"4⤵
- Loads dropped DLL
-
C:\Windows\msagent\AgentSvr.exe"C:\Windows\msagent\AgentSvr.exe" /regserver4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exetv_enua.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\grpconv.exegrpconv.exe -o4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bonzibuddy.tk/2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffdbca246f8,0x7ffdbca24708,0x7ffdbca247183⤵
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\msagent\AgentSvr.exeC:\Windows\msagent\AgentSvr.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x2ec1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "C:\Users\Admin\Documents\These.docx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38db055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocxFilesize
336KB
MD53d225d8435666c14addf17c14806c355
SHA1262a951a98dd9429558ed35f423babe1a6cce094
SHA2562c8f92dc16cbf13542ddd3bf0a947cf84b00fed83a7124b830ddefa92f939877
SHA512391df24c6427b4011e7d61b644953810e392525743914413c2e8cf5fce4a593a831cfab489fbb9517b6c0e7ef0483efb8aeaad0a18543f0da49fa3125ec971e1
-
C:\Program Files (x86)\BonziBuddy432\Bonzi's Beach Checkers.exeFilesize
7.8MB
MD5c3b0a56e48bad8763e93653902fc7ccb
SHA1d7048dcf310a293eae23932d4e865c44f6817a45
SHA256821a16b65f68e745492419ea694f363926669ac16f6b470ed59fe5a3f1856fcb
SHA512ae35f88623418e4c9645b545ec9e8837e54d879641658996ca21546f384e3e1f90dae992768309ac0bd2aae90e1043663931d2ef64ac541977af889ee72e721a
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXEFilesize
796KB
MD58a30bd00d45a659e6e393915e5aef701
SHA1b00c31de44328dd71a70f0c8e123b56934edc755
SHA2561e2994763a7674a0f1ec117dae562b05b614937ff61c83b316b135afab02d45a
SHA512daf92e61e75382e1da0e2aba9466a9e4d9703a129a147f0b3c71755f491c68f89ad67cfb4dd013580063d664b69c8673fb52c02d34b86d947e9f16072b7090fb
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXEFilesize
2.5MB
MD573feeab1c303db39cbe35672ae049911
SHA1c14ce70e1b3530811a8c363d246eb43fc77b656c
SHA25688c03817ae8dfc5fc9e6ffd1cfb5b829924988d01cd472c1e64952c5398866e8
SHA51273f37dee83664ce31522f732bf819ed157865a2a551a656a7a65d487c359a16c82bd74acff2b7a728bb5f52d53f4cfbea5bef36118128b0d416fa835053f7153
-
C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXEFilesize
3.2MB
MD593f3ed21ad49fd54f249d0d536981a88
SHA1ffca7f3846e538be9c6da1e871724dd935755542
SHA2565678fd744faddb30a87568ae309066ef88102a274fff62f10e4963350da373bc
SHA5127923556c6d6feb4ff4253e853bae3675184eab9b8ce4d4e07f356c8624317801ee807ad5340690196a975824ea3ed500ce6a80c7670f19785139be594fa5e70f
-
C:\Program Files (x86)\BonziBuddy432\BonziCheckers.ocxFilesize
152KB
MD566551c972574f86087032467aa6febb4
SHA15ad1fe1587a0c31bb74af20d09a1c7d3193ec3c9
SHA2569028075603c66ca2e906ecac3275e289d8857411a288c992e8eef793ed71a75b
SHA51235c1f500e69cdd12ec6a3c5daef737a3b57b48a44df6c120a0504d340e0f721d34121595ed396dc466a8f9952a51395912d9e141ad013000f5acb138b2d41089
-
C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page17.jpgFilesize
50KB
MD5e8f52918072e96bb5f4c573dbb76d74f
SHA1ba0a89ed469de5e36bd4576591ee94db2c7f8909
SHA256473a890da22defb3fbd643246b3fa0d6d34939ac469cd4f48054ee2a0bc33d82
SHA512d57dd0a9686696487d268ef2be2ec2d3b97baedf797a63676da5a8a4165cda89540ec2d3b9e595397cbf53e69dcce76f7249f5eeff041947146ca7bf4099819f
-
C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page18.jpgFilesize
45KB
MD5108fd5475c19f16c28068f67fc80f305
SHA14e1980ba338133a6fadd5fda4ffe6d4e8a039033
SHA25603f269cd40809d7ec94f5fa4fff1033a624e849179962693cdc2c37d7904233b
SHA51298c8743b5af89ec0072b70de8a0babfb5aff19bafa780d6ce99c83721b65a80ec310a4fe9db29a4bb50c2454c34de62c029a83b70d0a9df9b180159ea6cad83a
-
C:\Program Files (x86)\BonziBuddy432\MSCOMCTL.OCXFilesize
1.0MB
MD512c2755d14b2e51a4bb5cbdfc22ecb11
SHA133f0f5962dbe0e518fe101fa985158d760f01df1
SHA2563b6ccdb560d7cd4748e992bd82c799acd1bbcfc922a13830ca381d976ffcccaf
SHA5124c9b16fb4d787145f6d65a34e1c4d5c6eb07bff4c313a35f5efa9dce5a840c1da77338c92346b1ad68eeb59ef37ef18a9d6078673c3543656961e656466699cf
-
C:\Program Files (x86)\BonziBuddy432\MSINET.OCXFilesize
112KB
MD57bec181a21753498b6bd001c42a42722
SHA13249f233657dc66632c0539c47895bfcee5770cc
SHA25673da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
SHA512d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
-
C:\Program Files (x86)\BonziBuddy432\MSWINSCK.OCXFilesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
C:\Program Files (x86)\BonziBuddy432\Reg.nbdFilesize
140B
MD5a8ed45f8bfdc5303b7b52ae2cce03a14
SHA1fb9bee69ef99797ac15ba4d8a57988754f2c0c6b
SHA256375ecd89ee18d7f318cf73b34a4e15b9eb16bc9d825c165e103db392f4b2a68b
SHA51237917594f22d2a27b3541a666933c115813e9b34088eaeb3d74f77da79864f7d140094dfac5863778acf12f87ccda7f7255b7975066230911966b52986da2d5c
-
C:\Program Files (x86)\BonziBuddy432\Regicon.ocxFilesize
76KB
MD532ff40a65ab92beb59102b5eaa083907
SHA1af2824feb55fb10ec14ebd604809a0d424d49442
SHA25607e91d8ed149d5cd6d48403268a773c664367bce707a99e51220e477fddeeb42
SHA5122cfc5c6cb4677ff61ec3b6e4ef8b8b7f1775cbe53b245d321c25cfec363b5b4975a53e26ef438e07a4a5b08ad1dde1387970d57d1837e653d03aef19a17d2b43
-
C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.batFilesize
279B
MD54877f2ce2833f1356ae3b534fce1b5e3
SHA17365c9ef5997324b73b1ff0ea67375a328a9646a
SHA2568ae1ed38bc650db8b14291e1b7298ee7580b31e15f8a6a84f78f048a542742ff
SHA512dd43ede5c3f95543bcc8086ec8209a27aadf1b61543c8ee1bb3eab9bc35b92c464e4132b228b12b244fb9625a45f5d4689a45761c4c5263aa919564664860c5e
-
C:\Program Files (x86)\BonziBuddy432\SSCALA32.OCXFilesize
472KB
MD5ce9216b52ded7e6fc63a50584b55a9b3
SHA127bb8882b228725e2a3793b4b4da3e154d6bb2ea
SHA2568e52ef01139dc448d1efd33d1d9532f852a74d05ee87e8e93c2bb0286a864e13
SHA512444946e5fc3ea33dd4a09b4cbf2d41f52d584eb5b620f5e144de9a79186e2c9d322d6076ed28b6f0f6d0df9ef4f7303e3901ff552ed086b70b6815abdfc23af7
-
C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCXFilesize
320KB
MD597ffaf46f04982c4bdb8464397ba2a23
SHA1f32e89d9651fd6e3af4844fd7616a7f263dc5510
SHA2565db33895923b7af9769ca08470d0462ed78eec432a4022ff0acc24fa2d4666e1
SHA5128c43872396f5dceb4ba153622665e21a9b52a087987eab523b1041031e294687012d7bf88a3da7998172010eae5f4cc577099980ecd6b75751e35cfc549de002
-
C:\Program Files (x86)\BonziBuddy432\Uninstall.exeFilesize
65KB
MD5578bebe744818e3a66c506610b99d6c3
SHA1af2bc75a6037a4581979d89431bd3f7c0f0f1b1f
SHA256465839938f2baec7d66dbc3f2352f6032825618a18c9c0f9333d13af6af39f71
SHA512d24fcd2f3e618380cf25b2fd905f4e04c8152ee41aeee58d21abfc4af2c6a5d122f12b99ef325e1e82b2871e4e8f50715cc1fc2efcf6c4f32a3436c32727cd36
-
C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocxFilesize
320KB
MD548c35ed0a09855b29d43f11485f8423b
SHA146716282cc5e0f66cb96057e165fa4d8d60fbae2
SHA2567a0418b76d00665a71d13a30d838c3e086304bacd10d764650d2a5d2ec691008
SHA512779938ec9b0f33f4cbd5f1617bea7925c1b6d794e311737605e12cd7efa5a14bbc48bee85208651cf442b84133be26c4cc8a425d0a3b5b6ad2dc27227f524a99
-
C:\Program Files (x86)\BonziBuddy432\sstabs2.ocxFilesize
288KB
MD57303efb737685169328287a7e9449ab7
SHA147bfe724a9f71d40b5e56811ec2c688c944f3ce7
SHA256596f3235642c9c968650194065850ecb02c8c524d2bdcaf6341a01201e0d69be
SHA512e0d9cb9833725e0cdc7720e9d00859d93fc51a26470f01a0c08c10fa940ed23df360e093861cf85055b8a588bb2cac872d1be69844a6c754ac8ed5bfaf63eb03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBFilesize
471B
MD5123c3ac9a5546a9f451b197a09ae561a
SHA15c1c93b448a828a01b2ab9c3d43ce84d13bcd2d2
SHA25626c47abca53430515b249fa00f968ae5b8c1b4f9783742765414a3d05e2b97ea
SHA5127e9b390a462a009633335293f83c287ba7cf98f7290ba2745258331d6e94b62eb5f3ca6486bcb3d2c4fd4ee1966f12f058f312a8399bd7f730447085f726db7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_9A347AC5A42F886F9F966873087C7F2EFilesize
727B
MD5f4877ecdf78ec2ee14a3157fb6a66062
SHA11a81b922063d89ede3fc0a2f41ad56e6b96cf3f0
SHA256ef7896a4f2f45f79a7519cbc0f174f12b2f1881708d12d2c20795bad90543024
SHA512df05204a30ddcd71e5df01721b71570bdbbb5c54546d5b3f0696664a458e315aeb16aaeab954433153c130242ca50f58dbe0860b796b80049c3a0f7f231ecd15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141Filesize
727B
MD53b51e41d93df132b90a46d9f529a4a15
SHA1adfcbfab7670e420b66f7530f9d866486186f352
SHA256c14843a220b612d6c90a59232c764c088b50a939614955a23235d5418cea8084
SHA512e04cbe221cf9e8bb01828d03922399d568b7d68d845fea670bc829f82d8e2eb88aa9a7d24a4b89c838cd7e0d90279e40c5ad07f5a6aeb8d0acef21fd8975f282
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBFilesize
400B
MD591c2debc6d0695412ed2b7960c138678
SHA197e1738d68b50af34bc5d7d24349b98d9d9153b7
SHA256bb4cf6abeba84e47d27ee5c6100241b04cefea38314213e1e66b0535789b9580
SHA51218b9f84d88f1c0af907ee7051d574ab78220a35aa9a0e3c8526ad863609fcd8def3fafc0265098ee6514cb4a9291b16e15fc2f5372caaaa8e22f8576b5212d76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_9A347AC5A42F886F9F966873087C7F2EFilesize
404B
MD59faa5e2e9cddb37692a50aee4c6d15c7
SHA1f5faf1057891f5d7cc02966b7c055cff3a05f75b
SHA2567384365df1d6a5873d4089f70bdfeb76ccb4eb867236bf1cef060be9ae07707e
SHA51281b91538eca70cacfd016501476e236de741f46c1cd392c5fe0278a1feff37d5ff09ca9f767e349ef281374756bb7b1628b2ec050d6b344512d6c593e3b4206a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141Filesize
412B
MD5bc933d156c8d7a07c9f1c58300eaf4f6
SHA173748b70500cf3594b75ad413abed59bc228280e
SHA2560f0f3e20fcde2e5f3a3606e75b323e22fecb3b1936619ced61118c0b9db2f086
SHA512a93ed084d25c2a29d336fb87b605b4beab671d81466aa9b56eebb6a3b4b1910d15768e92ee8f5c1417c721ea7f58549ffdf12bb02f6a0520809dcdf8c8de4a73
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57740a919423ddc469647f8fdd981324d
SHA1c1bc3f834507e4940a0b7594e34c4b83bbea7cda
SHA256bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221
SHA5127ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59f44d6f922f830d04d7463189045a5a3
SHA12e9ae7188ab8f88078e83ba7f42a11a2c421cb1c
SHA2560ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a
SHA5127c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030Filesize
64KB
MD5d6b36c7d4b06f140f860ddc91a4c659c
SHA1ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA25634013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
SHA5122a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031Filesize
69KB
MD5a127a49f49671771565e01d883a5e4fa
SHA109ec098e238b34c09406628c6bee1b81472fc003
SHA2563f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6
SHA51261b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032Filesize
34KB
MD56e050be3bd6794eba86225c7782d2dbe
SHA17ebe1b4291b92f66e4d35bc9109ed5442e35eb20
SHA2560cd7b67e7bcd622c93226fff7a6232189faea6f63c74aa354ac5e161b152e87b
SHA5129acb7630e337c3af1de1772bb3c2fc7cdc95c56917ea4c386e58127847880267fc25698b8dc0fc93f2bd9135e20b050a46fc3f02a2bf27ba5f67e281c1076930
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033Filesize
19KB
MD52e86a72f4e82614cd4842950d2e0a716
SHA1d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA5127a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034Filesize
65KB
MD556d57bc655526551f217536f19195495
SHA128b430886d1220855a805d78dc5d6414aeee6995
SHA256f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
SHA5127814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035Filesize
84KB
MD574e33b4b54f4d1f3da06ab47c5936a13
SHA16e5976d593b6ee3dca3c4dbbb90071b76e1cd85c
SHA256535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287
SHA51279218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036Filesize
1.1MB
MD593feab00f76536d681c1b77eca2c7caf
SHA1c48cbe893b3178a56357c132cae2fa63918d790f
SHA2565da61564d6ae3fa4506522460d177f8b642b20bae63f81cee14b9ca71fd49226
SHA5126276f945f1008c70bdc559a8d6a14c609a033af2fae6bd80c129da546e7df6cfb3fcdcc452508df8ee5be7a0a87a6f9930664b8b9726c4e52877802a9ceca5ca
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037Filesize
33KB
MD53cd0f2f60ab620c7be0c2c3dbf2cda97
SHA147fad82bfa9a32d578c0c84aed2840c55bd27bfb
SHA25629a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b
SHA512ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039Filesize
75KB
MD5cf989be758e8dab43e0a5bc0798c71e0
SHA197537516ffd3621ffdd0219ede2a0771a9d1e01d
SHA256beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615
SHA512f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003cFilesize
39KB
MD581cc29e2c1a2b0d72b3c2336f5e10d2b
SHA1bcb4b2cca12037117cea7deb1364f8b812da69d1
SHA256f775c65bb21d38cad5157f59fec55604b106ed1b7468e129642fc2f78ab5d250
SHA51205293db6bf1b966c8a807c0e73b98e811f8529b72ce257f01aac6140ed74a25f2e06ccc12c3e6ecbaf797d87d4b8fa53f98e7411d9a537d13b2e320479e874ca
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040Filesize
40KB
MD53051c1e179d84292d3f84a1a0a112c80
SHA1c11a63236373abfe574f2935a0e7024688b71ccb
SHA256992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3
SHA512df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041Filesize
53KB
MD568f0a51fa86985999964ee43de12cdd5
SHA1bbfc7666be00c560b7394fa0b82b864237a99d8c
SHA256f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f
SHA5123049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005dFilesize
22KB
MD53b5537dce96f57098998e410b0202920
SHA17732b57e4e3bbc122d63f67078efa7cf5f975448
SHA256a1c54426705d6cef00e0ae98f5ad1615735a31a4e200c3a5835b44266a4a3f88
SHA512c038c334db3a467a710c624704eb5884fd40314cd57bd2fd154806a59c0be954c414727628d50e41cdfd86f5334ceefcf1363d641b2681c1137651cbbb4fd55d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060Filesize
92KB
MD52fca258f08e1964b5dcb6e9839e79683
SHA16bde99365e571bd40540721a1bcfbb34d862d883
SHA256a439a2915a2ff5b2048a8042e149353e4e531da9b238071476bfc22eb450fc0e
SHA5129f62f59ae067ef428e846a3a376190140a5d37d42b0cc448f930255763ac83ed0f895260084fac3b8415025a2f819e9bbebaaf63f6e0e3fd7bc00ff2eb12121c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000063Filesize
198KB
MD5cda68ffa26095220a82ae0a7eaea5f57
SHA1e892d887688790ddd8f0594607b539fc6baa9e40
SHA256f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb
SHA51284c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\00f194399257ca72_0Filesize
4KB
MD547db2116da50fbf6263ab3f99bdf903a
SHA1219a6fb68c35cb72260c9502b8c7adca6a7ce014
SHA25657fc5091962c78888011086716c70c3710f19b1473960f1964d2291a048c60eb
SHA5129e65a6ba5392555086ac560721f554a5b63448cc4d1318e10b1f5c323ac8ce5dd1427c5330e712d7c78b762e1a1877e24265b7d91b23529e3d495d5fe300b970
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02735674612cbc52_0Filesize
3KB
MD5e7fdae9f6ede027bf04a2900f7ded3f6
SHA14dbb8501c010fddf5f472c8df9ffd32e83bdb10c
SHA256a2682d3b5aa642adc10d8ca2eca0a7a2f8e1f1180fa46ed0a25858c176cb6bee
SHA5123fb96bc375c798e6318a184e52a25f9403bc51fa42851b1f5c902c3e2225f304778ec8f011b1165ee068194922f16798adcd522669bad42c67ac66b36e5808b0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0580a8e1646d7bcd_0Filesize
42KB
MD5960515388b77d00e1f79c2446274bf1b
SHA1d441b246f23bbcefa219a3c8a5ba4c0859d9e0a0
SHA25637c9d0886027441883c766458cef800bd248d4950e11ac1e2ebbef9f2e54f63b
SHA5127e9cc954b8375da674b614600fc9ce7750da12b4c6da09d3885fac0a2177bd449144ba4b775bea8f93265e771929cf66ff1d1fa205be8500ee1a96bf21be74ee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06450eb6a7b09545_0Filesize
2KB
MD5cef127a28b56528bde18ad85b8c13850
SHA144b15e84a749101534c71d2be670e21c4f82da2f
SHA256d0b0c6d48d0af6e9e9ef0734b57b38fbb06fdb20a142e21844b883445f8a05d5
SHA51247181cf90e3a6a74e1cb3887e24b8cfab00d614861f12dd56cdc52b2694851c572535e6e2a944213f8dad92b6ba865bd37549ddc4e436018e50884406c00eb36
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0ce6240506261827_0Filesize
2KB
MD5c6ae917a229c7fb1035508eb3c4eb7ca
SHA1601c234a8d3fdba6f91a6b2178bc0d11ff4ce227
SHA256ada21fd7b44e795bb170357f77c7a2610089ad634a7eadd2b68d2597c3a70051
SHA51279d78cd1d6bac3b4472972db70e4cc4d9372b56aada08632a9e82e57ce7a4de42d161d17b08dddedf857a3c55e296b1b908cce3854e1da3c2afe6ced5da51efe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14ff8116b518ca2d_0Filesize
2KB
MD5374937baf60851e0d30c9bbadf75ee1c
SHA1e12322f08a8b5ac3b05e7097417e3116bb9b2ace
SHA2564f2d3b1d32107ec4bbaf9d238f914ea61984554ff339016a93aeb37f7a685cb6
SHA512005c8cb79e6da7c5064e200b9d72fb76dd94efff5994fa2caf94f5e453733f0861f03d388a317878cd7e6bfde6530fb51e407918c4d61d39f811af16c31222e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\252c5afb57e673b7_0Filesize
1KB
MD562924204258c1c6af6cea8011cfa1713
SHA1ff378ea6059f87c8dcc2a4d78bb22022891ffafb
SHA256205413ffda45b64c4c474c3898be981452d0051977394ec177074caf0bf6bdcb
SHA5129508d6a5033fe6b0d7417c807995c2b388bfb9437102228f21fee782f0522f1ffc157bd96d205bd27fcd55942ffae297410be7e7a48b8770bd4cee1b79bd2ba8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0Filesize
3KB
MD56fcd7da38a7dab3b3718f4cbac8cd731
SHA184a65786334d8f55a4b45a9fe02907514e6322df
SHA25643667e3bb16219339a2b6be325fb9fdae2cc29609bdfd89d6cda02d4980c771d
SHA512e48694a9ffc454192a8c576014634daf38620c7a249127645652954a1013501a73b94d7a797959be228c5c2d8487a054dc2fad34a6182bc692b77e3f523e5124
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\28324e9db7b11193_0Filesize
32KB
MD541a3a34f2b6a9ad14cdf496bf53e0687
SHA180a5dc2d6b3546016d2882bc00c6065646835a81
SHA25647eff1696549d610fad22ae5231c5111469ccf3822cbbece853cfc0dad657544
SHA512a1b7ae40259f16a899492f68068fa08665da200138c5c35c9eeee5aa99aede14518c2c0ef51722b7a7851843e230e0c8406a6da467956b973cfe1e26531c61ce
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2ce29dfb4fbfd6fd_0Filesize
5KB
MD52f3b8dff7e261611abbdba9f8c8f03f9
SHA1bd5b1df0e99fd4c2dc09d92c6ed806af4e62f23e
SHA2565361058a930ba3e2d6c04a8f1a8ab50d7cde8ed5aa5102d1a35e272346d52ddb
SHA512e08e50c1c1d03df31ef3a90c3cc860cb854c979d2a2b2b45ee2266121860a1704803a9e381510c7ec0e1d3895343636cc37cea72cdf71bf700839cf7d8e8de58
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f272be2ada0a40f_0Filesize
307KB
MD52f2f62c35c1c60bf98cbd7ed0de8926e
SHA14e7f9032b55c720373deac44fe2a50f3015a526d
SHA25669851d901c62ebb8ca7e17b24d80f7f2e5d88b116db01a9373b9d6034adaa11f
SHA512b7fd1cdeec0cb16ee45807405524eb03f96343503194c9c20499dd7af24ab4abe0e72907de79727be27ac7f2d691ce217927c89e5b0a7363dc9a3208adbfc24a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\33f0991b0c05bbe0_0Filesize
5KB
MD5862f68c45378abae257d55cfe8584263
SHA126b30674d4e70e75ce8744af31fd4ec6726e8641
SHA256a67e67e29c6dcbcf01b31a63374b91e60f579a14b6260aa9f7647509ddb7d497
SHA512c1b648371613742af88d3843d289a38a789c3d131c7e8ce3882cba22c6191e976632ebf71b87b4d47f6f06155250c62f8e6cfe1ff3c2df46dfa36d803729956b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\35fb661c62eb428f_0Filesize
11KB
MD5552bcaef9ff9cf29f3d6eab69da9379a
SHA126e5033dbd41e7ef972fa2b84f23f7d816064bff
SHA256dbd84a011092b29b4afc9583d7e82cf402b50fa6fea84f7855003283a74cff03
SHA512aeec9aad0a8f21181a1be72726dd47b8e861951cbfc2ae3867ab8182b39ef89bee0596b2da2b442133be13be28795509b0526f62d8e2cf58d89f646513df8d4c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\388ded1aff7f2aca_0Filesize
3KB
MD5ff5014aaa92095982f470829328d4b15
SHA11ae936220f41ee70c7e80b9263ae2ef7e9b3310a
SHA2565aa76ba8463692894b733ade6bc0229c9ffd1984802fb7641324c907ac7e3618
SHA512c441fb38b113b5a81f8141b3d70d9eb58bf7be38f5de9cfd1bb111d24428fe252f1a30f4503d55cfbc5713a7da4e876e43563bd0b0539771b6ce420ae9dcc4cf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3bdfc5885239b388_0Filesize
4.8MB
MD5058c695e4f68766c9573746edb06d423
SHA1af8bcc5a15f08438bfa5c365ba97cbea1d2c0526
SHA2568eaf272465f2c20aaa9671a64b17f0f94bf85a22c667d28390ab397125e947fe
SHA5129e98766fd19054cdc96e4d1e6fc474bc125da9c10ee2d4013c1c82dea1e524f32123f8bfe03f99bdcaac33a7aae137ffc81689f07b357e111bee45cc9d761778
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0Filesize
1KB
MD5b5cced17ed9683ffc7a82de19736a920
SHA185826243eff4de46a2befa4697230abe427f94d5
SHA25636839c5b6db339dde9ea6d80938aa3718208cfbb88df0b230f41465544c84cd6
SHA51299803a94b42a2b3ef87290407e20a02afe7e36c8a4716b1ad2d87433a601a669b7e1918cacfd04343e682ab50c946ee14f1d2be5f5fe70031bf909fcf8d3051f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47d4e623e47f5bdd_0Filesize
262B
MD5e1f792097e3f148b00eabaafa1426478
SHA1dbab989858b61d67b04ff25eaf7dbc5662c8626a
SHA256dcc03cb5b93a5fa23db01904473d95afaf35ab2c5a259dc01e31a5a800798a47
SHA512022eeefb84d2d45fcc961314d11a0844c2bc09733ba27b08d5ea17d2b6313fef8b4fc9e82e32d0cd8507bd796d1b076624bb42af344bd61fee24dd9e2882659b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c693273baa0190b_0Filesize
10KB
MD5bc583625654a53bf804c01779e43b8a8
SHA18286c9c22b50f5e520d68a110f4a157f73218a7b
SHA25643daf89fc794d7ebcffdc402449af0fb029134012a291c8234443f5e56b6849c
SHA5124fda43f49bcb130219c03061dc82697ff908353dd4b20d9b7908b99d06a05e39e09437a464949b3090487fce0660bff40f4cb8fef91d1ed2893ad3fdaebd50a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e6742505c79459c_0Filesize
3KB
MD59553dd7cb8761ba5f7dfafece7ecdb64
SHA1a155a067d6f380f7a2fd83cd82ba887257f450e1
SHA2566b8453003d9a7015a69399a6ab546689bbe7a8e56ac4eafd50c8de7789b108c3
SHA512dc0fe7aa92e77dbdbc65beae851d2e9407ba98a7e3569165a0d333ef50522dee0602ff50cde2c6e4e0ee814cf0674dc03d44e4c4c6ee775ecb7c29cb4a4a8203
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0Filesize
3KB
MD5fbb7429b16185b4248ea5001aa030186
SHA11955c1c69707d53f8198a70fb8367d0899ce2083
SHA25671e110c0e9e626f8493f820d87f667b079d9ab1303e675be2a780f9fe0a88580
SHA512b25c85e023df62c082d4bedf6e92d514407b84559ba4219fc3f29670c3aba0c373e75635c80d7cdf8f59a057fab70e525cdff259f317074791e7b696de65b262
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5801d3329fb36c59_0Filesize
2KB
MD553fbb4924efd8edc93a39f5723b4da00
SHA19c10483cb42f4cdb1deaaf38d13435745503cc61
SHA2567d675324a2e13cdd4270c9b519f917554cddc9f078022ab029245b8421da843f
SHA512f25dfd2bfff204d4c01be34a3d3e71e68188a80bd5790a9439a0780f07362efaaaa9336697e4648c0e4cb4397b5f19f2f88e27cf07a47f26277ee3bcdf600b10
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5901cd6815f5b8c7_0Filesize
19KB
MD5847ade2bc2df155ff629d3853ac65869
SHA1f9f88dac2417c7f435153da1d9ff9f32d18a7e38
SHA2566a074c9deb6ed523254004e7281410734e4f9c8a2164ad17f3fb0cd79282008d
SHA512bd6555e4150869d205c9dfa2e45e8292ce45267d47057254ccf38b3318c2b4965e42eb9ff2cad1438fa4ab8b245d58454758426c33256e65d8cd034917622767
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b4e90750864db1d_0Filesize
433KB
MD53625225e68221fdbebf413aecd76d776
SHA1e805e6241662cabbaf5ab3789373d1b485f817cf
SHA256553d0361cb5bceaf863c09c9430f8c155d3342116f5ebcb8104be261bcd0a54a
SHA5129f46db85ebd22963f872ecb0aa60aa4c4eb703070658b1fb35b48f7a1df1146763a6f7afb06ef1f7ada4a746d174a2285502a4e37b83b19c484e187e8b7bf463
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5ebae3eea1f01edc_0Filesize
2KB
MD57cfde498c46a04651bb79816a01a3236
SHA1421bf5aa8daf5a70cdb98270abbd9fc0b38f2f99
SHA256dc9ded5f2401e71f0a38d500e3b7c2cd7fd391ee704edd1f44604c33c2f77904
SHA5124c889de2ddf36f21d477e38c9ef59279f9240420dd8fddfaa6f37b04b0ea565a24a98035dbf09f9bc76ae692b4a6d06f69fd2bcac1063f8a4bde9f367aeab9e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\62f20db8aae8f96d_0Filesize
3KB
MD58986fddb72a7e403cd89f2639906ab93
SHA133b4ea1c4294191306bddee900ff3a4ec8b768bc
SHA256c957825affeb2c148545b14e0d14075c6abde03eb269cef4b6a4f5d5f2bf132a
SHA512b636c8f37050b9e43b55ca54edce94e8cedeb76938afb046077189bf99dce08cc8179ad6b2c22019612ec37bdbdcf0b68fd55b9ba7e27aeb35d7af6f274ea0d1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\635e64b37935c888_0Filesize
1KB
MD5d49b2848390de132c593c20f4a63b474
SHA1775d63d8fd20974df1e202ba56904d0623fd75d8
SHA2568ceabb781590072c2bf558eb1720e9e043e81fda8f0e24267262de562e75598f
SHA51263737a4dd32a4f85a913f3756c8be4da262a2a053d36181edabbc143871b92e0eaf12eafdd8ffeaa27f97712e5ee76290ab1898c4c295315ccc74dfcb083fc19
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\63c6995fb9eb98a2_0Filesize
2KB
MD571ffe57116f4a8a8a9cafe278d506c13
SHA164612c6769128dac60943c8ac8e8b386ce23ae9a
SHA2562470c561b3b41ea0e5e9fd1f5a5d2505371324b799b32d0f9c076c3cf3d4ccaa
SHA51284dc06beefeaf600cbc9c2c5bc621b60f63ac15c657b251d8f6815a58c39027957048ab71505b2616a98c894a6d1ed041e81611a10d70937efa603a9ad1be55b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\64fa70d4ab69732e_0Filesize
8KB
MD5177b755c025fca2f70293dba4895fb7d
SHA1da6bc831b273275d1c0b92538fbde29047e4900f
SHA25657e94fc5e90f227e6152b691331a758f66c1ea7ac967395dad33499bd22223d8
SHA5125ca7098b46237f2a7e2d2b896feb0ff2289f074e6023d8f5ddb28adc96695a83e8f50a346a61e9e4fe67062c1b4b6d7f2c314cddbfea3007063a502ad3565110
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\695c42f61090a800_0Filesize
13KB
MD576188edcc9c3e576e08941a2daf064ed
SHA12bdb6beafda1a8f8dd122a41c72f6e24a8dab1f4
SHA2566eb1c7356312920598ef9342c084d614fe5e42dec44f84d2b0328ff42068004e
SHA5121c02368ad7a2f244c38ad30ca31d587bf983b3baeb8a1ec02743b74d8da5c3630a0577d78eff492ca88e9219a69e29cd50840d4e48b3a40c2b14e53ed2f514ea
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6d3b0ad57bdf7db9_0Filesize
1KB
MD5714fb03ac3c89e765b49c888a5e35192
SHA12e8c4ff6db06151d6e5bead05f5148dfa24dcebc
SHA2568df22d4d9d1786ecade184260047270552abeadcffa1fb18a6e6e4f0be866b00
SHA512ef4c6b0535f569729be232be59f7ae98abb78e32baa98fcf4ecb55cd62244bc6074189b20afd906fd73485b6719e364e1f40680f06d57ec981d88315b1a1ef62
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\718aba49c9504085_0Filesize
2KB
MD5bcf3ec686e62d118de81cc730b29eed2
SHA136999551faf5f9b196af16a17fda1177036b9d27
SHA256bf12faa68643d5af32d6d0eb2500f7bac5e21522df8465b36c4b1725349a5331
SHA5124fdeb146c794b918a4c49cca28b43fb4fbade44f53e8debb2165a6a51c95a6d0668acb42e40a222cb2a74b0cc15a083e76bc51902c4fc8cae512da5b7dcf79c6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\733a2ebc15407e86_0Filesize
22KB
MD5c5ebdba3e139ba9c4a1fee04bdbfe492
SHA1caafc529052606fce4284d27040e334348e4c86a
SHA256c8b800752256877bd9b56a4c7ab1d8de095117e5a51e9e08c4618ff6525e314b
SHA51294617eec0e64125729078d66e19234c04e9de8b3b419b4ef5d1538c2d3c1f5747b2a94aabe96b7b2d45e00b80ee91d8515eb138959315b01732521eb5ebadfa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0Filesize
2KB
MD56ce060de35e8ee61d564377fdfedec7e
SHA17e9a15670c212ea5aaa3d9c51b97c19bef486eb0
SHA256333a1b9320383fc4aa79fc05098e56b45c380bf936d02fa678455f62b41401ef
SHA512044f048c96a3592dc627f1a19e8135f9f7d35aca144191dfedcda97b8ab5fbb6cc5dbfe31b9597ebf258eee26f5442a16b824bc0886f5838f671e7e71a200e0a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\75c1dffee94729dd_0Filesize
5KB
MD5f20bf480bdaa03c16c96dc7c028b6384
SHA16ffc40183640de098685d40bc2d4ec93ffb23e23
SHA256f29925a7217b81d10af6b38224c71e13a8e80baa0a0d6ff4f1fae329c3d04ea7
SHA51207c36d02ef04aa267dd6f72b11b93bd038c11e11a0840eb757d53862649ba387e0cc03c7e7f6f07de0ea66030d237c81c33843ff0dcdd021be2657ae6f2e8b6b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\75ffcd5862ddad45_0Filesize
2KB
MD5f80af3f2b4b40b862c4870a9e7be27ca
SHA1f290900db1cb14c3721916ad8415ec11322c04e4
SHA2563326db010937d5419120a21e7cede58ae9b52f345ab3902773674fe4049f53ef
SHA512558d88d1da211a4ac3997ae144e5585e7651d9b9d6c486697a31e09c7a92ca0bd719e02f1bd01789b96e4a50730b2b348fe0ac52f203bf037075152ebb47873a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a66a1246c4f29f4_0Filesize
12KB
MD56d9a08bfb7996d83759eae2cf63a11ad
SHA1170aead0bbacb31cfee013657adb948c3417f558
SHA2567bd123f340d6e55753ab247014485f9661f5a11eaec777d18c43017fe3d8a7a6
SHA512defd78ceaeeb5c9abd59c98e4d324a33a689b8a0ceea584fcc5859f72dcb1bcb07c1e09a65c5b58fb4ec2d2a9f5cb53fcc4efe580a64da310f0beaf0c9bee2bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7cf9843337c39c04_0Filesize
1KB
MD589ecf05eca220fa8b07688bb61f964f1
SHA1d1ac42ad05236da94d99cbecd30d63f52d49c2f8
SHA256cb9d342906974dc59aebe89d5f053caebcda1341d89a3c6bf3b782042477d776
SHA5124ca236a50f215f76550f3c11be756e92ed8db323d0a56853694a0187408c028cfacc0a8aa1a7eeb8144ac27e499def10ea3f5ea8b3e6603c767f0be01ae492ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\88b955edb6eae2e7_0Filesize
262B
MD5262fd6045bbe63e5c985aa646dc0fd03
SHA1d84a96b35c0ab0bb6675421ac6e71a6d11cd1e7f
SHA25692096805ac79bc08449e85750407d2683e82df0c5e64e4cd2889eaf4cac66c1b
SHA51284494e8f1adb3c741b3704b47c84de073023ae53c7750361c64611e0379e881a5c894320a250b7980b34ed9e1900d93bd9c44b3a3175e1e478a575c513d15bd9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0Filesize
1KB
MD5f9cbebcd200f477da0a3a24decdf6aad
SHA1670d847b762711b64c9c662762ccb118977ef842
SHA25632f40c4617703a306861dc0fba355ab3a21cdf2fc07204753a5d98eb51c6e190
SHA512b0a04b0c89070dd1c43adb4ddc1b7b3f1b4a5e9c31b125b7bf4c1630340eb5b7b9997d1f0d49984a15b58f8dad63bf7064249964b16361e4e9209de2f161d180
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9412c8b664751f90_0Filesize
2KB
MD5dc7af9ac17da695d9fe172129fd25b8e
SHA15bf835529b81c8d02ac5361ed46788627d2e6c95
SHA25689427cb44027b3dc2f410e0526c7eff3561544b8213ccb790289034a8c4f0dc3
SHA512eb4b04cce470c53d2af76ab13726ea5b9af553cc086a2bb571a3f34088dacdb72c91801e0a023c02cc1880a4d5cd5f44d49a43acb8f2bffef77447efb0bc62b7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\94ebe1630900d094_0Filesize
20KB
MD5911bad03721737e046e0024288e9cef7
SHA1668437651f6d700319eaf9a682d1037791ddeeb5
SHA256b0d889c83a27352c5ddeb26af936cc35484dc18586f22f2ac192425833bc22c3
SHA512e8fc402394892e12f6c0bf7037fe31ae6df565f036e0a7c539635ea094e8cd3dd05e503401ad9b7d8e7a0c0011666e5ba4a3761b5a242f846280553aa2d9838b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\960f838b42b585c9_0Filesize
3KB
MD5d281659ccf3e15256e722ac5a63c59b2
SHA1b770fab5585a70e556b34ce8af4027938c70eb66
SHA25666eb53edf7dbf1114768ae37f7e937898be23f008cc7f76df21b09372d14125d
SHA512346287dc55aec675a1181d0a85ad2d2eae929d055621ea33ecd7c236045a269cc0f423be77be9558ede19b506601cb24f1cdb0bd7d4f9ba18a86062ec73ddecd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\99110e9a19c3c06d_0Filesize
4KB
MD5db88ebcba13bbac0d818f943be3190b9
SHA179f72ac0e6cf410e026a393b1ed0286ce2da40b2
SHA2565379f7d2182798aee982bd04764bf6ba3c531572aa4d73407651b2084ff616c7
SHA5121e458a94ae432c3f32bafd8342ce0ccced02ded123bbc23c0bfa1845b9431cece1f5d7428b46b63c1bf26b38a11b0b110e00259bf1a008a70856106aee95623e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9eb49b832d016644_0Filesize
262B
MD566dec16510ca56fd28274ec134db4222
SHA18fa4e27809bccfd40735400af04c4bd256ded478
SHA256a857e7fa4f7dd118b78cadf0de76daed38f3ebb4c8adcf5ccec9a74c5640b188
SHA512d4ffa231eaa6dfbc55691590df57f45893aebf8967b8bb4368a1b89bcb511859766f498579e9d9994d3c768610a272928f8b7dd29c01e86a1f63a92f65046859
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a09f6271ad0c4092_0Filesize
47KB
MD551a0d6e6bb13f8de9a02192c9e653b20
SHA1e3401e380c3f3a20408d4be5620ce6b31f98a21c
SHA256883414af5eb051c6188de9a6cfdc8b5bc1406003d8e36c28a0f9d69b6f86587e
SHA51278596b7e86b1309abc0590647c5410e8006c9d8a6c202912fd4abd0682a46e9d7f7ad2ce3906680cb05da85299494239fb92e6cf7d6f105199183045c0f5c0cd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a37ad9a49149528a_0Filesize
6KB
MD58e2f4744302459548107d3d34a38f153
SHA18846f025760283d6b74c72effa6bc56d14a2a9a5
SHA256e8d436c986efdf3f308e9986bcc3f9980021c7622f29f03e7af96621e85c8842
SHA512513ef7cf0fcbdc7472731fbaac118c860e03e4aa10e4a56e504182de4734897b3bf72a4f36f1c6293a5aef5660247080bbc72fcf0e5f3014bc5ce037195d8572
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ac9b40a0411376f7_0Filesize
1KB
MD526c238743f2faf390d2b518494d236fd
SHA12ec74bee86e090bc9bfcebae1e2a1a527929a2f8
SHA256d3231aad4d0a864cfde55b9ab6ed2d4d321dbbe2f9a0e2e189004120aecbb3f4
SHA512dd2441d06de0d9ceb0e58c943591d65bfb1da1967b312b084719713f3b4375fd0b7e944af9684a270859c2ba7446154f023dc05a75bc5c36f0edfaef5d1e09e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af48edbd3578ee3b_0Filesize
5KB
MD5e2660ab4db18d44883cc90014fddb9dd
SHA1eeb14fa87e59e68e0adc19be2c3f685cb45d23be
SHA2564a86beaf94ac27ca5cb1f5668ab4b52ff4bd05923479c4d7d3e64e9593d15d3b
SHA5127da929bb2a135b77bef191ef8a3ac15f5d2017bbaf4f2f610ffb4e36e27bd7ec5372e13e19e38c4928fa6bb6e56b4009d9ea873106dc2af9ebe3eb48f2f09018
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b31d132250e09b6b_0Filesize
5KB
MD589cb341c471c400b708c3878409ddf28
SHA1efcb0e4d01205defd08b69940e4cca0cabca94cf
SHA2565eaa43dd3ee9e968b5b9b7db593eca3c75426b1ba7b1f0a6ea8794db63e49d65
SHA51251d59d4960b50bbc0daef584b3c4e6c1c633c7ec6ed7dfb21a751a07567925a7b73f78225fcf4cb04d39cac94fca659b013a839a76fd1250144edd452cd31fba
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bbd3a3dd511050fb_0Filesize
26KB
MD506349c0f9e6747461a0a621ad9981fef
SHA14cbd094081a6706b3b4551bbe900ba1dfdfeb51e
SHA2566dff0f89c7a53760ad0eab095e6d29daeef068bf8825a16320254cc97cc72b68
SHA51217098d6db2b57e04265f91d70c78f063352105ddc04dfae514367f573733f266c9bf030e54638f397fb38e5d3d3dd231a3a85c3751706563ad2fc95ba4800b5a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c6ad28a084c2cd20_0Filesize
20KB
MD5776b5905e70130d49896cc9fbcb77cfd
SHA18dc3260564dff6c9b6da6991de6b0aa8ad425934
SHA2569f4ee098a39616c2c69afdce9e3c6fcb29d47cb15344d32bf72052ded8135b4d
SHA5121a2fd1794046d7e8f6c0ac670ce47a89f2a620b53917749fbf9f9a02a6089ace08595f634997c80db5efd916f6967040a5656a606b86ab42adc57aed377271a8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c6e860d208c8f654_0Filesize
13KB
MD5c08c07da0f6d61af3c70a9ac13f15abb
SHA1cc5e3ae7f7e7ce7be9e2e7856c8a5933641b0b4e
SHA256912d172fd3af26806dd0495f70a1b1d8d182cf14f93bc88e2ce969ca66fdac75
SHA5120f0bfb8e438cf6941f0bbf299a681b74ceb32e6b6fdc64f97f0f51d0ede4e83a982c1485811e14270da11af57495d23958d9ca168ada6014d08593e986cc6e23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ca08db5c7e3a99df_0Filesize
175KB
MD5130312dc42c109a68ff4307e3675b33e
SHA10fa462cb3d7110a31aed74750b9a535fd7d017e7
SHA2567d9feb256a2b17dff68cc7e38c01a0d12728a35e8df949cb845dd8b588a703a4
SHA512bb96ced64c00b27cc63a78ac32ae55348bb34dc81efa30963344c77515a82c31edc5e0e162e6c3b02c639db552c17c2d7a85a838322bcc66587912b8aa7db562
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cca6dff0f171f457_0Filesize
34KB
MD5378668e481115f2f8369ee49a4eef478
SHA1dfc0dd3b7331c978550d735c7c1f424fdae77bad
SHA256c7feada49716b212c5ea251603f62086a77a20877831eab955ffd09fcb644615
SHA5122b8843f87dc507aea4b63d3bdc986052ab8173d1059292219577d1f8850a73d4b7891a93dc8d544659d5a09beea9ce9ca99d59c02ffe80c82ac874e775c163c5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d00019f29c31fea5_0Filesize
3KB
MD5b1d031664f16ad12af0e6914e1273491
SHA11894b60ec48a762b62aae74622cad71737c22220
SHA2565bdf445baf5150c6bf9f898194cd465769f348847548bc421701121e2fa55dfb
SHA51293274cdc9e8c72cceb477de1c924abb5db06227d9bbc755a3321e0fde75e71ad53897e5f32b4464b056c969942f493e033741dac9278fd9006b07d4dec915e41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d145f69efc16229a_0Filesize
2KB
MD58e7436e0b13bf082a074b70bfc4ec12b
SHA16b45e5676aaaf9e382d92baac987eae671ab0c16
SHA256e8701c998605d12bb9401b26ca67bf7ac092cc9082131914807bc99ff80eeb5f
SHA512e225de937b0c7146a3b64c6c11b3633cfba4e8f13c0d7bc0d7da0fcbefd1ef8bcc97b0baef7f90e8846325afc6849e160e2a239bf055989fe8db0931848a8f34
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d3dbb3008455b523_0Filesize
262B
MD5f9e61d361c97292b1a51eb7ee3ff1ba5
SHA135733c9fcbd28c1377a6f43fd9b86743a67a5512
SHA256208aaa039beca38e1fac0026c8573edee8957a1511574f8bab982f0c69d09568
SHA51201cf146f19f0778bf1b1a4b36c69ba031f4e279013d98fae7456c2f6f75c49c052018b2a7ca6200c4c85123675eee95f33fa689d3034730809e3ef60d33ae237
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7a29efad91a1117_0Filesize
262B
MD5654bf4fe1d9e9aa511357178669f3161
SHA16ac156718807d93556cc75b6ace464da60e9a770
SHA256f15e976ac2c0cbdeee4bd7e93f9f674a38a17fc138dbc606544315b7b8f5a7fa
SHA51277c6590b4bb72115dc6093046bdc0693c9d85e870e331af980759fd2c0f44b49929ced369565c947921d06ec783199886dacf803491571823621f252f138b2ee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d86829ee97a8a592_0Filesize
7KB
MD5343a12908fecd0b7262c3624601e3b92
SHA116036b0260f6310d4905c107c1f651e6d71777d1
SHA25679ac8fea34a14161c3d262d812d26ebac6fe4d3a36f549636359877e17ecf754
SHA5126a339e6b13d33368e4b54425941f02e713c8703d264b70a5af19504b610a9c2eb62c18dc5e69d76b346c0dadf0da834ce1de11ce63c0e0dbffbcff84df7ccd51
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daea348421cbc209_0Filesize
3KB
MD5a1b4a27cb88c04b1a0541131a37667e6
SHA19647268f690ffc27ee6b46c8a6d241e8757d10ec
SHA2560ab450366ad6f9dacd0ff1c4a49dbeb1209f9d63c57820daf6c3ba2dc3d38ec7
SHA5122c500ea8356441b871e23dfc2cd4d6cb7eee8be3cef6e9a931ba54c1b5d086737a839e6612a3c6c04a725805a3c2bde11f0b8698b0af2bd9e2a530ebfa191efa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db70d675c8a8462f_0Filesize
8KB
MD54a0799f450569aed587d0420f6899bd1
SHA11975e935bcfa551973f828cd3364cf4fef8bbfba
SHA2569e82e8de0043bbddfcb57c1fc987982bd071ff5358cc28df7425c0e98bc7f5cd
SHA51257d073d7527cae37d20c39cad4d17913aa75830525ea9f48cfc486dd31d08ac81652cb2f0e1300bae1f6dec71f7b3c430800a4ad030539170e981df9146e5266
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dfecdb17649723b4_0Filesize
14KB
MD5d5e711a7cc89770139a63c56c574000b
SHA1da005e4d8fbe2e49ccdacf64c614efa2dfcd1403
SHA256b285cf3c53f7753395995367b0c5a7e4f07b43b331b9b360f54e201ad2bc3a80
SHA5123966f4700dfb7f36c92a773799ce177570e539dede44ef4d89238aae5a9c73c5a4dcfa5e1e52036b8c5a4b548140f7b1fa9437189c52d3140b1eb060864a5c8f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e3d18be5d494e38e_0Filesize
2KB
MD5c4656be0187b4083d92e9765088cbd2f
SHA1f27156fe64e0168ede4625f506e2723e25cb38d0
SHA256936e4d1c6ae1fe18271e7385ad8bbe19ec7a0ce4d9c784992aaf488ad71eda07
SHA5120b0b3a02796f67e435e78822e715634b9e2dd5c557ee047a1c644cf9f29a47ba5305d074ecf3235a42d92ace7d4dd87175a128e41f0bd78a725564571a6de3fc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e52ae3fb759a78f0_0Filesize
262B
MD584384bb77c338ce3435374e7154a22b0
SHA1e6dbd22f6fde8bd592fdd4a97e9ab846ac7539fc
SHA2562bc4e2b2b30e4203669ac4fc0b59cafb0e08cffcfc667b122c897c148ba643c9
SHA5123783aee265a73ab9c415a9c96b701a4bb54538b472ebe789200aff34e83f06174a7462dee4f554633d37f2d1809fc2caef60011620baf5bd2fef229f47389693
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0Filesize
2KB
MD567e3493dd1ee8705dbe411a4067802ba
SHA1ae6deac6343b24e8d64fb608cb3d2be9571e3632
SHA256b8503bf8d4e7a876a40441a9caae24bea07439edd2a08641a36ab86ced7389fe
SHA512fbef84f30918625baad15877175f3dbccede15075e8d5469092bf525cf32c55cba00295185108be8de64f3b32688fc7bcdade90be03ccd40bebe1c1da836264c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e77f9ff417c720f4_0Filesize
289KB
MD5a20f13c6e4ff53af2e48bddd8323c9c6
SHA1e0db0bad1a4f67e4d331d4faf41c0b3e928b2c7c
SHA25604e350ead6e9dfff73466fec9333dd95a53117ea5d4fef056832abe9ff4c5e7e
SHA512c0cccc597a5d97810022c2b321343bea8441fae90aee099997dee2c645d5e036ef507b48359cb5a29d62871edae19c1f89794982b24a22b2a5ce95f36ac832f6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ed53b33ad082a1f9_0Filesize
158KB
MD5fd7884b99edc67d295f3f4a5b4daf6c5
SHA1faa7ba91404cfcdd84ba4410623d07c938f1caba
SHA25658e0d04354684ad41fafb024b692a068f9cff9c3794f60e847e039c1066834fe
SHA5120d466f6e45641db6b9eec3625dfc65ddd0bb54b02699b8e72d0356a0f0dcc7d297d19ddaf4269d38fcfd4268f65e81cdf2a5f27ee6eeec6e1524689ca0c95a90
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\edf801781e463cb1_0Filesize
10KB
MD58e947804583b49006ad42a19166b37d4
SHA1853aff1259c714ef1b3753adcfa7753c5388b9e6
SHA2566afb8349ae57250771c837e6b2a8e24d0e1253a00142e61351d6df1b38e2c436
SHA51263832d72a8a3ad57471614d8957747f905ebdcd9ad647f3f731483adf88541c2c8b9233068b0141005dd7460d59f44dbd13df99f247e9470ed274b4a4eef60ab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f078f5fb70fd150f_0Filesize
2KB
MD5f95c4b0d5c6befca86833969399b5251
SHA17d9152d61db2e2aca36e42a4f9382291a7857a24
SHA256d756fc964499a046c9277cc085c369bfaee4dbb1f789a577e4966fb2d12e3a3f
SHA512edcc65d23facfd7531b6c600f30f0333df40e49a4b5b29b9d9a7e4d06b9d4ef3e4fef45f08dbde4464dd88cdc62301abad16691ecf511b9e5814d8fbf150f389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0Filesize
2KB
MD56ae186380518d457848b573f2f81abf9
SHA1bcdc2eb5b9e4f614c14eda5ed778b1c0e748d83f
SHA256a668e60dca6244cf64868b57184c3a582daa974aeaf177bd6ffe819eb0c96c7f
SHA512bbe1badadffe299e42630c6472c1aac76509de07b8580c27fd82f95bb8d74755cb2f65d712dc08ccd492968b6174bc1fc9836cf047659aa8ede8701da381eabb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f89251fac2b69325_0Filesize
3KB
MD54810bdc488e317f694075bf3d1de3f1b
SHA1f512740153fd44df6ebd34141b9508f38c0eca40
SHA256bc5ad10dbdff520b9f37f45adcc0caaee9c8064cba862032d3bfcc2c58f03063
SHA5127a37b4b027478f159383c63d4b901a9b4c8cb1f8e1fbb53da960bd86aff961d80038edec9541e3192c1bc1ee6f0c1647589243285ecbe4879608724e9b48df74
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fd686ebcfe320b4e_0Filesize
110KB
MD56f0b396e30a89e8ab67bd3a8d040442e
SHA18e33858d29360c19c08460feb9b26ba0d22b9942
SHA256d6dd20de68c46f0b49baca8b1acea2ba156721c5db8175348d25ba4b13878fc0
SHA512f2c79d325d1b576f86be74dfe788362e1210176f77f39f16a8fd1507f4ad4a067bd99e0d347efc112a75862a8c496c9a7f73abe20ced9d40de96354e78479d75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fd691ad6ea892cc7_0Filesize
262B
MD5de349628bb022db012fcd3f4088496de
SHA15862290bd47fc406b97af12f1c389f4e15fea36b
SHA2560d3160665f9154d68406ad724b0ec3cad9040954c5b13463e46d7b5182ed4d51
SHA512c4c7d9273c1aa11262f4b00f7058c2286ba54676a36931ba048a8a3bfccd6b621df5edbcdb48943d9f77463fbd07b155cb4d613ef4437232ce043234023c6669
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD59a2b01d1f049d128f71f253d3f3c8c0c
SHA1a52bae28ab62f789fa2a70982437c65a6dacfcd4
SHA256a76cb1df06d46d94ea78fe110592ea945db6afd1214d51934cfd78777ec1d302
SHA5124bb3f18dfba566c1a13d9dba9b20931327e9bcae32ffef046b7631954f15f0cc8b25b8ceee8d124e848f018d290ae1fc54736b28a61d8620f36ab5a1fb37ce65
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
5KB
MD5ebe4c46e27548e53af84ec7e7b55b069
SHA1db10f47ba1b8b91c9f450e8e81fa7d76352a6a19
SHA256af1606d0bb9a6561d396444da8899669aad67d2487f80d5730eef7512e1d69c5
SHA5128ab3d70e735be5924446062ed175f65ad878e7ce6a2ae4b5895b275a28c04ad2dfa6a95d1955d638bf830dbb81c9c0e9704fc6a47c4e86714400155b83a021e1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
3KB
MD5855c664e7dd707438efdfb7084c35498
SHA1b15c82cdc87a93c10ab1f39b95002943eb0afe7c
SHA25613c96598b389e64d84cd4e263211d4f2f786c279b4e26943d9107363496fecde
SHA512af9355979b81dd27876f9a8951febfb56891d26521d1c397f84b6101af6eceb96498a02789c8ac46c86eca0e463a93c87dff9633988c3caef6343df6b40f8aa9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
3KB
MD50ce81bd7a2638b7961b326b098dfd506
SHA15a27b7ac58c50bc0cb83713f0e6158f8a8865e77
SHA25624bc497105167e3db973be17c888e2e1b5faf7b5194c0186d5a36f57a2568c31
SHA512baa371b451b2303ab117d75bed863c7ad88fc1183d093a9899d1a037c0e2f9f10dca31d21ee9b329fc40845509c4ec3e69fa6bf6c2e39f08079c6a3dd5ed87f6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
3KB
MD531f0cbd02af462719eeb0c9229810812
SHA1c4bb44cb3923ca39de6193beb7b438093fa82ae6
SHA256f293682765f189c2934ffe258d159a42116aa71130d083ddaf149a5db636ecb9
SHA5123d5abc60c78056367068888b370ff8ccc241db95d6011451305475d64e100f8a786d59f7986ae5ffae0487541716080637c4af57ecb7381d15f5318a4453cb76
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
4KB
MD589fe18e476fb6c7501a35df167b415df
SHA1635933c0ccf89a3c4e921a418f3acfe55f12c107
SHA256c7a25195039dee76c85874ee9fbe1fe468b8066cfb9692a006df8d11de383d4d
SHA51260112f53e72d089dbe81ab0e7b8c12a70672d3a499e934e6b21a6793619e5deffbe69e4eb86f996a9946e53a2dbc883aa77278aa6c0dd4a139a9607692235bcb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
5KB
MD5dda1668cdf07c02c0bd44345b156fd3f
SHA1414f65215d3affbe52fc05ce84bde6cfd0212750
SHA256a3c606c660c15c7963c534f1cf097364929864e8e9d85c16e7ca0790b39b60cd
SHA51254d2b55ac3d8f256c4cfebfecc28171d292f8ec9c49fb2bbf8c44d30685c13297418502f2162b8f0ee448ccf3710238c0a3a1e0944b17d92b8802cb54a707a77
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD5b01f5b770b68f2c78255d5679ef4a193
SHA155f74ee51674aada3a93549b83a1c961b891b902
SHA25630e888a9c0ae05962bb5be26ee0d290e2007141562c9d8d7d5b93951bffbbd24
SHA5120d78e6299357fd4c34df493404357f7effcdb0c9c40a6628d35ab4ae4b74d9a35e47ef37e684812a099f0d60ab936de6ec5d9872a5a4e0a64bf3eddd76a19b94
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD5d59d38afccbcb90b6a68da661afe5157
SHA1f0bb3db12f08bdfd6b634a135bc0af3e3c770347
SHA2569c1686ea0827aae028d453e42f0e1edd8a3c6868bd49d7c95cdd9d53bf757cea
SHA512cee0cd542f55cf316a58b93578a8a1ebf2efd0c4959fdc4bfa577b407ddaa4972108c8cabcb113707176b63a44f332cb68cfb8470ea745a3e6ddf7b78a20dfde
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD5fe3f18cf7255686bb0b4d22c1ec0a232
SHA13567dc8fac8beaf4e598e725f139af8fe190426e
SHA25698561438e30b194dd302d76aacc57ea064adb42147669e1622aac8132b8e29f4
SHA512d2b82afabbd76ac991556b2519fdd336073ece20e9d134eb855ddad8665e296c9a2fd364bc59b3c1c914a5e0b0cf10e9079d23235a2c41e3460da89256758083
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52bbed40cceb5b5eb89072f0679a48a55
SHA158696149bc564dfbd25d3d845ad1300d7b3d2160
SHA25677c591aab4e63549bef0b22f4aae186730af25514893f08366f4b01da4a27d86
SHA5125df3a10ab580456e1f5de38b2afdc06a7226baa88ad0a56388c7d736e766ac31d0cfa54f729766ffe09fed382ec8ee5c361827aa79c66a9ec2e3b88a2efb5269
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD5d99e216f17e7c28e9916eeb5ada2c4b9
SHA1aa9877551c201d2f72b5969869427c7138a33e4c
SHA25645091e6be3718f6ba6a61ebfe4d96c517d70a346f5fa435224ce9ca0309a4234
SHA512fed257fe697cfd645f76b08f513738d8e20dec58877fe7dcf20602525b338ec02a81001b1cb7ae51e307aee4746ef0ae1ae4447bdf13e2f911009d2bbe96c22e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD5a10e2ebc9b28a424db387541cd00eea7
SHA149eb8bea94e211c572e84c68a4a4577a9c0c1ac4
SHA2563188897866b20c7167e168e5175cc0bf08e4db317d2ca41447dce24eb7517957
SHA512d756830b44633b0e833a71a0cd733b38f6f5d12ddad47d1e691b3de724e54865522c35f0964e93829e39a4046f6bbc1689db1ed06a1b7de041c749832500a968
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
10KB
MD54ef001158a8e94a3fd39ad11fee7df84
SHA1a7168a50ad05f0480bded16f796b44c69929ed7b
SHA256cb085a8ad8fbd0e0194c5d14989639db65af63e4e6b0480a1c89346afe9dc567
SHA512fb0e07c3a2656b677d1a9d749fb6ef33ea8d46c64f7122fe40994f8c389974e5e8e9c158f19312357a3c9216b8b52b83f52aba3bc37620a84d6c27504829db43
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD5d3ee95e72c4f8de742c174239198cfc7
SHA1fb8af75c3d138de0c4f09ba15fc86bbdca24c162
SHA256c382de798f4bf7160ab54249309869c7536949a8e2b02101bd88ad2ed189a352
SHA5120c012802bd06cf0dec2f1bcab261f56654b7e1ed9e6641aac077768721d07c90c00e9e231392815642a2100c316c1f58b52fffe2fca53c9d35ebcd3e2703eca2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD56e833356fa095ea3b89cd604e72ac826
SHA144c81cf77f4dc84dacdbf82516a13518fb662256
SHA256b8e46084459ddf4b3b3c854ff81e73847f7e6922a97c62dcdb1fffc755c61393
SHA512af6cfbcf4906919232ce636b2650e353506f91d6df81a2698fe2e48ae794b7b487ffaa78020799f15ef09df18f1cb43650b2842082f8267f19d8ab365c8aa7d5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD5dfcf27e54243a322f0367926d72b9717
SHA1ca0a1ac5c22dc9b06b8804efe7862173e063b9d5
SHA256eecd996c31ad75f37ec483fb15dbf24bf06ee8277ec5ea4cf145de2ceb4a7b87
SHA5120592e9bca085fa5d1342d9527754f2da120fde9e0f443649d204f9b3189e739fd8e5aa1c0bbc4dc4f49c81a9bf61f0fdbb8b2a1e1ec879ed8c3e38b8512b74ee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD55e628559eb480675c621c018f9e82c90
SHA1da0b8655698b7ebc5df57853c4f24d196b3fc165
SHA2565666bf897e6c61efba362d87e21b1e6e22c1e7d2d9eb68df980dddc4548dfb45
SHA512a02e709e9391bd67d37081bba5c805087580e9a0072327b54335b1873063b40bb9e25509e42339611dd5c61e4f6e7ca5172432278b78738f04fe0ccafa879bbe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD5281647d1f09ce01607f28f87df4e5b3c
SHA1509149f69af99d6947961de7c1cbdaf31ba11f45
SHA256b3749bdc179b270fded2c11a4fb674c6fa0ae0c44bf47cde20f7e6eca8242356
SHA512ee59a1cb7d1b691419e7dca25896a2eda20ba11589358025c4472626e99602ae805dd432b4954e16a22841d60b890571c179f080fd7995d6b5c8a1d916f4321a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
10KB
MD5aae6d1cf835c5fa658723c931f8f10d0
SHA1e402604bea95896ac6ca8b8dc0cfde6ad61c748d
SHA256d1a0ed1d0a0057a619d569b815caede8c6903f4f51982aef3700d00810fd1a9b
SHA512cee6a0a30356f0907ae8226e535aae45803dea6b313ad97ffabe5726bdbf631699573ebe5b4924c0deccd086fde3e2850d671ea28bc5ae69aee93876734c5bda
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
10KB
MD562520f31093e6c49cd07923dadd88ed9
SHA150df16744ed3931d0377c7c8aa5248ecea78d1d6
SHA2560e9e4949af23660bd15dfc494d647a65dc373b44b65e324eebc26c7010580c81
SHA512c9eba46abb2a65a03e8908b99b2a1245dc0b3305dc919ad4bde581064e39bc3ee1a1a8b140feda3f201c5a054376828a78bb7713e9f080271a6311b23372505d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD57a2910aabf9efdfdf2adac1ac4e6b477
SHA1b12cdb2e7b4d107d9873e240f5dd597f4056a285
SHA25639e1f608f33405151c0dcdc3339e35f64f291191c9d4c75d28093c08910e7020
SHA5127046e1ef408fff2748f58e7a53094cf4bd40f60c8c55f2e80cb90d41ca19a4f1e03750108e6a4b412f5f543a2ac187e518f67291344c1942fa4fd5b063be7793
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5c55851e2076168525f3a82c55e3dba08
SHA1b9cd5a9697c11abc32a0b6cc6c03ef1c26a84181
SHA256a9bd53b36ffd22eb77bb0f3aa75cd488d5d62c246468320c9d5d8e0624e700be
SHA51251895f4d129b3553e740c84dcff21b8e0866671c5166fd1ee5a2e14e04e6991dc6fe5339a795d99376194c12250d0ff12543edde7dd04423c61e50432ad8ad9c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD5eeb018c434fe5b197254ff19ebeca943
SHA13cd7b1791709fc1c560e7cd0daf38d1c48364026
SHA2568f79d194cf0859d3def56604b4d3694b04c473893bc397a2aedc0fdd7e50c119
SHA512bac34f1a88c96aea973e5e06c1831be97682c8ec6e61e463f07926221f2f29237a2d6571741655a0bcc04696d1e6dfd750ce19ef73530367d483befbc7a004f7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD52e346ca499078e6876a58ae6f5487e6f
SHA14b32cdb5bf0a9d3ea61c33c3bc3784edbd967545
SHA2563f44ff765cf8c394f9493b73078ca7573c0c1c5de06c8abcf2f21142a781fe84
SHA51272af7ac09197dcf427af26977afcdf5460bec1b4d69f5626d46ef2ee603da1a4155db9af1c8fae0fa32bdbad769907a8f4397e8e8f27b8bf4e31ed425230557d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD56721a395f443cd2e712cf96fe0ec402e
SHA1b76783e42a45a1e11a6ba943655c6ab10ca53cb6
SHA25643b1e7284321d60fb7c140041a8d12627634a0b1bb02318f6899f2c64ce74a1b
SHA5126988827f4c6624a457100613bae93429ff6e257751a42122bd8179c1c7e4a6f5381d736d36325bfd8d6f239e207490361431f0ac6774f4f52344aefa6d1547db
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5e0c76708409ac4b5826c505cf335295a
SHA1196e4216400ba2f858b3b7e215838889dfe27cd4
SHA256a8e4c7a96e6351d65f6691920fa2b81ec451fc480a112cb4717dddcc4c302093
SHA512334fabdb1acb3930298d682210a4aed8b13f5c0de2c5f869d0d8db5fc313b53f09fede1deba5fc71911fa7a3d7a253f715e7fadbcd172baf72d881a841d9b790
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD52bfebfa2127c40a5ca5015c8f81102f0
SHA15a7d6f4c5f5619b726e296e7843af3470f0ffa98
SHA256c2355a319d4d24ff1fe709b7639cf966aec2d85487064d4b5080e41e9ca71359
SHA512fd4d31ea90124ed6e0205a628336094154dbb9f38673829dc6770521e3199904c351ea67654b85beb44b960cc455e3114c261ab47fd422aba50d7d06894d8101
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD51c99e5639fac24ead823b56ba5cc3b24
SHA1f627de95295f7b0a2b7b16cc9d853815e9b5780d
SHA256368f7b419250676226f77e081aa0df864dcf047c3477dff92da6849e2660eaca
SHA5125d69ff968adfe3a7e023bf173c7d704db0c668785aefea029a69c8d846a0940cfaec6002f53e12394b700e5f01e43f02c0374f23ec97a1fdcdfc35619f216362
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD5dc92df69cd073c0fb2281d867db071ed
SHA152e63da9030f02135b171acf0fdfb22c62e88166
SHA256cd07e2556ab744b7c6d9fdaccf79b66aa4f9f13a7df7cae930697a4be909bebc
SHA512868260a1eeda54285374368bb84833e9fe2cdee1894541679d0aad14e20b0a2e9e513fc931e765c5121bcfbc3ef0f491a73eed3216ac23a33c84d44580706f26
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD57520c519edcd4788d448b08fae780ed6
SHA1c3f2c6dc0c72040eab48535bbb40d7e904664880
SHA2562f5bd0bc640d7309c9f2d1414aedcf55f29dc088d9716e61d7c490c894ae047b
SHA512d65c4ead480f3f625c2a7d03135eabb374f0007d4a1a3d19bad389bb5a25debf8b2bf16b00e93b2ded93daadac9af745c16ca9be2f5326e47e87e46c4486e024
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
2KB
MD57049e5d6c06ef5aafd661e474ae721bf
SHA1400cfb77e6b1c5ebb15e7b0da96525a7d97ec5bd
SHA256ad502d99b8355673085a9af3b24881b5faf06fcdc8604a701d11782bf0f0e357
SHA512f4eef7320fd65e2430658b21de49669bb363959e39bc841788fe00209a0a7adbae040b783568fc26985bb8aac664ef1271955506ba266f510df697e0ab884620
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57979c.TMPFilesize
1KB
MD5be04ad47f83bb0cff56274e6dc7beec0
SHA1ce7f7047402593d3c941a8855ee84a46baabe162
SHA256e6e6039b427424080b89e2f4edfec4fe5986606a2aa9da6c08647bd76c2a908a
SHA51201fdd817f267de805e4321c5b0637c7c0b6f892b5c5db3519c8a595d6719ecc8b0a9b44b0abb6f9474c8dddc5bc00d451f2e36c2a8ef787541f45f1533167e64
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5a3ea246b8c41666aea967463c99ee0f4
SHA13fe9e08b17b376c484f8ba7b3c17231cdfd5b868
SHA25656109b963505b3a869afc53a853f61c085ceff249b34b6325716051fde513660
SHA512446f9ed01317180a97b0a987349966c19af3d3ab0c2a1e071931a20e93d39c5a15db5c7bf7e85c45fc2bcaa99bf491389092d15021a6e6582b3046fc8c6828d1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5c2c24cf6c05adf2236292ddb0a85e7d9
SHA1dc33d2f7a62708ae16ec81523fe5b174a2375bce
SHA2562dc6d288d919ed2fea281a110dfc22beae6924b07ff1dfecd7469af79b97c1df
SHA512a171370e1bc86cd1ab7b3e504ed01144ff8a5704e6839affdc81585cafe2effe627548c02eecf05d7b2f649e7db6eeeccd29378c13d57ac120ad1825f499a9d8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5502638092ad0a172b5447fba2ab885db
SHA1599abb47049db3746ff79edf1de3197497d640a0
SHA256c9e89d2913841c1349858d05544aeebf33091c40d37e898107a3844b519d2597
SHA51230f4af255f11f23ac8070ab8015f135211dcc16f33981dbfe18d0f8667924cd5221b63fa387fa5d264da0ecca7198944f9f1110523f53665b2ac096b12d9d924
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD50bfc89b18856a1fb60bf9df1e63e0d33
SHA13096cffa133e08f638a39fcf41fe50890dbbb64b
SHA256fe390e00783fc782711b26f4b7fd6edda0ac6e2af7408d29f70184a33666c467
SHA5128fb7c8254ecac31d2b0c8bc04655c7a21d7ba3be7bab9b72b85a2e59e73ff2e53edb8cdd4063271466ed3c37e55cd04a99c7f07e03f5672d45d065f877df2cc9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD57aa62b9d59a5e6c19008803f32d3517c
SHA129b32aead847bde6a98ea563b4f870f40dab7739
SHA2565a0dcec02c92a4dc7c13baa26b609865dbe2b5cb7218fc6dcd00a1f74fccb776
SHA5125a02497462d95809f639672ca5c769904058a9ee9ca6d15ad24d7ef643f917460cf77d588748d68beb32b5dde218514bc3e2bf58a0d75d783e42884b569d1b3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD52cdaa8b149b55a5b49b2bfd755fc4a3b
SHA17b72dec6ba174019ee7ea8026f560a17bdaa5cd9
SHA256d36bdef02ad0325fc1e901c473a86f1721e972d8daf4a82e8d3ecb363b12b5af
SHA512133631f694d21e893322b8090f6d094ebf1167c834052450bda75e870e51ab24e2ef5d21c49dac26db7a0efc2baee010631d6c78bf144e03589f35eaee29e447
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5607e19305ea433c96b5756e7d6d7961b
SHA1425a850c2fec6220143037e19c75aa9aa89650c0
SHA2561f4877c281b6212ee782462c600e15dc739ec534708fac6ce6b78ddd8eb2e4d5
SHA5127769d65d16f5beffb65eab0b55d053e7603348710fc86a96b001492403e228cc27ae8b2f01801dcf84ef9d3518cca667361579546e909f6f0eefa7156068f8fc
-
C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmpFilesize
8.0MB
MD58e15b605349e149d4385675afff04ebf
SHA1f346a886dd4cb0fbbd2dff1a43d9dfde7fce348b
SHA256803f930cdd94198bdd2e9a51aa962cc864748067373f11b2e9215404bd662cee
SHA5128bf957ef72465fe103dbf83411df9082433eead022f0beccab59c9e406bbd1e4edb701fd0bc91f195312943ad1890fee34b4e734578298bb60bb81ed6fa9a46d
-
C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmpFilesize
8.0MB
MD5596cb5d019dec2c57cda897287895614
SHA16b12ea8427fdbee9a510160ff77d5e9d6fa99dfa
SHA256e1c89d9348aea185b0b0e80263c9e0bf14aa462294a5d13009363140a88df3ff
SHA5128f5fc432fd2fc75e2f84d4c7d21c23dd1f78475214c761418cf13b0e043ba1e0fc28df52afd9149332a2134fe5d54abc7e8676916100e10f374ef6cdecff7a20
-
C:\Users\Admin\AppData\Local\Temp\$inst\0003.tmpFilesize
8.0MB
MD57c8328586cdff4481b7f3d14659150ae
SHA1b55ffa83c7d4323a08ea5fabf5e1c93666fead5c
SHA2565eec15c6ed08995e4aaffa9beeeaf3d1d3a3d19f7f4890a63ddc5845930016cc
SHA512aa4220217d3af263352f8b7d34bd8f27d3e2c219c673889bc759a019e3e77a313b0713fd7b88700d57913e2564d097e15ffc47e5cf8f4899ba0de75d215f661d
-
C:\Users\Admin\AppData\Local\Temp\$inst\0004.tmpFilesize
8.0MB
MD54f398982d0c53a7b4d12ae83d5955cce
SHA109dc6b6b6290a3352bd39f16f2df3b03fb8a85dc
SHA256fee4d861c7302f378e7ce58f4e2ead1f2143168b7ca50205952e032c451d68f2
SHA51273d9f7c22cf2502654e9cd6cd5d749e85ea41ce49fd022378df1e9d07e36ae2dde81f0b9fc25210a9860032ecda64320ec0aaf431bcd6cefba286328efcfb913
-
C:\Users\Admin\AppData\Local\Temp\$inst\0005.tmpFilesize
2.5MB
MD52c087c78603da7a922362096e7f8759d
SHA12c67a471e57af2c29614ef550bfb364e0867304a
SHA256ae9280dbbced00fd04c12a81d61bc5b5579734371a1acb2aef8dc9e298ef73de
SHA512e5be61f70952d2a04705da13a74d56c29c1f28af95c993045c19dd0fb348cdd25b0f38474a25df96ab8db31c409a73d98c9279213d7b4a86501bf6be05162976
-
C:\Users\Admin\AppData\Local\Temp\$inst\0006.tmpFilesize
1.8MB
MD5b3b7f6b0fb38fc4aa08f0559e42305a2
SHA1a66542f84ece3b2481c43cd4c08484dc32688eaf
SHA2567fb63fca12ef039ad446482e3ce38abe79bdf8fc6987763fe337e63a1e29b30b
SHA5120f4156f90e34a4c26e1314fc0c43367ad61d64c8d286e25629d56823d7466f413956962e2075756a4334914d47d69e20bb9b5a5b50c46eca4ef8173c27824e6c
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202403280906501\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeFilesize
1.4MB
MD5e9a2209b61f4be34f25069a6e54affea
SHA16368b0a81608c701b06b97aeff194ce88fd0e3c0
SHA256e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f
SHA51259e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202403280906501\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeFilesize
1.4MB
MD505ba2fabc0ae86886deab9a23970a6b2
SHA17f2b256703724b0b2b7bd08ecdfc1bb9e6a77148
SHA25641cf6a7e2df161a26ee54ceac323f9eaf22754c3cdac6aec1b05f4c4395c055e
SHA5121ae02e7572f109071956ca245274ef0ef9958624c6b102a0c1dd1b1647b5f75322d99679d802a9a4fa95974f37f8f1e9f81454f7641710a1fc950c7a07281a0b
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202403280906501\assistant\assistant_installer.exeFilesize
1.8MB
MD54c8fbed0044da34ad25f781c3d117a66
SHA18dd93340e3d09de993c3bc12db82680a8e69d653
SHA256afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a
SHA512a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202403280906501\opera_packageFilesize
3.4MB
MD51bdcb432901635fdc95b70bdf4d687c0
SHA155bfef75cf44b9e3dcd115a87420f224d241a0b9
SHA2562562c7bbb7277491db45e185c88d96129e734b3adf20824789cc6c7a4abf6f49
SHA512e85f139068548c4ec3e207de123f7e038bf16f69e9810d48e5a613d3930d83590c59d8377456d2839dbca7ecb044dc7d7b7dba2d6cecbe6bdc795ba414e738be
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLLFilesize
73KB
MD581e5c8596a7e4e98117f5c5143293020
SHA145b7fe0989e2df1b4dfd227f8f3b73b6b7df9081
SHA2567d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004
SHA51205b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLLFilesize
40KB
MD548c00a7493b28139cbf197ccc8d1f9ed
SHA1a25243b06d4bb83f66b7cd738e79fccf9a02b33b
SHA256905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7
SHA512c0b0a410ded92adc24c0f347a57d37e7465e50310011a9d636c5224d91fbc5d103920ab5ef86f29168e325b189d2f74659f153595df10eef3a9d348bb595d830
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLLFilesize
160KB
MD5237e13b95ab37d0141cf0bc585b8db94
SHA1102c6164c21de1f3e0b7d487dd5dc4c5249e0994
SHA256d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a
SHA5129d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLLFilesize
60KB
MD5a334bbf5f5a19b3bdb5b7f1703363981
SHA16cb50b15c0e7d9401364c0fafeef65774f5d1a2c
SHA256c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de
SHA5121fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLLFilesize
64KB
MD57c5aefb11e797129c9e90f279fbdf71b
SHA1cb9d9cbfbebb5aed6810a4e424a295c27520576e
SHA256394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed
SHA512df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLLFilesize
60KB
MD54fbbaac42cf2ecb83543f262973d07c0
SHA1ab1b302d7cce10443dfc14a2eba528a0431e1718
SHA2566550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5
SHA5124146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLLFilesize
36KB
MD5b4ac608ebf5a8fdefa2d635e83b7c0e8
SHA1d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9
SHA2568414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f
SHA5122c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLLFilesize
60KB
MD59fafb9d0591f2be4c2a846f63d82d301
SHA11df97aa4f3722b6695eac457e207a76a6b7457be
SHA256e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d
SHA512ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXEFilesize
268KB
MD55c91bf20fe3594b81052d131db798575
SHA1eab3a7a678528b5b2c60d65b61e475f1b2f45baa
SHA256e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175
SHA512face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLLFilesize
28KB
MD50cbf0f4c9e54d12d34cd1a772ba799e1
SHA140e55eb54394d17d2d11ca0089b84e97c19634a7
SHA2566b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1
SHA512bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLPFilesize
8KB
MD5466d35e6a22924dd846a043bc7dd94b8
SHA135e5b7439e3d49cb9dc57e7ef895a3cd8d80fb10
SHA256e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801
SHA51223b64ed68a8f1df4d942b5a08a6b6296ec5499a13bb48536e8426d9795771dbcef253be738bf6dc7158a5815f8dcc65feb92fadf89ea8054544bb54fc83aa247
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INFFilesize
2KB
MD5e4a499b9e1fe33991dbcfb4e926c8821
SHA1951d4750b05ea6a63951a7667566467d01cb2d42
SHA25649e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d
SHA512a291bb986293197a16f75b2473297286525ac5674c08a92c87b5cc1f0f2e62254ea27d626b30898e7857281bdb502f188c365311c99bda5c2dd76da0c82c554a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLBFilesize
28KB
MD5f1656b80eaae5e5201dcbfbcd3523691
SHA16f93d71c210eb59416e31f12e4cc6a0da48de85b
SHA2563f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2
SHA512e9c216b9725bd419414155cfdd917f998aa41c463bc46a39e0c025aa030bc02a60c28ac00d03643c24472ffe20b8bbb5447c1a55ff07db3a41d6118b647a0003
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INFFilesize
7KB
MD5b127d9187c6dbb1b948053c7c9a6811f
SHA1b3073c8cad22c87dd9b8f76b6ffd0c4d0a2010d9
SHA256bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00
SHA51288e447dd4db40e852d77016cfd24e09063490456c1426a779d33d8a06124569e26597bb1e46a3a2bbf78d9bffee46402c41f0ceb44970d92c69002880ddc0476
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLLFilesize
52KB
MD5316999655fef30c52c3854751c663996
SHA1a7862202c3b075bdeb91c5e04fe5ff71907dae59
SHA256ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0
SHA5125555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcirt.dllFilesize
76KB
MD5e7cd26405293ee866fefdd715fc8b5e5
SHA16326412d0ea86add8355c76f09dfc5e7942f9c11
SHA256647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255
SHA5121114c5f275ecebd5be330aa53ba24d2e7d38fc20bb3bdfa1b872288783ea87a7464d2ab032b542989dee6263499e4e93ca378f9a7d2260aebccbba7fe7f53999
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcp50.dllFilesize
552KB
MD5497fd4a8f5c4fcdaaac1f761a92a366a
SHA181617006e93f8a171b2c47581c1d67fac463dc93
SHA25691cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a
SHA51273d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLLFilesize
2KB
MD57210d5407a2d2f52e851604666403024
SHA1242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9
SHA256337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
SHA5121755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLLFilesize
4KB
MD54be7661c89897eaa9b28dae290c3922f
SHA14c9d25195093fea7c139167f0c5a40e13f3000f2
SHA256e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5
SHA5122035b0d35a5b72f5ea5d5d0d959e8c36fc7ac37def40fa8653c45a49434cbe5e1c73aaf144cbfbefc5f832e362b63d00fc3157ca8a1627c3c1494c13a308fc7f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\andmoipa.ttfFilesize
29KB
MD5c3e8aeabd1b692a9a6c5246f8dcaa7c9
SHA14567ea5044a3cef9cb803210a70866d83535ed31
SHA25638ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e
SHA512f74218681bd9d526b68876331b22080f30507898b6a6ebdf173490ca84b696f06f4c97f894cb6052e926b1eee4b28264db1ead28f3bc9f627b4569c1ddcd2d3e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.dllFilesize
1.2MB
MD5ed98e67fa8cc190aad0757cd620e6b77
SHA10317b10cdb8ac080ba2919e2c04058f1b6f2f94d
SHA256e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d
SHA512ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.hlpFilesize
11KB
MD580d09149ca264c93e7d810aac6411d1d
SHA196e8ddc1d257097991f9cc9aaf38c77add3d6118
SHA256382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42
SHA5128813303cd6559e2cc726921838293377e84f9b5902603dac69d93e217ff3153b82b241d51d15808641b5c4fb99613b83912e9deda9d787b4c8ccfbd6afa56bc9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.infFilesize
2KB
MD50a250bb34cfa851e3dd1804251c93f25
SHA1c10e47a593c37dbb7226f65ad490ff65d9c73a34
SHA25685189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae
SHA5128e056f4aa718221afab91c4307ff87db611faa51149310d990db296f979842d57c0653cb23d53fea54a69c99c4e5087a2eb37daa794ba62e6f08a8da41255795
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tvenuax.dllFilesize
40KB
MD51587bf2e99abeeae856f33bf98d3512e
SHA1aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9
SHA256c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0
SHA51243161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403280906476471924.dllFilesize
5.2MB
MD594757651cfe527b6f6cbec4f4bde22c4
SHA17f75055c0a9896227cdb4c9d7e6be1f229c39e2e
SHA2568813082de86313292687dc69dec6d598e705e360ab6165f66af5b57eaf592d46
SHA512787a91c02a621d5867f4bf0f455052bfaf6398ff368e8ca3e6a751e17745479ebd41f9076c4dc467cf3a78ca277e1359948847b35c78dab53b1c907a89eed378
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_240328090648004432.dllFilesize
344KB
MD5249434a8c975016a1c8470dcaf811158
SHA142d6ca313a29c57a08b45a01edbf528e583483bd
SHA256a8a5776ccc1061caf412888bbb454d06d0146362441e2d9f095eefa9568e7a2c
SHA512a1738fb47b6959b50733d41d1b56b5e352f99415808cfe1379b2a06d4cc4198384f6d97577397953e7a965c6209ee918223932bad62bf1bbf4b09ec1f584a91f
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_240328090648004432.dllFilesize
384KB
MD587af6b1d4eed9761e28740ebaf0a11e8
SHA1e997db899fdf370b86496d6037d90a6e842dbbf2
SHA256470d05ada3c470ffb7d1196ede7652ea95c01a070586b93170598e7542afaab4
SHA51211e5895f43457fe6c7c766bc2dd465d59b6353a94e09a99b23e06397fa5e92f4a03bb68938ab38d049916e5db9cc262b0eb6fd089866aff160f54e40708c8334
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403280906492145264.dllFilesize
3.6MB
MD5d69eac8b3ab36feddb890abd4be2e083
SHA131758a06e8a50fa40e2779da7544a6ae21b0c3c1
SHA256b2ff6271aa6aee8b7996773e73f6eb1cae09c6801f699de56fb43607d545f317
SHA51227d6b71e3db8f542c6c606d5941bfca3ee25637cfc70289b9cde8ba841c8986770c7f6501e5db303758ac28e4e6672c0115b489197d2c75e94fa1b58626a3a3d
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403280907009355660.dllFilesize
1024KB
MD55827e08b6f71d68454fc765314b9feec
SHA15ec96259906b5580475020f271682056c2af0b9f
SHA2567503bf18423af8adf419b9ee5579da72cbc4ca897349e6731718bcdd3c402979
SHA5128318f6396ed95b4124f6dca860f9825d809f6bf5348ae75fce9a93a8185f731dd4dc9447d49a29e0b3fa8fba669202736f9e14e76f45a7ceb69ff43a9fd4e7b8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
202B
MD54566d1d70073cd75fe35acb78ff9d082
SHA1f602ecc057a3c19aa07671b34b4fdd662aa033cc
SHA256fe33f57205e2ebb981c4744d5a4ddc231f587a9a0589e6565c52e1051eadb0c0
SHA512b9584ebfdd25cc588162dd6525a399c72ac03bf0c61709b96a19feba7217d840ae2c60d7b0d3b43307a2776f497a388e79ef8a646c12ae59a7f5cc4789bbf3c8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RQP8WR854KXZ4ZVJ9TC1.tempFilesize
10KB
MD5cb1cfdc868f2ebefd43322f4aefb3ac8
SHA19c0c297010d0577583df0ab40184c3cf063104d3
SHA2568505e3ce4dc7fcec6710ec482399eca6e044cdd5b3d6f4dedf6fbee6e2b2411a
SHA512c6a1a99c0d8932a313ae1b53501f235ed0d534eb9df236951e1ae9e4271ee84e266afc7c076cb5a0fe17c0504e42aa6f01793d06d9f4b9bd073e5b760d4813f8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
10KB
MD5f79c22ee73ea43d874a67efbd0303e21
SHA1f788a24f12b088aabbcfccdddce63a67edaccf2c
SHA256686c4696281a8648c9c439aa5702d166b3b363a68cd4fd262e1b8b639c637e18
SHA512ecdce34b26a3516519fd9e8e929da0d1485a786e9d17201526c8e6b93de0aad684d5974b5f2abccd80fb4ee9e6b0f98610017d3153902fd89074e5021f4b1fcb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
10KB
MD51f406b4318eefb67edfd80a789d5276f
SHA1ae6e5cfb46f618e4951614cb8e4627189ab4cf13
SHA25698bb9558dcd61c1eaea8064fd903a8e0ba1ffc19825e3dffb7953a27443cf4f8
SHA5123a0c2f3c4b5c3752f47db843b391d9b4de1526d50efe840fdd47b802d75b71dbb197b7879f96d6c100565625bb27f62d0e75ed5b4377e3e227fa0fd9a9bfecd6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
10KB
MD5a7f684a4260ff442437f05b4e4d591c2
SHA1fb2ded5ab9ad315238ec76f5f302297a5d9dafad
SHA256190a3ea0b2708b932acf1e79e4771762f023f94fca28be2d06ddd76f5217e5b7
SHA512a949ffc6b9251e4589a207dcdea0418456b1577edc3c47c31a8acc603ea2e9b02476d7e433d8f22445e64e273be831042513abd3c80ee211ec2711e9b971c870
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
10KB
MD57b5fb41107631868434fec79bbb2c985
SHA15face192cdc3b0c8dd1c93ef0893ec99dbe55e0d
SHA25662593d4792c4b290f382b7a157e35998d0adb7fa5677b0f573b27034689c954b
SHA512f150b76d9251dcebf08d851767fe186191a29b4dd5e5c8aee3012e1e049e4e1de3b4f51a74356fb81a31bb8c0d35efb7bea5b47d8c7bb1a63b9a759f3a68e5f9
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.datFilesize
40B
MD561a865a78965c01d9e224269b59d0026
SHA16371b35166597d71936750f471edd706800a5a28
SHA256833d6350abc5eb73eac0036d9d872ce6ff170d60754f4527335f67a715bebf5d
SHA512742422dd2e39ebc6afcf6d9408d36f8d19392d677e83cd015d7eb15b7064ee2932bfb4f3d11e364fc02fcabf45f0dc3e8191c7dac558f4f5565f44ebdc5de60d
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.datFilesize
40B
MD5a1aef2d3eb61d591dcbe34d787bdaf0b
SHA105ba4aba485dcee4823a62d6492623605aae96df
SHA2564a55e781afd85cac7e5d8dfef056a8648320a01c2d87218bdbf9996e0ccd3fe7
SHA512ed104c18756874ac7f574809b7c44046d6d4acad29563b1ef8d489949d018c56ba969b63ebec765248617d1adc439b27de02ee3cf5b9389c5bc1b4ef839da759
-
C:\Users\Admin\Downloads\Bonzi.zipFilesize
49.8MB
MD565259c11e1ff8d040f9ec58524a47f02
SHA12d5a24f7cadd10140dd6d3dd0dc6d0f02c2d40fd
SHA256755bd7f1fc6e93c3a69a1125dd74735895bdbac9b7cabad0506195a066bdde42
SHA51237096eeb1ab0e11466c084a9ce78057e250f856b919cb9ef3920dad29b2bb2292daabbee15c64dc7bc2a48dd930a52a2fb9294943da2c1c3692863cec2bae03d
-
C:\Users\Admin\Downloads\NoEscape.exe.zipFilesize
13.5MB
MD5660708319a500f1865fa9d2fadfa712d
SHA1b2ae3aef17095ab26410e0f1792a379a4a2966f8
SHA256542c2e1064be8cd8393602f63b793e9d34eb81b1090a3c80623777f17fa25c6c
SHA51218f10a71dc0af70494554b400bdf09d43e1cb7e93f9c1e7470ee4c76cd46cb4fbf990354bbbd3b89c9b9bda38ad44868e1087fd75a7692ad889b14e7e1a20517
-
C:\Users\Admin\Downloads\OperaGXSetup.exeFilesize
3.4MB
MD59e34ff64125086c8a247abd2847199bf
SHA1bc30fdd711d917b38076397ac85cc6e0554c606d
SHA25691b97e0b2833f3a29151fdc3ea84616889495d6cb7cfc3e3925b70301dfdf2ee
SHA5121bfd1053637512f70c5f539cbed66a11962b4315ee01351b923b66817f27cc32be9746d2edd9ebbc8235c1a2704f1fb22b647cc4f0cf8a03db66d1ead14a54c4
-
C:\Users\Admin\Downloads\OperaGXSetup.exeFilesize
913KB
MD5c9f823ba13cdad483d0f7f27130ceafc
SHA12bd720d5beab032f11244e5747fffef8bb8967e5
SHA256d1ba84df5593f8dae8cc56e63ca1199d245b896b4fb45ece78f138ec71c32ae9
SHA5120dfb6f679be48cb717cb54d2f81ad4e5f1928d85315ac72a3be9e553312110b70b9afdfb5b3f8b7f27574f9d21c9f94331608162b8c3a442a35158af0fc3dcfb
-
C:\Users\Admin\Downloads\OperaGXSetup.exeFilesize
1.1MB
MD5e7a8ed66dd5f9be61f8ee768a3297cb5
SHA1e9f0d0961ebecb243c100ee63028343562e007b6
SHA25655de2f01240540401dbc30a09bc2f89f50ee6a06609c637283e94623e18cc60e
SHA512f2a7d42cf0e287a493c7ebc0bfe4b594cfa835843cb91ccfbeeaf9024a9231483fa4a4bd357faf76041b2b46c27f4977fee1c8d4261b405fe043f07108008082
-
C:\Users\Admin\Downloads\OperaGXSetup.exeFilesize
1024KB
MD5a427e2080071d6bb6099079d9885cd99
SHA17bd5b6457cf31ad109d7f4d1a58df915d2893318
SHA2560de38b58d7cc8bcdeeda27eb65803a8b157954c18a994d0720b892ebbb3f2c04
SHA512392ace2d9717223f95acec4bb8077c65b7a83d5b1ffb57aa18b8f442b27a4f34bc9cf899b8745d1f6cdeb9dc5e5511c3c193cd961c1c614e92e3fed60148262f
-
C:\Users\Public\Desktop\ᑫ⾠◡∫៲▟ᰏ⠴ᘭᰚ⛲⤷⯙ぇ࿘Ᾱᩱ€ア゠ໝⲑᑸ๚᩶ᏵFilesize
666B
MD5e49f0a8effa6380b4518a8064f6d240b
SHA1ba62ffe370e186b7f980922067ac68613521bd51
SHA2568dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
SHA512de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4
-
C:\Windows\msagent\chars\Bonzi.acsFilesize
5.0MB
MD51fd2907e2c74c9a908e2af5f948006b5
SHA1a390e9133bfd0d55ffda07d4714af538b6d50d3d
SHA256f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95
SHA5128eede3e5e52209b8703706a3e3e63230ba01975348dcdc94ef87f91d7c833a505b177139683ca7a22d8082e72e961e823bc3ad1a84ab9c371f5111f530807171
-
C:\Windows\msagent\chars\Peedy.acsFilesize
4.0MB
MD549654a47fadfd39414ddc654da7e3879
SHA19248c10cef8b54a1d8665dfc6067253b507b73ad
SHA256b8112187525051bfade06cb678390d52c79555c960202cc5bbf5901fbc0853c5
SHA512fa9cab60fadd13118bf8cb2005d186eb8fa43707cb983267a314116129371d1400b95d03fbf14dfdaba8266950a90224192e40555d910cf8a3afa4aaf4a8a32f
-
\??\pipe\LOCAL\crashpad_3896_GKXKUJHUPDLFQODPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/432-326-0x0000000000C80000-0x0000000001240000-memory.dmpFilesize
5.8MB
-
memory/432-397-0x0000000000C80000-0x0000000001240000-memory.dmpFilesize
5.8MB
-
memory/1924-320-0x0000000000C80000-0x0000000001240000-memory.dmpFilesize
5.8MB
-
memory/1924-396-0x0000000000C80000-0x0000000001240000-memory.dmpFilesize
5.8MB
-
memory/4188-3021-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4188-3010-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4188-3019-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4188-3015-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4188-3016-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4188-3013-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4188-3017-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4188-3018-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4188-3011-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4188-3014-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4188-3012-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4188-3068-0x00007FFDCB890000-0x00007FFDCBA85000-memory.dmpFilesize
2.0MB
-
memory/4288-3658-0x0000000000400000-0x00000000005CC000-memory.dmpFilesize
1.8MB
-
memory/4288-3471-0x0000000000400000-0x00000000005CC000-memory.dmpFilesize
1.8MB
-
memory/4288-3472-0x0000000000400000-0x00000000005CC000-memory.dmpFilesize
1.8MB
-
memory/5264-344-0x0000000000390000-0x0000000000950000-memory.dmpFilesize
5.8MB
-
memory/5264-339-0x0000000000390000-0x0000000000950000-memory.dmpFilesize
5.8MB
-
memory/5620-398-0x0000000000C80000-0x0000000001240000-memory.dmpFilesize
5.8MB
-
memory/5660-399-0x0000000000C80000-0x0000000001240000-memory.dmpFilesize
5.8MB