Resubmissions
14-01-2025 05:35
250114-gaenbszqam 1010-01-2025 23:50
250110-3vv2pswmhj 1011-12-2024 15:19
241211-sqgcmssnbr 1009-12-2024 01:54
241209-cbqprsxngx 1026-11-2024 23:15
241126-28wpqa1ndp 1030-09-2024 21:45
240930-1l2rsazhpg 1015-09-2024 22:03
240915-1yl7vsvbpf 1015-09-2024 20:03
240915-ystcwa1elr 1020-08-2024 16:21
240820-ttt9cawalj 10Analysis
-
max time kernel
957s -
max time network
962s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-06-2024 04:58
Static task
static1
Behavioral task
behavioral1
Sample
v2.exe
Resource
win11-20240508-en
General
-
Target
v2.exe
-
Size
121KB
-
MD5
944ed18066724dc6ca3fb3d72e4b9bdf
-
SHA1
1a19c8793cd783a5bb89777f5bc09e580f97ce29
-
SHA256
74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
-
SHA512
a4d23cba68205350ae58920479cb52836f9c6dac20d1634993f3758a1e5866f40b0296226341958d1200e1fcd292b8138c41a9ed8911d7abeaa223a06bfe4ad3
-
SSDEEP
1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZs/WVEdz725sK:J1MZwlLk9Bm3uW/Wud2K36cn/wCY
Malware Config
Extracted
C:\Recovery\qqt44x5-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/505396626D95443A
http://decoder.re/505396626D95443A
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe -
Drops startup file 1 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\word\startup\qqt44x5-readme.txt v2.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 41 IoCs
pid Process 4036 RobloxPlayerInstaller.exe 6552 RobloxStudioInstaller.exe 3296 RobloxStudioInstaller.exe 6964 MicrosoftEdgeWebview2Setup.exe 5664 MicrosoftEdgeUpdate.exe 5408 MicrosoftEdgeUpdate.exe 3116 MicrosoftEdgeUpdate.exe 5716 MicrosoftEdgeUpdateComRegisterShell64.exe 400 MicrosoftEdgeUpdateComRegisterShell64.exe 5688 MicrosoftEdgeUpdateComRegisterShell64.exe 1120 MicrosoftEdgeUpdate.exe 6620 MicrosoftEdgeUpdate.exe 3376 MicrosoftEdgeUpdate.exe 5496 MicrosoftEdgeUpdate.exe 7544 MicrosoftEdgeWebview2Setup.exe 6908 MicrosoftEdgeUpdate.exe 4468 MicrosoftEdgeUpdate.exe 4576 MicrosoftEdgeUpdate.exe 6928 MicrosoftEdgeUpdate.exe 4052 RobloxPlayerInstaller.exe 7872 MicrosoftEdgeUpdate.exe 656 MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe 2828 MicrosoftEdgeUpdate.exe 7912 MicrosoftEdgeUpdate.exe 4052 OperaGXSetup.exe 1088 OperaGXSetup.exe 7084 OperaGXSetup.exe 1628 OperaGXSetup.exe 5708 OperaGXSetup.exe 6112 MicrosoftEdgeUpdate.exe 3900 MicrosoftEdgeUpdate.exe 6744 MicrosoftEdgeUpdateComRegisterShell64.exe 6992 MicrosoftEdgeUpdateComRegisterShell64.exe 5420 MicrosoftEdgeUpdateComRegisterShell64.exe 8176 MicrosoftEdgeUpdate.exe 1316 RobloxPlayerBeta.exe 6996 RobloxStudioBeta.exe 6364 RobloxCrashHandler.exe 8188 Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe 1956 assistant_installer.exe 3420 assistant_installer.exe -
Loads dropped DLL 64 IoCs
pid Process 5664 MicrosoftEdgeUpdate.exe 5408 MicrosoftEdgeUpdate.exe 3116 MicrosoftEdgeUpdate.exe 5716 MicrosoftEdgeUpdateComRegisterShell64.exe 3116 MicrosoftEdgeUpdate.exe 400 MicrosoftEdgeUpdateComRegisterShell64.exe 3116 MicrosoftEdgeUpdate.exe 5688 MicrosoftEdgeUpdateComRegisterShell64.exe 3116 MicrosoftEdgeUpdate.exe 1120 MicrosoftEdgeUpdate.exe 6620 MicrosoftEdgeUpdate.exe 3376 MicrosoftEdgeUpdate.exe 3376 MicrosoftEdgeUpdate.exe 6620 MicrosoftEdgeUpdate.exe 5496 MicrosoftEdgeUpdate.exe 6908 MicrosoftEdgeUpdate.exe 4468 MicrosoftEdgeUpdate.exe 4576 MicrosoftEdgeUpdate.exe 6928 MicrosoftEdgeUpdate.exe 6928 MicrosoftEdgeUpdate.exe 7872 MicrosoftEdgeUpdate.exe 7872 MicrosoftEdgeUpdate.exe 2828 MicrosoftEdgeUpdate.exe 7912 MicrosoftEdgeUpdate.exe 4052 OperaGXSetup.exe 1088 OperaGXSetup.exe 7084 OperaGXSetup.exe 1628 OperaGXSetup.exe 5708 OperaGXSetup.exe 6112 MicrosoftEdgeUpdate.exe 3900 MicrosoftEdgeUpdate.exe 6744 MicrosoftEdgeUpdateComRegisterShell64.exe 3900 MicrosoftEdgeUpdate.exe 6992 MicrosoftEdgeUpdateComRegisterShell64.exe 3900 MicrosoftEdgeUpdate.exe 5420 MicrosoftEdgeUpdateComRegisterShell64.exe 3900 MicrosoftEdgeUpdate.exe 8176 MicrosoftEdgeUpdate.exe 1316 RobloxPlayerBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6364 RobloxCrashHandler.exe 6364 RobloxCrashHandler.exe 6364 RobloxCrashHandler.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Enumerates connected drives 3 TTPs 29 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: v2.exe File opened (read-only) \??\S: v2.exe File opened (read-only) \??\G: v2.exe File opened (read-only) \??\J: v2.exe File opened (read-only) \??\R: v2.exe File opened (read-only) \??\Z: v2.exe File opened (read-only) \??\P: v2.exe File opened (read-only) \??\T: v2.exe File opened (read-only) \??\V: v2.exe File opened (read-only) \??\X: v2.exe File opened (read-only) \??\F: v2.exe File opened (read-only) \??\D: v2.exe File opened (read-only) \??\F: OperaGXSetup.exe File opened (read-only) \??\K: v2.exe File opened (read-only) \??\D: OperaGXSetup.exe File opened (read-only) \??\N: v2.exe File opened (read-only) \??\U: v2.exe File opened (read-only) \??\Y: v2.exe File opened (read-only) \??\D: OperaGXSetup.exe File opened (read-only) \??\A: v2.exe File opened (read-only) \??\M: v2.exe File opened (read-only) \??\F: OperaGXSetup.exe File opened (read-only) \??\L: v2.exe File opened (read-only) \??\W: v2.exe File opened (read-only) \??\B: v2.exe File opened (read-only) \??\E: v2.exe File opened (read-only) \??\H: v2.exe File opened (read-only) \??\I: v2.exe File opened (read-only) \??\Q: v2.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 515 sites.google.com 514 sites.google.com -
Checks system information in the registry 2 TTPs 20 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7mrd24ik9l.bmp" v2.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1316 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
pid Process 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\Ribbon\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\ExtraContent\textures\ui\AvatarExperience\PPEWidgetBackgroundDarkTheme.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\MaterialManager\Show_in_Explorer.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\PublishAssetPrompt\init.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\AnimationEditor\ic-checkbox-off.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\Debugger\Breakpoints\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\DraggerTools\Light\Standard\Transform.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\RoduxContacts-0.8.4\enumerate.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Slider\SystemSlider.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\AppStartup\Dev\RoactRodux.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GameVotesRodux\Promise.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\Qml\QtQuick\Controls.2\designer\ButtonSpecifics.qml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\WidgetIcons\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\textures\ui\AvatarExperience\CircleCutoutLargeNoBorder.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\ReactDevtoolsExtensions\ReactRoblox.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\Qml\QtGraphicalEffects\private\FastGlow.qml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\InsertableObjects\Dark\Large\Beam.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\validation\__tests__\KnownDirectivesRule.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\JestSnapshot-3.8.0\ChalkLua.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RoactUtils\ReactRoblox.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Lua\AvatarCompatibilityPreviewer\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Lua\FileSync\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\SideNavigation\SystemMenuButton.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\ApolloClientTesting\ApolloClientTesting\utilities\graphql\directives.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\ReactDevtoolsExtensions\LuauPolyfill.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\RobloxAppEnums.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\TerrainTools\mtrl_cobblestone_2022.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\ui\Emotes\Small\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\Tool.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\Server\ClientChat\CurveUtil.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GraphqlHttpArtifacts\Http.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GraphQLServer\Dev\Rodux.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\TenFootUiShell\HttpRequest.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\ui\Controls\DesignSystem\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\ui\Settings\MenuBarIcons\PlayersTabIcon.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\models\LayeredClothingEditor\MeshPartHeadTemplate.rbxm RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\textures\ui\LuaApp\graphic\Auth\reversevignette.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\ui\Controls\XboxController\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Lua\AssetManager\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\Server\ServerChat\DefaultChatModules\FriendJoinNotifier.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends\RoduxFriends\Selectors\init.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\Qml\QtQuick\Controls.2\plugins.qmltypes RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\rotationArrow.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\ReportPage\TextEntryField.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialModalsTestSuite\SetAlias.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\BuiltInStandalonePlugins\Optimized_Embedded_Signature\ControlsEmulator.rbxm RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler\ReactReconciler\ReactFiberComponentStack.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\Qml\QtQuick\Controls.2\designer\images\busyindicator-icon.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\scripts\CoreScripts\Modules\ContactList\Components\ContactListApp.spec.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\JestEnvironment\JestTypes.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-12e911c4-0c4b13ff\LuauPolyfill\Number\.robloxrc RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\Navigation\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\Ribbon\Dark\Medium\RibbonTextBox.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\textures\ui\Controls\DesignSystem\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\ExtraContent\LuaPackages\Packages\_Index\IAPExperience\IAPExperience\Utility\getModalShownEventData.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\DeveloperInspector\Record.png RobloxPlayerInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\textures\ui\Controls\DesignSystem\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Lua\PathEditor\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\content\textures\StudioToolbox\AssetConfig\gridview.png RobloxPlayerInstaller.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 28 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wermgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier wermgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wermgr.exe -
Enumerates system info in registry 2 TTPs 44 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioBeta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioBeta.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioInstaller.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0" RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth RobloxStudioInstaller.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-STUDIO RobloxStudioInstaller.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133636787893864241" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-6b63ea89d2e54fd7\\RobloxPlayerBeta.exe\" %1" RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\Enabled = "1" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rbxl\Roblox.Place RobloxStudioInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a OperaGXSetup.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB v2.exe Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f v2.exe Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C v2.exe Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 v2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 OperaGXSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a OperaGXSetup.exe -
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier chrome.exe File created C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe\:Zone.Identifier:$DATA OperaGXSetup.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 6996 RobloxStudioBeta.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3760 v2.exe 3760 v2.exe 5028 chrome.exe 5028 chrome.exe 4036 RobloxPlayerInstaller.exe 4036 RobloxPlayerInstaller.exe 3296 RobloxStudioInstaller.exe 3296 RobloxStudioInstaller.exe 5664 MicrosoftEdgeUpdate.exe 5664 MicrosoftEdgeUpdate.exe 3760 v2.exe 3760 v2.exe 3760 v2.exe 3760 v2.exe 3760 v2.exe 3760 v2.exe 3760 v2.exe 3760 v2.exe 7872 MicrosoftEdgeUpdate.exe 7872 MicrosoftEdgeUpdate.exe 7872 MicrosoftEdgeUpdate.exe 7872 MicrosoftEdgeUpdate.exe 3376 MicrosoftEdgeUpdate.exe 3376 MicrosoftEdgeUpdate.exe 7912 MicrosoftEdgeUpdate.exe 7912 MicrosoftEdgeUpdate.exe 1316 RobloxPlayerBeta.exe 1316 RobloxPlayerBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 6996 RobloxStudioBeta.exe 3136 msedgewebview2.exe 3136 msedgewebview2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6996 RobloxStudioBeta.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 5076 msedgewebview2.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3760 v2.exe Token: SeTakeOwnershipPrivilege 3760 v2.exe Token: SeBackupPrivilege 840 vssvc.exe Token: SeRestorePrivilege 840 vssvc.exe Token: SeAuditPrivilege 840 vssvc.exe Token: SeDebugPrivilege 5664 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 7872 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 3376 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 7912 MicrosoftEdgeUpdate.exe Token: SeRestorePrivilege 5664 MicrosoftEdgeUpdate.exe Token: SeBackupPrivilege 5664 MicrosoftEdgeUpdate.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5076 msedgewebview2.exe 5076 msedgewebview2.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 3304 MiniSearchHost.exe 288 firefox.exe 6936 SearchHost.exe 6852 SearchHost.exe 4308 SearchHost.exe 7512 SearchHost.exe 6628 SearchHost.exe 6388 SearchHost.exe 5928 SearchHost.exe 5196 SearchHost.exe 1796 SearchHost.exe 7404 SearchHost.exe 4052 OperaGXSetup.exe 6996 RobloxStudioBeta.exe 4256 OpenWith.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1316 RobloxPlayerBeta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6488 wrote to memory of 6584 6488 private_browsing.exe 88 PID 6488 wrote to memory of 6584 6488 private_browsing.exe 88 PID 6584 wrote to memory of 6600 6584 firefox.exe 89 PID 6584 wrote to memory of 6600 6584 firefox.exe 89 PID 6584 wrote to memory of 6600 6584 firefox.exe 89 PID 6584 wrote to memory of 6600 6584 firefox.exe 89 PID 6584 wrote to memory of 6600 6584 firefox.exe 89 PID 6584 wrote to memory of 6600 6584 firefox.exe 89 PID 6584 wrote to memory of 6600 6584 firefox.exe 89 PID 6584 wrote to memory of 6600 6584 firefox.exe 89 PID 6584 wrote to memory of 6600 6584 firefox.exe 89 PID 6584 wrote to memory of 6600 6584 firefox.exe 89 PID 6584 wrote to memory of 6600 6584 firefox.exe 89 PID 4476 wrote to memory of 288 4476 firefox.exe 93 PID 4476 wrote to memory of 288 4476 firefox.exe 93 PID 4476 wrote to memory of 288 4476 firefox.exe 93 PID 4476 wrote to memory of 288 4476 firefox.exe 93 PID 4476 wrote to memory of 288 4476 firefox.exe 93 PID 4476 wrote to memory of 288 4476 firefox.exe 93 PID 4476 wrote to memory of 288 4476 firefox.exe 93 PID 4476 wrote to memory of 288 4476 firefox.exe 93 PID 4476 wrote to memory of 288 4476 firefox.exe 93 PID 4476 wrote to memory of 288 4476 firefox.exe 93 PID 4476 wrote to memory of 288 4476 firefox.exe 93 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 PID 288 wrote to memory of 3884 288 firefox.exe 94 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\v2.exe"C:\Users\Admin\AppData\Local\Temp\v2.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2988
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:840
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3304
-
C:\Program Files\Mozilla Firefox\private_browsing.exe"C:\Program Files\Mozilla Firefox\private_browsing.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6488 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -private-window2⤵
- Suspicious use of WriteProcessMemory
PID:6584 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -private-window3⤵
- Checks processor information in registry
PID:6600
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="288.0.1614922014\709459219" -parentBuildID 20230214051806 -prefsHandle 2060 -prefMapHandle 2052 -prefsLen 19310 -prefMapSize 233483 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c8d8212-26ec-42d1-a767-dc7ac5101955} 288 "\\.\pipe\gecko-crash-server-pipe.288" 2152 229e24d7658 gpu3⤵PID:3884
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1700 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd0247ab58,0x7ffd0247ab68,0x7ffd0247ab782⤵PID:1900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:22⤵PID:6316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:6324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:6348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:6340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=3912 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:6644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3764 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:6872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4352 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:6976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4392 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:5432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4724 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:5580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4408 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:5748
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:5168
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x254,0x258,0x25c,0x250,0x260,0x7ff6901cae48,0x7ff6901cae58,0x7ff6901cae683⤵PID:5064
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=5016 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:6036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --mojo-platform-channel-handle=4488 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --mojo-platform-channel-handle=4760 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1156 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4388 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:5560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=1488 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:5360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=1952 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:2264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4072 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:1312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4080 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=5372 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:4016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=5220 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:7084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=5344 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:2668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5812 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3252 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵
- NTFS ADS
PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5912 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:6924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5908 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:2628
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4036 -
C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
PID:6964 -
C:\Program Files (x86)\Microsoft\Temp\EU295E.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU295E.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5664 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5408
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3116 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5716
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:400
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5688
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUI3RUZGNzYtN0QyRC00MjlBLTgxMzItN0VCNTJBQTRCQUIyfSIgdXNlcmlkPSJ7MjI2NzVDMzktNDFCQS00OTVDLUFFNjUtQkNGQ0UyRkFGNzJBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2QzExRkJCNS1FQzc2LTRCMDEtQURENC01NTkxNjlFNDRBMDZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcwNDYzOTczOTQiIGluc3RhbGxfdGltZV9tcz0iNDY5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1120
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{AB7EFF76-7D2D-429A-8132-7EB52AA4BAB2}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6620
-
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5664" "1352" "1272" "1348" "0" "0" "0" "0" "0" "0" "0" "0"5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5824
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-6b63ea89d2e54fd7\RobloxPlayerBeta.exe" -app -isInstallerLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1316
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --mojo-platform-channel-handle=6292 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5684 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:3324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5620 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:3512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --mojo-platform-channel-handle=4504 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:5372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --mojo-platform-channel-handle=6636 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:8060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --mojo-platform-channel-handle=7128 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:5656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --mojo-platform-channel-handle=6844 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:6344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7000 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:7904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2716 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --mojo-platform-channel-handle=7112 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:6232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --mojo-platform-channel-handle=6968 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:6096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --mojo-platform-channel-handle=6672 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --mojo-platform-channel-handle=6288 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:7528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --mojo-platform-channel-handle=6932 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --mojo-platform-channel-handle=3416 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:5672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --mojo-platform-channel-handle=4628 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:7164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --mojo-platform-channel-handle=6684 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:7940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --mojo-platform-channel-handle=1536 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:5204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --mojo-platform-channel-handle=4224 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --mojo-platform-channel-handle=2736 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:7664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --mojo-platform-channel-handle=5376 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --mojo-platform-channel-handle=3380 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:5728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --mojo-platform-channel-handle=6824 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5004 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6720 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --mojo-platform-channel-handle=7104 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:5312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --mojo-platform-channel-handle=4224 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --mojo-platform-channel-handle=3516 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:7936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --mojo-platform-channel-handle=5600 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7204 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:8000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --mojo-platform-channel-handle=7264 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --mojo-platform-channel-handle=7324 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7584 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵
- NTFS ADS
PID:7520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7640 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:6960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7656 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:8108
-
-
C:\Users\Admin\Downloads\OperaGXSetup.exe"C:\Users\Admin\Downloads\OperaGXSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4052 -
C:\Users\Admin\Downloads\OperaGXSetup.exeC:\Users\Admin\Downloads\OperaGXSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=109.0.5097.142 --initial-client-data=0x2d4,0x2d8,0x2dc,0x2b0,0x2e4,0x715652b8,0x715652c4,0x715652d03⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7084
-
-
C:\Users\Admin\Downloads\OperaGXSetup.exe"C:\Users\Admin\Downloads\OperaGXSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4052 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240624051146" --session-guid=847f853f-dc14-4e44-a62c-3d447ca09d81 --server-tracking-blob=YzUwNzdiNzc3Y2MyOTcwNjc4ZWUxZDFjZTJhMDZlMTZiMWZmMjdiOTJhYWIyMWE1ODc3YTA5OTg1YmQ2ZDYyYzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9VVlJfMzczNiZlZGl0aW9uPXN0ZC0yJnV0bV9jb250ZW50PTM3MzZfJnV0bV9pZD05ZGNlMWUwOTE4ZDU0YzAyOWI3NDYxNDMyMzA2ZGM0MiZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX3NvdXJjZSUzRFBXTmdhbWVzJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX0dCX1VWUl8zNzM2JTI2dXRtX2NvbnRlbnQlM0QzNzM2XyUyNnV0bV9pZCUzRDlkY2UxZTA5MThkNTRjMDI5Yjc0NjE0MzIzMDZkYzQyJTI2ZWRpdGlvbiUzRHN0ZC0yJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGJnV0bV9pZD05ZGNlMWUwOTE4ZDU0YzAyOWI3NDYxNDMyMzA2ZGM0MiZkbF90b2tlbj00MDQ1MDEzOSIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcxOTIwNTg0NS44NzAwIiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1VWUl8zNzM2IiwiY29udGVudCI6IjM3MzZfIiwiaWQiOiI5ZGNlMWUwOTE4ZDU0YzAyOWI3NDYxNDMyMzA2ZGM0MiIsImxhc3RwYWdlIjoib3BlcmEuY29tLyIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiIzYzM3Y2ZiNS1iNzRjLTRhZDQtYTE0OC03Mzk2Mjk3ODBhYjkifQ== --desktopshortcut=1 --wait-for-package --initial-proc-handle=30070000000000003⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:1628 -
C:\Users\Admin\Downloads\OperaGXSetup.exeC:\Users\Admin\Downloads\OperaGXSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=109.0.5097.142 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f0,0x707052b8,0x707052c4,0x707052d04⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5708
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406240511461\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406240511461\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"3⤵
- Executes dropped EXE
PID:8188
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406240511461\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406240511461\assistant\assistant_installer.exe" --version3⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406240511461\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406240511461\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x2a4,0x2a8,0x2ac,0x208,0x2b0,0xf34f48,0xf34f58,0xf34f644⤵
- Executes dropped EXE
PID:3420
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --mojo-platform-channel-handle=7632 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:4140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --mojo-platform-channel-handle=7228 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --mojo-platform-channel-handle=6192 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --mojo-platform-channel-handle=5336 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:8084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --mojo-platform-channel-handle=7140 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --mojo-platform-channel-handle=7744 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:7476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --mojo-platform-channel-handle=4456 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --mojo-platform-channel-handle=6592 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:12⤵PID:7228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6796 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5440 --field-trial-handle=1800,i,12305938034756893013,15183721880779004094,131072 /prefetch:82⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:6628
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:6596
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
PID:6800 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6800.0.1211905759\646245801" -parentBuildID 20230214051806 -prefsHandle 1824 -prefMapHandle 1816 -prefsLen 19370 -prefMapSize 233491 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f9f7b36-0305-466b-8b34-e6a8a7ce6d06} 6800 "\\.\pipe\gecko-crash-server-pipe.6800" 1904 1698ffc8558 gpu3⤵PID:7012
-
-
-
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe"C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
PID:6552 -
C:\Users\Admin\AppData\Local\Temp\Roblox\RobloxStudioInstaller_2DBAE\RobloxStudioInstaller.exeC:\Users\Admin\AppData\Local\Temp\Roblox\RobloxStudioInstaller_2DBAE\RobloxStudioInstaller.exe -relaunch2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3296 -
C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
PID:7544 -
C:\Program Files (x86)\Microsoft\Temp\EU8A0C.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU8A0C.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:6908 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /healthcheck5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4468
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkFBMDJBODUtNDcwMi00NUI4LTk0MkYtRjQ1MTlBRTA2RDcxfSIgdXNlcmlkPSJ7MjI2NzVDMzktNDFCQS00OTVDLUFFNjUtQkNGQ0UyRkFGNzJBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5M0VDQkNGQy1FQTg4LTQxNkEtQTc1NC04NjhBRjY1RENCRkV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE3MS4zOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzI4NDEwNzU1NCIgaW5zdGFsbF90aW1lX21zPSI0MyIvPjwvYXBwPjwvcmVxdWVzdD45⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4576
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{6AA02A85-4702-45B8-942F-F4519AE06D71}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6928
-
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "6908" "1308" "888" "1156" "0" "0" "0" "0" "0" "0" "0" "0"5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3708
-
-
-
-
C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6996 -
C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\RobloxCrashHandler.exe"C:\Program Files (x86)\Roblox\Versions\version-80c47ff7f44d48f7\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --attachment=attachment_0.630.0.6300556_20240624T051159Z_Studio_B2F8C_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.630.0.6300556_20240624T051159Z_Studio_B2F8C_last.log --attachment=attachment_log_0.630.0.6300556_20240624T051159Z_Studio_B2F8C_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.630.0.6300556_20240624T051159Z_Studio_B2F8C_csg3.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.630.0.6300556 --annotation=Format=minidump --annotation=HardwareModel= --annotation=HasBootstrapper=true --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=ad847d7f5168ecfb2a8f42c2d912f9c436294a66 --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.630.0.6300556 --annotation=UniqueId=2160238917717924650 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.630.0.6300556 --annotation=host_arch=x86_64 --initial-client-data=0x5dc,0x5e0,0x5e4,0x5d8,0x524,0x7ff66a6b3720,0x7ff66a6b3738,0x7ff66a6b37504⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6364
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=6996.6228.152784681026079401324⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5076 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x120,0x1d0,0x7ffcf5bf3cb8,0x7ffcf5bf3cc8,0x7ffcf5bf3cd85⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1944,78818563243945301,1227646719744971713,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1972 /prefetch:25⤵PID:7300
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,78818563243945301,1227646719744971713,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2052 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:3136
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,78818563243945301,1227646719744971713,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2480 /prefetch:85⤵PID:7668
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1944,78818563243945301,1227646719744971713,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 630, 0, 6300556" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:15⤵PID:6340
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUI3RUZGNzYtN0QyRC00MjlBLTgxMzItN0VCNTJBQTRCQUIyfSIgdXNlcmlkPSJ7MjI2NzVDMzktNDFCQS00OTVDLUFFNjUtQkNGQ0UyRkFGNzJBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBM0E4MzRBMC01MjExLTQ1MzQtOUFCMi05QkMxNEQxRDkwNzR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcwNTA0MjczMjMiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:5496
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5541A4CE-77E4-4CBE-9ED8-BB0EB59E1DB3}\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5541A4CE-77E4-4CBE-9ED8-BB0EB59E1DB3}\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe" /update /sessionid "{6E6130BD-754F-4848-8BE7-EF26DB118470}"2⤵
- Executes dropped EXE
PID:656 -
C:\Program Files (x86)\Microsoft\Temp\EU56A0.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU56A0.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{6E6130BD-754F-4848-8BE7-EF26DB118470}"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7912 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:6112
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3900 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:6744
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:6992
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5420
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkU2MTMwQkQtNzU0Ri00ODQ4LThCRTctRUYyNkRCMTE4NDcwfSIgdXNlcmlkPSJ7MjI2NzVDMzktNDFCQS00OTVDLUFFNjUtQkNGQ0UyRkFGNzJBfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7MUY4MkI0MzgtRjAyMy00QkRELUIyQzItM0ZDQUEyQjc2NENFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODcuNDEiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MTkyMDUzOTYiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjEyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjI0MjAyNzM1MCIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:8176
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkU2MTMwQkQtNzU0Ri00ODQ4LThCRTctRUYyNkRCMTE4NDcwfSIgdXNlcmlkPSJ7MjI2NzVDMzktNDFCQS00OTVDLUFFNjUtQkNGQ0UyRkFGNzJBfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins3NTFGODI3My0xMTNGLTRDN0UtODhBOC1BRkREQzdEMjZERjN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE4Ny40MSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMjIxMzU3Mzg3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMjIxNTM3MzkyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDQyMDMxNzIxNiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzRhZDljYjZlLTgyNDUtNGU0Ny1iMjk4LTFmZjRiMDQyNTZlMT9QMT0xNzE5ODEwNTE0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUgydnJ2cVlCZTVJeCUyZk0zUllFRXFzdnJPRiUyYjRidDhZa3JvQ2JreTFBUk9GJTJmSkFpWFJjaENCQ3A0Q0pjTEZKM2s5NUZ6QTdlR0Z3SmRwVFVKMkdSSmJBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA0MjAzNjc2NzgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzRhZDljYjZlLTgyNDUtNGU0Ny1iMjk4LTFmZjRiMDQyNTZlMT9QMT0xNzE5ODEwNTE0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUgydnJ2cVlCZTVJeCUyZk0zUllFRXFzdnJPRiUyYjRidDhZa3JvQ2JreTFBUk9GJTJmSkFpWFJjaENCQ3A0Q0pjTEZKM2s5NUZ6QTdlR0Z3SmRwVFVKMkdSSmJBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTYzNDM3NiIgdG90YWw9IjE2MzQzNzYiIGRvd25sb2FkX3RpbWVfbXM9IjE5NzM0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNDIwNDM3MjAyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNDI1NjY3MzU0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5MC4wLjgxOC42NiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM1OTY0OTIzNDAxNzc4MzAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSItMSIgcj0iLTEiIGFkPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjkwLjAuODE4LjY2IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIiBwaW5nX2ZyZXNobmVzcz0iezQ4Mzg4NUQ2LUM1NEYtNDg1QS1BQTI4LTQ5RjYzRjM4QjRFM30iLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:2828
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:6936
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:6852
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4308
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:7512
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1956
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
PID:4052
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
PID:1064
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:6628
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
PID:892
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:6388
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5928
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5196
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1796
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7404
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7872
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:2008
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:1608
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:7552
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:752
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.41\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe
Filesize1.6MB
MD5a9ad77a4111f44c157a1a37bb29fd2b9
SHA1f1348bcbc950532ac2b48b18acd91533f3ac0be2
SHA256200a59abdeb32cc4d2cec4079be205f18b5f45bae42acb7940151f9780569889
SHA51268f58a15ef5ba5d49d8476bee4a488e9a721f703a645ddd29148915d555ca2eb451635c3b762e5a0f786d69bb5cba9bffac3eeee196f1ec7ad669e2d729fe898
-
Filesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
Filesize
5.4MB
MD5087672ef1f8a03c6fcea3dc8ffdd2a24
SHA12b01ce0e333d858c24b785584d52ade38cf679a3
SHA256595b1052c954a7e68abcfc53df39db3ec77ac8ec66d187cb39150cd70e3cf601
SHA51254ec51d1e50b0e39a14099da13f1adda591719b58bc6f17a727c6a47461505c4d122fa2100b59029b17a755362f9c435966ad75f5a1df62c6703ab8dd5a2de90
-
Filesize
15KB
MD5a612d2cc69ceba609b454b5915dc8d36
SHA1081f9e0b0930a843ef5af1b2c382fee22e3e7bc7
SHA256a47a78e9cb6e467613036e2f433d2b312d520b4ecad8852aab1aa19d2e1ca5d8
SHA5120ed4d4d4c9a3670bf6557908d59d4a75cfe258285969d36f62f070034443f4431e7abb934d04a12a3ea406af1356f87c84e8afb802a67daa84cda5f005e89978
-
Filesize
7KB
MD5f71bb2af79e43618ab5fadb8ee7eba59
SHA1bd775513336ff6ae1814e4e671ada288a3d71b07
SHA256d4ba8624de7ccb2e9752d5459372715b5484f4f51eebdbf8db2b431390eecb02
SHA512785d56b3c044ecbbbf2af6df66a8c69675b2c27bfcfd060d5f7cd9674d14a0acb82a7eb43803d855c00136b38294c7a3c30f73e48c5f416d11d05a284ca68a79
-
Filesize
44KB
MD59325ea9c46f56722ab992adde064c5b0
SHA15f2aadda0ed572d45e854305872934eca179fb95
SHA256062e5747551c8f680cea4767569af6cde432acd45c30071dd26f9cba769d5126
SHA51252fa754ca2e5ae51b24fb93df21e6f397461229994a2804fd161b7b8a41f50e523e8c378a35b57c991183ec055b1f321e1b39f80626f1d4d614a19400b2e2ef0
-
Filesize
44KB
MD56606c18f467b81f80a3435fd06e6f2b1
SHA1f718d61fdb02b694f48b92c7aa12e4f984ef2215
SHA256d39265ef20f172d44d8191aa39b9dc685e2abfd67fe005d57072195f66d78c67
SHA512f8b81b9c006899999211d589098d6b599211f964dbc9e3fb156c68ffd5408f6d4193b543e62669e0f1cde642647e22530740171541dfba9e244db52afc33fe37
-
Filesize
264KB
MD5bab1d3431d048ff30ea86ea1e82b456a
SHA14e74343547d682f02d14164c80182495b87205b9
SHA256fc7d89fa3edc24092b92bc2973c48e4938f57acc57fdd0002133eb41051b7af4
SHA5126f17b1db9ce688fa9c3f1aa87b10723f634f1ef144560742877bce2209d2f4c3a986eb264bbe63e483e0d40452c1e8714dae94cbd494b7785fed3eb5f08210b6
-
Filesize
264KB
MD553e2ae66d3a6f47713fbc1f0724eb254
SHA132e179e33e124733274a14bd2fc5df2db4f22d84
SHA2569bca5c7e83245181312914bc5ecfee47118e4e5da33e06d6118f788b001d93c1
SHA512320bb2c0dd95ff2752307803ce8e3ef57f3a83ef0b42654d068661072a235a6934385957e6a42eff0b839e966436d1f08f6b9658d88ee1bd84563bca0735d610
-
Filesize
1.0MB
MD5011e4aca502eff80e9b69ba422e1dc72
SHA1be09cade14d8ebb3a8f5e7f0bace2efac4c75dba
SHA256da52c160a1e6e0d2a6a3be6c40de0359229d3ff38cddf01723c635c38874ed95
SHA5129ace6cc51c9eade6f8dc516043ab0a20c05c80e7f2166dec86d07b1a341ec011a966ed8613890d33e807d3955f6b21fa4b139f287e9016e199ed6377e533c554
-
Filesize
1.0MB
MD54099711d58a9aae31149344caf13754c
SHA117c535293d6c6ee9c3416a299b094628e63564a5
SHA25697f458c81e029ef10d5c6f0eb3e982732b2d842faa9c386875429634563b15f1
SHA5129887df590e59b4d3d753a72cf8f9aad5a3492ce4017afdaf210bd51aef3006954fafaa4145cc1259e7d9a43487df184930a7e78609cd5dde7d619ff1904a4f41
-
Filesize
4.0MB
MD5a9960327ba57ec65233f6101c361cefb
SHA141a5451d8c4b114dc86c28a0a5a232baf8ad7fb8
SHA2562f95f4fe8543821a271eafabac50fd83d4eb7316ebed76c606196fef61a2f6c4
SHA5127110554229cde3f04e555e25642cfe1d480f065cd11e7e7ead927092c27ca1cc5d5d07539e24aa5a1180fad47b40ca121227b82edc2b0e2260e61805f9d98eb6
-
Filesize
4.0MB
MD598a8fa4906eb651accaaf651cb491bd6
SHA1ab0b9401cddd46989418771527184c9c24638bc2
SHA2567e16b14bcdbaa4f318a28a3c35722e922f74a4d8947df79c5769ed3a11607a9f
SHA512687eacc9483c886124e258e02b1ec160eb7a998d4561966c8238dc4eced39f30062e7b11351d2689f0dec2ea43b39a4b223755bde8e672f64deef142696b0bc5
-
Filesize
34KB
MD5b3523b16452054d65d400b2d78319208
SHA1bb23da671c84f2e6c430132c921d571fa4cf6a60
SHA25695240e0b7807a4e12e17d1a3912ab442ee9f07a8267b9152ba16f5e92251cbbf
SHA512848b4fb26fc31e8a6a8b81ef03e571b9675c8d852d013cee7c4575897da3c3398e8a2c389abfb0ee3a64167a3e8baea1bc23085eebd2a9bd7869b54d8b083dec
-
Filesize
59KB
MD5caaa5222d179a24ca5540080c7018b99
SHA11f415a7a73a12a4c16f25709504f4e4e4beae9dd
SHA256b729255f2e984a20fa0f0eb07e08368cf468fd17ff27a7d1dbb4042ec261d8cf
SHA51271b4f878aa154ba4a8523c2e36faa8dbe3cfafa082b18796d8b69539dee9506253b9e55fc9b71cc2c9027d22ae08587b0e2ddadbc8d3395dbb73584d1ca1ebcc
-
Filesize
41KB
MD5cfd2fdfedddc08d2932df2d665e36745
SHA1b3ddd2ea3ff672a4f0babe49ed656b33800e79d0
SHA256576cff014b4dea0ff3a0c7a4044503b758bceb6a30c2678a1177446f456a4536
SHA512394c2f25b002b77fd5c12a4872fd669a0ef10c663b2803eb66e2cdaee48ca386e1f76fe552200535c30b05b7f21091a472a50271cd9620131dfb2317276dbe6c
-
Filesize
24KB
MD587c2b09a983584b04a63f3ff44064d64
SHA18796d5ef1ad1196309ef582cecef3ab95db27043
SHA256d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0
SHA512df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067
-
Filesize
104KB
MD5668112d8aea3825028ce24b05c32d64d
SHA112b45b678df9ee5e7a164ac61d5e653a7f40c5d7
SHA25699e9d662960fae52b2fd42d963c0cdad67626cee0f6a800f94c5233880453e58
SHA512673d72e3f27b3bb935333db57653fb1843f016f855de1e989dcf9fd569d201b4145bff1bb5bdcb5429562f7b9b31eb2c7efbfa9a5bf1a262e267461bb42666e8
-
Filesize
69KB
MD5921df38cecd4019512bbc90523bd5df5
SHA15bf380ffb3a385b734b70486afcfc493462eceec
SHA25683289571497cbf2f2859d8308982493a9c92baa23bebfb41ceed584e3a6f8f3f
SHA51235fa5f8559570af719f8a56854d6184daa7ef218d38c257e1ad71209272d37355e9ad93aaa9fbe7e3b0a9b8b46dfc9085879b01ce7bb86dd9308d4a6f35f09e5
-
Filesize
328KB
MD55d4114cb033dd9abefa79daa8bb1fce3
SHA1403170941671bb5c568c2a535cfc5d3e0c6798f2
SHA2566d6e9e73e627d6becbe74b55cd632ced17a11df4e70a99ea305e76184e13dc2e
SHA5128df0ac9df4d07c8d5572e5cfbd94f1d30fff4a8346bc6807f864550c78fa3293595eabdada7e669192d6b0fac47c06032bc94120ee9a3d4445791e865b54bd28
-
Filesize
105KB
MD5989f75e894f728b36d6b1608a96fb908
SHA1c5c82edad1b5668b151799a74e017a16732072ee
SHA25632a2da14d39f556bcd2747be3b2599227b6feb35c4e06d5ea5402c03562b4d1b
SHA5128f1aac4b0841caa18302b2313629ce7002d251a4e4e2f2839a987667501a43f2785863c647dd87139a3bb866a103aae2fb423425e258bb9ddfd912f499b7b97a
-
Filesize
190KB
MD5536de60587177aa8a6d83cf8a96a9cd9
SHA166c0cde28acd7507ea11d8c955bcd2ea5d584bfa
SHA256cdf3b516109e7a14e5f0ed5578c6a94f78c49b1b075c9263a7302b7072b7a67f
SHA512e1aa352f90326c83fe4edc8d05cfab287283d345bdd35735f2c9aca8fcdb881c2f1ac22a790e5741bd12d14b3e4b6ff9fae3a08f42168baaeffd0595c67dd486
-
Filesize
16KB
MD53eeaed2e145baa3fb6498b4a74ae3682
SHA1e028ee03cc477b111fbbca3876b88bcc7e566ab3
SHA256ce9862fa7994263dafe058059ba05e19a9f907d5d525c0c68405788eab71e625
SHA51245616d94a7081ed7c65ca880db6a472d23d9a4b3165f92ea9feefccb16488d4efdc24b12e472f7697cc72f7f0b0ae2261f943e41a615a2b96e2136dfc5d4166f
-
Filesize
117KB
MD5585c3e887214031aa0956eb0e8cd49db
SHA1f738a0b979c272b70250b80be560b9180a017a3c
SHA256d0f379be803c262e410bd9cde7bcea4bdceace93817e52a03f0d31799f4f5b50
SHA512cb20316e1f5c95db5cf3feb9e9d92e86ab4a0081abec1a4487768cb58301be986010a2d0a67a903f4b9bfb2de3621eccd6c59dc5b4abb5d170ae5d1bbb152c97
-
Filesize
88KB
MD5e6028a04620e90ce050d3d29464e648e
SHA1f4ee75fa1c285ec7196640207ba54b4462d1c08f
SHA256f575c58acc574cf1f4e19f63481021ae81ed94ce16477a65d62877a2a4dad440
SHA512364de3ae4264e194e222d0b8d75ca5f9bcfd3715a0a40737c025e51771a83f24e94a6c7bc8295fb0236d8275a05fecd59dfadb6cf61ff64aca472b0f0d35bed5
-
Filesize
151KB
MD52aa5d594f5670a7e2e692faec7b12ee1
SHA1d3291d63c384f1d19e8eb37b62a2d0b6c43cb086
SHA2562da418ec4d58aff0a43cd9d443e529d56c54a25679cbe118f7c0f7a59a49a3b8
SHA5127697fc9f17a17a805952e84f591e2619fd74eecced919cf0074bff980b99b7b86ef3d8bcd8e8b5e93b458febd56c3602f8d5c7b9b78e174464de0a23e102d0d3
-
Filesize
18KB
MD58bde2fc66ae0ff17f4dd9c2bb2c71160
SHA1bd7d40787c69ef7cc9d62ea9f8930b741dce6a70
SHA256fca06c3cdc8f76dbb0a1b31c15bea6db30e6819dbb1e421abcb5f07a83197fda
SHA5127a47faa6b4415f1115a45d38b686726551e3e049d126983412965bd2b39a46930eb9da9e7a29f6fce2c4baa605c64342d67a073d3e84315342d503e0a118c1c2
-
Filesize
156KB
MD5cf36a28dc92f2096df5bb5034cae3dee
SHA1699b513644a4c87e043785085d942d18edf3a0c8
SHA256224defa1dc6a1cbdb2ec0adc116cba9d733c0771c9577e2ccb64628bc721136f
SHA512cfcbe8a4ef0342696bb095d17dce2006c5803b2ff1baf2fb579da04bf6e56489afd3f7ff8807a30ea5e0ecab9d1691319e8bf1cc35a3e5404ace10287a9c72e3
-
Filesize
21KB
MD5afef8c317433f1008740a5553fa0d4a8
SHA1273fd51d81f6e122436756aba3134d9ec13e7e28
SHA2567c8df7ee0062681e8001a6b3fd9a474143309402ef5fd201a59f2a11fc85f167
SHA512e4bd318fff9d48771ec1c3c5c3f61d89ddbf9ee706c107def0a1454508dafafe540a77af5f344b225ef9fc3efc34119dfd4f5dcf57c0d647b519625099ffd281
-
Filesize
22KB
MD56916c28708d5648da7529f29ff08ee49
SHA1869f990a921e9684918084783e3c8583ad3cf43e
SHA256e96687aaadbba9855cf703533c7e30e7d294f87525475f8cf1256f8b49a7f1b4
SHA512d5dd2e9fb214f6007ac234578a6cd302edd96cd254d62109d17683b5be092891a6e37c1cb3f9b41ab652fa4cee0845b200d7288f2103136dc267fe1b4090839a
-
Filesize
81KB
MD5b3c386a33e073308f6f13c8ec4ab519c
SHA177cf7a5f56fb4865dc3111da6d6faebe4a73e82c
SHA25682947dfb31946c918694bebe9f7cee34df4d2e0ea82b77b5e7285f2b7df09e51
SHA512eb792c3b679ce16b3a48843d1c992640274b29a7074c01e40456c212d9f6d078e87e49c5ad4b142cf297dfc35fb8652fda191647a475cc828f62d2d6f338719b
-
Filesize
152KB
MD56dd034eb8ea27177fe21c1458be0787f
SHA10ea30cda23a7bfae538a8d8d89a864202c6a52a6
SHA2564708ddf238ece3b915ea3e50650a85768f8b7b2bcd33064c4114be36cd58e5c8
SHA512eeacbe2edc06ef13d67b44778cd80c6cbdfa6c6f38f0892b26f80a01727ab034ce006ecf7c5107cabdc2fbb07987566eda7fe7254b820a240fac14cf37c96515
-
Filesize
16KB
MD5670177b2596d2258e38e7879f8d2912b
SHA17497ceea278524432f0feb16130a38492f0acf9c
SHA2568f832d9d5574e8cb52f32ca95c1768f5f13fa297f96f6ace1fa5f5867c3a41a4
SHA5128bcb373fe9616154cca4f9a01d24b50b42ae93407bd1a915ce3f50fc0df8d6de12904697722ade6250537d36c82960119179668ae1d40d305107bd9fedc37e42
-
Filesize
157KB
MD5e24cde772a7fe66f33c9d667a709c727
SHA15df7c85e9f2b63125321a5a688c40c26a1bbbfb0
SHA256d381b3ea2aab24df826f62a77f89e7b58a424f2862d9ce1e7b7d300498b4cfd6
SHA51234c1357e37a8ce5fdfdabfcd7c83a0524f2513d4688f8a601cdf56b816c24a06d77753a1dfefe138a7719dd988f9796439222a741420e65f59e84bfce462e94d
-
Filesize
18KB
MD5616d424a1e3d848fd3bd2aef3922e979
SHA1c39051876cfcd0c420af77771d91556b6c078fde
SHA256987d3f474d5492c9ffbe7d5417595753b97a08d23076583af6c798a49136c423
SHA512786f37370147a5ced49d33080c193b756b2502e1a4c89173c90f88db7ba788e977a3cbeeed9de2d94cb2c7979f930bcbbe725e844802ebb64ad5318b513d4400
-
Filesize
115KB
MD540e30a31b5956d7ddc5e7a54dfbd8d6b
SHA10fcedea4dc5d13af21e8117d1797303e8532c0ac
SHA256edd62e05b8baa81c1443312525dfc863585d0833e021cdb75494c9b8da6003f5
SHA51210eb09f0d7a298b0572362c15402a8018425d999911525b5bc9e52c6d03d099d33e26de310f2ee4a161053d1272987a6a7f7847c814214e755dccfe1ca439496
-
Filesize
18KB
MD589420f2bf69a1c6f0ee3dd91032b8e48
SHA1e64be6eefa16d0357df2516bc8a7aa8e9e540922
SHA2563a68eacd791ee0438320afdaf21714bc019de8f31a02454a11023e1c3106c069
SHA5124b1520f815d1c1eecdc34cc1b5538835b7d1e8d0dcd99352b334d1b8137262e5408f8da533d6d926a7d42e3567917674d848660d39be62da48dbae79f5c604ec
-
Filesize
217KB
MD5424246f1c5a69e7fa901657ff3e8d5d5
SHA10023acf65aad374851511507cb975dc8e93ab0dc
SHA2567c770f18d82e86dee4ac67088125229eb7460cbeba54f057da43ba89c35c093e
SHA512ddd602c3ee49ce60877b9889277fbd4e9f70ea6e1759bfeb0533a59f5b4b716bd90a01d363aa9f23912e22b3d00dfa6e4e49a8cdd6ceb300f16bc6e4961961c6
-
Filesize
102KB
MD5c4edb689f8d135dbbd80cfecc1244353
SHA146811c8e4c10e32649e6b37821124ea80a02bee2
SHA256bfe917c4af1ca6d088df34e4be2f344d7ca4cd25d153019ffce3b02174b8af8e
SHA512da0a469f7c6278316f97499074b48fcee39915340aca10ac5ddb98c756792fe5ecd1f9003859cc317a44eb5488035021a7669a9f05be447bb29aa6a76452d9be
-
Filesize
29KB
MD53a30f0ab9d3d2695a9f16a668dabfba3
SHA113179209da086de0a4546d292c37a9965b767c0b
SHA2564f14cbf37233cedcf58f899d93e6084f4d7ae517b53ad91de751faa7532d7d6a
SHA5128861cda3a2042dafd2b927909096c9c32eb7025e4b3501724964296cfcf40adf12d0580640d56bb8f2f97c7f229661fc009029c1feb3c9bc053af759127e83ce
-
Filesize
24KB
MD5ab0d10f0161add92d694e1c4d861d60b
SHA16797be1d5d497114544b052f493547d59fcb2566
SHA256a54ab1126fe57d0b5d20bf7d62a50acc5dd2507b1f8fdae9115f10402625cb7d
SHA5121e7f787c215ecff6342007a97b20788a1da93b25fb33627517afaa4650ccc2e0bb87b580207aebd85d2774bcd03ee424fb8752ee7818dc00b17a299dde754ffb
-
Filesize
46KB
MD53dda883b89b1f31dd1e8e0be2d4250e9
SHA1ff69000e8307afcb2b4db7d6117b47975f9de06a
SHA256e60268695e6c66a62ad318850e45954bb22d21f2ae62fe9f0c5490dcb1e69f9b
SHA51225176c5acc9cf658129508ccc1b7fc8e93777cc59a404caf06a0e0eeb7c10b5276923aa51d56a99ebfd45d9f05b16f598794fb31ea0aa39565770b3c3b8c8c43
-
Filesize
19KB
MD5654b495cf8877c0a6c9423793216dd88
SHA117526245d961301ad40c738f6b6d16a2afe6ac8a
SHA256e6e0c443422b16eb462ce281ca745a2e8cd58d266c10bec39a12dbd45b92af69
SHA5120c319332fa505d54972ec8046e209f109c52dde42ae303d862856e2107e7f16ed5332375acc5a9c1272d940dc7be3576e57b833e3746ffbbbf9b8c71ec3482f2
-
Filesize
96KB
MD5443826e43ae39d6b6d996ec061398f84
SHA1a996ce34b3bac4eb02a8c113b1105de8f17f0868
SHA25687fb32803b0681980e6fcf71b9d20c00239b622beffa02de6184e8b15d7b9b51
SHA5126875d9dfaa2d4b0fcced2350ac95aac477e9289ffc4e192f8a3d20eda57020d31d6feff74b5f4978f1e5f6373b13d81fd041ad95978c1a20c867710bb1acd477
-
Filesize
806KB
MD5296107fd9e4b08da2a5eb5381e62e59c
SHA10fab647f77db64c6284dd6335f6f01696217fb88
SHA2569a75f06abaf3c4db9cb4110d32c18ba80356efafd79e6f6255aefc31054ff133
SHA512519f5c12f414e6321e63c5c2992b4eb89131334543310513ffefcb9b4cfdc9cbf9adc48854dd40daa8475b238ec4a1b1d6f31d666e5edb773f433582777bea43
-
Filesize
51KB
MD5588ee33c26fe83cb97ca65e3c66b2e87
SHA1842429b803132c3e7827af42fe4dc7a66e736b37
SHA256bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
SHA5126f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
-
Filesize
26KB
MD5f69ba3526d786a446e180f354bbeeaa9
SHA1f157f99692d6fd2d20bd7d394497221a53bd60b4
SHA2560efa1477719c104e5e2c378644379fea94cfe44713fff23a6bc954ad92843dd4
SHA512f2b724f8d1c459de258c1cee3dc51c2809c3e8a1e4cc6660685d817fb82a9b663bc16e5b6c1a832d99c9cd4aae558c47a6aa0b68db980e4b083b0560d66030b2
-
Filesize
37KB
MD5a8e5e056923a148d5075bf076ab09e9a
SHA1d1c90df93ba2d032b7fe9d9c97f8a6c5d5e8fd39
SHA25613c2995d4800f07ecfaacba780ba4cbd279ae432935ebf591365039cf688e835
SHA512fb6bd1d4e05e49213fb46c279b677764961a8b27b3f9741c4823833b9c427d135c195854ac13a200cb0e30d5d0db9d4ce468395bb6972b30949c5784ed87537d
-
Filesize
87KB
MD5d2895d96341b1d0c1eefec5fb110bbbd
SHA13e8cfcf221da48d743936a5acce94851d0a3a3b2
SHA256d389e6eb3728840e524e4aa67ea2e0cda842ba753df9390539fb3768651d27bd
SHA51215623935d525a08f663296543a43483551b4d888367147d7def69d5752b88a169ebfd96ef425a5cde9c1263a35c8059390ace0f94c79c390a936bf52e1e84c38
-
Filesize
43KB
MD534b84a5f5fffbd87e032fabd53e069b0
SHA13b72db743cf7d6c77890ad72659fa5581e696e3c
SHA256cc2b698f436c2cd413ee64cdc5ceca617473e7a8cdf90844a9778bd65fb08d67
SHA512b3b50774dd9dcca826206144cf52eeb5a9ff196f4447cb32e77dc595141ca0cacae31dfa1681d67013541ee14097280fbb304ccf956d42389363ff896f9dc17e
-
Filesize
17KB
MD513ed713c90395183137623b19b399a18
SHA15ee72fd3a0b140a8a179cc8e8214a2343fc0c0a4
SHA2568b733f2169b13e6e5aef73e152822d9a71a6de691ec28ce2d9e0f15753a19d7b
SHA512c7f69a65a55082a9b93b9703ebd05acfd55ad5d858d29b49353db8fd0a9f3df239bc1e84a6cef629f572c70ebfc275e8af91117e92c1a4d81fa05c964bd12c35
-
Filesize
19KB
MD531fb1d1b98a40048ac0fe2b5027cf71a
SHA1e4a5be46ed8cd1dc01daf7616c0e5967a6a36589
SHA256241846415f892bd71daa4fc7ae2d603e00eb61e17861599ec6750c41d0785fce
SHA512101e3212c9b848a134e9d95fd42111c3272f0ff76c59f2917a969f2b2d67fb95c5f4e77b3b6514ae986f876a5aa0e264e1b239fe4e07391c54d4430b849c0db1
-
Filesize
79KB
MD5c2b7f59e7eef56285bd18e5d0763b4de
SHA1778b18fb34679d01f3056e89021a3f4623f75373
SHA256aa2baa93d8fe182766f8a1d13c1d517f20c8f80e9a3a126fd259e9d43e64131f
SHA512b16fd4f98c5c130ba9140c4a3652e285d5a4bfa8d5c6f0fefbc1e97fdd1bd8edfce6336942324216177ad018dfbebe6717b46a4ee2742e3da9ca69b81e3b3b67
-
Filesize
20KB
MD5584f52a96aab6de9f2eec20e433cafea
SHA106cf2045e966787f71b070c8829eb3b206485b3e
SHA2565ad1ff39ed7ac284a9c7769b0e0bb4fd76c8000e4fda8e783facb55d31ff00bd
SHA51283a70686c5b26791b7dc8ac517480c9c4e9aadf3c7172d73f6a80b39bbc30954da0c2c6c9f3b0ffc6dfd6f289e0414109235acd3b38db21c03b564640a2693c9
-
Filesize
29KB
MD555966d309d023bc6f40b08786ad2f9ba
SHA14459adb0b74b3483b1f661f015db183938e42dab
SHA256d83f88c5d5a849b7cd32403809ec38de91793dd6b9a4f9edbe625b3f98269322
SHA51205a4afbed6e6e8c50f9a493a54c2f247f5bcd8910181f1dab37747498c34d1fb0f31e1ec526275334c3b2b0b78b61e79adc7d33c909968e784b8445709b9252d
-
Filesize
75KB
MD50049e2c4454a1b88d7e5232ce501274e
SHA1562dff86ef5302b31a35f3335b94f2120f83c3ea
SHA25697977d6df3ba89444d76c5a05e1923ab4722e3c4a9c8d04cca207493fd2e5532
SHA51234addbbd3ebc57bf1b6c39d876211d8756bc74decc658c8a64d253414b93ebb7b394837ccd7b2fca7772794f114443548f7b98c8a023cab3a286150bc8fe7ec6
-
Filesize
20KB
MD5e68c49fd30b218d571e5435773c46d89
SHA10107595579b3d17c8cc585b8a3b08ca7ad1814b9
SHA256d1fc73a52c9ee2f44fe2bb46b0dce37af0a9709bb1c1c2992bf435d3aad7bda6
SHA512ebf8476180427406119f6760919be8983f1fa322df3982a8fd7d81bd0b26ebc4505048d4e4cc281aafeb5046211c458637f11e8911a8fcd277019ab7e1c9e247
-
Filesize
30KB
MD5c3caa237ff99a1e55d7fbdb3f48b10f3
SHA1a31ee58ddeec33770613cbfb6f7418cd94e07ade
SHA25613a06d8b3e97713b984a16b8dc8e4e80fe59890bf88791aca961e8a54911fe93
SHA512ed93ded04db5accef80e0fc3d45197ff8a0e031a23a901ba2cd2611d4ec96bd6208c9ef7f0ba79e3f0b9beaf927b674a7dce1fd1f58b3762fb70476817271230
-
Filesize
88KB
MD5c729a3930550abc4a7d40fe798093b95
SHA1b0f3bacaead5515f457850cd8df539d71fe2bd79
SHA256f300dbc8120410263e239caa74cc4cbf3a99a89dd686f87e256e1e12d0e45cf1
SHA5120505e70c560696e12b6321e04c98798c4f926afaab948097ebc6854d31a3df1612dce1c53e5ce980a68dc4fd52bf92a30e30911c16bbf7a2ab350b28480729cb
-
Filesize
56KB
MD5cc97d349b7d3a16a418d1e1cd74ce69a
SHA13c1de5d26a55901dfae352011d5d6689b0a1ac86
SHA256edb6a4322ce7d576fe85295edb721c404cccb8434e6414b4b0b6bcfa5f1c9496
SHA512394f4ed1e35a804d4eefefa447aed03494bfa6359fb7953724b1da7c97a2de7c34890f7f00066b4bce24d967891c3e3ae07e49ba841238c6a744fc6a37d9eadf
-
Filesize
90KB
MD52e668cb1e2d4d46bfcdb5b051ae824af
SHA17e312eb3cb04b0cd0dfda5a2e8ed880f5c54d281
SHA256bdb0aa60710cc1760b06eb496bd90352f085c156058b39db16ec45421e07c24e
SHA51294c2b2579688c6bea2369a9260eb1704f420c67722091be0f1adaa0ad3dbc244690743c13c064b48852780a4cdfa2f8bf1b86b6b5f7153134aba129a3620a9bf
-
Filesize
67KB
MD5e4619ee8863ed75103fd55d752037036
SHA13b69c3f48b9c35049e09a0f2724cbd48ceea5642
SHA256bb9153c3317dd6fcac3c6049b0d82bb968a8b60fb99517fd4e367ab61a052bf6
SHA512bf0e1921334e3ac48fff7b9275f318d7fcdd6d9a120f721d95c8d8e26abd903b491d4c53465aeae43a9e92468403c759bb1ee68f344f8a54eba67cc1e1b1abf7
-
Filesize
77KB
MD5f8688fd8074fcd2255b76ab5693a950e
SHA17f0960a70fd5e16d7ca386490e21a3dbbe8ced1a
SHA256d9e22fa9d02d335126295db8776100d4bdc910278efed0416f555fc62b8848aa
SHA5127b3bbdb3347f6cb7746707aa64195ac454b77a11b563e8bd5ac2ddca101339ba13437eb7a90118a3dff9aaf2e84ed8674d0c5e2326f1d8da7b91b6c9eb21ad86
-
Filesize
21KB
MD59a8060eaa001634834ea16f0c3d596a7
SHA16fb1ddfa6d3dbb63eeca37168a84701e05116886
SHA256d842b147a3ba170a5fab342a5586e3ae2da20a8efd3529f3089e37c7d2511f5b
SHA512eabfedb79b876eb5c1a71ed91f86ca6860a7207751564d14c8c5c157d4359c65271a6fde4fe91d7ff174f745478e0fe7936aed560645af8d4ecf2bff2ce23447
-
Filesize
73KB
MD527134070249eb78e61922e089cb41464
SHA14af2ceb19603088d207eaf0da5a2b281b1cb93a4
SHA25642d3fb202ad75b27bc4eba2cb283c38132034448144dd4c0d76601b7063fe458
SHA512a4d3a10ae1d6c92c15e134aad39e2fbd9e47ce9a7d5f5a1c7c247bfb1020dda591fa23a56f8e5809726875d1fa9649451e816729017d35dcf8dbecdb3ae132ed
-
Filesize
20KB
MD538e28801d3222ef034410dc0a4b8e8cf
SHA1deab3f7e5c3c0b90b79427591c67026efd10eeb3
SHA256fd99ab7987ab298eb69e512dd4694493749969d8ff3094dcf79563139ac6c927
SHA5128564809bd64a30db808d1ba061226ca41edd445f25cb388cca6835b9552bf12204a45f241cbf037c9ed1b0dc63ebdbe368e3a7a4e5814b625bdd8d691705e6d1
-
Filesize
40KB
MD569201d18e4afd6eb6f9632fcef22e08b
SHA13d0f38f8d2edbc48037367a5f0db12cb54a44885
SHA25678c1a8d6204336cd524559ba007f90c6d864ace14f02e78cc495ea9de245d30c
SHA512390bf0570047912cfd70d807f85cef985f55d8f0c2ff26a7de9880b15f5bea742a26ce748a23b3463cbaa0387489b539ed1daa1ca6a44a8152d5a6d65d75a78d
-
Filesize
29KB
MD5ff122ed83c65b35220660f38c2fa26d2
SHA1f99451f4b2fa18429253c8b80209900bf711e8ca
SHA256a0b52734f27b7bcdacf0d69789bb34370bfc772019a37ec52a3f62ea60f83dbd
SHA512482afdf9c42f5277ba8412746ed79d2a9628d1287b53c7ffdf4afa3c71adc3368bdd1731b45104991a3a500451c9f02a29e0d15387fd706ff22ff0dc6869bf1a
-
Filesize
28KB
MD56b4ca20e99beb91b47fd15e3c5ecd0a0
SHA1fbbe3dd38cffebfa724618fd828d09826d815d1e
SHA2564797fc1497acce42c03a13d933704c3a1620f9fe53aedbc7f57d5f1531f9d528
SHA512ce267fc8c7767769291f11b451c17ce2245d26f8530efe0d2129e83f00ca6f35635278555442a2b936934762d333b83b3babddf82e324ab1571df580439a823e
-
Filesize
24KB
MD5e0210d118b3139c5c77b0a3cdf07240c
SHA1520912218ff8fb26d188dafe6eb7d53e4a1347b8
SHA25609afbb320f0230e85ca0b2ad49ca106b3cc9bbacd2e45bb4e8faed3a3fe93444
SHA512dd11395f2f830af1571beb0293e78a4ef01c252371194bf0e8154d6494d951e44b0e34219ab52ec8cc8ed47eed88b99592e9fbfe2c8d4cd65e26faa257a64550
-
Filesize
44KB
MD54829199e6a5f896653a07f378f420e20
SHA1ea33810361856e36459b0da1d93267c6252b25fc
SHA256f5d8f9bc07f91b59566bbcfa3c572d6d2ba2f35432b9ab89bcd7ad343cc61ebc
SHA51283ba69988097dd4a39a19136ca5e68d0116305cc1d04fc519f59cb208ec0e8e5e592abe8fc9badffc701fc56bb6aa293c4089261f4d4a9b3d616026f000f48b4
-
Filesize
37KB
MD5268da14d73ec6cccb4647564e4e25166
SHA1884a815b96d1d83835fcb7fc2b49fe362cc373de
SHA2566246205f17fda587ba079689db72f167c7c538fa990717333ed9c20b4ca38786
SHA5123257fc1782e49e20fab4fa233806a3b77c99456ee264e670f38a06480b957cffb34510647fd98eaf56f7f18d56c3aa0269114f1ebab54ab3d8fefc9718f82a0e
-
Filesize
41KB
MD5ebd8f2400543868dfdfc7ebff27c47fd
SHA19ab3cdfe58d2ad2cad9864d2791286b5fdb7ab9d
SHA2566b689b20a7a1af0643a69f932a66b47efe23476af02a287f81fab50a3a6e5f2a
SHA5128d65dcb238bc570cdb9719d3b16bddf1d61a5b936328fcd0945e7d8ded7260c4f2c71a964d0eb239a906d83726f07af1e11b3bcf0f211492d3e7de6f2c08cfd8
-
Filesize
59KB
MD599adec199701191fda80529b0506e475
SHA1ba63a6135825ed9f463762fdb1fe8e4a3cab26e7
SHA25686301cee42e07c559f6e99eb7e7270015f1b0617d1169feb1310508d4c6e004b
SHA512c4ae0733870ef45a493685a3871c77dc2f9373d6104b429d38d508b5e6b0263114b0680e46e57ca20dc236cd45a4f6be4a1d1fd54945015f6bcfbd379e911267
-
Filesize
44KB
MD5f5bce7c34fba54e4e03a45f9d5c4af8a
SHA1030bf2c60bc5a6a0b261d703e763855fb795da2b
SHA256b21e8176ecc9cdf363326c2eb5bdf1816d0062caba7a4ba8e02a3831c0aa1551
SHA512372de00a1196a4dde470287278e4cdb05c99869be9d0dd1c60509cda586472fc0f0eb47771b50fc08dbe9caed41518ab7094e85334e668bbc02b15b6b6648c7e
-
Filesize
147KB
MD5759ab24cf5846f06c5cdb324ee4887ea
SHA141969c5b737bc40bbb54817da755e3aa7d02f3c6
SHA2567037e6c967c38477a5fcd583c74892e16b7a9066cd60287c7035bf0760d05471
SHA5123470ae07eb7c54feee1e791e63a365cfb0da42f570a66e6c84faf5db6bf8395173c6cb60e8c5cf28eae409f26ea5433c3c5d6ea32eb07e5997c979c6e3ccf4be
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
38KB
MD5d226de9c93ff96dc55e6e30f5a85d021
SHA1d0b8e2e514f4cc9082097abf45ef734a67fb0cb8
SHA256bdb71298f75d294ca2c1acd2761281411e4aa5bcef6ebe04b25ff626368e969e
SHA512107d831633a3ac36e050aa3a001989f3d2310a8fcfdecde87d26f1968a22b430b769747a0cc1ae7b5836b183e77bc958ab594f8dc4d8f6c087601eedb1ded73e
-
Filesize
12KB
MD54b17683a9c2aea30ad57ab528b1193d8
SHA1422cf75ec155db04b5cdb54b4a93753841117815
SHA2567e4a782c39fd38580763a74d468b89dc5cbfb98dd952736ab6b9f28616ab6395
SHA5128d022fe2aaaee986beb3de89c2ed56654d0f66e0a4cce4d510d4f79266df72634b226397247609071885be8bf557ef34d2d653fa76befc5a4e243dbe77561c8a
-
Filesize
2KB
MD5e42ec6b410d58f9eab79402595ee5180
SHA1f4006349907450efceee3d95e22d5d13ef3dc944
SHA25665bc2f865f48231ec6d1b7de4f43e52ec718f71ea80a0bc82cfbd28f67e5da8c
SHA512ee22e892e34e00e870d44721a985aaf5fa3293b0f853f3cd899c7147dba85c5bbdb9f0d8673499e2ead097d8c64bfc2f977d9311c62eb95158a7b3156bb574b6
-
Filesize
16KB
MD5ad0b0a15ef3f7a3a6f5261b183c16b15
SHA18c865e1beb257cd92193f27e17e788554b6fe385
SHA256708f26f30515317fdc6588b52a211c063c2e97661c0e44d45ca900dccfadafc1
SHA512ff0a3b63b52a563b465be22c020a970a59b22e5abd06b8cfa499c6851a1a9f2deef661362ae23e607da253faaf8ce80c9cd6af6699e6d98ae551384de4037a2b
-
Filesize
13KB
MD5b719a8366eda95227742be154613749d
SHA1aedd45b5b9fad053e6868f2bb6e50cf8735bccb5
SHA25696e15838aa9622f72a935df3565a710eea3d61ad9c05b1ebd270fe37e879c8b0
SHA512ca463ea57c73779d7c5d7a9e5b40489f561eae7b8e08a50e5b6bfc0bbcb90408a2b95ebf3704558d75851acba41face2199a07cc81e3c2135042695374e8acd1
-
Filesize
13KB
MD5650515cee912b49fce6f2ce8df66c5cb
SHA1756164c0156db6e0f62fb573744faa55b2df5a3b
SHA256027bac256a3286117ae52caa94324b2c74a7ee267d6125fcf8007cdb79079907
SHA512dd11e213af9895b32ab7d145c7e477a544e814be3571fb5269678caae7339e07953d0c8ac2d96fb360b712a197ff0c47066aeec008225ac1a63c62b77970382d
-
Filesize
20KB
MD54bb41589495f1ea9cfae4edbeaf72d4d
SHA1941daa51b36b7fb13055ebc33ebfced016148914
SHA256b3863b650ecb1c2d05e6b1dcac16b2c50bf70b82c668568219e1a541c241f3e0
SHA512ba87591ab2269f172828d709f0d32335ceb2af45b1a7ce8dc9d4f3ace531d1b4f01d321dd7150f434e7b9c99e577cdada906d2c2002dd738158e6877929c4d95
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State~RFe5b153a.TMP
Filesize7KB
MD57988670428a38a4301959c6ef8ee4113
SHA140ebf1e53a51ae7170d2547a71a8ac9a11cd1d7f
SHA256c97edbd16ef9cdc2e4ac10ef6dc4343aa07b5ceef2e5b64668b00f462e4becf2
SHA51257a8aff55d78c610f5dcf82fe19df13daabedb5d79791dc604f9b79e9c8e23e2881331d6a9a3d9e49782badfbe63e064dbfbeaa1fc57a936075057e35b919a5e
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5f843ee534601ff3e27c9fb312424cbd4
SHA1c933ec4206db45024366be7276744466aa5118ea
SHA2569049802f9dcc66ae43a23c228695ac671fc4d5c5f4a35c88f120450b14a2c0fc
SHA512a708a7320993318ff4fe3abaad7a2d97d09b1c11439142749f3c4262695faa7ad82e0e6fd4b7902f487e07c11c2306b6fd352dedcdd4608cb034c0089fb9b56b
-
Filesize
356B
MD5f6eeaa596c00fa7c720aefd1f77d6391
SHA1718303da88316b56f4063ace32512939cc631a46
SHA256bff0c9f5bffa3ef9b04d48e26cc140e43fd1b4f995199f37ce56e9f94fc3ac1b
SHA5126f99266c47d4ffd8059e3020c3c4723120bbcd2ac17d3a7cbcb44fdf1b790364d411d78183b0181697c67eee3abaf3d775c39a1184a4242edc89dd08c9078a41
-
Filesize
356B
MD5ece16ff096a31867b6045ee415d11a3b
SHA1ff0b5fcde5d73456e5f81a08c6c8b96f44c7cb60
SHA2562497d5c015872e0837b4f626f549229753f70f3031407f5ff551235361aca873
SHA512f3b3396a9a2527b162b9641db9a153bb8f59b19a15d462e4c77d12c37fd560129439071bd487dfc1fd5943c16c6e712ae97da4cb8396ba13c8be4afb758fb8b8
-
Filesize
524B
MD52dfe8bb22a1692c0ada448809836c4c0
SHA15c945d9be961bc9407e9fb0eee66baec0980b486
SHA2569a8ac886b6420ccaa42d3f581331713b4eb50463044cec83f201fb7f93d394f3
SHA512d9206dfb917bcff794e06cf22a16f2ee6f32d560c167ae1193a87a4e93931442655aee1fee8cb12f55789b0bc5b882d4b18c7eb0178d159ef86fca925360e993
-
Filesize
2KB
MD53aae9ff980061bf0548855617f898101
SHA1266d2d2ef1a4bcc2667c01424f464651941c5108
SHA25661d8071c813c1b8170e57b1deb9749f0f6e889d7b3c3d1ba6f25e73311ae32b6
SHA51222ced4d77d8286fb9245feee4be54fe07fe03ed675cc9252f406904bd8d19ff54f2403c7600fc2fab3183aaa075be6b5e255e5e2918a77f799b9349031a0f0ff
-
Filesize
2KB
MD5de65f7aac072c1acc4dc4cdb5594d184
SHA157533674ad9388bcd14464c04cd53c4e9b7d11c4
SHA256c393f333618edf07a9986eac1666536df3a53513e1477c4371240e9eccea999f
SHA5124296c4feb5bcce6ca3499140f59a7d13132982dddd6fcf33ad133e4b418fa4b7f01c6439d46a4b7a1fc50a895eee4b7337dc6dfe86bbe2eab3ca136098a8b88a
-
Filesize
5KB
MD5284c4d248f8fc0cebbd56701842c2d1d
SHA164afd3b282d763d7cf619de6ecfa4da5c369c763
SHA256058138ed97c7aaa28c9789f029cf720ba876ec27fbdb80e18e37b51e15d2e47d
SHA512c3d529931bc851db303f40c7c3bdca9b3691c9409bda68f6c7297a5439e404e623d7532e92c6a56d151d591b6d3e86a6a28d8923c4a4461786dd36a9b41c9fe7
-
Filesize
5KB
MD54344162c6283cb6a81f0c802702df062
SHA130fd7a12808459d3d4a11aeb136376e31d02a1cd
SHA256306fa2564cc69cc8f1fe638f4b4d7bb666a73400298322f59fcf2c7c2d6ff518
SHA512b38194d5082fc562a10ebe2cbd7ad78afc4d7bad8f16fb91677ae25677ef634de03ff54484f3f9d8750785c9e39ec8f0c67afa9cbd50c5512d12b8625ca5b062
-
Filesize
5KB
MD5ac175296a230b8dac9be481b2a11af9e
SHA1b83d8cd1324eb4ecba4429f78e592cee395cb0b9
SHA256781bae8202c719c96c6e19fb6f78c9221c7289ef80f14a71b65a1d48796decb1
SHA51281cae3975c1a3a625e006149fb28c8d172d753f25875eac6ca5c01b22c248820cf299e6e0fbe6158ca640f9a47e8c67ef44e4399113b8b8fe1018ca46f14b683
-
Filesize
5KB
MD56f1618a9cc3fb41afbeb31c2ca47df92
SHA16677fe54eca85f20aa5a7788adff6d869e6a5861
SHA256550565300f0375c0dbf2dc07f463d850e229c37731da8d19ad929022a438815e
SHA512e4b7a801a50da3fcb03d4d81ee868b81be63a9bce562afd32ec66562f47951ac0e55d8ff9b61b855adf8fa91cce35600b2b2601b40a0d7189523defe029a023d
-
Filesize
5KB
MD59a6d3fcf576183f7e0689572119df7ba
SHA10df5de5e2d89066ee163f7f7951dabf18a69ba42
SHA25686620b1a5796eb272c84af47a9c27f580a1eced00908d4eb480b8e9ea91d591b
SHA512267bb589c00f66c4db2ac1851f04b72a1c08ccf347bf948f6f0bd68e0a4e9697ac6fa3538b7741aa0ab3b7b4bda7ad2aeeafab57ace06cdf546a02e2f7888fbd
-
Filesize
5KB
MD5266b72df37c434da825728c55cbd13fb
SHA1cf538a1ccd2f51124a2a6c7e052ad099d44302bb
SHA2566e1e0803aa98766b2d65216393fdfe57e18a9a54e47d1b1ea3869ae53e148955
SHA5127f61c41473cb14ba1f90c4117e33b0644a8472c59eba6769fbe186f67471f3a0b659127fb519e97aefc062f0381706685389db14765b2d31befd506b13b37031
-
Filesize
5KB
MD51c8d45dc99d2698c1d32007b2cda6256
SHA117ef97e04919bbbd00ef6268b90efdaa4e70dffe
SHA25618e9a88b2c2f511bca492be0ca317ef970abe8f32d1e1081a4d0bddb353b2ed6
SHA512fea4b5fb876d1e7d3e631e7e34926d8aa6d72dac6270a534d95eee0547670e6adc48abe8e3136846c312d55dc1aef3d4bbbcffc00fd5aa02d57b1318a807994c
-
Filesize
5KB
MD58d1979310e3c4d8d8793b0a7848efb77
SHA11df1db39e6799c6f91a198798c695191011098a9
SHA2567e0808da95b1b2c06aae138564413d2d2da69c21250d3aa0327e76971d5ae57e
SHA51246dcd46bd20f27c46889643c5ed52e436ee2adfe2c31b2a1e743e56e55567ab6eeb233400c3968afcee2956bde98f5389b7fcccda1ae02dc18170e564a79dbd4
-
Filesize
5KB
MD552b37304b818b25c4aaa2db189d1d59b
SHA178d569ead60ca7b60b60060c13a83d8cf377961c
SHA25698df0712b0b879e746bce54346c7eb477c9d2e454d0248580652a89a4eb36574
SHA5125af1488a8ce4320adde079e2b8cbdf92edd6f16fa35498c6558a47c3bd4d4709f155c4b04762a3bb83bb22cff826b99e16b4c8786acd6f56ecd41b8b414cc2c5
-
Filesize
5KB
MD51dad1dda0a7c1f031391214c369d28ad
SHA1b2a947494b82ef633daaacafa3a959bd971b5b2e
SHA256f741d92d010f4e50f0137faec2b4a3491b454391fa48c990b8961d03526e9ec6
SHA51240a0153160ff1d505153d12229377ea7081b3d64a82284fa50cef3cdadf14423b13904f8622ee3ca9a60d55b26468097c590bcbbe142587d9ca09f6d02de8b69
-
Filesize
5KB
MD543396acb23107375444f36c475baa892
SHA1043abaac5af1cab508c0d94813b82fe9967d1924
SHA256cfc6a34b02c678c7f0ea920e82a7752c1674e6d17e97f3d253dfc3576a55721e
SHA5121863c37ded9b3bd07c4edd438b3ba2a5757b55d087b0f3b10128f1e07dfea7ae53372a1808db0687998383dbfc832d1495baaa05bee4d977021fb4414094caae
-
Filesize
5KB
MD5c58dd6fc18d26302798782bf105936df
SHA138f062992c395a3083a15987d0c010dec29772a2
SHA256a653972776dc561eb19f11ce5f95b04ca8457bf2c10eebf82b1fb4ed73515910
SHA51214faa479cc5b6e02549a9e7d6f2e6de5d3ea7910c4dd852daa39fc5161b8d0f9122a95707e22035602957384b66cf48a06b91bf123f7cedda44cad44bc404184
-
Filesize
5KB
MD546d358670dadc2922aab3214a24ed970
SHA1f55813ff6d8d2cf9b0379c49cf481df4ef6d3568
SHA25668a1d7cee8be09774c73ca26a823bf9ea1636a3bd93368d722a3a1eae51f25a7
SHA512262f14232cefe1d19aabbf91d1aba85b8135714088759eb2ab05023da8ce73e6bf03b6dee8791ca0b9722c010e9370184bcdd3360fb0415da3df6e5f10c59cf5
-
Filesize
5KB
MD5263f2aca8d0bb248571239dd20166b2f
SHA148227f10707293caf4bbbd3e17b714b929cdc64e
SHA2565b6ecce2ca54ee7dbcbb467f97e7eaca21ba78a6daf4e9e3cae4c5d04ef62561
SHA51206d77cbf04d46657cb014752ef888128fe490c0172faa2777a875648995d4611620e786c300b3ad78af48be90c9401dd9806340b11446b13e3f7e896e982e54d
-
Filesize
5KB
MD583f07f7bf9cdb21732e181df765718de
SHA1fc1dff486536f964eb2821a14805ba33f09c867f
SHA2567ac2c9d7924e2e1f6ac09879378c25cba1c4f28623ba2e56bdfa32bd5828a921
SHA51218c84030a8129c84044c4717373191bfb9320b7753145f8954e6442725b2a3b1a633968377af90c8153e88ba78575e0e39c382622fde08332b625fb06a5a1b96
-
Filesize
5KB
MD543f1f73d429c03679a7b6d7297d3c24f
SHA1a796e1b4e5f6b073a51dda014726e3e066c0df2d
SHA2566fdc3e27fcca410379b9484caee15b112758e01da3cccafb51dbbdc410ee768f
SHA512b3eb4da4e63aad5a346089502f09d1909a46afeccd0693b147bc4ad52d17cbbaedfff0eb6e22ff90582f55b614561f60932334fb6f2bbd27f87e917dab62ea1a
-
Filesize
7KB
MD54b0202fe778bbf45dc8e8625182c4369
SHA1a315eb1726b76263fdabde7aefcf07dfc7f437e5
SHA256f3203e59846614ac8ee6e4b3a2e4069c05eeeb93c226011cd23fd553527573b6
SHA512f31f56a5516aca023f89d4f872e7e2d5c7a70d4270abaca46452a1e81496c19261bdbe0356b66687ac2009d3c2260c56e5e96683d115224ab628d679feb2121c
-
Filesize
7KB
MD5de4a55c4711b3cab43d68cefbf66e7cb
SHA1776a73b8ffbd86a5b759c149b6e9651989ce73fb
SHA25661649025e389107a7f6525163e1ca581707207e01ed411458aa6c05828cee51d
SHA51232abd3c4cafc0ab885081b112d43693fc7f47985a61e4725d69c8464321451d2f450d8006a0824c5e47b44778992982dc898e4bc87c152f61a9b258b77a4883b
-
Filesize
7KB
MD59f2c8a95515d41017c51f69cc7a84280
SHA130acb37b5e92174513872b3bd024899ef2ef8805
SHA2566a235cd4007c5fe1d6e385505269fb62564141cb1185c773c1fd24d77605c631
SHA51257f7bbabf186fec9844ced94dbaba40902c1bd41ac167fc82b36401b3d93d087029b82bfbb24b2e7e1daf964a5ab6b0f4755056da8a77865691c098fd1ec84eb
-
Filesize
524B
MD5f37bfa56afe5c6cc435d4c254f7b487e
SHA1792fd43daab93f6195e86e609bcc1ff08378c345
SHA256044b6e7321ade8b551b630af52bd9d341429e756626c9055505ae458bab55c98
SHA51281fffcee06b788956aa75f003f6eddaf799c132cea34c5fe71e1710533ade06daa2413058f69dcea828cf4efa0ae6ab1a3b84ebc0297ac87d760144edb63cc8f
-
Filesize
2KB
MD5e7c1cdd02a325114de23f2fd5c158abe
SHA1dd84d043f13eeac9e979fa01abade4012e27286e
SHA256ecba4c6d1f7c94ba08e7d7c276b39e1c4931fe594d8332026b39bbd4b27917b4
SHA512f973b79f798293ba3f7f651dee072e91fb8af3819cc67682ceb3580c2d46b9943c0383def24906e139fa16cb7b289e76ceb1554d5fae598d4d79ebf72041ca54
-
Filesize
5KB
MD556222b38c14ae77808c52ea814ec22a3
SHA18aa50e0c4218c917d6532a6dfe4ce38318713047
SHA256311760dfcaf656c6ccf28d415661e9fd34cd0693c0bd6b0c148f3bb1458ad8cd
SHA5124ecb700f59d3f84963c067b572791614f8b70756b82dd5ab7bc034d2bf1e5a42e5be21a54b7d8b5f5a52f18bf1063120464981793baf96c554115a0a53f5ff33
-
Filesize
5KB
MD5590c1a3b70b35aad95bb1b30578282a5
SHA11ff2312302ba55f1be9353bd6e2bcdc8e9ed3952
SHA256c4f33d29667f2888d1948c7a4e4cdf03035bdff9505868d13008a2da23dba90e
SHA512efad7036b02a7362d709d627e8628ad933d597e79c7f7c2328d92365c2f43d321657eb0fc447b98f1d8573fc4d7ba822a11df9079c6dad2bf992821a15572b4e
-
Filesize
8KB
MD59bb93ec18dc5879ac20c002a687a3374
SHA15a012e6bf9363293d0932beef3aa45eb07584cf9
SHA256a13cbe03a0a2dea57009c76a5de17eaef28401d1764c84033a86f4c37a336e4d
SHA512d4c16c0fb30fc709d0c3c26df43912a62e99097a47ba4bbc1a2d9a65990334412ba2fd5984694b00bd46676090acc7a345864b12075b8b3d297979ad322c03e4
-
Filesize
5KB
MD595a62f9b3949ec5ced6a9f9735942851
SHA1b272a89fa7eca163865f5eaf141da1c3dd33c4ac
SHA2568dfafdab56a92b9238a37b1f3b926873714c7f6c534d5421b3da7678e57ac206
SHA51242acc327d8135005759aedcdd3199b9b2d29d985d6dae104e4c097520bb72757110e446337371db87579807a99b2205cfbf8b5d256671b608168812846a5e36a
-
Filesize
5KB
MD5e9f719bc942237bc5674cedcead80084
SHA1e6f5811c091ebaa0b5e12363caea6a721f058ae9
SHA25620bb535f527edfc52b0ebed0a41c443c17bf671d5504cc75334ec77d00a3507d
SHA512bd5d45dafab191561ad40c02ff473e3d30abf31391449e55390d8b7d7a82faba23def00c9405916bff4c2cf8f934c7587fee981ef98a5e8d5d5db93a552ac4ba
-
Filesize
5KB
MD5aec0f58ad82bae4482826554d052062d
SHA15d25762dbc1b7310a77659313b4b07e970d233cd
SHA256b8793020a601c07af0311edcf8f95c9b87649bc3b54611adbf209b4c81a44271
SHA512d6d40108d97a4c2e4dbecff82089600b02176520ed397d481e65a40af75567c2234f7aa288661150e6ad119ae74f72aeaf719c6a2be6fd72c5268c95e29383b4
-
Filesize
5KB
MD5d2e90c29e306ae59607d9418086081fb
SHA14671065be8c32873f257e9252eacc09a4e0513b5
SHA256bd92ae06a86cb7786e10f1137d5e7a920c2afd8de421a0b63ed114c31eef25c4
SHA5128dac655bbdd4ff538b8e7c52ada2fd01954a97898e8b4bc78ca9c2d9c7fb48af3dd19a9e6f44b8080039910f939fc752b980ddea513ea67e1be40cadca99ed27
-
Filesize
2KB
MD513414a9361b5b9a7ccecc8964a61d0a3
SHA120d8669eda812cb7bda3291db715dadcdd044177
SHA25657e114050d1dccbe3479a85b6ebae8e8fde6144f761d292a2eb8732110ff2870
SHA5129d1c1051639fc57c202d90dc45fa237e353f6d223cf903d247279f9613d0c6895752b904aa158758f03cd5455661fe718d64e22ed9fd27033ee822502edf5d81
-
Filesize
5KB
MD5193eeb079252e97fab2db98d3ff4ead5
SHA1ccc91d19824ef1d2cf10202c2cb690f2c427503b
SHA2560b96d04d6cbf39991e8331adc0b36118e8c931a672268128e425528514df21c6
SHA512c9dcf75d4e9b959b5ff54e2d0bf9ea929ebb5d8fd168c88df1a58cadcf7713af62c4d8b2b7e9199699e0f3c72abf9ff984303f3f296842dac4c7cab677d29513
-
Filesize
9KB
MD5530fadd03c185c6b589ecc729f47d798
SHA1ff1e7e67f796a69a1658592b2b1ea97f666cf6c8
SHA2563151089f0fd2361c373992fda809c01379ee18f60e2050cb2c006770f5f096a6
SHA512c25a8f110e26574f11a25f96a0324d8f4eddf43cf252bda5ebef9c8edda825990e32e0e55a44f797b677f140a7131ba505e9ef6620c7baf85650b9c97c5d2507
-
Filesize
8KB
MD5f3fb318fc7a0c2853eb1ca2781fb7334
SHA1bb8c1744b45cbe092c3449f4450194b4a187ce61
SHA2565dfb3df0ffcfc0e0adf5ab4f68a47f62bc02f573bff55403359123dc741ff103
SHA51297955c5f20bbb7806781a47632941824a4784655b84a5d0ef3814110b9b8d749016cd1961ed7ef8538c102777e5315edc384fa66466b897303cbf5239eec34eb
-
Filesize
8KB
MD55c47355e2283c071d8e4240790201e71
SHA19e6d6a880b17670219466a3208e4bfa2d719fc4e
SHA256ed149c689dfdc72e3b977c72822b63490674115d974eaef7fcfaf3b64e3d63df
SHA5125e65af6dcb605258a42a1de6e1a50e76e06df20204bbbd63d711710af4ca20b87fa10cf435300434896317fad7ee1a3fcb3e8dc022683a9e3ecc001acf1a5bfe
-
Filesize
9KB
MD56723c2a6e54396a856ad79c3df03c051
SHA1a272e530c09e2b11e2902405c60683600d93fae0
SHA256aae9a220071eaf69d24fe5b29aa49080e85d7abad12eedd0a8a967ea32169709
SHA512b6e030e6756f4b10ab678ee86c2eca39a5c4312e8ff5c85482239dea0793d15593dea1217d1d331a338504084cf27ab73ece5de367e0737e3203e7d6df09eadb
-
Filesize
5KB
MD542f0d6d9464ba53e6594b82b6656c09e
SHA1b14c65698064d9d0df19a081edae4c9d109047ca
SHA256e180a720320cce651e4b0ff0c3a737e2c907df7a4cc0b1f5269beac7a30e3257
SHA5120ae70334c05ed1b706abbd50e6b7dc407666e2de7ce4382df5b23ef26f3667f39e72c1ebbc95c95b9d42b690f12872f6f5217754533addd66171e2368267931f
-
Filesize
8KB
MD575956d7ebd864de2264f5d0d4614cdc0
SHA1388b7377240fae596a63362562dea9cf5cc8b940
SHA2562c8d4817a6e5fdb6b4110e143ed03fbbc9fba5f8638b5f466c28bb2f293c6dfb
SHA51207248d28e413cf62c633db1efb1faeafdf892177ec8a5de3a21eed1e04157c48809ab9b26fa2f71ba94c5804301d07f7ea3748ddc5c0bb09d99a0967055a0392
-
Filesize
5KB
MD52e06b9a01fc67dc18a6590dbf9b6380e
SHA1e6755f2a0b7c683e5189a5bae853980a0d7c724e
SHA256cd7b58028dd77668d1c41757295c36989f055a7eb65b37bbc0746eff97e77ee8
SHA5123a6af7d614d64a47c4d1ee3cc47041d0226b8dae9693f126365f3163471894097bd1a3a6b2a289165fa0b8e80695dedb5d7b0cdb572b12fbf7a1c37c9831aed9
-
Filesize
5KB
MD5d786afab97d4b4c3db5622c0d71622be
SHA1961272baf1cfb045fcde6695412f9d23d654aafa
SHA2563b48b9c527578f8af53dfbb6337a27f7ad2a727e3b2544e58308a3c785844ee1
SHA51217684f38d5655fc503755bd82219ce9eb1fb774bbaf087be4441a6779f0fe84a22593c92c13788f055fc30feb0be63b1218d47a2ba7a13432e4d4288ff98b52a
-
Filesize
5KB
MD50c69b26309200ec59bcaea56acebfd1f
SHA161e04232615f5f2a30b9311e8b4246bf728024a3
SHA256c8529d40a37534b6079ffb2bbad178f8e19d85d992012e0b3b9c7b4c8b321b53
SHA5120815b79810f2ab8347346342661baec1fee3a6d441641cf89b8ca750866c4b79eccd3112839d1b925df1c93adf8587415a1f4d7dae22d84a529332ca11244bd7
-
Filesize
5KB
MD599d676090815a8d326392fa7a9dc1c6c
SHA11edde4c2b497489fbdff161ad295c6aa9f2c8c7e
SHA25697ea32e430858baaf97251ac22217f35593e32a7a9b9cfa22b8d55f1bdb17db1
SHA5126a320ec53aca3ea9ef8da6d057634afbf76784013d07af11cbdea3ee7cbbaa0ac32f8bec39186c48b64d5a323efada1ae9bbd49d8567130ce3a79fecd05030f4
-
Filesize
5KB
MD56875b1da5fc8d2fb926a2665ea64295a
SHA150d74505a834cd4563e05c05678a8b2cf918e19d
SHA256aff65880006f3633c68c36a7b9c5899f40200360410d91ad0249aa02194210e2
SHA5129fd58dc95cc8f319f4053ba6736437da96a6bee0cbc3fba48b0382753400a3bfbaaa99a09b69acf476d4ac95e3ba1acb9062204809cc75be474c6ae02dd033b3
-
Filesize
5KB
MD5ae4b14e8d8e92528c9f6b610c7ff46d8
SHA158afbc8bcdc94c680f6ebbb29ae1b8c3b5a392f8
SHA256d5fd4c4dd647f4b3916a4a5c840e297108580a5805680e8733c42ae50a20f8ef
SHA5126e0c30f5a1e11995fed4cdfd08fffdc26d4c39a35e82e0c2ba9aa60b692f5e5280360e5a81855a74ca6899bdb27afdd7df984d1411158bb4d603f25d730d7cc5
-
Filesize
356B
MD534be2bb4330ab7076120443a30c53617
SHA12d192b1a8afb39e45caa3b6b03d8043f53c0064e
SHA256f4dd6eb5442cf35187682ba3a9f18f5ef8f18ef227e8e2bed8057d924196f69e
SHA512009c3e34aa7be65b7fb3ad1395af88fe14b4630f08c16ea5e2de44107bf3c41ead89ed5cb3cc12476986bee96195e77e37a59ee25c7c56b0b51809bc836004b7
-
Filesize
9KB
MD52c15fbf728067a2ebb95a113bac5d811
SHA186194565b23858c897c75175838b50e90c1884a3
SHA25675257e977e974be6bf75709d26499dfa7c8f23da71e781552db41d8b297cb8d4
SHA51284a6aca7e0271b7cf3d18a887b0df8813754e5e9a5a6abbce333eee383108e9175878900a8475593c324292215ece64359fe122d1fb33133fc468978a7bac8e1
-
Filesize
5KB
MD5d73187cb154fcf8e0136129491fca0fc
SHA1505e4bbb3397a5649ded44823acaf24a43e10c10
SHA2561600da54bc7bd714bf07ed9b35b4d3f691251e433ffbc181d8600ab4e318bee7
SHA512631c4655eb662206af68e4cd0438b904c323da43620c3d156e838e606bb2340b0c81f74ad3c65374c1742372a7a80f979a4f0a74a70531586f3ff69839cda379
-
Filesize
5KB
MD595bc9359691c242056ddd4e797771857
SHA18ce8d3fab281c12ad557323f99b952bfa6f85105
SHA2566c97eef835b068c71d3e500b2cc0cb1def0038faf295ad1ea0ab78481078ab99
SHA512d0d7b3f86bdcb8f19a6a1537907a2214413267bd1429f9c17523f04f34653d17bff482ef96be43b61d1ec9e9e8189655a45096cfb526ef393dd8c90b688d41d8
-
Filesize
5KB
MD5cb9c75da6f8fe423510658be72c30ce0
SHA14dd4232195d879b0f7ae2219c071fa650fe2f96e
SHA25634411638e4a65f93930bb5fd61285b66eec47d9147da2a565e5ef67da7012774
SHA5122bcd214f8b92bf31f9ecc01a420b9bf57d4266ab6ec9f6dd7ad2e44a025926ab966f8e5bf1879cdc6e9e9939e58f0406125401535f8479df093909b68c30b5a1
-
Filesize
5KB
MD5c0ad7fb0106dbf33b7fd8e9d8146ca43
SHA1117e30cee0082e7dc1ca0b9e7a9a7445a1ff34e3
SHA2565bb856aa353d1105bd59ff0560de83ae791b96bb42c464eb88b734fc57ca255d
SHA51229368c206404d9df6354b346048e88ea49c7ca798e787ee71019033ebe86b7614cc4a54a89283436fa6449dc4fa3cf371f9b0e0d8ffabf41e8091d8b1a445800
-
Filesize
5KB
MD5a271b4d3da2056716b532293bae196de
SHA145093c3c7708923addeec96bcb0724f970cae347
SHA256714f1616034c5618dd5954030701b3b8298bb0b1f8d025122c8e585d53319133
SHA512d4f15df360cf50ed042e2e2c05088473630b83f2a244f9ae0398ee819b39b371887fc9bf7560cd350b21ecd466943737073b9b39816f52f41b60b6c46ff72f8a
-
Filesize
5KB
MD53fae1c40fc7438cca4f99c68edc87231
SHA1ddc109ffb9d6816fd4562d8eb774aa66d061cf43
SHA2562bda62a77ac0dd7f8bc04ef7287f141312563e46e584ed586b5bef6ff0f572a5
SHA512a948ba6195385379b3e1847a4df82507d8393316a05c244f20c5cedf46045953cd3e5f641abaca7d2eda7a8a5f12d285bc92c45fae897989987a74c4283b0f7a
-
Filesize
5KB
MD5084a9f89d5bc8e09bd349a590dd35a2f
SHA1ecdfa6bd57bb493ac9aaee50704e73b976253f04
SHA256807bc1fb01ac103ac8aa6820d0f3d473847934da1b73770296e849b09c82cd56
SHA5126f8feb5499073ade21ef16601e30225e5c8dc5cd77ac9492775c19a94fb1995a229402e5bfb3f565555ac28a5d3c72bfa75e758ddee43bd7feb09f893b8558bf
-
Filesize
5KB
MD5834c9c768f0c2f4bbf1cc2f88da1a164
SHA1f95c350537251cbf58c913df254cf530e27593be
SHA256f62b049c83410b8cd602bfd69b431469a9935cbfd6d16b9c172b33f6893cb97f
SHA51204eb531278fbeb7924ca799402c2b62c38c06745597ff63586f4f997274eb1c1546e7edf36da1d4eccb270dde93c02764f3ab09cefc32de7375b562bad856637
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity~RFe5a4d27.TMP
Filesize4KB
MD57feff9f6d4b1e5f144bba87b970ea405
SHA13d136fe6f2aab2bee89b384adcf0e608b553e00a
SHA2561948d9d7996def87ceaf02205e4c57d6d240003b264fcd55661b851746c7f0e4
SHA512752986c9e4f5b026092b33d5f9034b244ccb9ce52e2c4ab1715ebe7a989c99df1b3fa9f89d4801c3b9bfd6c851e174116698d839efde22e87480caed51557072
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bbf85ed8-910e-4604-b171-64fdf09519e9.tmp
Filesize6KB
MD5f5373bf40356cc519f61d17bf8ddae13
SHA14a05e083d8ef00512c1543b5741351dfbbdcbee0
SHA2567f9c8ade446690fac479a4b69f746f16b29b51e1ec5bf924270dd26abf1fe2df
SHA512a3ded1f415a300058fb3a573f9060eef6e8517e95e9439d7db90867a1c909d51c465b5467b7bf2202d1f900260d71b81a70dbebec972f7bf501ba4900d83d90e
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133636790469005003.txt
Filesize68KB
MD572ec1cc7ad56d065b125b5e48b5ef149
SHA10cb3e1408819fcc9cfc550da243fdbc74f958be5
SHA256aff407526fd2d49e99671d91ad7acd9a428e57dd58ccf31929d9e3c63565850b
SHA5128f952b2746fafbb2ae567426ab8f56593dd4e8859f65798986a63c77b1f1a861cee53f770e8662499daa217f173757b85326d74193ec4c15df277fcbfa058533
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133636790509673311.txt.~tmp
Filesize68KB
MD513acf79f0e434ca490450fc8fb08f30a
SHA1b387307ac7ee2c4003692eb809b363c009573ca6
SHA2568e403532d09b87f73c2d9b66f3ce57daf00567535feabf3dd8a8f0850cdeebe5
SHA512b4cfe885157a06d32a981141d50eb8d75823abd31a55df313b180833a4b7678c68bd76b6325145fc931ad1c50ee55f3b399244b312645167dce23da8870ad0d7
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD539d4666686d4d084fb912849685c9d4e
SHA1f3fc60fba210a812081442e980ba7725fc79a259
SHA2564835b9baef92a0c3878fa3ea22a53cc9eb1016d525189d775f98a632eeaccb51
SHA512218ee9358fec144bcae2f28dfe8b6d1bdef569665e44e1ebfd05c22752082863c23d33d590e7a7f735d3b63c1555ebe9fa205990935a0049444cb1cd4b0071fa
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
Filesize10KB
MD5028d4831556934337c2af8554262b119
SHA1dcf75517954f926f64305989e0d8701917d55bc7
SHA2568e03fbcfcca60ed5145b37386515cf0247241db32e314353376be55d338314d1
SHA512f47157b03e3001a37f2e4e2b52353d7794dd61b52f804af44c12fafdfa9be8c17828b6e561662611a906c3054de1e8a0fba6a54ef1d32ea6ac7d8c0a5481b3d1
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt
Filesize846KB
MD5766f5efd9efca73b6dfd0fb3d648639f
SHA171928a29c3affb9715d92542ef4cf3472e7931fe
SHA2569111e9a5093f97e15510bf3d3dc36fd4a736981215f79540454ce86893993fdc
SHA5121d4bb423d9cc9037f6974a389ff304e5b9fbd4bfd013a09d4ceeff3fd2a87ad81fe84b2ee880023984978391daf11540f353d391f35a4236b241ccced13a3434
-
Filesize
5.8MB
MD5071a86a82f51e91c9a47bb2db7499e0c
SHA1d583e6fc19ddf59a70b7f3898fb1b1933504cfeb
SHA25615ce1bdd1a117d0a755f8f77e5a789ccf171cfd0c56bb7532ac8cad8c35de692
SHA5121345b189bfc4c5a7eb9c6397efb2d9d19a6498b6e4da03e5b2fee3904c2ce914b3d4ea7f80958dfd5946fb92ab1c45b262f81a029a7302237b96575c94160dbe
-
Filesize
5.5MB
MD527469372591b14ff1c57654facb5e020
SHA1492c166cd0e6c8d122ca4687659bf047cd48afd7
SHA2563b8fcd52686095049b1563fbb6ba0bf73113a01b13c303bebcb36d8339a1519f
SHA5120cfa845de57acf6f17f295f0771c2a61cd846efdee79da012def474bcaa91d9e99d3d528cf5698e6112a310c4f97e98ae74b6cfc601b2988c51e92270ebf92a2
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\5fb81cf4-9f5d-4ca6-b077-83d2c9dc9116.tmp
Filesize8KB
MD5d1fe7a85b78878eaf46078642acfc520
SHA12337d80df60f2fb81d8a32479558983eae99d579
SHA256440d89aec63943991198e4d50a1d56124c545502687bd11fa2f87ba2eab1886d
SHA512e8f41b48b78ac5b6cc2f1d77b92ce013befec604e15368de3d2d9a2b4dd9d94ca54a474613d0a3a5becdb0cbeb646557164b5363a9b433ff9338544b1e9494ea
-
Filesize
152B
MD5f77781aafd905a804ca65568936ecc9d
SHA18d808c00bb4ae7ba3fe76a305070c5ea3a8aa20c
SHA2568ed726e666c0d43de58f22580106178721f597c6d774755224f97d2b5eaba284
SHA512a43462560c0073675e16625693a94e4a049fc3d3e6f9db8da4b2e76fad3d92d9eb43b4096e3c0c48507e4d478c32d58a6ad7de4ed15facebf7341638441ff92e
-
Filesize
152B
MD52a525b10243d454a4ccc348209bac3b1
SHA1446983af7a5b930416ae81c171bc8431d8c18fb7
SHA256a8f14d3dc48791cb3c0a9ac1bb2eaf35b461e5a7941c6562a175648f9a1db2fd
SHA5121043d8bdecbd37a6da12838b9f44c96e18f4e4100a1e69574a93a529e8227fde669dff7014e8cd8ff31557478ef9a17b6fd5800bf844d3791bbe1f5249080a5f
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406240511461\additional_file0.tmp
Filesize1.4MB
MD5e9a2209b61f4be34f25069a6e54affea
SHA16368b0a81608c701b06b97aeff194ce88fd0e3c0
SHA256e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f
SHA51259e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5
-
Filesize
5.8MB
MD51a4fdbb85e2b99ec1f3ca6e4716ddf62
SHA1fb4698270b8664980407b932d76a99907ce1033a
SHA256e9ead6307f9461d7cadf9a37cae959082e08d9d8d98374e4f7ea15ddd5d53b2a
SHA512a7da63f9d7f95c0984f120f12df31a7051624fc0825a658cc54676b2835ecffc8f549e37d777158925901b520642d0adf1c3e3046302e24a70514266acf04cc2
-
Filesize
198B
MD55526cbfcd842ee37ac0bdc5298779b16
SHA184ac603f922d3a76248f40eafc7c8c3efec683b3
SHA2560eaaa8b0a218d35cb41c1cd3dd52c879fc2294820efc5a2043513effa4f1a6d6
SHA51268cc7ba10ef5f088c3e4c63274b6f89aa8913064b21eb4d418936db13422a6390dcde3d01a2fb167123d6b429cb52c5706d17dcdef141b96184d0703ef0f8b76
-
Filesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
Filesize
517B
MD561f4cca3b446ffd4e4881993ca41dd11
SHA151351bfa32abf4f14f013e76396f355a1798a445
SHA256667e85013d32487ddb26c39d1d1d24d8fbd14afc94d978f562c0433dc6a3ec78
SHA512257650dd417fc543f01ed4d3a060eefcfec4cf016f96311b3b9d1a5d9fd5b2632672a715aac9d1be4299cdd8556ef8a616146235b301eb2f10d020aa4df7b000
-
Filesize
1KB
MD5917d81092b86c1cdf52b8f528d7f733d
SHA125c91ef0564c71bad7fddbf79a2e0b4cdb67b573
SHA256e77bf2d2f6e5bb94e1d6a3ef2c4c599b36e5e03d95973ed9ff6815c72cafc64f
SHA5129550f02159626ae891c91d94f58d57dfb46537e80c45e309631323a719587f904ee9326afdd2d5ffa5cf25a36d57872ba86918dc6f5c543d852ccfd52dedf50b
-
Filesize
1KB
MD57e779ae3e8514c52b65cdb8beb6864c5
SHA143ae3a2e0a1faf5318c68c363a95ab07a5e0b503
SHA256ae5106fb974608e76fdf32711dfdd7b5e442a0a46021c93042ac893db7cd6de9
SHA5122a89706d1b8cb326fcd545ba22e38d5c8d26b76bf5cfa6368536bcae22fcff38ae594c5a8aa63cf793e5d94dc7e75704a2f183745f7ad664fd04a09c02cfb397
-
Filesize
47B
MD5a66b93e3a9e2d8392583a471d11c3473
SHA1ac3351ca848fa7638b0c216c1afed2151833c351
SHA256c2154b3635f69c39a122889234e2acf8e08510200d8c5c5da3c474803ac1c56b
SHA51232735582b55662fa73e200a9814f128040ac624f9d6c52e29c8b2f1d099c9f7914c0d5ff9aaa7dc02883f8a016fe9f5dbc307997cc7d202fa3e01f93d3e95eed
-
Filesize
305B
MD54daffa2ba69d7be362b72c6a921a7411
SHA1713c476e5b0306a9ab7a7815d3184c1c55630b5e
SHA256449183bef8fc659efdad9db9294b82f63d33f5c7e339986fc1ed92a36b8abb97
SHA512a4466ce9f906e2092c9dfeb3a4d3e0ee414ce256b70f941cc6962d10392eeffe73d1af74dbf2409191002530a1bae93a4c436ee57705b82be525d6e386c3c286
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c