0226f723ff835d0b46269c1b896fa18fef0a8ed24dc3c72872dcf4cb45be90f9

Resubmissions

06-08-2024 13:23

240806-qna2qszgkp 10

06-08-2024 13:20

240806-qla9qazfpm 7

Analysis

max time kernel
98s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Robokits_USB_BT_18_ServoCon_Setup_V82.exe
Size

3.1MB
MD5

e0017606ff7935c846769b617a522c90
SHA1

ccbc102781a64f7936310e8f25028101ac3ff353
SHA256

0226f723ff835d0b46269c1b896fa18fef0a8ed24dc3c72872dcf4cb45be90f9
SHA512

b904262e8eea28f2229f6b670cf0240314626a8736aa90ed86f7c254cbe461190f1ba0976794b08dd11242b577c29bf3b2d5d767d910ad48889697a0e0cc34c5
SSDEEP

49152:sN26FOnzGn6LJvqkwnpC+mWd6uIcc+vo7dP6dF/WPxDz0peWUiz8ahxkYu:s06FOznLo0+Dd6uxc+vqYdF/WPxDIXxI

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

irsetup.exeDotNetCommReviver.exe

pid process

2808 irsetup.exe
2172 DotNetCommReviver.exe

pid	process
2808	irsetup.exe
2172	DotNetCommReviver.exe

Loads dropped DLL 17 IoCs

Processes:

Robokits_USB_BT_18_ServoCon_Setup_V82.exeirsetup.exeDotNetCommReviver.exe

pid	process
2688	Robokits_USB_BT_18_ServoCon_Setup_V82.exe
2688	Robokits_USB_BT_18_ServoCon_Setup_V82.exe
2688	Robokits_USB_BT_18_ServoCon_Setup_V82.exe
2688	Robokits_USB_BT_18_ServoCon_Setup_V82.exe
2808	irsetup.exe
2808	irsetup.exe
2808	irsetup.exe
2808	irsetup.exe
2808	irsetup.exe
2808	irsetup.exe
2808	irsetup.exe
2808	irsetup.exe
2808	irsetup.exe
2808	irsetup.exe
2808	irsetup.exe
2172	DotNetCommReviver.exe
2172	DotNetCommReviver.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/2688-6-0x0000000003280000-0x000000000364B000-memory.dmp	upx
behavioral1/memory/2808-18-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral1/memory/2808-36-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral1/memory/2808-151-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral1/memory/2808-158-0x0000000000400000-0x00000000007CB000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in System32 directory 2 IoCs

Processes:

irsetup.exe

description ioc process

File created C:\Windows\SysWOW64\MSCOMM32.OCX irsetup.exe
File opened for modification C:\Windows\SysWOW64\MSCOMM32.OCX irsetup.exe

description	ioc	process
File created	C:\Windows\SysWOW64\MSCOMM32.OCX	irsetup.exe
File opened for modification	C:\Windows\SysWOW64\MSCOMM32.OCX	irsetup.exe

Drops file in Program Files directory 34 IoCs

Processes:

irsetup.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\msvbvm60.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\olepro32.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\stdole2.tlb	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\VB6STKIT.DLL	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\uninstall.dat	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\uninstall.dat	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\uninstall.exe	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Interop.MSCommLib.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\VB6STKIT.DLL	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\asycfilt.dll	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\uninstall.xml	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Interop.MSCommLib.dll	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\DotNetCommReviver.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\uninstall.xml	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\COMCAT.DLL	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Robokits USB 18 Servo Controller.exe	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\msvbvm60.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\asycfilt.dll	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\lua5.1.dll	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\AxInterop.MSCommLib.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\IRIMG1.JPG	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\IRIMG3.JPG	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\DotNetCommReviver.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\oleaut32.dll	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\IRIMG1.JPG	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\IRIMG2.JPG	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\uni55CE.tmp	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\olepro32.dll	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\stdole2.tlb	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\COMCAT.DLL	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\uni55CE.tmp	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Robokits USB 18 Servo Controller.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\AxInterop.MSCommLib.dll	irsetup.exe
File created	C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\oleaut32.dll	irsetup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

IEXPLORE.EXERobokits_USB_BT_18_ServoCon_Setup_V82.exeirsetup.exeDotNetCommReviver.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Robokits_USB_BT_18_ServoCon_Setup_V82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DotNetCommReviver.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202e15a703e8da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000e32f0ce19edf9867cfb1b8579c45e1d84456a79eff8900975a8a68ec73cfddb2000000000e8000000002000020000000cfa3a8eab3694a347ea86cb374454411ab6b0f82b216f980f8ead00ccd5dec2190000000e47fa8d816f1921a502c41d4171cdea063680909e071b1ed8f3bfd88fb75ad6e816092b14b14709bbfdf6a126bf67392185f3848f34d1d658ef566ddaecd5b2c312f7f76a96c86ac6dbf387cb8c1b7b186512d171c9b2afae566dbad184cc549e69d4fff898b04aff2e288ea515d9a455d10e129eadcda51708234f5962e7bd537b6f666f262c211b141c9f1dd0f105b40000000dbb878cea7716045856a2a0a29188389c9565fe0f576f185d5aa4c4c3411ba0b6c7480ebbe8e1ccfd676e3e06712d0cac7c0b4f2b03fa2ca3cf1b39885e6a1e8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000000e7029f296a292a85467ccb9afca619922039069f4ca7cf053f9e2968ad626ae000000000e8000000002000020000000f5817cfcfda4544068957909b4d5c60a574f77478a917c8b47577d64d7fc1c1c20000000c24923610dbb40e597baa68d584e817a0239e1a5f4ce12d21cf950e55211881e40000000503dd104b20f5918357efe99914d845455c3ec49ae35334e43aa95d09d528aa7d5fd149dea42b41169b137a439d6c4b75654da6f16480ffe0967c40fb39b176e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2A6BE51-53F6-11EF-861D-F64010A3169C} = "0"	iexplore.exe

Modifies registry class 64 IoCs

Processes:

irsetup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\TypeLib\Version = "6.0"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D0FC8A81-2CB2-101B-82B6-000000000014}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSCOMM32.OCX"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ProxyStubClsid32	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Programmable	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\FLAGS\ = "2"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\ = "_DDataSourceClass"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\TypeLib	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm\CurVer\ = "MSCOMMLib.MSComm.1"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ = "_ErrObject"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\TypeLib\Version = "6.0"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\TypeLib	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\TypeLib	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm\CLSID	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014}\TypeLib\ = "{648A5603-2C6E-101B-82B6-000000000014}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\TypeLib\Version = "6.0"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\HELPDIR	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ProxyStubClsid32	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ = "DMSCommEvents"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\TypeLib	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm.1	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\TypeLib\Version = "6.0"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ = "AmbientProperties"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\TypeLib	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\TypeLib	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\MiscStatus\1\ = "132497"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\ = "_DClass"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\ProxyStubClsid32	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0"	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Robokits_Servo_Controller_File\shell	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm.1\ = "Microsoft Communications Control, version 6.0"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\ = "ContainedControls"	irsetup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

1092 chrome.exe
1092 chrome.exe
2452 chrome.exe
2452 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exechrome.exe

description	pid	process
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe
Token: SeShutdownPrivilege	2452	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exeiexplore.exechrome.exe

pid	process
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
2712	iexplore.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exechrome.exe

pid	process
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe
2452	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

irsetup.exeDotNetCommReviver.exeiexplore.exeIEXPLORE.EXE

pid process

2808 irsetup.exe
2808 irsetup.exe
2172 DotNetCommReviver.exe
2712 iexplore.exe
2712 iexplore.exe
1932 IEXPLORE.EXE
1932 IEXPLORE.EXE

pid	process
2808	irsetup.exe
2808	irsetup.exe
2172	DotNetCommReviver.exe
2712	iexplore.exe
2712	iexplore.exe
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Robokits_USB_BT_18_ServoCon_Setup_V82.exeirsetup.exechrome.exe

description	pid	process	target process
PID 2688 wrote to memory of 2808	2688	Robokits_USB_BT_18_ServoCon_Setup_V82.exe	irsetup.exe
PID 2688 wrote to memory of 2808	2688	Robokits_USB_BT_18_ServoCon_Setup_V82.exe	irsetup.exe
PID 2688 wrote to memory of 2808	2688	Robokits_USB_BT_18_ServoCon_Setup_V82.exe	irsetup.exe
PID 2688 wrote to memory of 2808	2688	Robokits_USB_BT_18_ServoCon_Setup_V82.exe	irsetup.exe
PID 2688 wrote to memory of 2808	2688	Robokits_USB_BT_18_ServoCon_Setup_V82.exe	irsetup.exe
PID 2688 wrote to memory of 2808	2688	Robokits_USB_BT_18_ServoCon_Setup_V82.exe	irsetup.exe
PID 2688 wrote to memory of 2808	2688	Robokits_USB_BT_18_ServoCon_Setup_V82.exe	irsetup.exe
PID 2808 wrote to memory of 2172	2808	irsetup.exe	DotNetCommReviver.exe
PID 2808 wrote to memory of 2172	2808	irsetup.exe	DotNetCommReviver.exe
PID 2808 wrote to memory of 2172	2808	irsetup.exe	DotNetCommReviver.exe
PID 2808 wrote to memory of 2172	2808	irsetup.exe	DotNetCommReviver.exe
PID 1092 wrote to memory of 1004	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1004	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 1004	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 924	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 940	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 940	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 940	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2260	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2260	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2260	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2260	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2260	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2260	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2260	1092	chrome.exe	chrome.exe
PID 1092 wrote to memory of 2260	1092	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\Robokits_USB_BT_18_ServoCon_Setup_V82.exe
"C:\Users\Admin\AppData\Local\Temp\Robokits_USB_BT_18_ServoCon_Setup_V82.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742706 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\Robokits_USB_BT_18_ServoCon_Setup_V82.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2958949473-3205530200-1453100116-1000"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808

C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\DotNetCommReviver.exe
"C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\DotNetCommReviver.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef71d9758,0x7fef71d9768,0x7fef71d9778
2⤵
PID:1004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1384,i,4632085888306189199,432383508631288514,131072 /prefetch:2
2⤵
PID:924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1384,i,4632085888306189199,432383508631288514,131072 /prefetch:8
2⤵
PID:940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1384,i,4632085888306189199,432383508631288514,131072 /prefetch:8
2⤵
PID:2260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1384,i,4632085888306189199,432383508631288514,131072 /prefetch:1
2⤵
PID:2052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1384,i,4632085888306189199,432383508631288514,131072 /prefetch:1
2⤵
PID:1412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1604 --field-trial-handle=1384,i,4632085888306189199,432383508631288514,131072 /prefetch:2
2⤵
PID:2820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1160 --field-trial-handle=1384,i,4632085888306189199,432383508631288514,131072 /prefetch:1
2⤵
PID:760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 --field-trial-handle=1384,i,4632085888306189199,432383508631288514,131072 /prefetch:8
2⤵
PID:2968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3748 --field-trial-handle=1384,i,4632085888306189199,432383508631288514,131072 /prefetch:1
2⤵
PID:1800

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2332

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\BackupSync.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2712

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:2
2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef71d9758,0x7fef71d9768,0x7fef71d9778
2⤵
PID:2380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1264,i,13149323237486417332,9265196116914488944,131072 /prefetch:2
2⤵
PID:2736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1264,i,13149323237486417332,9265196116914488944,131072 /prefetch:8
2⤵
PID:908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1264,i,13149323237486417332,9265196116914488944,131072 /prefetch:8
2⤵
PID:3032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2096 --field-trial-handle=1264,i,13149323237486417332,9265196116914488944,131072 /prefetch:1
2⤵
PID:2488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1264,i,13149323237486417332,9265196116914488944,131072 /prefetch:1
2⤵
PID:2020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1712 --field-trial-handle=1264,i,13149323237486417332,9265196116914488944,131072 /prefetch:2
2⤵
PID:1304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1188 --field-trial-handle=1264,i,13149323237486417332,9265196116914488944,131072 /prefetch:1
2⤵
PID:1228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2868 --field-trial-handle=1264,i,13149323237486417332,9265196116914488944,131072 /prefetch:1
2⤵
PID:884

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\IRIMG2.JPG

Filesize
42KB

MD5
1e637bcaabe0d6a9c934c7695e93c848

SHA1
b6b74872437806beaeba3dec9154f8db1d74d8a4

SHA256
bdc20cfba77986cfeb7520b5cc9820856ca37b1b2b1c8b5cfc7ce5920718ee5e

SHA512
d812b11b56918facdd77e611a6f22fe765d74730dc222fd6583356c5dc2f30b67d28bfa47e8d7f41857426176860baeb0b3fbfaac6b3a1a8f0633d2ab33e106d

Download Submit
C:\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Uninstall\uninstall.xml

Filesize
8KB

MD5
97266d0aabc74250101f2bb83b1bb7b2

SHA1
f8d96d9811a7383032b3559b4eefc58ba4badbbc

SHA256
4daf71c6c8095971a39a4e6fc51511a6b74f6c0219605c7453d48291f840e07e

SHA512
b903ac4b450439eff6c724358d0aec78af5e7c8e50d67431b8b6cc6bc62b31b75b24b89052ed413284f57c87528a8e8413e3799200edec334ec952ee89c59db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cac7286b3bccd3c9967183ac8b60c78

SHA1
d9133a705934f0cf4ccc705b07b158d723f310ba

SHA256
dcff45cdbd7f7af94f6c2114b91659f4053e1670be479c95fb5b34f394c7af65

SHA512
a3ddc00e9d49b150ac56470e43d9a833b572164c2c677f839234950ac94686f076f6a5429bb762d23901281795bf15f8164bed10bfdb7988b510f1d07746f444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24963d985f4aae95ff3468c15b1e0e26

SHA1
8fff8a07207dbe0e572ba8cf3047b41c9ab67071

SHA256
b137b9c8113abd8449c7f96c713e5f6dd75d059119b16535f21d0b9005fe406e

SHA512
1f63a373bf2bf58ba6e4a13422a5a1d70e96d58c93ea9286d3f16627c6683a320ee6abf9454302c7e58b7febf5ae2f84b9a511c26ce9c30dee0dee923fedeeca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f6ec3979c43197dffdc51c3d8ecf261

SHA1
4f353f3dd3300088d7ef3f60248d366a47259d8c

SHA256
d0f99bf6824b0568c6baeb7e37bc0d321f2abd529c1d9d2be2d6d0d8c933ec65

SHA512
80927bdd089b16667b1ad5aedf84e2c2b4c0fb68bf5684e3f64fff85681028cd671c5513741689c6e858abbb9a5281f9cc37e6e4adafb229dec46b38b9cec38e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cba6815e7bdeeade78ae835d5e0b2520

SHA1
e910b1b3c74fa788dee3359c54d21277d6796787

SHA256
2f40b6a88dac5a2e160b90a7c90de1b4665311013881d2edaa0983252d2b624c

SHA512
3f01e11f1286b0214f3e45f726cabd01648fbb37856200984c4bbe4ab29775725ae4f632154e6dae04fb8f733fe9bbb7cf77457ac87a39089f9c69e6fe75b00f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d87f96d563f39beaff700e521e32660d

SHA1
51d8d3df6165f78aaa3bc813d573135629e53cc2

SHA256
6ed09598dde043a6b9922fac49021e05a30adf9e831e503d6f47793005248a3f

SHA512
ec33b0eb3db1dfb6b109d2a442ed608e4b9f4394d2fa98be85b098d8766aed36bc3fc82c7d6385a18889f55728dbe5b740f7945c2aa97b3c703eab6eedfbed59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2479d495eb1c9d39520d72d46d7ffe44

SHA1
f8325d67064b341956fb1e6ef058e0533371d45b

SHA256
b3d5be9f7d31a9b4ada1556fd053e51a66848b442c6365ee2f44c15eac3fed2d

SHA512
a32076bd41aa922a566d0bcd7df3d2c20a917b3f5ed394cd9fa20780f47fe808ebb205f0bb3d3b3587361cea4958e319b25e060a21bf1b65da87f30c9fad8efd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4ae4cab0540210a60c405949197027f

SHA1
94dde9e7927bce8eaff5bd5df30ea78156fc146c

SHA256
52cf3c3263f6d6fd722fc2d074aeab4b88f53b75faff5fa5aecdb6ccb1329d8b

SHA512
e0d7f727257d7eeeb26ca1f6eb609ab4cad4e77744b86228df81206fd203b8b4a55b6f638df53513b3a97409a47565f0b2f6c2267cd84387f48fd0a53cbe5c51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7592db591068ca5de563648a7d22f27f

SHA1
3475410005b335992e5ffcd042de6ce1a87a6723

SHA256
28d5d20f4b4acab8c4b5551d5bf24420d76ab1d576425e5c6103841be446dfed

SHA512
ac8007f0f85c3b6bc9a0bd3083ca6b1b7f9b20cc61c7a7e2ab11b12992d3bd07d42f8a1fe4d9529bc63e997db07a0e7a177741ae33ecac6dde3bc95fb5151130

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
afb41067687ecea644b43e2cc260fb66

SHA1
27e6a6607b864a0e0d91023dfbd58a811be6642f

SHA256
b2ddecb055ae02e1b4e3732a92153d3f6ad7965ee69ab9e3d71557aac026844d

SHA512
648ce3fcb7b07e030e507d962e823ca68b999a5aa972724441c00d410598fd61790037f1943a3f0f642fa01b6e8f37218d01d023a7b1a7e274a5c533bc1fee86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
bf87bb7586231e3eb781c0b8ef0625d2

SHA1
e924fae2598b72cc065f92a77bc0640de781e224

SHA256
8424f2172e1664d1fae0fe2b8383876413f86f70eb5bf394bda22ade7ec17092

SHA512
6ac7e6d31c6dac6e1b50c6dbf2957adb57ce9d46cf9136bfa2715d7814b878b2fbbd9ec8f329865c608fa6dc9385a7b71481fdb32a91cdede5fcef0cc8de3233

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
cbfe2af290fbae6b8766bc9f7296a5a7

SHA1
86f3b04c165b6b9456c826b695b1aa8160c57a48

SHA256
9817dd9888d67f68e35fe89849ec82af5f9cf73e89b9e5d454947f2330a29dde

SHA512
33b97e512c3b8ec7e2f3d0e346fc0802290b0046d6113d2a25730e0ac971bd0d207ea6401d3d9dacaf30c1efd9c602bd38bf68005d53b8943ed668a255271df4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
136B

MD5
8be06ea45cc61dfe4572d5613134c5f7

SHA1
a9c11a440388c5ea7f9a2aaebf9492954fd6e185

SHA256
0b6ca92e92dbc3e7f54483b057a1ea33d4f3805c8e19170304fa69ed4759f399

SHA512
5a027413740e3f154f48bb565717642dc3b0b248ba4a13bca1a8d9145eeb20169c7cb62e645c8889d72cdcd63b988be24440498a3b1c019781f8b4fe7455c651

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000007

Filesize
50B

MD5
1be22f40a06c4e7348f4e7eaf40634a9

SHA1
8205ec74cd32ef63b1cc274181a74b95eedf86df

SHA256
45a28788cde0d2a0232d19c391eae45777fe640790ac0674d6daa5672c444691

SHA512
b8f6f42d375e3ad8015d744fa2814994fa6e588b41cce0131fca48194dd40146b08169a8ce0da350525ff32a59a16edb503c72e0f07254955c82a0d38074856e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons

Filesize
24KB

MD5
196b326cb80c358110c630efd091b6b7

SHA1
09f2b0e48d325340991f3f22d3c2b8d052d08c56

SHA256
d539de78d1b8af8b448d09b662b61844b1c4920bd7e27a00da18ca0035ffce40

SHA512
fbbd614e6167030703d9cfbdd4610d4bb7b8f7651dd96ea423618d7757d67956664a67f07c202ca0c1573e622e6984ba8b6aa558ad2c9318bf1bab976e705b97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000008.dbtmp

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
148KB

MD5
6cbf7f0932b8f8e99d4b77b8114efaad

SHA1
c583802c2feda5603a8c39e8ca5b344246357035

SHA256
0a2d86bb4354a63c7ec8a53818a2a1a29d4ff4b70259704142c57c5f1262a2bb

SHA512
cf31359e9b4bc06d8827aaf268ffaa3908456174b565105ef1910118020d69907e00fff75bdee1993a2a4a73b4d1f3ad4845fc76fa11c62e259da9a7c0545824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
686B

MD5
1e590cb5f64255b06b021c5a27207b45

SHA1
b1e98e80e8b092fa2fc4cd26bc265368151d0598

SHA256
8072fbe6e41358367ce2e5318c9ce1cd119903ad60a7ef701e443b88109e1c16

SHA512
961103c27398c283742560a2c0493a160bf2d2c07fce90c86ffe2e75db64fe7193377854ab57734a85b14698e5e5edafa5e2a2a38c247c8dcc9b40712891dfdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
684B

MD5
05ecf5779e4cea1d90cbeacd162eb9db

SHA1
ee635903b8dbeef6b80599ccadd7171b313d936b

SHA256
bb63514d7f8013c3fb91d6e71f937a5d6d659906cd9060a7ade8ef70dcc4343f

SHA512
4b9a267567f0d63c4d40662c41eb6a1d1459f74a97d924590bea42dd01477c41a1ab67d6567c1317768dccfd2dcd2997f6fb3498a9e4902bc71c0dcf51f29a6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9e8f383cf27e25bca6edf97342f1a0a1

SHA1
b3c75fad483c2f9affac327ac43ea3340e985704

SHA256
615289ead327180494c921a3b4aceb396f2b2f233c6ebe567fdd34792e991504

SHA512
ed5d01316c76c4eb7ebe9ce3dba29750feeca1d7c54ae75eff88eabd4682c0bd5729db24e0e30d1caf41559ee5bb7edc4cfc9a7a186f336f264d7b4f8138bda2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
efda97b02a98def598b2dcc2e756207e

SHA1
3a88f49a0ed89e483eb49ecd5424455fe67e4b17

SHA256
5ad4200e78d3f2cdaca7331a485c7fd4fd9cceb5aec9907e82d1a3886c5f91c9

SHA512
610b637dfa5d093c2fd2b7f25683bf98238501e25b06c814fe1aadd5c5d6d2cb00d9e29fd4f2c6c3d4d02478cc3aceda63308fcaf761c18c1266d1f2683c82c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d5a26583c03ecfe3b5a7c6ae20f4c141

SHA1
ecc9eb0c5f72c2527396394c24fc738435fd135e

SHA256
e0e64b447105e0ddeb51e12fb52e1723960cf77866bce30e417ae626b59e173b

SHA512
798c77d0b78359021372cf68b361fd410a21ac82ec5608ca4847990b64a5c47c2363b3e9042df5723258c40c666a0db8f3ac9c4d3ba1d4e8f0754f0ed26068d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5136ef9bd6b3824a218730c38972b36f

SHA1
78095e45e5e939f42a5aa9920c0c0992b2b627ff

SHA256
543eaf5edc78c4662165ea69b8b6001df88d516799fc5ee848feb41f25ee5e2c

SHA512
5e8b94d5ca01ffc1ab4c181b260fb395159893f6aa836f1e51a2e5eeded0d6a1015ebcddefb2a555451bbdfdcaa1b3de5567734293f8812f3f7dbb206ad23d83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8a76432226d79bff0e1be7d27fc33253

SHA1
ca358b2e498d65d871a2329b360ec7bc66c23b8d

SHA256
6ffda75b04056ad55db20a32a4cbff84bda1e08df52830639a85871773c013dc

SHA512
b3629ee4959487f52ec71d764d266bd93628a7c9d250a4e0d02c5caee60fc7af16fca5bfdde19eac97764f8d2785f018a1b49b7f7ae0befbe5812f2f04bb1dbe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13367424093378000

Filesize
3KB

MD5
0b11bfd65d57185db27f35d2fc29ef24

SHA1
77cca514beaef50e86e9f2f800edda73152e29cb

SHA256
432d46adae6a61c6f458f8b7600787c0123d2f4e8867eabec46d36aec851a4e9

SHA512
7a85c6c69c3b6bbd5658b564e46ac9f3418481e6d088517077761f258256021527d2600a797cbee08070a6f00d41648ec5a8d6122871381a42bb1dde19eaa1f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000008.log

Filesize
72B

MD5
e86f12fdbf4e6984814c10b60bde3f5d

SHA1
54e18ea616aa5209588162862d43fdb09e6d42bc

SHA256
4b71397c10d80fe00b0f4737762b2ca8a55bf0261b29da741968601422f30c3f

SHA512
737b7d3a3df890e9f239e56145943cbfe8cc28c1e2bc6ff13ebaa043d4b3107cc26eee20ff513948b0278b23fcaead211eb8610134990824af448c95d4ade489

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
136B

MD5
a7b68a0ab8726389c0f5fb11145d873a

SHA1
04fd82665042c43c07d078193c72f05a376d6b7e

SHA256
c4e3e61f66964f7cf72ecc0bdfead76dcad66b3356eef6e8cf6cfeffaacc1078

SHA512
89d4c9f4b6c19a202e5cf41251621a1d1fc2743ef5bdede02b4ef2f4de47f08b958e267a22d22c9b9fbe29c8619f2da19873ec843c7459d317e3b3ac855bfa8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000007

Filesize
107B

MD5
22b937965712bdbc90f3c4e5cd2a8950

SHA1
25a5df32156e12134996410c5f7d9e59b1d6c155

SHA256
cad3bbec41899ea5205612fc1494fa7ba88847fb75437a2def22211a4003e2eb

SHA512
931427ad4609ab4ca12b2ee852d4965680f58602b00c182a2d340acf3163d888be6cfad87ca089f2b47929ddfa66be03ab13a6d24922397334d6997d4c8ede3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000009.log

Filesize
2KB

MD5
eaa159ff9d8ebc577f367a2f9689560f

SHA1
a6b25272058ebfd1c5400861343d1a68f3fb2458

SHA256
493fecf9bacb6d6b74cf95f8e8a18890953821dec9724f29ea3fad43473c8f89

SHA512
374c10bb62427b1c8bc50dccf99562cac5d6bfd9699e5080eb773ea2fdf74328667ce2ac186603509da215193ec84d2dc65d445a9ac3e9ac7f66cb571625c426

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
250B

MD5
f143e6f119c2d8847d965363cf0b7cfc

SHA1
8e04789d4860e92034ae647d94012180b4f49242

SHA256
e9739e370614d16bb1ba7a23ab7d740ad87b5204c01fa6851b0e08b43f42e37b

SHA512
27a572e90d3aee8ac67694cb4cfe302f519a4449f92e7f4f95618c8891ca32266d2bcd4545672d97872a179ad9d2fb9331bdf3db2133856dbca06007013e1cfb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000007

Filesize
250B

MD5
6316ced427e0896eabba65c73a534940

SHA1
efd205e6f424ead848d34c60dbc1c78b6224328e

SHA256
0a54d5903ab8a4927d4ef07ffa5ad577cfd670da9e92da498fecbc70f6710f38

SHA512
381a08f735c4867750e5540841c10a911f3af98e42089fb50a69766ce9f6902e265e88dec1695bda15b7a709d3ccf311dc3c0252d7f5592fda0d5fda6875fa86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links

Filesize
128KB

MD5
c3d9934a35c2eb334a2d7d64c18bc684

SHA1
95e6b3e6343f0413c5df09281c0ab9788299ada7

SHA256
b5608587f99a331820dc189ce0c2cadf20b2f9197cd7ff39afbabf6eaa445c05

SHA512
9964d0878e18e9d4275cd79477c236149ff25e72fb560fda30589ae561f187d5366d6cedecb513ff9c0defcc6b5e1a6ac61fba537e9e98e0ff3a35c3b07f7fcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\89b58d09-fa52-4b73-b2e8-c0f6b95ec437\3

Filesize
2.8MB

MD5
d5f6b1f8c8911e5c82324c8b8ad7bc7a

SHA1
ff78f0e27597e20ec2dc214c23f96a7dda973840

SHA256
61017e21deae103185c37f85234a03fb0be6a00b8585f5ff9f43eaed6974d667

SHA512
1daaabbed6015d20d76e427fdda19c963bd3e3a2d7969218f36b066ec9a3a8b87971a123c5a9ab19767d99ad3f51b9c1fb73f989be1403bb61833f6b32b41b45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
249B

MD5
c84dc491f6136e6eb9586d54f657dbfc

SHA1
0268a5cd57fba3c081fb1edd75bc1b5746673345

SHA256
4748a67f15ddb350e945bf207f890288aa224f478f3554de6be566b76078b16c

SHA512
1a597bd2b72ff561316ce46336e1309cd2853f83a4379c110a8b4d261e4f09791df7650d40ce7e2bf77399389136e0f09c929c17515a1c1f841f77ebf33d7583

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000009.log

Filesize
34B

MD5
fe62c64b5b3d092170445d5f5230524e

SHA1
0e27b930da78fce26933c18129430816827b66d3

SHA256
1e1a9ca70503efd8c607f9bc7131f08aba0476d75f2586dadb4da5485a5315d4

SHA512
924daccfbfb0c0464b4c5fd769e01a8f2e96fe28b635aa27ab4cd91766b05b03bbf941af14c017436107673f01bad815ce1fac2a649e745c76b3c736994b4fd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
249B

MD5
950b46987faab3328f5f99c249da4e7f

SHA1
81e8d82faec7628af1b438472dee376d9ed4ecfd

SHA256
b9fa07c5b78891c1914313f376fd3965d70376892bb7d6a32e0c2b0fa509fafa

SHA512
667ca3256b6119aba4f26d7747c45179b56531173a8454abfe005f865127a1c63faae1b4a1aa6851616ffc0d29bc6ff017013bbfbfcc629964563e7c343e5b4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000007

Filesize
118B

MD5
fb45dce6bda278c7d3d13b393437b975

SHA1
401dc4c3873fdefffb73d4ace2c33eba4da6f031

SHA256
39ec38c22a26d9b457a468bde28023cceead2c76c189a2b9ab9cbbfd7ae62607

SHA512
966ae0e1c36342af2abab8e62713646fc4c17d8013fb160fcd58891e47413b89cc5adce1ce52195e7b985c3e3f9092f63171dcb7a1fb572195b008a88d2b5aa5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
309KB

MD5
ffcaf97a96a154618a6c098edc5d3a60

SHA1
081d79dd874d9f50c4926c12d5d1ad2024615973

SHA256
805d7c2fc0747e0afd7d97965bf627e07c642db06f816a56ad13776fcc0790fb

SHA512
417b06bd85a024829bfae9a531f008d41c363c60a4dd10304326e7e1e6c21de5837e5f823443e2eb1fff7252241d4aeba011e0c68fbc0aca8c84dd5f5e9f92b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
85B

MD5
bc6142469cd7dadf107be9ad87ea4753

SHA1
72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c

SHA256
b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557

SHA512
47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c06e6742-5373-4fc6-8e0a-5e52f5f31106.tmp

Filesize
309KB

MD5
5ba29a09c474bb3c8c6e187fe37238c2

SHA1
d247bb534762c1074aa28851be0eada601f1ccdf

SHA256
3abf7d50c8335f39666a841bcffed2eb003e926ac973164175fe5264d7d454af

SHA512
b765c329c4988d1d538355f132980fe9119757f2b0736f4f0ce7ba5a8dce9e60ec13bd5ce183f23fd339249be9781dc735a795b3f8c4eb6dd5d409b22074a9c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCAF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1912.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG

Filesize
36KB

MD5
34283ae06d4c273345140335c9e1fea3

SHA1
5c71544cb871b9ac9129e67be57f116afc6f9e54

SHA256
ab396300c9cba5b3de42036477fad66cb674ddc8348682adfdfd96382a0050bf

SHA512
6d390c9f6c4d860dd4287d1b14e82888bb54d46dbc515f2f293619f8799422d6674a4d99428ff785f43dd2516ae37fe3e7487e6200363ec13545cc10e407317a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.JPG

Filesize
39KB

MD5
5aa983a12e9e1cb3fcb01b221b54c38e

SHA1
d392a0b5ef26ddf0fa59a029307a730185a6b6da

SHA256
19d4d0650fbb944c10fd09b3b6c2b3b0c471d3b2be67c6939a72ffd5369346e9

SHA512
00a68494ebd7daef0c9482f759deb6e0548ea59a412b1d6d1044ab4d718cdf128053139713dc9c6c4ff5dce43bd291ad81f721e4e92f79f7bdcd430d279a7b83

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
318KB

MD5
b5fc476c1bf08d5161346cc7dd4cb0ba

SHA1
280fac9cf711d93c95f6b80ac97d89cf5853c096

SHA256
12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

SHA512
17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

Download Submit
\??\pipe\crashpad_1092_UUFVCHFXJPQIQLTD

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\COMCAT.DLL

Filesize
21KB

MD5
3b180da2b50b954a55fe37afba58d428

SHA1
c2a409311853ad4608418e790621f04155e55000

SHA256
96d04cdfaf4f4d7b8722b139a15074975d4c244302f78034b7be65df1a92fd03

SHA512
cf94ad749d91169078b8829288a2fc8de86ec2fe83d89dc27d54d03c73c0deca66b5d83abbeaa1ff09d0acac4c4352be6502945b5187ecde952cbb08037d07e8

Download Submit
\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\DotNetCommReviver.exe

Filesize
24KB

MD5
ce9c3033e827b7318c9296c88cf87e41

SHA1
3319729c637db2beba82cd140f3ca169e2bbeb84

SHA256
7d6858acdd1fe1d3202a4cea2e949edb3ba8d2c80fee8747bb2ae3b9ade49fe8

SHA512
b8f192df0594f27e4533b933f31e2eb68bbcab7425307441f72f15fe371c5f982b26654c08a6f3813c4bd2b87d60dfce24d237628d2a8aefe230d419e76ed8e2

Download Submit
\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\Robokits USB 18 Servo Controller.exe

Filesize
972KB

MD5
ab4f4abf30c603b154eddb0b84517dd1

SHA1
a10c73f6db64f1f3e5b27bcd844c9b1030152c87

SHA256
117e23df0356db7a85c958174312bbccc6fba007974f07e6d3221c9a0198b50d

SHA512
96e4ba207775daa3247f0b8bd203421a1f3b7539aac67cf952472322cbd2b8e1cc55cca64b949e15aef52c42933cc2c3f2ef2d8930d3da3cb9b23219c764d9b1

Download Submit
\Program Files (x86)\Robokits\USB-Bluetooth Arduino 18 Servo Controller\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
\Windows\SysWOW64\MSCOMM32.OCX

Filesize
101KB

MD5
2c6119da3993f410e74b15112f840cb0

SHA1
9d7aaffc0bcf955cc75d4ecc228b1ceda8a1856c

SHA256
51a1d6812e445c26c71465e2709e6d1ad587f8513002d662cd160f424f48b37c

SHA512
053ece4eb2ddba51c0d683a7afd439ed88605ab83619de738f7ad2495bfe9e9f16fc3b829c7fc9c779b50f039b9fad66d16aed520a5adfd1522a711073f78208

Download Submit
memory/2688-152-0x0000000003280000-0x000000000364B000-memory.dmp

Filesize
3.8MB

Download
memory/2688-15-0x0000000003280000-0x000000000364B000-memory.dmp

Filesize
3.8MB

Download
memory/2688-6-0x0000000003280000-0x000000000364B000-memory.dmp

Filesize
3.8MB

Download
memory/2808-158-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/2808-151-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/2808-36-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/2808-146-0x0000000002420000-0x0000000002430000-memory.dmp

Filesize
64KB

Download
memory/2808-18-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download