Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 01:30
Static task
static1
Behavioral task
behavioral1
Sample
Rogold-features-for-free-master.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Rogold-features-for-free-master.zip
Resource
win10v2004-20240802-en
General
-
Target
Rogold-features-for-free-master.zip
-
Size
1.3MB
-
MD5
9af85a0e9cf3434b11e204e4851fcfdf
-
SHA1
f72d568c37ffae330e1c190acce7fce2f7e9a1a5
-
SHA256
f7c4af6864b5671b38c3ef632c153f3095dce5b1c3ba3bf973849e879d41943b
-
SHA512
cf7a9c45ecc042b8a251641783ff92fede8e8c2b5da2570b5ab5a1222bddabe7ed21f1ea5964c9b2bf194ae0c4ac2f722676aa51b4254844de3fa2e64d3c8d39
-
SSDEEP
24576:SEwyp8RerK5FgN3sU/Nw/ZIzrO6hnV/GxhNtU/jauti+Ky84nLY5pr/i:TaeG56FqIzrOUuDNSeu7Ky8qY5la
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 31 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Documents" msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "9" msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000 msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3784 msedge.exe 3784 msedge.exe 4064 msedge.exe 4064 msedge.exe 4032 identity_helper.exe 4032 identity_helper.exe 1136 msedge.exe 1136 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
pid Process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 1136 msedge.exe 1136 msedge.exe 1136 msedge.exe -
Suspicious use of SendNotifyMessage 26 IoCs
pid Process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 1136 msedge.exe 1136 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1136 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4064 wrote to memory of 1816 4064 msedge.exe 102 PID 4064 wrote to memory of 1816 4064 msedge.exe 102 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3748 4064 msedge.exe 103 PID 4064 wrote to memory of 3784 4064 msedge.exe 104 PID 4064 wrote to memory of 3784 4064 msedge.exe 104 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105 PID 4064 wrote to memory of 2140 4064 msedge.exe 105
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Rogold-features-for-free-master.zip1⤵PID:4712
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4132
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffdb6946f8,0x7fffdb694708,0x7fffdb6947182⤵PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:12⤵PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:12⤵PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:82⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:12⤵PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:12⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:12⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:12⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:12⤵PID:4004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵PID:3740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:4648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8067792275830885588,921346960906649098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:12⤵PID:4956
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4492
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
90KB
MD5e68f8a19866705c0e35a30812b957be3
SHA1c88b39d0eb0a12fb0b32b0ed761435242c00f457
SHA2564815df7fa6ff875bc8fcf24a4de4a71a772484861f3bf16d5b69792662c12d92
SHA512d82d5545ded0e79adb5612d789126256dc22cf9303b0ae960ed03ad6318e9636181d858c80cdd999ec11bb0a962ea3a474bec21ecb4af00ed465a3e7a460a271
-
Filesize
165KB
MD51127143b6a7d9df43a3d328fe4c7c6fd
SHA127945afe03925254d3c117a6e9e82c8346bcdcd6
SHA256df19bfae9f5380178e5ad56a3824fe6503e2c36fbe19ebe4fd5b2ae53bed642b
SHA512b2278f8ef064fb5c70df22c283d1164a4c2aeaefe99dd80ce6e26f37f94aa0d2d59e8f00116b594bad11eed62e516ae77ed949295b8678896a305f0d7fc539e1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD57a0a7b52ba059bef6f1a0c59fe1e50c2
SHA155ace74529431ff585b5e9b69834a8cab96d9f47
SHA25638b3c257cc52420931e9b4f376f1ff487c06473d7e17d92c2a3b26cdc8e163ce
SHA5128a60118cb981102d5b5454d9acc91d9d3beb0be8e9d04b26d2576596430023c8c6866a08a96c1320a7e445c769c2b303f0815ff31eb684f53f86e229f8537c5e
-
Filesize
5KB
MD5f1f58ed6ffc17290591fc3617af62de8
SHA15ca9cecbe80e68a2303d5d5a27495a9dc44e7c1e
SHA25633fa3b07abb5106de0320072f3f32b4e260d872a989e2ff4f804858f5e0a6a38
SHA512fc46d8f57be76737449c9ff273cb6862189dc88e72a1ae826ff475e74c0b78b61914664c6fced9a26c265831523198c8c0a3ba7f8370a25abdc6a4165dc8d779
-
Filesize
6KB
MD5ef33239f115fa61b59a5b96f576d4b4d
SHA1a085e018b1ed86bf7f2de0b0bcc5ed4be2d2480d
SHA256eecef222e9e1db549fd90498ed064b29babd0bd161d4cb2e256f5e9368a3cac7
SHA512fd04e0cb4b47e6d9ba0e596f3b47e72c2dff34f8d660edb7de268762d22a80fd121a93d5277ad057e1e0990e710af43074cc84cd536e15e6ad0bcdcccc7eabb9
-
Filesize
6KB
MD5daf9959299f390cbc873b6a611305de1
SHA129f678951245a5bbec910e22ba0a9a7b6dbb80f6
SHA25628c3d6d5eb7e1eb8c235bfee34a2695919a5f3e2f66ba5509a67f77f920d22b5
SHA512777a4e9560ef7fd2494f4a9fcdfea0479a8262b06374beefad921c406b421d14035e8721bf34f5e004e9f76efb0eda60ee893a01ae2669d2fc814beb386cecc1
-
Filesize
6KB
MD5503d79e8550e1d45a12a3419c76008c8
SHA1cb348c7446ebab956844458385b870d838fced14
SHA256c1f5685f013c1dc076f1fd876540cd0b196346cf023382b3f505f19d8b4adb69
SHA512d96643195c0151a090099b82daf93f31e8bdfc18817180fc47968ee0e0c41edda8d83338a3219b2b9088723f73eca0419e8771a9efa70b508f5550460bc68072
-
Filesize
6KB
MD5f19a362d4b97a9ee379c5298e44c823a
SHA12d959762ba2dc737c39d9daeb4eb1930247bf9f4
SHA2569e0a8ad14d6c306c3d8660e0f51078846391d861112cbb93527211b1b935ecb1
SHA512429750129ba1d8d45eb902a34744666fff58f2a9b79ba416d65bc53d28801beea6de21335d8fefef1dc874da5ba54340b5e2ce6f0f34b926243c05ee9e1a071f
-
Filesize
26KB
MD535a4b39975681257ead801e322027fc4
SHA18c0fdccc5f7c796cea9e42e8d0e1440a558e9bab
SHA256f164b93119df237bd8622b53f66a09b09a918802c293363da4476083d917730f
SHA5126d540b57c173f78768d19c2252ac820c11c870f2f8de75f43c5c405ab8265acb8309f9c61b92c2b9aece78a28ba6391f4afd9a7b717b341cdb549e5d9cfb2e22
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5f920636f6016bec69145dd79c7033797
SHA1f54afdf149b9371ddde13856544ceeaf611d44da
SHA2562b2c11877c3fe399841b138364f1e95b188af5e8e7d3b24c6cc9251005f40f8e
SHA51246ed909f6f825114d1441c0cc91a87c630bbf94f3d550b95d7eef93d21afbff41d9d869de824afeed2196f7f629b2f5ae2228ab7f9a8a02d8caa5565357ef512
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD53e6be75ccdf3557b9861eb17daa4ad56
SHA18c30876fb771bd617c83cf88384b9183385d912a
SHA256f8d5b15649de7b876d7a86a5f9526d2e657c0dee5139b84ad0e19722ee711aba
SHA5123282c8647741ca953dcd26e86f48df9b47f30e5e1ebdb2a93a346d990be3e3491ab763c89ca78e23e85a3468d744f5a8622b18f1acdaf4b602021a19ef433249
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\kinfohglhklmfmfflonpoibmejphgfkm\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
1KB
MD5112a2b322937570b12dd0912c1ec46e0
SHA1ca273a0d11b28d1400b24f595d03f2c3bd48d31d
SHA256dfe15acaec3d2ced7cd436dabc606d2d5d816fc08afc71a1fdd12ccea6b1b07a
SHA51232cd3b44a8291318eb5489349f80ed18b42c6ff9144198d99c3c7fb5f2646bd2d850df69dd8a93d166f406fc73132aaddea5f0b03b48e01847b94c1a549bd890
-
Filesize
1KB
MD52b2a80b54705dc86a630aa62a938c132
SHA17c790fa9349fdc6ea25d7efcff6e13d84e82e79f
SHA2566f52b749ce19cb9354c0d0b22f7aa2fe24716d35bd243fe2c58e22dd61b3c77f
SHA5126d5bc77e4a8a5c3c45c8c844308331df402abfbaed2cea92c77fe4b65ed58ae6b5b8e06355275f00dae82fba4a772f672ac697bb3e7d57f8c2c977973e06e853
-
Filesize
1KB
MD545b908a5860cc44205e3bb7387eacd24
SHA15020589e8f39f45b251b16397cfb2fcdfdad62d1
SHA2563fd12fb154d8aa053183eade1e96242ce1c6b8521d9c329da5619762e5603a72
SHA512468ed232dcde5ccda6c0650fca12f0f722291797983692d5bbfc2b8ca1bb88cf71e1b2683a8b21cd4d1a67a8490b8b059ea23ee893cf41285865dbae30bf042d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e0e00b9ac9e435528b01de036776b396
SHA1eca1eb1b881d138472aba090713f920add5132c6
SHA256c9d81ec0bb2f01262849bf6c9b3b0023e6281f19960832dd00f09c8213791d4a
SHA512f3d4bd0148d3afd7706ec92c0f91ac6da7253cb030237127fc6e6c76f9aa129c29ab3be2854e3f0e8ba60121478a633f3ac4640481ec8babfd48d2b551dd9ccd
-
Filesize
1KB
MD5c292afa055aa0ef329135522ce65fa3d
SHA10caa0225dfd2ba702181926c462081521295d43e
SHA256cb77545800314357e0514adc4338a051250e50f5ee5754cdaeb111280fb4758b
SHA51219d207ceb670fc872e046b712cb54c9fe452b29e4d99236ba5107ada43439a98451f540e0a1cc699db568c5bbd355b9e71743153af8a6dc33cd7b545940822ad
-
Filesize
1KB
MD56d52426ea50609653b832a71bbf56a6f
SHA1df06fd627ef00107c97b76b853557fdaa507217b
SHA25694188d4f025fa7747715ff001ccc27a2dd1ee841df34527162183d211482a429
SHA5126f9721f0214a3c66b49817bb0a095a5bd1b9b7670e1b1c1c75d63dbab4fcb1c4605db4cec6ca4098dd5ab503764851f37784da3c833258de47d199053ece1bca
-
Filesize
2KB
MD542791d103afad80cfbc3776f1ec01d59
SHA117dd93cc975e8d96ffd650165445206ce7869c3f
SHA256df5d38bc8801d02fc72bc12597df8290b19189e8e13f8f907f34a2634596179b
SHA5129a6c7488897c2ff5210b44027b9158fed3d45f9448e3eda1e2f15c6bdefdf0730bdfdcb40181a8f346a856bca7f4940c8cafa076c138da4131069c8270bc6c65
-
Filesize
1KB
MD58e8acb0b8191b4a47f3e7ac43a91d52e
SHA1313e059562a94ecf49a1534107b674dd26e24045
SHA25607084e1b08a8878b8e141541300168d16d093f401dc60b6705d45b913c69372b
SHA5127ad8e3fe9e9c92b60c954decdd6ce8b25b05acb3183a1a9116104fe172a5929ecbdf7df7651dc61d85f3a995f4156ab00e3d9f8bf021616090f5b3bd27f741c6
-
Filesize
1KB
MD54b1aa70a4348ab0dd2741f3b95146513
SHA12124593d9ac173e691e799d56282a84c5f56ed56
SHA25674a8da4712c87bc628f5a5d2416892007e5a8b1b96c11e120970ce37075ffe8a
SHA512003e7199e297ac7ad4f8f94dfb191b46412c7b2163409c95a1416081d50f26b528321e01770a5c7a51d7d6782d2996511da0ab662746e174802cf228bd91d6af
-
Filesize
1KB
MD583cb9e6ceba75a1c1e3481c65847b722
SHA151fd2076c355a7da84739b97cc67ac5ed3c558c9
SHA2569e6e2988a36a84b63dcc9e7a8479226069ac6e3ecb421ab25dee6d18d4c72585
SHA512f66682e960048842b76c2d5e2ffa9e1e2a3ad4f467c76417f452bcad40e70bda58eb62f6f9a8f8078cfc5b116e848b8d676f59cde0a9d8a2d05be2b299a99351
-
Filesize
29KB
MD575c814ef300fe22f5b429ec99e0f0e53
SHA15c7948f1d82588fe876cb667374894b182c74d10
SHA2560f22f841b6f1698590ca366a66ce6d32e88e5193033de47f710073af6f614088
SHA51219b66a39a1dcc7548863f5a859f08a8dd0e1f0c62e5891f56096bf62b534dbb0f4488462390366269d636bea10674f57b7c20a672d4bbf03729f84c970f9b90d
-
Filesize
6KB
MD5d3222706b6db60ac420bb25e8e841f24
SHA1b1493d7ccd4b45bc5de5fb4a16cc679b8c8c4302
SHA256cf9fa64bb4fc77812fdcc6b978edf4a49f1721673e9775d550727526b71a29c8
SHA51225f18a70e7968242624c3ff5cfd8135e52db6de2b928adc21d186cc51b5cf75926ba12066b8aa4cb3677517b2636026bbfd7ce5e3f052b745e62e540a3cafe99
-
Filesize
50KB
MD56f3cb583d4f9d916160aaabbc8fab383
SHA10574454aacc14d5c1bd7eb506c64a3ff415d9b41
SHA256dd6bae3099c1adbc13194d8780bf8f8e9a32abd9b59fcd4399c73fa9ec5500d6
SHA512075452768e28282acccd5b8a7a597fd78012ad1e0f9a2943496ed0f53f0aea03d5defe5d167ad7108be0d2114efd523cf5171a02aa4f7c744d30aac5838b7b0f
-
Filesize
48KB
MD58aaee3990ef2f829a948bf91ff9baa58
SHA151e5a5b8cfb7036e7f92a371bce83707df1e122f
SHA256b1cc47f3ed4d51243ab2563752e52808a972979b10b15ce65e4c39b805435c5f
SHA51243cc1e820d33139e1fc02bff5fdae1ac55099e756627e993365acadb8d0b9cba17bda229fd47873a62984dc3d7f0e2f1d53862e7376625f57eb54d4fdb2a3e89
-
Filesize
11KB
MD5575252e8511c8cd923272533649e9e02
SHA1935ed0ee5012ffa4abde430ba4e88a94a2ffa505
SHA25644077456b79dd854f09ec2641cc3c1837a7c7fa94508d89bb6f46a9da9d7ad28
SHA512be33ad4c5a80c616d2cad28e37ae76f6cd077eeb257a4136c707beaf8ed12c358515a1de84e779b69bd50fb05b5006587d9034870fa3f2754a74886192ce20d1
-
Filesize
802B
MD574cd703dccdeb8e80e9b5ff1c739d995
SHA1c6fdb4dc81973e64dea2f0a574d79f106e0e5583
SHA256295aa1eedfbf9b44c51e6f1e2fdfac433869e2bc6aa338115bce1e3d2271d154
SHA51268d2b3c28c1bef0707740bbc867b9614d71d3c032ca5cae48c16428458ee9b081762c0fcb2b9dd79e7fa1ab2ace740fdc9188f08b49b98df2414e1686bdb73f5
-
Filesize
6KB
MD557795b8c0ccbd4b88744e4001c86013d
SHA1a0605b57d3e61ad4caff08e2b89eb766de190239
SHA256c7511ac5960f5ddec04086ad00a56bf4790f9f5753eee88f4ae49c6b3ae9b441
SHA5127ec823d3b4a58107a71e6099555e62c5c0be0d8be1c700fbad4494447ba721a7da2d30c0a8568e5b318b019704b93b08f6d714029b2bf710bd1dde43fb926408
-
Filesize
3KB
MD5e5ceb942dfd257c3ce2973feaefaac95
SHA188be14c8382351e7fb5d9c99a5c693a646793eb0
SHA256d1547d1880036bb54829c4c72a9a1ebbe8fae95d724b412b53b31d20006478b2
SHA5127c657f0fe9d68ffa72abd7890e1b35c43f5cde4afedd6fa6a8300310e7edcd20a77d67dbc9095255087a81e571f67bf61d1dc140dd5acdfb7f5d31d8ebff44a6
-
Filesize
14KB
MD5f0f258d1bde2dbf26e209bbb7ddab3f8
SHA115baa60530cd0c90e7dd1e9e2d5258bf35e26bcc
SHA256fc1e7ced5f1f984da9c6ccf519b0489ac1531ca20308f8b0ed4cb9f674f45936
SHA512a303b07da87c4d72207f9a337def8f9a472b876b927f71794a1df4414cbcb7c932ecc949f681abed90e2d084f114c6e4ae03c2bf0e980a176eb13f20f54bef54
-
Filesize
25KB
MD51469efcda1f595c1464958f870cfb575
SHA10bb163f8fb095b87f936912f2300daca88b70a8e
SHA256e3518b44e82eede271650023615bb1615e3362b8d5be7c3f95f2d598dcbd6cf8
SHA51225278a9194c57169bdcb89bb7aa848d5c17cc25cd4065fa25323f031aac66a89afef58295df124794ab2f05a8bbfc58eca52d95f0fe22e4603a9c259adad5de1
-
Filesize
44KB
MD5af3b28751782cb531783042b6f0c7dfa
SHA1e702a973947547104a24fa91f88189bee19b5fd7
SHA2569fa7c120716fa3bd0a8c912f19edf78d310aadf4cbc64f7b01051028cb71bbfb
SHA512fc187edf1210fcf6ce2d42c0e606798fc4fcdb1dbfd51edc088e5ac45e697a82ebc2cfcc88d96b6dc345b7e1350d13af3a042edd02a6fcb647a10df356c3181d
-
Filesize
54KB
MD5a214854d2eff7dec6223dea449ff9b83
SHA1be37b66c359b7c4a28fddd9cea1278ece6034720
SHA256749b3011b07bbe2171ccaafc6bd99f3c9b8d2aff9fd84b694d2c2ef832d53da5
SHA5128f4a614a411496533a157780471675533968789a64a24f335ffe93c87cfc94439a28bbfdd814b8a49749a1a96a732d6c230c572b3a0efd454de3ac0187ae5d9a
-
Filesize
18KB
MD54a3f9b9762d106ddf45004cc1fa36758
SHA18b98e2a3839952604f9d4ca8d84f7ae4313bc71b
SHA256a383f1b468a1840cacc8781e81427d11154e189d8a059362f687a9aac97d4f7a
SHA512f86e6d09ac88f7b193a0673e5a389e412ad5866806c6db52e0447bfdbe337464d9b128b76d9f1dd6a06d4fc979fffc9c265c720d1d47dbb54a6f82a9b7a2f1b3
-
Filesize
4KB
MD5ff1ef9f6b4179ed9bace426a3b4c4d9e
SHA18134fedc355b061cacb40fa43a7e5397204c3f8a
SHA256a75571c3f2c67b33590790dbb6906c410c31de2513d36a5d9cba0cf20f709805
SHA512cb6f3bf0643ec2aaffe3a0a15501ffb1342b2aec67c9d09d2d0d7d1df9951638e226ea5aa606ce1488829ea00455783fc7e154495ee60c9f6f711439475dd296
-
Filesize
1007B
MD5af33e5bfb52eca7cf6e050bfb8b7622a
SHA153016acbfeb7057950e0cd53301e5cde297e3de9
SHA256ebe2a43b9905aef55e3a37e073d0f001299c759d31e52d494b4e242179a1ffb8
SHA5129934a3a5ba590e74bd06ef27e89de09f32283d3722acfeddbc9b4e0841cb3592898d6b847256cfb31b9210702517f189626f2c1567d35a8e6305af170efa9430
-
Filesize
1KB
MD5f9ae27ba6f606aa57ed8c117ad2e9f4c
SHA1b06fc6921d1dd89509bebee7694a6bf0cb959d60
SHA2567241746a46b1663f4ad7515a68d6b675a35a62619577f7285ac4e64e4adbe7b9
SHA51217470353fde10c300cd57c17ca9ee1e3297f9016e2331e592b67fbba33c06395b1fba18507102a97ca1a31d1a1e34b6aa32e446127d1cdbbaad4df6f744d0e0e
-
Filesize
2KB
MD5c1162e38ef8ed9d1091b7d5621f9c24e
SHA1cf6d74b268ce68d98b4454737bde4464e86d7ed1
SHA256a7be7205a59e5a6e8c74357f5da9a91b37d87bda23004ecb4ce218f9a0ae0efc
SHA512cab404670d08aeab212f68506e03f0da1bf6c5b5a01cd3617b2aa179aa7c7b7ddf640849357e26b401a3183ebcd2ec0894670a6c388eb573190577307c21d349
-
Filesize
4KB
MD512e404821a3c632ea31509a008d540ca
SHA19d84e1e74248379e75f820d18d9b5ec75695a1cf
SHA25677c24178e07e14a667e1b119d409f9bdf79bcc2f14e9b7ba4cf7ec9add54d85e
SHA512ab0881226c9861c1d822316418f22eb2807f673e697210d22e6415c52df3d5187bda795fdb6477c98f3b9171f996f8576aaa7401950458ae68fe802726d57b05
-
Filesize
1KB
MD5ca0ef860cfb4d207bd523bfc1c81f266
SHA1f3be2c1e4b0dfced30abba5c34c3930c3a475291
SHA2569321847ff359b540dc4a768c2c5737e19372c6be42e8e186e391f5d25860f9a9
SHA51282cc83394c197d410be6230fd2b47617a8a47c82699fe737e5955bac79baf30382a2b1ff3499e959e9b93be1f1d378d2bb3ab7d5795e37e514f8aa8f7992aedd
-
Filesize
111KB
MD5ac19bc8db9700419f1ba26c0505a22e6
SHA16d13fb681a9ab83f54d2af31e14a9ab24889ad81
SHA256bbca7e9fe513284bab1c4336095c9b9b3ae6a9be0d65048f9c86c8755a915d77
SHA5126fa44aa1e58933b9f55c272e2d668eb93aa23bf08db6b569a34b5a74132dbe1f32ea783c665d4776ce7e6b5924c1ec3dbe26ee027b735cffad9af7d8cff679df
-
Filesize
40B
MD5b9362f1fe9b6131b7858b61241b2d50a
SHA16465796c82a321d85ffd1656ec16a56e9949b6f3
SHA256beb9a782df61836adf632c54f24e49ccde18c1cf4b8ab58385fd414d49dfe24d
SHA5124704760c7ac82d9813c51f39526e6b49858d035aa197ed33487b4ff8fd38f40f2fad5128c955211749d2a12120a6d133e99bf16f026d8d9c6658567a99ae731f
-
Filesize
7KB
MD57a0a8fd2bfe13af3ec262b02ddec0024
SHA1fb323b7b3613f0133b5ae0b281ad3efbd1d77bf3
SHA256dcc8eb45216073a4970f30319a524f75fd00550bb7fee9e86b92986ed6088969
SHA512d11a5946aa7e76abafc741016745487ced0b3f275af16f68acfa0c9ca93652f29d94b9dd1cf37f9e2d70f773a05a770cf9570842030a2e7e37438efd7023cc36
-
Filesize
3KB
MD56166d978b726c24915a40ca7f70d6c31
SHA100bd97d43b31fc8b4edf8f83331f4c368e5ab20d
SHA256acadee609aef380f0b82342a4993d70a38af712ccd06a893bc9d8911b68a6fb1
SHA5123b7d8179ced0d7dc1b6ba1e94b0fb058140038898addecc9e574c751595eb33e994a602120271c103d60042efc1524fb8bee36a2b1362776db3bddf7cd97c914
-
Filesize
20KB
MD5d459139e92fe4391308c6c083709ac05
SHA18deb2666a8648cdfcf0326c2bc17c37eeb46aef4
SHA256d7ea7f6f221600d69f8e6fde465757b507135cc2b19504cd89d1eedc04dded54
SHA512502090e9255dcfb76e6cbd5e981c97dfbebfeaa936e9dd29fee001e471769d74e9e8bae3b94acd45f1e1f3ca50b4a524ec93814df03e17e55349a840f7383cbd
-
Filesize
1KB
MD54464ed6c6bbbe1b403c640d8be17fc02
SHA1ece6eceb170784f421ea2d54285492383bed13f9
SHA256578f07b6c78ef0dd0a53c95487a793f3b8022e39db8567b07efe3e6c77f79e7a
SHA512b85c293fe398910635532af36d0fff84902c0ded374676c7762889702c60810928d0de2c0db569eee14e22043af2f45eaa7475c52586c05f6d64034e444f2433
-
Filesize
1KB
MD56cf3202774f00284a3a169a673308000
SHA192816622fe9b949ae125c1695043e72c544a7b5b
SHA256807708056c0e2ad9e5162cc5a06098a95f9e66374c30580ce7418dfce77cc5b5
SHA512480a9b476a03a929b9b33ef7ec5010ed11d126e377a744e38cbad378e3463db62a53db6e741dd22a58b06b9ad7bb5c708990324c3587803e85c4e56d366cf714
-
Filesize
21KB
MD5e1006b1ee8aba8a1e8f06575a465eeb6
SHA152fe3a1050a8b749356aefa23c8bc3adc4d7921d
SHA2564d03538a9607b86c42344b0ec09a2ae8f8ccc5365445f4f373f59213af9890fe
SHA5125ef7a4e9465caa12586f266401379e2a909469a7f5ff5d32eac1f04cd13a8ebe5baaa55a92545bd9d1d3f6bd51def059cb47f23046f9ec7b39ca5131bd3689d6
-
Filesize
87KB
MD5dc5e7f18c8d36ac1d3d4753a87c98d0a
SHA1c8e1c8b386dc5b7a9184c763c88d19a346eb3342
SHA256f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
SHA5126cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516
-
Filesize
94KB
MD5e686744c912ccd8af044f2d1560034a2
SHA1e30b1a9bc9a08c7f0369bd50e87f2a1fe0143486
SHA256b6f80cb5cb9eb278f9846b7604747cad1b465b014a589c4d70870757661ba350
SHA5125b203e8448711c527e0afd8164b6d75be31a1cd1ad28494f0e0d19dc4db0aa487757858845882fe57c4316c0c13f66b63bebd79e3881fb9a4e0c61a71e6385f7
-
Filesize
83KB
MD5dfb1267e0168e267d9c1d96c45936bc1
SHA13297d938966fa0aedb2ea8ea623e1a7326bb898f
SHA2569c10a91200f3ca0e0a32d584da80d06cb684dd5c3dd8e06582e9405f4da849d8
SHA51270e0fe7dafbe294ed076b6ab683a2a680782903a3573881ed59f8f98be18a8eb5141291f08c521ddf9f4cd439ac6e399406ed5cb8af5dd589de635bda7b4cfd8
-
Filesize
23KB
MD582dcbc53e9781c343f9c31de2c390dfa
SHA1bd66034601dc4a1acbe29bdd53f87705f1b5555d
SHA256f0f35512ac7f23e1697c4d44e8085f010932ba021eae8442b990e38a32c81e08
SHA512ea11cf43065311ce5d1eed13ed3ec3fb3236decb1b21bb09d66cef67f3699eecdf73987e91911b89bcb0b97798d95b0c6bcacce3e1bc90123518dc38df36c641
-
Filesize
4KB
MD59215c3ea8f365ed7ffd2892cb8a34e06
SHA15870de039e8b1c373c03f79106412839aefe7e8e
SHA25651505d11aeb3189173d979636d741ffaa6cb05accb0d3ba20c2794abded63244
SHA512fd6759a8f3e5305a39bbdd900587e664587bac3c17b7ac834d3152495c5b12139126f811bb2721178694251f0eaaa83da2e56e87f1b3d4636debef8b3c4fe19f
-
Filesize
4KB
MD5f537b12e364c493d83dfc00bc426d116
SHA1a00181499fcbf59d4f8aff078a11b1fd53b06ecd
SHA2562c667b7114aa82270750e14c7fe8f7becbfe093faa7f66d35ff08ba1607124fd
SHA512bb0b3ee4166d134096cbebfba69559afca3a9d606937fbf13f5a37bfd3225d46de9e51e1b8ef8a81868fd68e26a13a4ac277b3e34a34f42da263598a099265c3
-
Filesize
35KB
MD5f498fbcc5e87a4d88e66720704e3ee22
SHA128259da5aa3af01461f6ff5fce1b6bcfeeb5a1c7
SHA25604abb42b1096496e40048d1b50044af03dfb4521bcdddd8b69a7b07255dcd949
SHA5121f5942c3b7a88d67892bac011b0bdc99b3ec22ef0cb8f782b4c3931046131a235ce4d10bc8a3cdd4b2f6a247edac1cbf42b5fc0b6a97d577c5378f8b31f9651e
-
Filesize
19KB
MD57e0ca19e935913fbce49a2972d79f0bf
SHA1a0636a4fd6a81d80911f5e9f34ca68765616bc62
SHA2562c3824b73a6fec4f2f32c8b6f6b0477b60d84c82122ac734964dadcf3f29cdf2
SHA5125d87ccac54b01d6d59bb6e16702d0a9ae7713064b68337e7c2e7f9a49e653b6c8eb5f5129e3c803a1d172a72e90b7e21070d18c33ce749637997d61ff8a61467
-
Filesize
1KB
MD55269032ac135b44bba5c598407ce13f7
SHA167e384ef25357283f85d1ad02ff3336c0649be20
SHA2564a6eb44fcdfddb42e1581ee74985d99fef82bda1f68d70181c3b844170cf3313
SHA512e1f58e925d6314163d2b92f4bc3fc47251e4b02dd1d04029403018c89263c154079077f650b78856bfe257bec58b22db6d4e08ccff6519c7c223fa95063e8f53
-
Filesize
23KB
MD52ef1c5e4f978340d3307c1c22b279cdd
SHA17a375d4910a5550aa597d58b3246581c57decb90
SHA2565fdd9b8d27fda115adf153b7203bffd6b539f55c9a7dd41b233e668f7c85e252
SHA51299c33b13ada6466a7a4ac00f0ac3af2026607813d0ef3ef965270cfe1397e8bf47df6cca97137615f5e399272a7fe6df70213fdc9bad5279fbb6be7a37dd86a9
-
Filesize
11KB
MD5d8b4049f08f807e603663d8e1404e4df
SHA1228ce65926cc7c0cdf2e98c51c66369c13ac6431
SHA256d4d266b9886ae9c1820a38ee8ddd3b4bb4ffd3ac33e565e8b27843739d2fc5b9
SHA5128e61e13709ea283c9363a1a10ed7af29722c872157fdff190337c846f66608f21284ee9d2d47aa158efeb0a83439b65f2d3fd8388e7ad2136191758e68fe2840
-
Filesize
28KB
MD513864f326e4d2e9a7cb4eba3812118da
SHA17ba16222503720a049bc4862b34746f327d1d6d4
SHA256049beff376e2cd9b75171642e60eef15ffbd7b5fd6f4afe38546b38257a8d3da
SHA51238151f9b7594ba9f77404e2b3eb62018333abceeaa5178136c3e6953efdbc73fac8bb84a29773b98ebbece8777eefeb6f86f57b0159b03e9b7bf875dfe01a010
-
Filesize
719B
MD56b47c1a2d8c13426c8645355eb475404
SHA1826daad7d9f2004ae17072d219dc661596b23ee7
SHA256ce7857ffde5fde28be728a8098d478e5b8b89f24e83975018d632ca491b7b37f
SHA5127c23ca6aa1f9350ec0dc946138fcd26a34b2f32f1068586ed6f0d0758df1ee65498035d558861604d0fe312abb89b57a2d14de980af27fdddc0d2380bc38169a
-
Filesize
6KB
MD520a0efcf633f04a30a27fe94c226e3be
SHA115230a8ce8ba1b476c0a864f4ccc6f3c258f3994
SHA256eca8accb7ac6e97f6b83c5bf476cdb2948a4ec249f6f9073ad663fa5a821dc29
SHA512d66a23b843d1ed5f4b29f88c95bf89e9720739e8696b25ac58a3396e84a7dd54a0fc9d8234545100b893824d7ebc33cf7114f2d4a895ac4d35d5380cad12a4b1
-
Filesize
170KB
MD535c38fa9d30304c5c116d49a5622f9c0
SHA15782d5d5533d6d3ae0188612041178a09142b952
SHA2562302f574de72c966886a0f6ed5d683acec134564657b5003e1f2a71bb81355d5
SHA512bee8b2c9f8399dd2c4c04b159c8c09226fe8080198500c7defcc6e8d4efde231ffd5d1f6ba01e01f8b1d9e1d7968f92c2518a8177408d10b1c86d2dd14361501
-
Filesize
6KB
MD51344c2e490266bb5357e7b6e18af638a
SHA10958bcf0033fe9ee9dc0b44c9c699779e67b219d
SHA25605306a4885c5745ca5b3e99c2edcd1c5352946a40ca2732222efe278f4ee86f0
SHA512b62646deaad07f29c29d2c3af164d13ea7ba8756f166f17cdefbe3a066700e22fbfedaf2912359f2a1ae0d2638e9a1b8b70cb0dd28130695ca6e1346f1c838bb
-
Filesize
359B
MD5b8a00340d7507b46c8a0b530ebed366f
SHA13093dbd9429adbe00b6ade7c9a5c850434736a23
SHA256e32a59f9770870e4de1e4fc4891ea4b1c9067c4cff9d05a327e69ad34d502a18
SHA512c77462437915cdbbf34183709196b24d2b748b8ad513c839cbe3d50860b8df6cd61a10a0263ea998e5f0485ce2236d8055876d1f85ba57a8b29faa481a087b52