8634e9241729f16a8c2c23d5c184384815b97026e3d1a2d6dd0ddc825b142aba

Analysis

max time kernel
232s
max time network
233s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 23:08 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rover.exe
Size

5.1MB
MD5

63d052b547c66ac7678685d9f3308884
SHA1

a6e42e6a86e3ff9fec137c52b1086ee140a7b242
SHA256

8634e9241729f16a8c2c23d5c184384815b97026e3d1a2d6dd0ddc825b142aba
SHA512

565b9243ec14dc1cf6f6ddf4a7158e208937f553367e55cd59f62f1834fcfb7d9fb387b0636dc07520f590dcd55eb5f60f34ea2279dc736f134db7b19e3aa642
SSDEEP

98304:Oapmon4QzApS9hNQdrhEYzOi85kXNjMcDPWDnkE3DJ910Fx5mwAbguuwS09Fo:OQhn5EQ9hNQAYzA5k6cTWDn7JKObS09u

Score

10^/10

discovery evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\rover\\rover.exe"	Rover.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe

.NET Reactor proctector 35 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2996-1-0x00000000060F0000-0x0000000006640000-memory.dmp	net_reactor
behavioral1/memory/2996-5-0x0000000005B90000-0x00000000060DE000-memory.dmp	net_reactor
behavioral1/memory/2996-7-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-13-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-10-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-20-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-18-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-22-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-24-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-16-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-15-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-8-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-30-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-34-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-36-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-38-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-32-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-28-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-26-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-52-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-48-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-60-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-64-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-70-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-66-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-68-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-58-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-56-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-54-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-42-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-62-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-40-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-50-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-46-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor
behavioral1/memory/2996-44-0x0000000005B90000-0x00000000060D9000-memory.dmp	net_reactor

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Rover.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\rover\_9Idle\_9Idle.017.png	Rover.exe
File created	C:\Program Files (x86)\rover\Come\Come.002.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.011.png	Rover.exe
File created	C:\Program Files (x86)\rover\Lick\Lick.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\RU_other.txt	Rover.exe
File created	C:\Program Files (x86)\rover\Exit\Exit.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.008.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.023.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_2Idle\_2Idle.003.png	Rover.exe
File created	C:\Program Files (x86)\rover\Tired\Tired.009.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Sniff.wav	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.072.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Reading\Reading.013.png	Rover.exe
File created	C:\Program Files (x86)\rover\_6Idle\_6Idle.003.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Tired\Tired.009.png	Rover.exe
File created	C:\Program Files (x86)\rover\_5Idle\_5Idle.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_9Idle\_9Idle.014.png	Rover.exe
File created	C:\Program Files (x86)\rover\0001.wav	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.045.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\GetAttention\GetAttention.008.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.057.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.013.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_9Idle\_9Idle.022.png	Rover.exe
File created	C:\Program Files (x86)\rover\Ashamed\Ashamed.011.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.053.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_3Idle\_3Idle.001.png	Rover.exe
File created	C:\Program Files (x86)\rover\_3Idle\_3Idle.012.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Speak\Speak.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.059.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Haf\Haf.007.png	Rover.exe
File created	C:\Program Files (x86)\rover\Lick\Lick.012.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Whine.wav	Rover.exe
File created	C:\Program Files (x86)\rover\RU_facts.txt	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Come\Come.003.png	Rover.exe
File created	C:\Program Files (x86)\rover\_7Idle\_7Idle.012.png	Rover.exe
File created	C:\Program Files (x86)\rover\_3Idle\_3Idle.007.png	Rover.exe
File created	C:\Program Files (x86)\rover\_9Idle\_9Idle.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_10Idle\_10Idle.018.png	Rover.exe
File created	C:\Program Files (x86)\rover\Reading\Reading.011.png	Rover.exe
File created	C:\Program Files (x86)\rover\Haf\Haf.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_2Idle\_2Idle.014.png	Rover.exe
File created	C:\Program Files (x86)\rover\_8Idle\_8Idle.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_9Idle\_9Idle.005.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.029.png	Rover.exe
File created	C:\Program Files (x86)\rover\Reading\Reading.009.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Sleep\Sleep.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Speak\Speak.015.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\GetAttention\GetAttention.005.png	Rover.exe
File created	C:\Program Files (x86)\rover\_3Idle\_3Idle.017.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_7Idle\_7Idle.013.png	Rover.exe
File created	C:\Program Files (x86)\rover\_7Idle\_7Idle.021.png	Rover.exe
File created	C:\Program Files (x86)\rover\_9Idle\_9Idle.030.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_5Idle\_5Idle.012.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_6Idle\_6Idle.001.png	Rover.exe
File created	C:\Program Files (x86)\rover\Slap\Slap.004.png	Rover.exe
File created	C:\Program Files (x86)\rover\_2Idle\_2Idle.008.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_7Idle\_7Idle.017.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.052.png	Rover.exe
File created	C:\Program Files (x86)\rover\_9Idle\_9Idle.013.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.024.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.008.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.012.png	Rover.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rover.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133766179494363165"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5088	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2544	chrome.exe
2544	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1708	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	Rover.exe
Token: 33	4340	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4340	AUDIODG.EXE
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2996	Rover.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
1708	OpenWith.exe
2996	Rover.exe
2996	Rover.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 5088	1708	OpenWith.exe	101
PID 1708 wrote to memory of 5088	1708	OpenWith.exe	101
PID 2544 wrote to memory of 1548	2544	chrome.exe	111
PID 2544 wrote to memory of 1548	2544	chrome.exe	111
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 3612	2544	chrome.exe	112
PID 2544 wrote to memory of 5044	2544	chrome.exe	113
PID 2544 wrote to memory of 5044	2544	chrome.exe	113
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114
PID 2544 wrote to memory of 884	2544	chrome.exe	114

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "1"	Rover.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe

C:\Users\Admin\AppData\Local\Temp\Rover.exe
"C:\Users\Admin\AppData\Local\Temp\Rover.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\MergeFind.sys
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5088

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x308
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\c40b63f2a0f34438a3a196fb1e69849b /t 1168 /p 2996
1⤵
PID:3936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff29cdcc40,0x7fff29cdcc4c,0x7fff29cdcc58
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1876,i,100459406551591694,10350818211871328211,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2032,i,100459406551591694,10350818211871328211,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2024 /prefetch:3
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2308,i,100459406551591694,10350818211871328211,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,100459406551591694,10350818211871328211,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3324,i,100459406551591694,10350818211871328211,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4480,i,100459406551591694,10350818211871328211,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4676,i,100459406551591694,10350818211871328211,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4964,i,100459406551591694,10350818211871328211,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:2928

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4676

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

96.136.73.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

96.136.73.23.in-addr.arpa

IN PTR

Response

96.136.73.23.in-addr.arpa

IN PTR

a23-73-136-96deploystaticakamaitechnologiescom
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

209.205.72.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

209.205.72.20.in-addr.arpa

IN PTR

Response
DNS

136.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

136.32.126.40.in-addr.arpa

IN PTR

Response
DNS

200.163.202.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.163.202.172.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

18.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.134.221.88.in-addr.arpa

IN PTR

Response

18.134.221.88.in-addr.arpa

IN PTR

a88-221-134-18deploystaticakamaitechnologiescom
DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

1.173.189.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.173.189.20.in-addr.arpa

IN PTR

Response
DNS

google.com

Rover.exe

Remote address:

8.8.8.8:53

Request

google.com

IN A

Response

google.com

IN A

142.250.187.238
GET

https://google.com/

Rover.exe

Remote address:

142.250.187.238:443

Request

GET / HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: https://www.google.com/sorry/index?continue=https://google.com/&q=EgS117BTGMjZ-bkGIjBHIRZcStVnz3rU0tjLNPTkRaPd_yr5EVoV0DIR9RE2_RFI-ABYYr7agC0QdT9TQ4kyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
x-hallmonitor-challenge: CgwIydn5uQYQz_WTigESBLXXsFM
Content-Type: text/html; charset=UTF-8
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-ngWHCOa9iP5SRoa9ZjAiVQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Date: Wed, 20 Nov 2024 23:12:09 GMT
Server: gws
Content-Length: 394
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AZ6Zc-U_kB6xa1QkAkoCQ00_ncSCD92r5E8HSLuEfvYGwIDvVsjp0H_JM2Y; expires=Mon, 19-May-2025 23:12:09 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Set-Cookie: __Secure-ENID=24.SE=awXH8SahXSzq3rakAMz-ffjdhi8yGdBrDAdXVilgaW7s4XlmPEsLzyq-FZUgdyradUr6FzcUXWZNm2g-UHdLfANLtjpUDFj4dlcQiianJU0YQCgmVsbGP1L4_zOa3re2VQkj0cNfEVknWbU_gecEa_oII9Q3N16C0T_GgexNIhHSBeK06zVQb9Sg-kZ7Aa1aVCsYGjE; expires=Sun, 21-Dec-2025 15:30:26 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

238.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

238.187.250.142.in-addr.arpa

IN PTR

Response

238.187.250.142.in-addr.arpa

IN PTR

lhr25s34-in-f141e100net
DNS

c.pki.goog

Rover.exe

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A

Response

c.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.200.3
GET

http://c.pki.goog/r/r1.crl

Rover.exe

Remote address:

142.250.200.3:80

Request

GET /r/r1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 854
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Wed, 20 Nov 2024 23:00:40 GMT
Expires: Wed, 20 Nov 2024 23:50:40 GMT
Cache-Control: public, max-age=3000
Age: 688
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
DNS

o.pki.goog

Rover.exe

Remote address:

8.8.8.8:53

Request

o.pki.goog

IN A

Response

o.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.200.3
GET

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3D

Rover.exe

Remote address:

142.250.200.3:80

Request

GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Wed, 20 Nov 2024 22:56:16 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 952
GET

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCdnAM1WJ6jQhB6sJGT2Dti

Rover.exe

Remote address:

142.250.200.3:80

Request

GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCdnAM1WJ6jQhB6sJGT2Dti HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Wed, 20 Nov 2024 22:23:53 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 2896
GET

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDEGAgOcBEqfBC%2B1yioLDZa

Rover.exe

Remote address:

142.250.200.3:80

Request

GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDEGAgOcBEqfBC%2B1yioLDZa HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Wed, 20 Nov 2024 22:26:41 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 2728
DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

172.217.16.228
GET

https://www.google.com/sorry/index?continue=https://google.com/&q=EgS117BTGMjZ-bkGIjBHIRZcStVnz3rU0tjLNPTkRaPd_yr5EVoV0DIR9RE2_RFI-ABYYr7agC0QdT9TQ4kyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

Rover.exe

Remote address:

172.217.16.228:443

Request

GET /sorry/index?continue=https://google.com/&q=EgS117BTGMjZ-bkGIjBHIRZcStVnz3rU0tjLNPTkRaPd_yr5EVoV0DIR9RE2_RFI-ABYYr7agC0QdT9TQ4kyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Connection: Keep-Alive
Host: www.google.com
Cookie: AEC=AZ6Zc-U_kB6xa1QkAkoCQ00_ncSCD92r5E8HSLuEfvYGwIDvVsjp0H_JM2Y; __Secure-ENID=24.SE=awXH8SahXSzq3rakAMz-ffjdhi8yGdBrDAdXVilgaW7s4XlmPEsLzyq-FZUgdyradUr6FzcUXWZNm2g-UHdLfANLtjpUDFj4dlcQiianJU0YQCgmVsbGP1L4_zOa3re2VQkj0cNfEVknWbU_gecEa_oII9Q3N16C0T_GgexNIhHSBeK06zVQb9Sg-kZ7Aa1aVCsYGjE

Response

HTTP/1.1 429 Too Many Requests

Date: Wed, 20 Nov 2024 23:12:09 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3066
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.google.com/recaptcha/api.js

Rover.exe

Remote address:

172.217.16.228:443

Request

GET /recaptcha/api.js HTTP/1.1
Accept: */*
Referer: https://www.google.com/sorry/index?continue=https://google.com/&q=EgS117BTGMjZ-bkGIjBHIRZcStVnz3rU0tjLNPTkRaPd_yr5EVoV0DIR9RE2_RFI-ABYYr7agC0QdT9TQ4kyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: www.google.com
Connection: Keep-Alive
Cookie: AEC=AZ6Zc-U_kB6xa1QkAkoCQ00_ncSCD92r5E8HSLuEfvYGwIDvVsjp0H_JM2Y; __Secure-ENID=24.SE=awXH8SahXSzq3rakAMz-ffjdhi8yGdBrDAdXVilgaW7s4XlmPEsLzyq-FZUgdyradUr6FzcUXWZNm2g-UHdLfANLtjpUDFj4dlcQiianJU0YQCgmVsbGP1L4_zOa3re2VQkj0cNfEVknWbU_gecEa_oII9Q3N16C0T_GgexNIhHSBeK06zVQb9Sg-kZ7Aa1aVCsYGjE

Response

HTTP/1.1 200 OK

Content-Type: text/javascript; charset=utf-8
Expires: Wed, 20 Nov 2024 23:12:09 GMT
Date: Wed, 20 Nov 2024 23:12:09 GMT
Cache-Control: private, max-age=300
Cross-Origin-Resource-Policy: cross-origin
Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
Content-Encoding: gzip
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
DNS

3.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.200.250.142.in-addr.arpa

IN PTR

Response

3.200.250.142.in-addr.arpa

IN PTR

lhr48s29-in-f31e100net
DNS

228.16.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.16.217.172.in-addr.arpa

IN PTR

Response

228.16.217.172.in-addr.arpa

IN PTR

mad08s04-in-f41e100net

228.16.217.172.in-addr.arpa

IN PTR

lhr48s28-in-f4�H
DNS

3.178.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.178.250.142.in-addr.arpa

IN PTR

Response

3.178.250.142.in-addr.arpa

IN PTR

lhr48s27-in-f31e100net
DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

172.217.16.228
GET

https://www.google.com/async/ddljson?async=ntp:2

chrome.exe

Remote address:

172.217.16.228:443

Request

GET /async/ddljson?async=ntp:2 HTTP/2.0
host: www.google.com
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 429

date: Wed, 20 Nov 2024 23:12:28 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-store, no-cache, must-revalidate
content-type: text/html
server: HTTP server (unknown)
content-length: 3135
content-type: text/html
content-length: 3135
GET

https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

chrome.exe

Remote address:

172.217.16.228:443

Request

GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2.0
host: www.google.com
x-client-data: CNeCywE=
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
GET

https://www.google.com/async/newtab_promos

chrome.exe

Remote address:

172.217.16.228:443

Request

GET /async/newtab_promos HTTP/2.0
host: www.google.com
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
GET

https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS117BTGNzZ-bkGIjCpwn5fxBX7G5wBi6dIe3aQg5F9wI9TFH88lscQXU-pCFnFlLIGNjcElXqNY80MfBsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

chrome.exe

Remote address:

172.217.16.228:443

Request

GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS117BTGNzZ-bkGIjCpwn5fxBX7G5wBi6dIe3aQg5F9wI9TFH88lscQXU-pCFnFlLIGNjcElXqNY80MfBsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/2.0
host: www.google.com
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
DNS

35.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

35.200.250.142.in-addr.arpa

IN PTR

Response

35.200.250.142.in-addr.arpa

IN PTR

lhr48s30-in-f31e100net
DNS

234.16.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

234.16.217.172.in-addr.arpa

IN PTR

Response

234.16.217.172.in-addr.arpa

IN PTR

mad08s04-in-f101e100net

234.16.217.172.in-addr.arpa

IN PTR

lhr48s28-in-f10�I
DNS

clients2.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

clients2.google.com

IN A

Response

clients2.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

142.250.178.14
GET

https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=123.0.6312.123&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D1.82.1%26installsource%3Dnotfromwebstore%26installedby%3Dexternal%26uc%26ping%3Dr%253D44%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D1.0.0.6%26installsource%3Dnotfromwebstore%26installedby%3Dother%26uc%26ping%3Dr%253D44%2526e%253D1

chrome.exe

Remote address:

142.250.178.14:443

Request

GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=123.0.6312.123&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D1.82.1%26installsource%3Dnotfromwebstore%26installedby%3Dexternal%26uc%26ping%3Dr%253D44%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D1.0.0.6%26installsource%3Dnotfromwebstore%26installedby%3Dother%26uc%26ping%3Dr%253D44%2526e%253D1 HTTP/2.0
host: clients2.google.com
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: __Secure-ENID=22.SE=Zz2B-XCvBbPb98W45L4MW2p1nMtMXIQH6psFcfyMaI3bcXAY2q6dLqzzV89Gn2XqMtNb_Q1no13blc1DiGUWibO7FUU-WP5DsJGnWdeRRGEkseQVHoLpy7uCxbVVUt4LMpj9fMVecYi98PItHoJkMEpTHcdnlagSHKS7eeZOERQhEW9kA8ZRaVp2GzRWs3OLloo

142.250.187.238:443

https://google.com/

tls, http

Rover.exe

1.2kB
9.0kB
14
11

HTTP Request

GET https://google.com/

HTTP Response

302
142.250.200.3:80

http://c.pki.goog/r/r1.crl

http

Rover.exe

349 B
1.7kB
5
4

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

200
142.250.200.3:80

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDEGAgOcBEqfBC%2B1yioLDZa

http

Rover.exe

1.1kB
2.3kB
9
5

HTTP Request

GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3D

HTTP Response

200

HTTP Request

GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCdnAM1WJ6jQhB6sJGT2Dti

HTTP Response

200

HTTP Request

GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDEGAgOcBEqfBC%2B1yioLDZa

HTTP Response

200
172.217.16.228:443

https://www.google.com/recaptcha/api.js

tls, http

Rover.exe

2.7kB
9.8kB
17
14

HTTP Request

GET https://www.google.com/sorry/index?continue=https://google.com/&q=EgS117BTGMjZ-bkGIjBHIRZcStVnz3rU0tjLNPTkRaPd_yr5EVoV0DIR9RE2_RFI-ABYYr7agC0QdT9TQ4kyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

HTTP Response

429

HTTP Request

GET https://www.google.com/recaptcha/api.js

HTTP Response

200
172.217.16.228:443

https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS117BTGNzZ-bkGIjCpwn5fxBX7G5wBi6dIe3aQg5F9wI9TFH88lscQXU-pCFnFlLIGNjcElXqNY80MfBsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

tls, http2

chrome.exe

2.4kB
13.2kB
19
23

HTTP Request

GET https://www.google.com/async/ddljson?async=ntp:2

HTTP Request

GET https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

HTTP Request

GET https://www.google.com/async/newtab_promos

HTTP Request

GET https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS117BTGNzZ-bkGIjCpwn5fxBX7G5wBi6dIe3aQg5F9wI9TFH88lscQXU-pCFnFlLIGNjcElXqNY80MfBsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

HTTP Response

429
172.217.16.228:443

www.google.com

tls

chrome.exe

1.0kB
4.6kB
9
7
172.217.16.228:443

www.google.com

tls

chrome.exe

948 B
4.6kB
9
7
142.250.178.14:443

https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=123.0.6312.123&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D1.82.1%26installsource%3Dnotfromwebstore%26installedby%3Dexternal%26uc%26ping%3Dr%253D44%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D1.0.0.6%26installsource%3Dnotfromwebstore%26installedby%3Dother%26uc%26ping%3Dr%253D44%2526e%253D1

tls, http2

chrome.exe

2.0kB
9.2kB
12
14

HTTP Request

GET https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=123.0.6312.123&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D1.82.1%26installsource%3Dnotfromwebstore%26installedby%3Dexternal%26uc%26ping%3Dr%253D44%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D1.0.0.6%26installsource%3Dnotfromwebstore%26installedby%3Dother%26uc%26ping%3Dr%253D44%2526e%253D1

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

96.136.73.23.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

96.136.73.23.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

209.205.72.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

209.205.72.20.in-addr.arpa
8.8.8.8:53

136.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

136.32.126.40.in-addr.arpa
8.8.8.8:53

200.163.202.172.in-addr.arpa

dns

74 B
160 B
1
1

DNS Request

200.163.202.172.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

18.134.221.88.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

18.134.221.88.in-addr.arpa
8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

1.173.189.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

1.173.189.20.in-addr.arpa
8.8.8.8:53

google.com

dns

Rover.exe

56 B
72 B
1
1

DNS Request

google.com

DNS Response

142.250.187.238
8.8.8.8:53

238.187.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

238.187.250.142.in-addr.arpa
8.8.8.8:53

c.pki.goog

dns

Rover.exe

56 B
107 B
1
1

DNS Request

c.pki.goog

DNS Response

142.250.200.3
8.8.8.8:53

o.pki.goog

dns

Rover.exe

56 B
107 B
1
1

DNS Request

o.pki.goog

DNS Response

142.250.200.3
8.8.8.8:53

www.google.com

dns

chrome.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

172.217.16.228
8.8.8.8:53

3.200.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

3.200.250.142.in-addr.arpa
8.8.8.8:53

228.16.217.172.in-addr.arpa

dns

73 B
140 B
1
1

DNS Request

228.16.217.172.in-addr.arpa
8.8.8.8:53

3.178.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

3.178.250.142.in-addr.arpa
8.8.8.8:53

www.google.com

dns

chrome.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

172.217.16.228
172.217.16.228:443

www.google.com

https

chrome.exe

4.1kB
14.2kB
16
18
8.8.8.8:53

35.200.250.142.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

35.200.250.142.in-addr.arpa
8.8.8.8:53

234.16.217.172.in-addr.arpa

dns

73 B
142 B
1
1

DNS Request

234.16.217.172.in-addr.arpa
8.8.8.8:53

clients2.google.com

dns

chrome.exe

65 B
105 B
1
1

DNS Request

clients2.google.com

DNS Response

142.250.178.14
224.0.0.251:5353

chrome.exe

68 B
1
8.8.8.8:53

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\rover\Come\Come.001.png

Filesize
2KB

MD5
8d0dfb878717f45062204acbf1a1f54c

SHA1
1175501fc0448ad267b31a10792b2469574e6c4a

SHA256
8cf6a20422a0f72bcb0556b3669207798d8f50ceec6b301b8f0f1278b8f481f9

SHA512
e4f661ba8948471ffc9e14c18c6779dba3bd9dcc527d646d503c7d4bdff448b506a7746154380870262902f878275a8925bf6aa12a0b8c6eb8517f3a72405558

Download Submit
C:\Program Files (x86)\rover\Come\Come.002.png

Filesize
2KB

MD5
da104c1bbf61b5a31d566011f85ab03e

SHA1
a05583d0f814685c4bb8bf16fd02449848efddc4

SHA256
6b47ad7fe648620ea15b9c07e62880af48a504b83e8031b2521c25e508aa0ef1

SHA512
a8e27abefb0f5bfffe15a19fd882b2e112687abe6ac4bbd5187036cb6058b0124d6ce76fc9227970c8fe2f5768aa0d1faa3319d33b1f42413e8bdfe2ce15296d

Download Submit
C:\Program Files (x86)\rover\Come\Come.004.png

Filesize
2KB

MD5
f57ff98d974bc6b6d0df56263af5ca0d

SHA1
2786eb87cbe958495a0113f16f8c699935c74ef9

SHA256
9508d82995364556a882c54306210e885868a8df2f2ad93485c14f88c9f9e1b7

SHA512
1d4ca268d1c98ac545008b079076609e18bfdf22cd31b7b75b9218d03c6edb37b245298ff717e48309ca862f973a4383b101e43732a162b4d7f78573612c64ea

Download Submit
C:\Program Files (x86)\rover\Come\Come.005.png

Filesize
2KB

MD5
7fb2e99c5a3f7a30ba91cb156ccc19b7

SHA1
4b70de8bb59dca60fc006d90ae6d8c839eff7e6e

SHA256
40436d5ab3589d33dae09b470ccacd369422d2569804cf1532e5946fc7e45535

SHA512
c0d83325928d629abba648360c8687091d18d52991297d69625ccd4617d4d5add4aa16c288cc408b26c79cd37decf5ee2198e8b87b67ef5b88802afae93fb51a

Download Submit
C:\Program Files (x86)\rover\Come\Come.006.png

Filesize
3KB

MD5
a49c8996d20dfb273d03d2d37babd574

SHA1
96a93fd5aa1d5438217f17bffbc26e668d28feaf

SHA256
f4c568336894b3140f0ca7005a5751ad5a860422290b2b6e23d72656160862b1

SHA512
9abb666891fa00ae77801fe9b3aab62bca37402197d22983e98d8442e6d890b1091a47dc1eca1ac68caa52a633bb60c8c3248de65056a6435f4affb98f401a30

Download Submit
C:\Program Files (x86)\rover\Come\Come.007.png

Filesize
3KB

MD5
e65884abe6126db5839d7677be462aba

SHA1
4f7057385928422dc8ec90c2fc3488201a0287a8

SHA256
8956643da83aa74bc89b4d71db7b470200863de230be647a6881d8f3f60df3ac

SHA512
7285b8acca0210a85dd4317a7beab161708544c4c25a742ce7284b545fa4953be89eb685e62f30fba56d6cb2fc806062ccdf4a0e62516eea047097c6856900c2

Download Submit
C:\Program Files (x86)\rover\Come\Come.008.png

Filesize
3KB

MD5
f355305ada3929ac1294e6c38048b133

SHA1
a488065c32b92d9899b3125fb504d8a00d054e0e

SHA256
37de9b0126ffa3967455083dd72ba70501b1e4c92ae25eb0667f840911585775

SHA512
6082003d98022597007623ff7cdece9d9a14ad19bf55ac35afb2277fe22378c865899a5b28b4b5828d0d48fb7859fea82886d98d8d3a3813413f1e864e3849b2

Download Submit
C:\Program Files (x86)\rover\Come\Come.009.png

Filesize
3KB

MD5
1d812d808b4fd7ca678ea93e2b059e17

SHA1
c02b194f69cead015d47c0bad243a4441ec6d2cd

SHA256
e4e2fe6652557dec0e703da7325808cab4722961398dc9bf9fdae36c1de8841d

SHA512
a8781c78d7d23f70f7450e749732d2909447cfa194d8e49a899c77f808e735878da8d838eecb4e8db7470d040800ae45f977d5f208bfad6c15d62d6456611e84

Download Submit
C:\Program Files (x86)\rover\Come\Come.010.png

Filesize
3KB

MD5
e0436699f1df69af9e24efb9092d60a9

SHA1
d2c6eed1355a8428c5447fa2ecdd6a3067d6743e

SHA256
eeae94fa4ddca88b0fefec2e449064ea1c6d4c8772762bb900dc7752b68706e4

SHA512
d6b4adf98c9deb784be1f775a138a7252b558b9d9443a8a3d1435043196738b1ea32439cd09c507d0e2a074a5ba2973e7ffce6c41b26e17460b7695428666cbf

Download Submit
C:\Program Files (x86)\rover\Come\Come.011.png

Filesize
3KB

MD5
f45528dfb8759e78c4e933367c2e4ea8

SHA1
836962ef96ed4597dbc6daa38042c2438305693a

SHA256
31d92998e8e9de48700039027a935b5de3242afd4938e6b10509dc87d84eb758

SHA512
16561ca527e2081519decbc0fb04b9955b398eb97db7a3d442500b6aefcb4e620bebd87d7c8ddad2cf940035710fc5a000b59d7ed5d0aa06f3af87e9eebcb523

Download Submit
C:\Program Files (x86)\rover\Come\Come.012.png

Filesize
3KB

MD5
195bb4fe6012b2d9e5f695269970fce5

SHA1
a62ef137a9bc770e22de60a8f68b6cc9f36e343b

SHA256
afa59cb80b91e29360a95746979be494bdee659d9b8bfad65782b474273d5e62

SHA512
8fbe3ca2950261d976b80efd6a8d36d4a47b445a3e4669e100ce8c5d2a1f692e7b40ab324494a6de7847861d99194e13344a84aa135e458924b95fadf3905fd4

Download Submit
C:\Program Files (x86)\rover\Come\Come.013.png

Filesize
3KB

MD5
3c0ef957c7c8d205fca5dae28b9c7b10

SHA1
4b5927bf1cf8887956152665143f4589d0875d58

SHA256
3e6a44a4e993d70a2f8409b4194fa15551d5f7a3651a5d1e74d3c6b640da08c7

SHA512
bf2a5dd182c7cce4f6d00a4a1738f3a777b61c612c2449716b0fa62c62570ca1c21ac0063c221923e5db3b4101a4e7e32e711c9bfa075a2949ea9fa2e51ca704

Download Submit
C:\Program Files (x86)\rover\Come\Come.014.png

Filesize
3KB

MD5
2445d5c72c6344c48065349fa4e1218c

SHA1
89df27d1b534eb47fae941773d8fce0e0ee1d036

SHA256
694d6774638b36148f7a1b14809a025a16895ad4ec8645a6db2fe9cd5f784dbb

SHA512
d8134a66845c71d633f56e5fd656d545f09dad82d18ec21a7415f825cb6c0634ed775008c6fdea83dfec95ce659144e6de806edac620f389fcc3064683c3a7b3

Download Submit
C:\Program Files (x86)\rover\Come\Come.015.png

Filesize
3KB

MD5
678d78316b7862a9102b9245b3f4a492

SHA1
b272d1d005e06192de047a652d16efa845c7668c

SHA256
26fab597e882c877562abea6b13557c60d3ed07fd359314cdc3a558f8224266b

SHA512
cb6154e67ea75612dddd426e448f78c87946b123ff7b81f3fc83444adac4692bb5f3a04038291d9df7e102a301e41541a10e709e8adfde376016d86de15087db

Download Submit
C:\Program Files (x86)\rover\Come\Come.016.png

Filesize
3KB

MD5
aa4c8764a4b2a5c051e0d7009c1e7de3

SHA1
5e67091400cba112ac13e3689e871e5ce7a134fe

SHA256
1da7b39ec5f3cad19dc66f46fee90c22a5a023a541eca76325074bee5c5a7260

SHA512
eea254f7327639999f68f4f67308f4251d900adb725f62c71c198d83b62aa3215f2ce23bd679fddde6ac0c40a5c7b6b04800bc069f2940e21e173b830d5762e2

Download Submit
C:\Program Files (x86)\rover\Come\Come.017.png

Filesize
4KB

MD5
7c216e06c4cb8d9e499b21b1a05c3e4a

SHA1
d42dde78eb9548de2171978c525194f4fa2c413c

SHA256
0083bb52df2830f2fc0e03ffa861728916e3f1a6db3560e66adbca9716318ee3

SHA512
6ffbcc1c6ad1a0c01a35fdbf14918dfc9e2026a3021e3b6d761d56f4006b4218ffc2278eb2f820ae54722cd0c35fde40ca715154f6e2ae6c24aef0724d0ed004

Download Submit
C:\Program Files (x86)\rover\Come\Come.018.png

Filesize
4KB

MD5
e17061f9a7cb1006a02537a04178464d

SHA1
810b350f495f82587134cdf16f2bd5caebc36cf5

SHA256
9049038f58e048cc509bcc51434119465c376700ec45bedfd1d8f45440bdc32a

SHA512
d5b899109a16195d3fdb8f23382b48bab70dfcd0c823a03a0cdc4e50501812fc644b938839c3346e8aabc2925ce3bdebffad07ef2f90d291663275ba3d225ab3

Download Submit
C:\Program Files (x86)\rover\Come\Come.019.png

Filesize
3KB

MD5
63dbf53411402e2a121c3822194a1347

SHA1
86a2e77e667267791054021c459c1607c9b8dbb6

SHA256
47b80b828244964005bd947b80958f3aa6372b843dc088e33fbbd35ab3f785c5

SHA512
4b4603d88bddcb86e4282dafd55d8f00b852464daab588a554db829af566d5aa6baa3d575c58b133276be22203c014de73c0c3e35bfbe53570c356ef47bb5a50

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.007.png

Filesize
4KB

MD5
be620aa30068983d6a301f8b877e13ed

SHA1
01c6721cac2ba7cb597aa8f61ec5966f7f3d1ea0

SHA256
427f1b23d14561f6d237379bc1be225b297520e3730ba9426a3b5a4f4c23db9b

SHA512
8cca7b42e1a19743b3637bdbee8c37b88bfdf720bdc958b3b20d12463023e364227778cfd81787812740002276efd1fba40f8555eb0668e04fb06bd272868b77

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.008.png

Filesize
3KB

MD5
25847136512b270eb7afffd7c2e09b15

SHA1
aa599c02e626ccbed6286d9e4fb5ca5fbe83d564

SHA256
c9c66d55efb08f037726664f670c0f3ee1c9a70984e82e98843b38f5ac7e0c5f

SHA512
2991a8743300d41f1a54c26f869ed85c4f7569eeecdc3293cd445bdf7eccdabf269e4971a3e014e4d76df70692e3b11cedcef0d65ec52790368d59b1eeb379ea

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.009.png

Filesize
4KB

MD5
b662b92de5650eb12bb6913bde8e2f80

SHA1
b409b1a1e71954e22b6767af0a6a7d7221a743f9

SHA256
40b3ce627ad895942b1a1646fb4ac3eeeb1f6e437358526a34545694e979cd45

SHA512
8c34d80a3f412156940fb92029affdaaaa2d6bdc969ae9158e71958dce3bbdf58433f53536e753410585931b0f2d3b5f59fb0b3604f1edb195f1ad6531e7992a

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.010.png

Filesize
4KB

MD5
862baaa8cf3bb2f9dd43c23d623e0ab8

SHA1
d4650c3ce03e01ecc49a85d70d80603e7981d7b9

SHA256
3e7a4ca0e822f85c6803e1c98c9b99638f087db32dc95b564bed2b66c0e456f0

SHA512
1f85ffeb22c0d36c6dc4aeb882fbe82344a6c05e0f551af7f81185b493c8acde38bb08e2fbdc8dd2051165c113e03f51cc48fe83e314c3b5e0c7f59db0d68add

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.011.png

Filesize
3KB

MD5
72c46212b763ac954acf4bf32d5cb439

SHA1
28e4822c0bd4f0904855a40302bf249697f879bf

SHA256
6ad8fcc20f45e70d685ad3ce3765b7448599908ec4be0b9b0aeaaf18556ec6fc

SHA512
b51bb5ea97073c5eeabe09f56c74382bf59d7b1f74892ae6c471e073f1d0b3194b1f2691e42a4c2fafde5a4a12168e0d17f1ddea304d220b7f86e9eda3d9ffa8

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.012.png

Filesize
3KB

MD5
ccfb7d94c55732978b1ed8e084fb78cd

SHA1
775004b9601093ce12077f0250840ffce3330e01

SHA256
275f133aeae7e82a9ade03e8aea093a004795acc7f195974f5a706d42f4dcd50

SHA512
62d23269eeafc07416e350361c296f2edca844ae7f05211817f431dd29cd91e3d8519ad9c6385fe17bea5364d261b0975fc76b0bb7ff423feedaaac4f0775362

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.013.png

Filesize
4KB

MD5
ac5b43906d0c5b3decbf1714340c32dd

SHA1
6733f920a045c9e6d8cee38518b8d3adda44667d

SHA256
a24bdcb8f4853f4e2ebb0960cc1d8f7abe0d437fe56371cbbcf4d80d45b25a9d

SHA512
0c14bc113d6f4b36c383047b751db7a1512734471d8309dd8d318a265a09a7ac77277a70aa808fc2cfea4bf3048019a03105159ea9ff554edca7889a9458434d

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.014.png

Filesize
4KB

MD5
ef52ca947a0aed7d8d9f896952c0f2a5

SHA1
431c63604359936dfe9349e4ea12e94620516526

SHA256
c9d929fd09cd760eff2b0cf5dce8a606b78cccd6f0dc62650214367ae82cb7a1

SHA512
96d6cc1838f8249461ceb4a431ed7a15ab06830bf3198a3c24f79186e595f437834f3d9a26f316b6fcf22b81c25ddd40d73ee1144cd5b356d9cee499073aa2d8

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.015.png

Filesize
4KB

MD5
d1e5d387f44135481c25dec0db1a4506

SHA1
04018fd29740f1b03cf636e810f1af66dcb1885b

SHA256
3adf6756d7263f68244d8b33b887205e0de6ebc62f74e7074a0cfbfce7e1bedc

SHA512
8527fbcf0beee898ebe7cca593243e2e56f3c918a5aac0c6cce81bbeeee220691f50574172252755c576f2e40768081da7667e3c70cec294579c2767081109fd

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.016.png

Filesize
4KB

MD5
435d5fc98c2dd7beab89abc40e189ce8

SHA1
ff4952d965bb4c6f6316e975eaca3100ad08ff9a

SHA256
35f3c263314a11dc9df9ccc2273cb0b9b91a263e0572ecfab0c03dacc56644a6

SHA512
5a266375c8509beac5b375167b1a42f8b371ec4978831bf921b4e3fa49497e55a2cf56b68cd859f8926cb7afbdd25ba608c1f41652c3c246b75dc9ca03a3be72

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.017.png

Filesize
3KB

MD5
a79665c04f79dc5a55c4d9597b69d0ec

SHA1
c32452ba7e9f251cec6c1a06a7c84bc1f62f2004

SHA256
7b375a9452a4bcf412b73b25939ce4843fe52d622bde8afcebc0a0869ace81f4

SHA512
f08165c6d1921f77179090c23c1d0d75dced6d528ba36f48d17d21863c487daacb2cbbdc9ff77fa29e6cb39663fe45b5e3fcc6eab0937d8bfe051daf4960cb53

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.018.png

Filesize
3KB

MD5
f418a22addc5536cd7c393b703321904

SHA1
0f8b6fcefd348a64174f930e2e6609619eb262fe

SHA256
8df8216e6d018b26c0adea3364d839ca7ea25de72951c3ee7978451e03befb27

SHA512
85bc106da6809023c992df2c7409d8fc272618909664c16cbe75a94320a500ef34d6c7e44220ea2ca3be6e12746afb87aaa1550d123f86ef9933eecb86f2bc97

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.019.png

Filesize
3KB

MD5
1f8286c65f313c168602024d8aec16b6

SHA1
59ed93824ff6657a82a5be0f006dfbb898fc7a5d

SHA256
f7acf4b77e418f08bc29c0dd64e60d657fd1e667bb8ebf3eadf7198a206b94df

SHA512
33e3bce912e9fb4cb970227713d0c9a87e7bd7aea13b22fdc0545108201860d9581b1c0abe4ec4389ea77f82f94b6aefa01d597ee1f48f3ad51b97b3e0236578

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.020.png

Filesize
2KB

MD5
307c9e2aa6960ff27affa569c168dab7

SHA1
6d2e0ab13f6c5ba7e0b96659c3815f3d6154a765

SHA256
b106b21918a95ece5daf714000d3290b58bcecee090520dfc4ee4a10a7713ad3

SHA512
5acf4f55a43fae34c1a1d5bf068844e3c4feaa7425854e1ffaf8eb3dfdb24c51611bf6e74fdb28ccebe39c9e272cdf8a58789cb5c945eee45798cca451c13d6d

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.021.png

Filesize
3KB

MD5
dd3ae05eb0435fd57ef7c3696f033435

SHA1
a58eaaddd0f94ee9adde5a632a8bb67742c12ecd

SHA256
0c52bce916be78ebac43395f22c29ae418ec7fb6d207585824ba7a0feb2c26a1

SHA512
2782b7e24752898792fcfe649acccb33fb64fe8873d78b8cbc77993f51b75b82e64febcaf498fcc810dcb76b33be5d50ee7e6c629a90e65452cd3c1a77d4c308

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.022.png

Filesize
3KB

MD5
78b72a23608f31bc83933b4ee3d27ad2

SHA1
c38ec5fe68167c21bb1a4c6cb665bf83d0829c76

SHA256
475bec3e27e34befd28a9329e66f77f591e505e62657a6e99e97f9f14514dccf

SHA512
27e4f508bb688183bddb478c222127531630eb9cb6498569a8fb127bca5d4fe0ce7537525e13c0f24fa0d2209e04b01e75712c45ead762602b2a9de883c9e064

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.023.png

Filesize
4KB

MD5
bd61c1c5919d6393055a8bf79425054c

SHA1
8579041d48f31a73d1e23388933a462f24c25173

SHA256
47521d14ffc6933409be36b12598f5596bedb0e0883f117d19e2e4ed3df6f70d

SHA512
1416eadf83704605565a6051fd4214878a31021ae15f025d40cfdcef40d453e0d77df4a77c954d6184529918c2da836223b2c91216f27d4302795631b1aaed46

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.024.png

Filesize
4KB

MD5
95887ae06eb9ec0d4444c5e18edbaae2

SHA1
3f259c52eb0f6ef14a967e10ca6d2c51b1fbc39d

SHA256
269273a2c3bde5ea70f5abc319e0f2ca091fd2e31b25c8e3c7bff91f259f74ce

SHA512
e81aa9b3b4e6cf576b8477620fcaf965c71ce2a17c37b933b926af0c66287d73b840aa4cd2b3d50bce2dffe78c61b112af7721c0ced3d81d23594287945a1e31

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.025.png

Filesize
3KB

MD5
1a6f1be2a9bd14176fe0a736ad660ab9

SHA1
91fbeeb90d7c49aa30237d19b68981679cfea052

SHA256
4b4c02ae6f6de585e979bb75b4433743e134ba56d3b967de35852bd8c4492c96

SHA512
04e5af9e93d00288e96740896e7f6fef08efc0298366254dbc272ec1290e9afb6d51df8fa2403b12330ae0d93a019d8543546d05df5a2f56bdcdd5008a89a2ce

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.026.png

Filesize
4KB

MD5
10c3e5b554f7e4e8e3506afd564296fc

SHA1
e0a6822d1f3f9a7b5a52453279a77fd0978ee86e

SHA256
a51de8d28e1ab2bc5b97b82d5bf567b19905cf8d5fbe701f5894a3012c4121e7

SHA512
26ffa3785d9e5988432003cb92969990e555b8c5375f0a815b6d0c6baabd805e5a2d527014fc02d99d6f088bd41701a4e002c268a4c64b135b9e6d9cdff1c4e6

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.027.png

Filesize
4KB

MD5
3ad406510fd809adcd3fe3b4c1ad8cc6

SHA1
af1f9d6416c6ce87dbc900364283f775c34c361b

SHA256
ded1b817326acbb4b35f3d0f7294d3956710c42f7fc09b1ff226f4342aeebe6b

SHA512
89d45d7dafe66f07227562cb5eecda7330c32ea4b71182122fc6c875ab12591e83d22fc4a5543a0b6dd420f04bd3ec92e319abb8ee2c0a9168c5672c8733082d

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.028.png

Filesize
4KB

MD5
9345e7c38b17183e22cf87e7848ca338

SHA1
f8a095ee838c9c08732d5e8508b06e8c9f6619f1

SHA256
cff6cdadb9291f85c8430f3e9d7caa4a4d5446e597319454ebbcf099bbb1d687

SHA512
dba42c857e469179d355465b82dbb4ef1e6aeca12f12506fca2f54fcd64c9b87ddf6f6f7311d5a20e953b14cc9cb4ec4c180060c445bf95b01487c1e3b89d17e

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.029.png

Filesize
3KB

MD5
4b668954943363bf4592077c8d658eb8

SHA1
227ae1f6a66f9dd44e9d4e094a11b6670cb93864

SHA256
992949fbac8692a831b535dae82e5fcfcc1a69e3fd354cdadc5e084336ef9b43

SHA512
7396ab15cb648055df298caee98217674c74c1cc4be16db40bed4a0621ed883eb0e9bba60ee09494d506914083dfae3f57c7a678ad46b8e609ccdb7beb69abea

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.030.png

Filesize
3KB

MD5
c8f7037f152271df7e454187ea9ab910

SHA1
bf9f1ed21eb55f63138d9e09448c3fbf6eee2e07

SHA256
307667e6bb9a558669a0d97fc94b94ead9dbd7de0630234eae0dd8974f804f9c

SHA512
42f2e434b8eb7c25b308589e0319ac63071d06f8c0f85340f65ac61eb8d7220fbabc3201147ba5445f86dbabfe4514d4df045fd9b7c747bd3b8344da5d49f5de

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.031.png

Filesize
3KB

MD5
c9a18cb30f2ee87da5a6b057f9eb1752

SHA1
6a5bca92b7085aa98e33aac742bab7ecdeb7cba7

SHA256
5e25d7d1636e502e7fbaf6cdbae79a07f843f4e3ae7d4c9f80f740448a55a824

SHA512
09b3e6c084b67b3f3d38fd32bc9b38508ca940d1dbd6328eb374b8e92e117f303ced4090921a5a206b9ae6ed13e8af019e25d298aaa61c82c111b35a2d9d2b5d

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.032.png

Filesize
3KB

MD5
388f16ed80d388ad5dcbd7d41fef6223

SHA1
95109782496ba1c6fbbb48cbd6d952926b2edad3

SHA256
6139352cf6695650b0b014ac69d76620927a57a88d6b87caed2a9f75f26c36ea

SHA512
24c0e17989ea9294899179ab7370761bc269ba032dc105c0509d133061f892bb17010fa425954a00ae9651ae48381f7bf49ed99e680ea80d7c2b7d87d2641abb

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.033.png

Filesize
4KB

MD5
57a378417f3f17b40a011c89007ae5b4

SHA1
b7683f0c59860b2f3008fd5351bd1ac9c8a92680

SHA256
9f3d55c559573c8b9caaff366ca37615ec37c5e647465819aca937514e3c0549

SHA512
b04c74d958c9ec253568240f41703e11662628a0bbb9cf619424c30b3f284c64823fcea5abb12a80f328ad58fca2b404d9d9c4f1eaa153dec131d27e6cc06765

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.034.png

Filesize
4KB

MD5
11dac077d9fc16a7ec98df4d5fc36498

SHA1
c853470ca361813932a6cd994f330c0fbce07a29

SHA256
a0ee973ef8fc7cab84013afba1d8b6d150de80b6eda2fdbda3e992df44c8e75a

SHA512
c2ab6c288c8a3fa0e283f8f31770d072e6f87d4f244f3653a056891df90ab5a23d85b113dab732c6616caa7646c9f1bb7a2ac66a07ae5b3b28a01d6c58a913fe

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.035.png

Filesize
4KB

MD5
7390bcaa22322b35171a9756363a5209

SHA1
980fb57a6465a498796b44554473255047750d2b

SHA256
407a2f61d7721f9d0a5ad68af40684c6d66601e683b10879a08fcc77c1e06aff

SHA512
3f7c2e6ace6c784d051db355a0f89a8cebf168621bfc053225e60ef1500bd2cc2382a1bd89cd72ea9af6ab0efaf418e775375ee9cdaa3d54e5f4cceb00d5e360

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.036.png

Filesize
4KB

MD5
cf091b18526160d38121a13a00daf23a

SHA1
270c77b34bd007ff7232008ddf0d546480ee7109

SHA256
1cf27d50e536eb1d7761a288147c0bddc2e3a8366138ea5aae89835cefb29176

SHA512
806b24ecad865e0c099f94c20bc00c752a2dce8df175c3d71c32879451a649ce9fb088d817b7506f883d3007958895f43cf42f2e1286294bd7ca38158b5e4891

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.037.png

Filesize
4KB

MD5
c781b39e267508b8c55918decbe6edc2

SHA1
a1b3309fa129f2bc1f85ef5a798fac9b70b8b8da

SHA256
a0a8ff5157430dd790e23e7a0d55d3b148f01c4dcbc9937a36802e2e2d0ad895

SHA512
c83676db0ed623c04541643e347803edaa1d832bb02938879fa27d8e69f0123eb746094dd91c7677c68967c8f6c6dc5418205aad85f50dac997271ad5d7efa9f

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.038.png

Filesize
4KB

MD5
793d66a8c196d0636e2bb78af873abaa

SHA1
c4da7dd57012dea9ebf805eed1ba6d10e3b60186

SHA256
4abbbae9f91c73ae9f75f2ef5409eef7b3279d6ef4e61622c447bd2a07b68d52

SHA512
8c3dc9d9930b5161751ab468eca4f106261d775f6db82acdadb9d97605c77340765425a8449b8d2a1f7938bb611c06ae345e19313ce3e6f97d3b613688d42a1b

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.039.png

Filesize
4KB

MD5
0371c7d71c88e33e92975e6fdb02fa37

SHA1
10030df864b6fae028718b497828072ca35a757f

SHA256
8aafc7196b0acd2638838a32be7dbab03409b8b15236269b850f6eb0da8e6b07

SHA512
e10f528b6bd600fa9d9b83b9c2684bdcfebffa4a9da17f99ccb774aba0fabd13889c95ab8638328b36088e20751ff1e6ffb35e6c27d89285c60373c695da687e

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.040.png

Filesize
4KB

MD5
01433b9800d5fa38bb306abf2c9c4f3f

SHA1
8472bc7b37210f55d803cd76d6a3d245c4066371

SHA256
0ab4dbebffa4f6f6a0826202384c7c9739b3dbded6f4a4e12a73324b580e041b

SHA512
1429f35903cf3bb978006304201ea1b6b7a0f5decfa2a5caf815272197001c55d035c67ef17aced1ba3a244f86e15aa05ddb5c97834af85023d44be6e4a1a392

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.041.png

Filesize
4KB

MD5
6d1255e4f71ace8b4c142aa9e52d7d19

SHA1
f530b793f25e4fb25a3189ef84440612e570c8c6

SHA256
602b32b93ee1bab8502aa79194c94c26dab3be92d41298c8a06749885cb93226

SHA512
c930ecc632cc84b8a484ec4ca609cbb2e078fba54e3337936cf154cf752e1738c910bca6900b6c43495efc6648c51a97fe5a0b5f39302d5c3aa1a7d767adfde0

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.042.png

Filesize
4KB

MD5
14cbb184b8247976e628c02af270a12e

SHA1
4905277c338f28abc53ce5c637dddbc507ae0f53

SHA256
8fea5b0356bec96ae05d549d79d870514e8a11f36a45a17ab8cc43608d4de709

SHA512
358c08a3ea572ff8367a63d588a0fd95323dd4f8fbe5965649c72dd0def00ed439967ca3bba436f8ae45f91e5bf3d1035d2c829e5b9440faed5a6483958a4b94

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.043.png

Filesize
4KB

MD5
e07a5c4ae63a28ebf458534374fcba5b

SHA1
cee375cccbdc4ba6c43b20733cfcb4b938d673e3

SHA256
e4e6c99dba17f95b94c285aff8f1e89abcecf73d1f7236e2c3ee64ccbdff8f11

SHA512
ea05d675ca914d2fec198cfd80edb95dc487988dfdbb58e3b51b5a3b27d15abe53052f00c675403a19ef41f448cbac2e7a53d95e6eef36e70bb03a4a3d1f6307

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.044.png

Filesize
4KB

MD5
a0093f0a665a1b9418fc9d7f07411c83

SHA1
266c44c1d152bd7943d6a73080fbe7ab17fd965b

SHA256
90647dd591ccb3c55aab2b5d5eeb26e8097deb08091cda9a2a325b3f13dfbb3c

SHA512
b8e3dc270abb79efdc993ee4c224e471a8b858f0eacd4fe30f8859f408e0d72d9b291c9f1a8cf68098a02abbce86b127c78f293d96e3ae772d305901ebc998ed

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.045.png

Filesize
3KB

MD5
1a31e3e4b51396b017f16bd1d3666165

SHA1
2e8e264557f4b34255e9b2c06bc1ab162d10d460

SHA256
8935c338ae47a33d7eabd27b2bfdf0bb94987e05507c1cc1787bcae6f5bbe720

SHA512
3f2c72b1702079600e4dbe07c1822275437d10ccea42a728fda95a0c819ce2ddfdb9bac417efed1d5812f42f6ccf80650648d6914bea1802fe9f49a987854c77

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.046.png

Filesize
3KB

MD5
cbc3bbf63b2c89c85fd8da607ce21743

SHA1
cc8fd3a6f4d613e84b2505df7a0c5a909aeb5493

SHA256
739215739871bf81916a1b9ec94cd8f4ef35e4efbef89ce7fdecdd5da8814296

SHA512
831582ed4d3bb04aec1768d1ee062503aad43d13a8771b7c6e333aa532d930a346244afe1182f514f5534389c883dbdea33f8199d9a37420065b4b54b29cdbf2

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.047.png

Filesize
3KB

MD5
741bd6176d358f2e03a1f9727901f052

SHA1
70817e1fafbdbca2228c953baa8377ac2d4864d4

SHA256
0d6855cc3e156e2a2db2cdf49d17d6d08333cdecf627b9dfe6089fc9204be3e7

SHA512
cb5ade02f0484e8b33d0b8b351ec74418080a0e37d97725ae01e0dfcc910477a9e112a68f51f1d25c227ceca717fe3da7f94d61b45ac0d594141feec9ee7c313

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.048.png

Filesize
4KB

MD5
0601a62c23efdaedc3201e9b27cf9ffd

SHA1
761727788cccd4c9f778140d808d63f1d3dcde38

SHA256
9a0aaf5e9c435711eac67f40001c404382dea6170cafcdbf6009111615c28081

SHA512
213e9e067111bd28bbb614b72a5a792a3e60586f3357d3d052807d9d9c6046394f551c5113b58e5ac1872004d02174f938e318955a5d5a2bf3d64edec85771a9

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.049.png

Filesize
4KB

MD5
6d80f228e04188716bf445a8cb86a1bb

SHA1
70cd4460904e2349584559232525d11b5645aa59

SHA256
938a7e923edae2e89de75f417ca19163e30ac725596dc02295dc2a135d4678a3

SHA512
39dc9e38d7304f771774874c0405447189565b00c7339709e69ca0bb8f92db8fd20f31a23199f4e8623a07ba16f93a836070d72da2ee125251107f30b17a3012

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.050.png

Filesize
4KB

MD5
3f1d28826aab1014c7e90905fc1656b2

SHA1
f99b4d52a1ae6e0d2f99b53155fd2e2d308ca946

SHA256
80721bc9b2610db0ecf2b550188153927e157ed57f1b462c6b235bcf7c994c1a

SHA512
a6b1814531a3cfccb398f412c27cf5351e2df0471c85f8ba11577f2b51535d79d97df8f498c82f507e4f8bc243ffcb0ee5ed9e91ecd4786ab2076cbf94143df8

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.051.png

Filesize
4KB

MD5
94fa35f6961bf7ae87ecd4e0709aaad4

SHA1
51dbdafd927bf7786a51a87621b2486291802617

SHA256
5796a05273c72ff76018f08d997bb080f2fffc0bc139b8f606534ad4fd49a98c

SHA512
b87bb14dce5034ba12ca90e594e9011828c64cc3c8b2524fc2ad1926546aca136860baa1edabe8ff1921f7620df312447706c1082614f119447b5f5a2497b2c0

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.052.png

Filesize
4KB

MD5
1f5bb0340ac9eb5d939acf9931c762ce

SHA1
170d0241294032cbda98d5dec9d96e13eb616ea2

SHA256
50689495ec0bb4ab1e1a1d42c6e707be91cc3cc0b9c2a689baeae43439f445ae

SHA512
d3c97f639b9f0eb208af6d0522ab3a8a21986b570f998945ad0403ee3bd17bef142bf6eefb314c7ee36e7fd73d882e2c4f251fdb3821ab199821dfe3e3e884ea

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.053.png

Filesize
3KB

MD5
fa4d9b78032c81d753318d3ff641ed2b

SHA1
3712e35841212b118e7dab4a4cd10b16a02470a6

SHA256
196ac2f65b4c272b1896eff29eaf6f25f1cbe3feb6cc7192e8d5d0b650c90c87

SHA512
5436589892dbd874b00739aaefc7e4dad9f2517ddfc7966e91b9692c98a627e389798fd512844814e9e525dfadb29f0fa74825bb24275444e604f63b9088f62a

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.054.png

Filesize
3KB

MD5
f7bae8dcbcf1adbe79453de90726c2b6

SHA1
fdd6c5c28dd458c83733042105cce22236e3986b

SHA256
04fd57b2feeb8eac4e2745f0b12973eadd7abbeed5075bec6b16d0fce9794e43

SHA512
635de30fbca2afa184023aa09e0b8d731e06208bb6e90bca4f1ea23a0a1d97bebdfadcfb33f2a97cace325c8e79727e60280642645e4e7abaf09397ccdec8213

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.055.png

Filesize
3KB

MD5
7fd261b26c51a40a06b1a80853950241

SHA1
2f989eee3e79e52f8f471112557ce54a9f26a48e

SHA256
16c784e9a16baa609e04a3ae336bf20c77815ade37e7c72658f0853f8c0c69a9

SHA512
927229a0eb9371ec06bb459b7771045d8d586ab3d31cec89bce519117c3b43b26f2c06e1fe30987be69774561948ee518fc6ff859cbc98356f2ae1b2985e027a

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.056.png

Filesize
3KB

MD5
c149e777fad160d88aaf2a7f07a3aa20

SHA1
12c5c4909d16f5dd7a6d224c3b110487af56221d

SHA256
84ba7a6b3ed60be094b20439c197d8dead3f66a36a94ce2867a2ea1c2c7bf9a5

SHA512
f16ddeb299194c9e8ad3e6582927435db41c025b69ea285ffdd95cb4598b1bd20c9a3051fe758105ce5567d9f1dda7739462678b1dd138fd5d9413bb07d65bb5

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.057.png

Filesize
4KB

MD5
8992c504e383f22b7aa0a6a339084e30

SHA1
363ec375b4bb747b30ce693996a315a095c55b26

SHA256
126a391accdd79633b6b3f1276ff43c732616c5e38394cbbbfd70bf2546b3899

SHA512
3e8087f8a88833a16ff5688bbd0d5ba65dc0e5cf923812833792720b59848de427dc2eebf5524a0f563ffb214617feb5e839dc7a4884db6b4e03701087f020bd

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.058.png

Filesize
4KB

MD5
649be036b3a67581355dd093e686e7a3

SHA1
8d7e076ff0e01c3fa17041770a2aa8ac3b2d15cf

SHA256
2b8c065807c408ac76ad0fcc6e057cbcfc9e02b2bcd81c7dfa7f8c82ed133c81

SHA512
c75259a0e3d50e66143dceb58064aa5e3233390ea69ab47b2cb6122f214c96c3537d8f69f7fae27ba30e315660949f38eea6d14c327b229166202ec3af0cee59

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.059.png

Filesize
4KB

MD5
35ed65621a1def88a4a2f28402a74ab1

SHA1
f2dbf765fd913a6fe56ff94ca2745e7e7c4d43ba

SHA256
956dbf693dccb7a5e336c6b0a6ceb3b6feb915ee0f4558a315e06f0a88c62fa4

SHA512
c3e6db17f09ac408336f0a79e9ff20b72a3a3bfbdafe999aef79c619114ccc1485d4568a9d26d2bf7e6227f855a5142cf2f2fba6cabf09c1ef6b253aea5b7947

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.060.png

Filesize
4KB

MD5
8553ca7a1d441809c54da2ee68ee3172

SHA1
f209679fcc5ec833f2e4c553b8064d5b01c3ee0e

SHA256
e0407f42755298680b520bc7c0fc86a39e7b5bcc24ed69bbe3c18801b30b6f82

SHA512
d19a95491e9dd6391d3471e0c87da09fd115fcd4af60e254491c20a19b42a49a239efe25bd1d685fb176ff5a52427d2e1d568fcaa8b64f5d6942a03d8906e132

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.061.png

Filesize
4KB

MD5
a882473ca56b26c50acaaabf8879b0b7

SHA1
c24b6d93fec91ab82d6403c54ddefb330a44d034

SHA256
18f3d6e5c64bc45e5bc2f2ef83c2dc16a72a2cccb5e92f15ce44b991e251007e

SHA512
4e42af701ab3c37c21d553ebf8eaee50715bd66d8dc08ebc83b9898e9c593ec1a138b16671211f8b096245c73fb96659838702ab02a64b294bcfb72e0c38fb32

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.062.png

Filesize
4KB

MD5
0c78aff0d4b864e64b9bb7071b50a1d7

SHA1
d59cbdff524365dc156d1760994fb42d7f6a57a1

SHA256
9261420d9586b58f67e47bbcc58e80aa96e7f9841eed3dcee6d3c1948a5f7bcc

SHA512
201f82f3b17edf824ba4e6c2e918f98aa007a332ad8cb44d8a33f59f4663439fe7425123c9e0ff4a2ffaf21ed13ee04e62c323b13a9da1e8b3ba699fc1dcf0d3

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.063.png

Filesize
3KB

MD5
7637c60dfa47847b74efc682dc4c77ca

SHA1
cfa3ed5014499b251ffa2d0e2455cefb354c13db

SHA256
3bcd94fd6d7def62f95ae8e918f79ef814e666877a4c4feb34a8bc9bdf12e00b

SHA512
1f3c973db9699508744b9b272d51a0fd27d5346fb278491efc064076026a5905bc1422fb7b8d2f4d093cddf7031c5e5e094dea83fdbffa9207cc4aeb6355c419

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.064.png

Filesize
3KB

MD5
00b632ac5bd1dae12aef474d09e4f8a1

SHA1
ff9783f8004af17392637c06e2c629a97d45ae13

SHA256
a484a3e5bc1164286f600773d2a66572291d394f92b44da0ba13217f7fcf884d

SHA512
b498723a0c2eea10463ab4527331ce9aa0238569f1c922d1dcc52b5a04fde6f8f285a642f5f42e2f9e06d4f37c91c4f8e3c42e97bffb0a29197cef94c6e31985

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.065.png

Filesize
3KB

MD5
a8f8251bbe3e2cfcc60f970c4a3ed2cc

SHA1
c9bd06f29e9a7a23431e87e3453608512a39e22a

SHA256
2e0369c7e609f621b6b40260d0bea53f901c1020ead7fe0dcde54c233323953e

SHA512
c4cf84bf866a09c7fadb45b312e05b6821bc7c54daa61f59b0df7b629dec5d1db5614fb038ab2a321facc93d2c9400f1875aa6cc96d47a26379fc5ddf3169210

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.066.png

Filesize
2KB

MD5
66e9e7589628c1fd7783f50acb471c45

SHA1
2ef8587f4a469e400946b4a99f3cd443dc94cb51

SHA256
251f0524e3bf13fa8619901c146d8a5d4fee009cffa23b9acdd0ac07512f8668

SHA512
031fa6bc5e0f682f0c35bf5f755ff2dddbcb958e832fdbfdfb66c06b284d41e3cb7480555e4f2466690f887d4f1b4daa05c8fd1a81aeff3f429c9eaa32425910

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.067.png

Filesize
2KB

MD5
6cf2444a103021d558e6dd935e49ebc1

SHA1
6b26a79525e1691dfdc05f6ee4cfdd3caccc67bc

SHA256
695ab72690b5ba5a52df51f2efc6ca093012ca2f23496158acc3a8c4b6a18c5a

SHA512
501f3cd47589d7ab6926daefae2b37382a3ad1f2cb73ca77c6f46f1e77afcc2fd1c72102446474f2402f5838ed2b491d10dfbb67ffa1179688c4da108b2a968c

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.068.png

Filesize
3KB

MD5
4c2cb6f9e74029bd309ec451740577c2

SHA1
d0f4688abf45c19f7219e45965ff29d53503f328

SHA256
dcec62d952ad120ad7a2367787f2b7c8a6625866bc954184f0f8745f5424c880

SHA512
a5ac9de839d51a57b7076ad1a34ad57e0152fef439e961e0ee67988c778139f1503dc68a26113a7aa6eeddad013af6201cbdb1855df3904cbe5e67f57a30e097

Download Submit
C:\Program Files (x86)\rover\Eat\Eat.069.png

Filesize
3KB

MD5
d6517114d14cef389f833bd82b3515c2

SHA1
a3ef4c4604f85da879fc0d84db4458611d9fe636

SHA256
abed8657f2685ce74f1bf2173d451768f74e6a99416d0dec7e014e27d2620973

SHA512
2829f278d34fb89878c2c72953b5d527d2050e98c503ca82d6cffcabd058a80a4dddd627a998d72e178c76c984595c0b292e3ef6d4bfb39f9295d8156f8303fc

Download Submit
C:\Program Files (x86)\rover\Haf.wav

Filesize
5KB

MD5
c7b2496e7a5f9fe3cb24c495ae528294

SHA1
090e8e12b484cb2e55fa545ec0c8bd0ceefec536

SHA256
d4f5ee6de515b0933d1f44be90119dd6fa426e7d3f09c17ef111b95abb7c8e77

SHA512
06b56e78e82c03453ae7a4ee0e6331573648deb3f7b8e695f131df5ec3760a7e5dda7a0aa4b861da3d1e13da2b04d48559477c708df84dd4724d7dfc9b415420

Download Submit
C:\Program Files (x86)\rover\Haf\Haf.001.png

Filesize
3KB

MD5
f7201296923fc4cb8afd42cbf61f87f4

SHA1
ddb1259579aef16362748b3d883996f13444a96a

SHA256
09f2b20037d0861ec7ba584775ce566cd768775394719ae21e71b7febbbcec73

SHA512
dd023410e3966f55cf271b1bf457a11887bf153828ef2d3852223e55bc1154d0944226406ef847339c8ec12869201c0e615c3d504e4fb228ee402109ad6ece20

Download Submit
C:\Program Files (x86)\rover\Haf\Haf.002.png

Filesize
4KB

MD5
8e7cfe5b887859653750c8c2a3ee3c2a

SHA1
fcfb03fc23a929734c75652f7e02d6a18ef02064

SHA256
d3d51bbee5c29e52bc25e754e0fdc2b0a5c5b2b57240a692002ac7c4d3efaedd

SHA512
a1042a7e66928011dd532e5bc1212ecf7540d0785e462ae1be1d1888777617033fec238b470483c90470a5626ce013de0148c83256fb9a608defc1664b750f2e

Download Submit
C:\Program Files (x86)\rover\Haf\Haf.003.png

Filesize
3KB

MD5
40ef38c995f93334b012d8f209a1f481

SHA1
c3a9ad41709952bf68be7bcebff2bee71e6e9a09

SHA256
4a1ad7cf9b1913d4176a5e4e76ad4bf5bb213c1c145eb02f6ad0338af0e62ff4

SHA512
a558c2e43627c9ad916cec39a092ad25f240f305566d14ed0241000b9df7e9433c3af197522e1219fd7eb021a72d14eacd73a1529afff39987f8d33e530b4e4d

Download Submit
C:\Program Files (x86)\rover\Haf\Haf.004.png

Filesize
3KB

MD5
41bfbf70a0331304cdafe8fd14665bf1

SHA1
0c87714f1448c553591b1635cff437f4b79a37d7

SHA256
180fc76d1faf1bd1297c1701cddf90783f5632d342ed6051996c60ec76b3d054

SHA512
e211758d4523088cb6fcccd0166f2599fb3ccfcaa08ff24754093dcf7b45d358dc60929f8e4d3b3722847fbd9e2b42fd1a04f8b8bcd4d29a20c7a0f552de748f

Download Submit
C:\Program Files (x86)\rover\Haf\Haf.005.png

Filesize
4KB

MD5
ef970f462499892ac580c7923e778473

SHA1
eeaad0c34615b8e2efbc7d1a9fa07aa406070d59

SHA256
19009a89acbbd969199fb0dd6c40e2309e8167b51d082ed5f2866369f69b3e87

SHA512
023fe80d5c1d02d44b2c6566f25e5bf1f5d1f40f857b18beed62ec35ce1ee575ebd1eac214e76ff5d2a2350e5222871ef804ab2bdbbaa18c967685aa52cc35c3

Download Submit
C:\Program Files (x86)\rover\Haf\Haf.006.png

Filesize
4KB

MD5
21bd262d73548619a39e1f2ab4befaf6

SHA1
52fc9e1e4a2d70f8d4576e0d34144da0d0fcad21

SHA256
ae18ac775b321e9e7536b78617631ff4fce0df38d5f09d0039c54a91d130a134

SHA512
580174bdce81fffca0955276136bd6a9907f7424c697a0032ccd540b66abf0246e1cda45304c3fe2b2ae20f54a04d4c5bafe67dd552c5bfdf7b5af2d44ada606

Download Submit
C:\Program Files (x86)\rover\Haf\Haf.007.png

Filesize
3KB

MD5
473a4b4ee9d88f06d90c42d326fe0dce

SHA1
c1c4a3235ac5a4e40d3934268461d65aa3018808

SHA256
a54852b7bd76d69895ba1e9baeee4b6e31d068a92aac3fc2eb53ff2a544a523a

SHA512
a6b05662ef8c2425dfd41671b3cf0d85b9064f6c9a47128d3757282e2e3cb8f75c9adb33362e86d722e76b55fa3bb719826f616dac2c137ad5ed4d23df9cde54

Download Submit
C:\Program Files (x86)\rover\Sleep\Sleep.001.png

Filesize
2KB

MD5
d36886b642677b462ce6be519afffebb

SHA1
9df69852a4703d8b7e3f6cea329baa25da493a1d

SHA256
cf9ae345704f960c078e7636bbaef23e9aa7eebc6eb75c83eb42df2e5018fb78

SHA512
e605484eaa7f740434b42e48bc5c42636c2037a1cfc865f0f45748385c343896f189591cf2841bfa0960e162ad1c2118a3410b622e1b02f6b8a872c562f7c4d6

Download Submit
C:\Program Files (x86)\rover\Sleep\Sleep.002.png

Filesize
2KB

MD5
06ebbb0a2f53dbe14d33729b65cfcf4b

SHA1
608788a8e2483edd7642126abfb1c6af32833c0f

SHA256
593280317a52da8972affbe291e96fad43847b4432d88bdfeb49bdb6a72f6e1d

SHA512
bd35e4a6929791c0043e8a98db2db8eda6c87a7a043f96577b3e14932c96586c541b101f98ecd24f18b0625cd673fd769f340057845cb92ba8482b2eb4fcb3a5

Download Submit
C:\Program Files (x86)\rover\Sleep\Sleep.003.png

Filesize
2KB

MD5
2f54f46a3a752aa552719e03dd1c93d8

SHA1
a07a322d1cb584bbc90d1fc7054c6ccc1c7771ee

SHA256
1e77c329527989906dcc7eff9985a347549183550d1688cacf5c0fd327a05454

SHA512
25e1736bee22bdccac035b7d84a40b98eb83b2c291ddb211a2bb936dbf921a61bb33af25949fb6140584ffe946f044b36fb4ededdd633901ed8e9c4a21c5f410

Download Submit
C:\Program Files (x86)\rover\Sleep\Sleep.004.png

Filesize
2KB

MD5
290c8b14a4f70930edd45ce7d74d5cc6

SHA1
284fe148f25c1a8cc7229d50e11c4f2937193483

SHA256
150e035e830c5052ddde3329892446deb9b05ce642aba4b6726efb35b1f0bebd

SHA512
8487f397b6a420a1aea5f710d591b965e770a59a0df034627e5e4c88d035da6457695f5612284b9b91439da3d62865acc4a2a94196ef5b8ad8bfbcfedfaa05bc

Download Submit
C:\Program Files (x86)\rover\Sleep\Sleep.005.png

Filesize
2KB

MD5
a4ccb66ae6df35df97f2adaaf0226229

SHA1
3fc2fe8138d222d950675ea85e88d58a8ce6bc06

SHA256
76e01114322f756ea5e598a4cdc43c5ebe278629042af59a745fbeaead090646

SHA512
5825d930f8420b1086c34b49e8d2b62dcb85997a0e0da43fcfade55ae8f2300ce45527a18ef3fa5e8f366382efc927a3636d0469ee57e45ee24f0d8e3dedb524

Download Submit
C:\Program Files (x86)\rover\Sleep\Sleep.006.png

Filesize
2KB

MD5
8962c047ba06818ac0360c7c89f46d65

SHA1
51570111bec4128c8fa75fe8614b735e86984c28

SHA256
c9ddef873462d5e13158480cf792bebf548f417e67470fff7a93959989f7a018

SHA512
b9dd3f23f74b4b2f22f250d01bec607c3fc125b3a9c19cfaf0fb6abee9635619e6be231bb3b897cbb4f005c0683c13d468749816e3a536ca16650e0eec5def63

Download Submit
C:\Program Files (x86)\rover\Sleep\Sleep.007.png

Filesize
2KB

MD5
66996e5daee3586bb0e9015abab61a69

SHA1
67b86380c42f4cbfe016500c2071affe4530b038

SHA256
a141e76ee32b45fd604723d2279a4e6f2b87f18a1b9f40f04b8145277d6ba752

SHA512
1113f3ff4aaef2facd093811fd898300a4acde5dd93c85f384f8d5979d8e02e12c7b88bb8645327d4ca1d92553bdd4a64c4fcfe93b6aa2bda3de089ab5537dd8

Download Submit
C:\Program Files (x86)\rover\Sleep\Sleep.008.png

Filesize
2KB

MD5
9c5909c8ab9e01dffed7e0da1e49366c

SHA1
aa956f8f746d0a16a0b79dbbc4ae5208bea4b9de

SHA256
c2a3d26c995fd2856eff73b19c62056ccdc4db083ec029988eeaa1b7095278eb

SHA512
3dc0bd8233212c9388e12ec27105941a55678d80939507627309137cc13ac3bc3c03f4717aaae3fb142d24a3214906224bf4b56222fd2882961740ff6245c2e2

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.001.png

Filesize
3KB

MD5
0197012f782ed1195790f9bf0884ca0d

SHA1
fc0115826fbaf8cefa478e506b46b7b66a804f13

SHA256
c999fa6fd26a4a2af2155bd05522b44b54d6df90d1a9703a288bdf18b623c2cc

SHA512
614bce1f761871ba1113de49217725b7b6661c703b03864cef736f44e2d1e0c5fbe133966d24afb15900f0e4da16b24000a2a638b6d7839848874f386b3b81c1

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.002.png

Filesize
3KB

MD5
b45ff2750a41e0d8ca6a597fbcd41b57

SHA1
cf162e0371a1a394803a1f3145d5e9b7cddd5088

SHA256
727a2aac0697bcfecdc56dc4507516f9f64c5faa426f0ce69f7e607b74c4e1f4

SHA512
82a9a3fc7dfae0ed6bf665c4f369f053af372551c1871d6b3dc775f447ba727e921ab831f8acd712cc31b66156eac643859404f05386e2592a15954fb78d87a3

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.003.png

Filesize
3KB

MD5
95113a3147eeeb845523bdb4f6b211b8

SHA1
f817f20af3b5168a61982554bf683f3be0648da1

SHA256
800f0c501905bc4257415ee8bed738f897273600c721e80a15bcfbb2e2b3b847

SHA512
4e55d9ced90f255b20890595f8e07ccaeedcbe08aed6303336eae7f66df1e50429259b62c556d5d8b179f7f9be22216c1592ba772e2cebd257b3401109f45cc4

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.004.png

Filesize
3KB

MD5
8ce29c28d4d6bda14b90afb17a29a7f9

SHA1
94a28ce125f63fcd5c7598f7cb9e183732ebdc16

SHA256
eb9abbeddd27ce6fa82f1f7437309209450f9f8412eb395923a45d946d9c50b1

SHA512
037babd109af1a2c05d7db87536bec41e3075d1120a37384d66f9460d8790be5732f8bbe6a2a13db3d017806fed88945f2a98697b586284b62760252276a8077

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.005.png

Filesize
3KB

MD5
83ddcf0464fd3f42c5093c58beb8f941

SHA1
e8516b6468a42a450235bcc7d895f80f4f1ca189

SHA256
ebb3efda95b2d2588983742f96f51bdbcb9d87a6949f2c37ea11f509d236a536

SHA512
51a6925bc9558f9ba232b85623d78f975d1c18c1990ce62153aa57a742e0897c72fc0665213024f8d5af96e56cc47eb384ee8d231910fdef876a0889b52a59d8

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.006.png

Filesize
3KB

MD5
6f530b0a64361ef7e2ce6c28cb44b869

SHA1
ca087fc6ed5440180c7240c74988c99e4603ce35

SHA256
457626948266abd4f0dcda6a09c448bb20cce3596b52076b8d90e1c626037dc9

SHA512
dc3d809eab3bfa7c65c35a36d55097e09fbefa2f6de962ae02c58540f6c88b3ca9be3361f3ec37b8ce7927e020463055c455f2e93baa3a3c12096b55abcab6d3

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.007.png

Filesize
4KB

MD5
aac6fc45cfb83a6279e7184bcd4105d6

SHA1
b51ab2470a1eedad86cc3d93152360d72cb87549

SHA256
a59bb83276f003dd149c2143a5a70f012212c709e72af283209adfb85a0835b1

SHA512
7020ba8d918398bc2d5e6ea4aaea007d576d4c3577adab80259336505b06e8163d0afde5a7b4d802ba2dab9ec9c757e88eb37780246c35d38e5fed8648bbf3a1

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.008.png

Filesize
4KB

MD5
fa73c710edc1f91ecacba2d8016c780c

SHA1
19fafe993ee8db2e90e81dbb92e00eb395f232b9

SHA256
cca9c6b8e0df9e09523ab59021ffff62b29273cae487335c87b569e8483aaae2

SHA512
f73b2ee270348247db1d7fea937cd69125afa6aef926dc5c1cef14b955630711fe106d56270172448d739014ae4fd7d221007aaa422b3625aa524b812baa10a2

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.009.png

Filesize
4KB

MD5
3faefb490e3745520c08e7aa5cc0a693

SHA1
357ffa8b2d4797d8d6cf67c0c84818ebc746ce0a

SHA256
6ba5254c0b10b6939d5cd80f3ab87757143896d20fd8e014c3fcca35657e076b

SHA512
714d9d32ab070a992d84dc597a086afb7fe040300c33c25f9acdd27f5f8894145a5f9f8654b522c04a9cb1babeb25000fac25b01b1c820d4cfe8d67e40cd72a7

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.010.png

Filesize
3KB

MD5
1bed8b0629ce72b595017371336ac688

SHA1
9180c6c3d0bdd3470fa38854de8af238bcc31d42

SHA256
a8cc3da0e5b87f10e6acd766bbd096dbe40ca60507867ec8ea66c56436fa6cd7

SHA512
4483b0ac1e83ef94f982aa7cf92767a24165060e1d492a87290a2301bcd2654e1c2e5d5cd637151408cac576d74d529b7d05e7e12b27e02afd17e24029a92ceb

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.011.png

Filesize
3KB

MD5
c9eccb5ce7e65fd1eff7aba4a6fd43e8

SHA1
cd71011e1172a157627e1595cc7ce4888370a765

SHA256
a4045f846f5b3bb0856dbfdca78b5871433beefccb1416a2824e8dccce9f5975

SHA512
3b07f14cbc06f2a4a75067e09c04c760af324ebe2de5c51c88648b184337aad48d319c2753bc9987ebb2094719d92a0f87d7c0fd84c4d893dd8351e7dc6de3f8

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.001.png

Filesize
4KB

MD5
136be0b759f73a00e2d324a3073f63b7

SHA1
b3f03f663c8757ba7152f95549495e4914dc75db

SHA256
c9b925e1f1409ddaa3aadf1ae7c2fb3310b69fb931190b7dc2f274f517fe38fc

SHA512
263911753deffbce295dda3f311225edeb375555b1db2771477167600573bea78719f6294960dc5c5d95885194412dd0f133bae75a30e16556377263165b3723

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.002.png

Filesize
4KB

MD5
f8f8ea9dd52781d7fa6610484aff1950

SHA1
973f8c25b7b5e382820ce479668eac30ed2f5707

SHA256
209e9d1fb6a814edfa4f8128d4a2168b274ea0eeb965a57f3c8b9695417a1bf1

SHA512
4f4e379afff8850eec6e4f3d165eba60f6916569ee7561b8bbf5a6bfeda27dbbcc0687ce02bece412616204f89861d23a92055a226cea14a29c53c653919c094

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.003.png

Filesize
4KB

MD5
fb73acc1924324ca53e815a46765be0b

SHA1
62c0a21b74e7b72a064e4faf1f8799ed37466a19

SHA256
5488954fe5b4d87dee40dd68cc1d940d2395a52dc52d1c77f40cd2342b97efd8

SHA512
ea3ba299ca07850af45a29e2f88aece9163c13f4921a1fc05d930c008bc017b698c9fb987120147465a53fe0c0848926f543081716d5f877efa5a34b10822895

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.004.png

Filesize
4KB

MD5
6da7cf42c4bc126f50027c312ef9109a

SHA1
8b31ab8b7b01074257ec50eb4bc0b89259e63a31

SHA256
2ebdf7d755b442de775819b0bcfe7bdd06fda92f6ad36dcfdeaab107f58f23df

SHA512
5c9783a8c14c6654db2a9a7818d4376fc3b2aeab9820539d20353018d90f734652ebba8052184b62f0e17f8f094da28c2bdfc73a0c707036fb5f923ed25625d9

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.005.png

Filesize
4KB

MD5
d9d3c74ac593d5598c3b3bceb2f25b1d

SHA1
df14dee30599d5d6d67a34d397b993494e66700e

SHA256
2cba290a8c42f664a0e1a8e571e27bc846024fa7da9f7adc773a471ef74046bc

SHA512
de70858da11efb89e7db55762827f8c1d4b55aff14faea8ffd8a5f15d32d6956f6ca4a3fdd9ffd75906a818af81ba9c7ef056df7c8cec4076308df94ff3207ac

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.006.png

Filesize
4KB

MD5
3071c94f1209b190ec26913a36f30659

SHA1
d76fbfbc4ddd17383b6a716f24d137a8dc7ff610

SHA256
89868008f5e5c55e5dd5982c15f105d11b9d3603ab45395dde0ec1c5ce61e683

SHA512
bd21f269dd92ab826caa6085bf79f17b6c9b6c4b660d03913295611bae590f277a9a0a0e39fa281737fcd9cfbbb6a5c8f02287d316954badca394e730bad72f4

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.007.png

Filesize
3KB

MD5
4b440d33599483a86c558e60c6d3a060

SHA1
75bae8a351fabcf3ca9ca53fb500739507545beb

SHA256
6c882155cd0be36a280748c257fd120dff0c51e791de4af921d2b0845ad08f56

SHA512
d4fc1efb286ac03168a7b3e488eb493d5790b2dad69fb070bb0486e00478c1917051c3cb8fbe547a4a3898936d9b4220e0f7c7e99971718a18893abd8656f88a

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.008.png

Filesize
3KB

MD5
561c308a3d3a7a2d43f5f4479b93fd25

SHA1
8ba181a2b0d8610b2b68db1b9513ee22967f01d6

SHA256
d901fad9dc67035d8a7f18b637892faa7cfd24992ca98fe42d26460be9db3691

SHA512
8e3d43aa8d698997429d04581bc4f0863b47bfca4d85fcc26fda55203bab8a87a0890c4ac3998ad7b4000e35629778a85d58f45a17141ac8ad7ab81fa4c096f7

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.009.png

Filesize
3KB

MD5
d7465bbc652d5455d1c937e0e27218f7

SHA1
df4466a78a14d92ce384952ecf01b72f3e5774cf

SHA256
04e81bcec536e463d0e4ca162cd0ea07f0d390fcb7924fda5c2d8ce4fc7560cf

SHA512
917c9e3658a8cdc5f4b5e8221d857689eba6a41581d124a04a3972d8cc23a5b7c7346ba4d4fcbd5bee3612384877ffc9ed70e2ac29269a21c11eddbb9f7c6db8

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.010.png

Filesize
3KB

MD5
33934ec3db6ba1d14de375298e7f667e

SHA1
7196b5047565881820284f84498c66d55c404058

SHA256
0da3f5c9c2a5070cce4bc81998d5c66b9bb416d61c28906b0d3a67087b6c70b7

SHA512
33183423626c6dae8cab79a85b8972f4158bf1fdecd0d99b64b403d5cac1b68dd9d51adef1dc9831c9f5b89831d29532dc542fd369ed656f465b1505478a582b

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.011.png

Filesize
3KB

MD5
485fd874fd5265cfc5f90b91a6f9d151

SHA1
e006e612da8008e632fc842699b275eb776cab78

SHA256
0fb90e3a6a0c5e7423a1b4f0a99d3c01a71443432031165514515d18ddf1ad3c

SHA512
640315aea6affa9064339487a9bb9be52a0a232ab03551ace8cd8a62c26554f449d24626d0a05de6a8cd69f9738da1ab08319174ec0751e3b52a35a0ae2f677c

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.012.png

Filesize
3KB

MD5
9ddbacbfac00d6d7f6c087cb84e4ce88

SHA1
4bc1b645947aa52cf28de64f4aff63a4b1f70289

SHA256
70048d06c4f87829bc571c1ef36d3593be207b284b4c0a93500e981003abe321

SHA512
ae181e2aad08dd124ccbeee6e7f1814c6bfd55fe75b474bd84913d6b469c9a5a3cbde0803e9212678e5c4063a570647021e8389f18dea3e32eb28348701d86c3

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.013.png

Filesize
3KB

MD5
0f048896a6cd8170a257d0aa9500732a

SHA1
88bae1bdb3a00d2a0d37507213e04becc69b9965

SHA256
05f4a52484729950b91cae3fec4c8030e1dd0a51f2c6f70c57c90d69d554d322

SHA512
160de00050535bd54ef757ca02eb8136589b4ac8fc5b3f4aa810fe4309a68a733501c244db0b54fabe14c667c15baf61a25f602413417294257f925ab84a9966

Download Submit
C:\Program Files (x86)\rover\_1Idle\_1Idle.003.png

Filesize
3KB

MD5
533bc8e9ad951ba6d05c35a829e89156

SHA1
2709a1e51dcfa820a064ee3f0f34dea9cbc4fdee

SHA256
0827a66c31995a144229ca6b9bee27de94fd5bba937d25efde961dfa544d5c91

SHA512
d1d31f38686caacbe9453cc92c0bb88c4b085903b7b8eb455241839bec6b5ec4de0a0747cdfbcccb7468bb3bc6ca654e34a748762bb1a71e8e4b90285d397201

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_B5ABCBE30DFC44A0836CCD0F3BE6D9A7.dat

Filesize
940B

MD5
f1a58168212c70ec543b7526e716865e

SHA1
2ff87b26171124704e9ae5360327528612e9d654

SHA256
a6512cf1ecd8493f1cbbc2eb6e9692dc412603f3bc70575a7a747d73c1cc53ef

SHA512
99051d32b557e9cb525ee4020cbded502a183d41d247476725171408c8b688eb448404700e4b2b1e872fc719ba34edbafca21c629f20737c0a82d071b21f7138

Download Submit
memory/2996-48-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-28-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-2928-0x0000000006FC0000-0x0000000006FCA000-memory.dmp

Filesize
40KB

Download
memory/2996-2927-0x0000000006EC0000-0x0000000006F52000-memory.dmp

Filesize
584KB

Download
memory/2996-493-0x0000000074E5E000-0x0000000074E5F000-memory.dmp

Filesize
4KB

Download
memory/2996-523-0x0000000074E50000-0x0000000075600000-memory.dmp

Filesize
7.7MB

Download
memory/2996-44-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-46-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-50-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-40-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-62-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-42-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-54-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-56-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-58-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-68-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-66-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-70-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-64-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-60-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-2930-0x0000000007C60000-0x0000000007D0A000-memory.dmp

Filesize
680KB

Download
memory/2996-52-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-26-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-2929-0x000000000BA00000-0x000000000C0E0000-memory.dmp

Filesize
6.9MB

Download
memory/2996-32-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-38-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-36-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-34-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-30-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-8-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-15-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-16-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-24-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-22-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-18-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-20-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-10-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-13-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-7-0x0000000005B90000-0x00000000060D9000-memory.dmp

Filesize
5.3MB

Download
memory/2996-6-0x0000000074E50000-0x0000000075600000-memory.dmp

Filesize
7.7MB

Download
memory/2996-5-0x0000000005B90000-0x00000000060DE000-memory.dmp

Filesize
5.3MB

Download
memory/2996-4-0x0000000006640000-0x0000000006BE4000-memory.dmp

Filesize
5.6MB

Download
memory/2996-3-0x0000000074E50000-0x0000000075600000-memory.dmp

Filesize
7.7MB

Download
memory/2996-2-0x0000000074E50000-0x0000000075600000-memory.dmp

Filesize
7.7MB

Download
memory/2996-1-0x00000000060F0000-0x0000000006640000-memory.dmp

Filesize
5.3MB

Download
memory/2996-6998-0x0000000074E50000-0x0000000075600000-memory.dmp

Filesize
7.7MB

Download
memory/2996-5530-0x0000000000A00000-0x0000000000A0C000-memory.dmp

Filesize
48KB

Download
memory/2996-0-0x0000000074E5E000-0x0000000074E5F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.