Overview
overview
10Static
static
10UbisoftCon...er.exe
windows11-21h2-x64
7$PLUGINSDI...ol.dll
windows11-21h2-x64
5$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ay.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ry.dll
windows11-21h2-x64
3Microsoft....ns.dll
windows11-21h2-x64
1UbisoftConnect.exe
windows11-21h2-x64
9UbisoftExtension.exe
windows11-21h2-x64
5UbisoftGam...er.exe
windows11-21h2-x64
3UbisoftGam...64.exe
windows11-21h2-x64
1Uninstall.exe
windows11-21h2-x64
4UplayCrash...er.exe
windows11-21h2-x64
5UplayService.exe
windows11-21h2-x64
5UplayWebCore.exe
windows11-21h2-x64
3chrome_elf.dll
windows11-21h2-x64
3discord-rpc.x64.dll
windows11-21h2-x64
1discord-rpc.x86.dll
windows11-21h2-x64
3gear_core_...LL.dll
windows11-21h2-x64
3gear_detec...LL.dll
windows11-21h2-x64
3gpudatabase_win32.dll
windows11-21h2-x64
1libEGL.dll
windows11-21h2-x64
3libGLESv2.dll
windows11-21h2-x64
3libUbiCustomEvent.dll
windows11-21h2-x64
3libcef.dll
windows11-21h2-x64
3npuplaypc.dll
windows11-21h2-x64
3npuplaypchub.dll
windows11-21h2-x64
3overlay.dll
windows11-21h2-x64
3overlay64.dll
windows11-21h2-x64
1shareplay/Qt5Core.dll
windows11-21h2-x64
1shareplay/Qt5Gui.dll
windows11-21h2-x64
1Analysis
- max time kernel
1739s - max time network
1738s - platform
windows11-21h2_x64 - resource
win11-20251223-en - resource tags
arch:x64arch:x86image:win11-20251223-enlocale:en-usos:windows11-21h2-x64system - submitted
24/12/2025, 11:52
Behavioral task
behavioral1
Sample
UbisoftConnectInstaller.exe
Resource
win11-20251223-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win11-20251223-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20251223-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20251223-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsArray.dll
Resource
win11-20251223-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20251223-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/registry.dll
Resource
win11-20251223-en
Behavioral task
behavioral8
Sample
Microsoft.Gaming.XboxApp.Extensions.dll
Resource
win11-20251223-en
Behavioral task
behavioral9
Sample
UbisoftConnect.exe
Resource
win11-20251223-en
Behavioral task
behavioral10
Sample
UbisoftExtension.exe
Resource
win11-20251223-en
Behavioral task
behavioral11
Sample
UbisoftGameLauncher.exe
Resource
win11-20251223-en
Behavioral task
behavioral12
Sample
UbisoftGameLauncher64.exe
Resource
win11-20251223-en
Behavioral task
behavioral13
Sample
Uninstall.exe
Resource
win11-20251223-en
Behavioral task
behavioral14
Sample
UplayCrashReporter.exe
Resource
win11-20251223-en
Behavioral task
behavioral15
Sample
UplayService.exe
Resource
win11-20251223-en
Behavioral task
behavioral16
Sample
UplayWebCore.exe
Resource
win11-20251223-en
Behavioral task
behavioral17
Sample
chrome_elf.dll
Resource
win11-20251223-en
Behavioral task
behavioral18
Sample
discord-rpc.x64.dll
Resource
win11-20251223-en
Behavioral task
behavioral19
Sample
discord-rpc.x86.dll
Resource
win11-20251223-en
Behavioral task
behavioral20
Sample
gear_core_win32DLL.dll
Resource
win11-20251223-en
Behavioral task
behavioral21
Sample
gear_detection_win32DLL.dll
Resource
win11-20251223-en
Behavioral task
behavioral22
Sample
gpudatabase_win32.dll
Resource
win11-20251223-en
Behavioral task
behavioral23
Sample
libEGL.dll
Resource
win11-20251223-en
Behavioral task
behavioral24
Sample
libGLESv2.dll
Resource
win11-20251223-en
Behavioral task
behavioral25
Sample
libUbiCustomEvent.dll
Resource
win11-20251223-en
Behavioral task
behavioral26
Sample
libcef.dll
Resource
win11-20251223-en
Behavioral task
behavioral27
Sample
npuplaypc.dll
Resource
win11-20251223-en
Behavioral task
behavioral28
Sample
npuplaypchub.dll
Resource
win11-20251223-en
Behavioral task
behavioral29
Sample
overlay.dll
Resource
win11-20251223-en
Behavioral task
behavioral30
Sample
overlay64.dll
Resource
win11-20251223-en
Behavioral task
behavioral31
Sample
shareplay/Qt5Core.dll
Resource
win11-20251223-en
Behavioral task
behavioral32
Sample
shareplay/Qt5Gui.dll
Resource
win11-20251223-en
General
- Target UbisoftConnectInstaller.exe
- Size 248.4MB
- Sample251224-n17kcsby3c
- SHA256 9553eed5c7ccd78596656a5bffef6d8c2422fcc427e2a72fdf8598ec1f849101
- MD5 ac3a554bcc2309a42c9401fc79f509c0
- SHA1 a6e078e73f7521847297c710f1b5414ca63b6ebc
- SHA512 464102696e35aff1ba4238ba5bf7b214b9446b1eb17e793ac81f0d65637fee2de5a17c7d7ccec02a9712c427a528427f370fc56a0474e97b76baa5ee59d914d4
- SSDEEP 6291456:xMft9T+czFEcmVszdemltmyFZr+GbJolbTQq3:xMHFz6cgsz80myFZr+GbeH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.BlueStacks Services = "C:\\Users\\Admin\\AppData\\Local\\Programs\\bluestacks-services\\BlueStacksServices.exe --hidden" BlueStacksServices.exe - Downloads MZ/PE file 9 IoCs
flow pid Process 885 1908 msedge.exe 225 4660 msedge.exe 550 1272 chrome.exe 995 1908 msedge.exe 810 6776 BlueStacksInstaller.exe 23 1272 chrome.exe 101 1272 chrome.exe 620 1272 chrome.exe 794 1272 chrome.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe - Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: RobloxStudioBeta.exe File opened (read-only) \??\F: RobloxStudioBeta.exe File opened (read-only) \??\D: BlueStacksInstaller.exe File opened (read-only) \??\D: BlueStacksInstaller.exe File opened (read-only) \??\D: BlueStacksInstaller.exe File opened (read-only) \??\D: BlueStacksInstaller.exe - Modifies Windows Firewall 2 TTPs 8 IoCs
pid Process 4832 netsh.exe 6524 netsh.exe 7016 netsh.exe 12184 netsh.exe 10520 netsh.exe 11976 netsh.exe 11964 netsh.exe 10128 netsh.exe -
pid Process 1776 GameBarPresenceWriter.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\storage.json BlueStacksServices.exe File opened for modification C:\Windows\system32\storage.json BlueStacksServices.exe - Enumerates processes with tasklist 1 TTPs 64 IoCs
pid Process 11824 tasklist.exe 11208 tasklist.exe 8360 tasklist.exe 4172 tasklist.exe 1556 tasklist.exe 7192 tasklist.exe 9544 tasklist.exe 2332 tasklist.exe 5348 Process not Found 9924 tasklist.exe 8560 tasklist.exe 8032 tasklist.exe 10952 tasklist.exe 12096 tasklist.exe 6416 tasklist.exe 8116 tasklist.exe 9080 Process not Found 7832 tasklist.exe 7988 tasklist.exe 1396 tasklist.exe 11536 tasklist.exe 5612 tasklist.exe 9308 tasklist.exe 3076 tasklist.exe 548 tasklist.exe 6152 tasklist.exe 5552 tasklist.exe 7048 tasklist.exe 10556 tasklist.exe 2316 tasklist.exe 11576 Process not Found 6624 tasklist.exe 11892 tasklist.exe 5780 tasklist.exe 7740 Process not Found 10716 tasklist.exe 11824 tasklist.exe 6236 tasklist.exe 10448 tasklist.exe 11108 tasklist.exe 7904 tasklist.exe 4232 tasklist.exe 12044 tasklist.exe 8540 tasklist.exe 11168 tasklist.exe 3144 tasklist.exe 7344 tasklist.exe 6868 tasklist.exe 9284 tasklist.exe 9132 tasklist.exe 4216 tasklist.exe 9920 tasklist.exe 5920 tasklist.exe 3616 tasklist.exe 9840 tasklist.exe 8124 tasklist.exe 11736 tasklist.exe 8492 tasklist.exe 4360 tasklist.exe 9736 tasklist.exe 10788 tasklist.exe 7784 tasklist.exe 8856 tasklist.exe 2396 tasklist.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
pid Process 5820 RobloxPlayerBeta.exe 5820 RobloxPlayerBeta.exe 5820 RobloxPlayerBeta.exe 1520 RobloxPlayerBeta.exe 1520 RobloxPlayerBeta.exe 1520 RobloxPlayerBeta.exe 3524 RobloxPlayerBeta.exe 3524 RobloxPlayerBeta.exe 3524 RobloxPlayerBeta.exe 8064 RobloxPlayerBeta.exe 8064 RobloxPlayerBeta.exe 8064 RobloxPlayerBeta.exe 7356 RobloxPlayerBeta.exe 7356 RobloxPlayerBeta.exe 7356 RobloxPlayerBeta.exe 7316 RobloxPlayerBeta.exe 7316 RobloxPlayerBeta.exe 7316 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 7112 RobloxPlayerBeta.exe 7112 RobloxPlayerBeta.exe 7112 RobloxPlayerBeta.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\llama\llama\List\removeIndex.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\ReactIs\lock.toml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\Console\Console\makeConsoleImpl.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\content\textures\particles\explosion01_smoke_alpha.dds RobloxPlayerInstaller-BPPJC9BGQW.exe File created C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\content\textures\ui\VoiceChat\Misc\[email protected] RobloxPlayerInstaller-BPPJC9BGQW.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Components\ControlsPage\ControlLayouts\GamepadControls.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\Ribbon\Light\Medium\RibbonLocalScript.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\StudioContent\textures\StudioToolbox\AssetConfig\[email protected] RobloxStudioInstaller.exe File opened for modification C:\Program Files (x86)\BlueStacks X\plugins\audio_output\libwasapi_plugin.dll BSX-Setup-5.22.153.1026_nxt.exe File created C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\ExtraContent\textures\ui\LuaChat\icons\[email protected] RobloxPlayerInstaller-BPPJC9BGQW.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\textures\ui\Controls\PlayStationController\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\Ribbon\Light\Standard\RibbonRotateSpinboxSmall.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\WidgetIcons\Light\Large\TagEditor.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\WidgetIcons\Light\Standard\AnimationEditor.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\Motion-31ab8d40-0.1.0\Motion\README.md RobloxStudioInstaller.exe File created C:\Program Files (x86)\BlueStacks X\Qt5WebEngineWidgets.dll BSX-Setup-5.22.153.1026_nxt.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\avatar\unification\v2\R6CollisionEmulation.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\TextBox.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\Utility\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\React.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\link\core\empty.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\utilities\globals\graphql.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\StudioContent\textures\StudioToolbox\AudioMusic.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Lua\FindReplaceAll\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\StudioContent\textures\MaterialGenerator\Materials\Limestone.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\Shared\Shared\ReactFeatureFlags.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\fonts\families\Ubuntu.json RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\textures\ui\common\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Lua\PathEditor\Dark\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\InsertableObjects\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\lumberyak\lumberyak\example\page\page.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends\RoduxNetworking.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\RoduxUserPermissions\RoduxUserPermissions\Reducers\userSettings.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\content\textures\ui\VoiceChat\[email protected] RobloxPlayerInstaller-BPPJC9BGQW.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\scripts\CoreScripts\Modules\InGameMenu\Localization\withLocalization.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\Packages\Light\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\StudioContent\textures\MaterialManager\Favorite-Filled.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\textures\ui\InGameMenu\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Lua\AvatarSettings\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\InsertableObjects\Light\Standard\ChatInputBarConfiguration.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\jsutils\didYouMean.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\StudioContent\textures\RoduxDevtools\SetState.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\lock.toml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\content\textures\AvatarEditorImages\Stretch\[email protected] RobloxPlayerInstaller-BPPJC9BGQW.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\scripts\CoreScripts\Modules\DevConsole\Actions\SetRCCProfilerState.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\Debugger\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\Ribbon\Light\Medium\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Components\HintText\init.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\RbxDesignFoundations-31ab8d40-1.1.107\lock.toml RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\App\Button\LinkButton.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\ExtraContent\textures\ui\LuaApp\graphic\playBtnBackground.png RobloxPlayerInstaller-BPPJC9BGQW.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Lua\AvatarSettings\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Lua\ImportPreview\Light\Large\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\DraggerTools\Dark\Large\Move_P.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Components\Knob\init.lua RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\Foundation\Foundation\Components\TextArea\TextArea.md RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-31ab8d40-1.2.3\InstanceOf.lua RobloxStudioInstaller.exe File opened for modification C:\Program Files\BlueStacks_nxt\avformat-60.dll 7zr.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Lua\Notifications\Dark\Large\PlayArrowFilledWarning.png RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\content\studio_svg_textures\Shared\Cursors\Dark\Standard\[email protected] RobloxStudioInstaller.exe File created C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\ExtraContent\LuaPackages\Packages\_Index\RoactNavigation\LuauPolyfill.lua RobloxStudioInstaller.exe File opened for modification C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\hi.pak BSX-Setup-5.22.153.1026_nxt.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-ec\fi\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-ec\pt-BR\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-mobile-hub\en-GB\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\wallet\super_coupon.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\crypto.bundle.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-ec\pl\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-tokenized-card\pt-PT\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1057171067\Part-ZH msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-ec\es\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-ec\zh-Hant\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-tokenized-card\it\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\Notification\notification.html msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-hub\es\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-notification-shared\de\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-notification-shared\el\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-notification-shared\sv\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-shared-components\cs\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-tokenized-card\fr\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-tokenized-card\sv\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\wallet-webui-925.baa79171a74ad52b0a67.chunk.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1057171067\Part-DE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-mobile-hub\ru\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-hub\id\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\wallet-icon.svg msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-hub\de\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-hub\en-GB\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-shared-components\fr-CA\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-ec\ar\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-notification\fr-CA\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\wallet\wallet-checkout-eligible-sites-pre-stable.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-hub\ja\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-hub\pt-PT\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-mobile-hub\pt-BR\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-shared-components\el\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\runtime.bundle.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-ec\sv\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-notification\ru\strings.json msedge.exe File opened for modification C:\Windows\SystemTemp msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-ec\de\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-hub\ko\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-notification-shared\ja\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\wallet-webui-227.bb2c3c84778e2589775f.chunk.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-ec\ja\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-hub\cs\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-notification\fr\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-notification\pt-PT\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-ec\el\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_2027170787\_platform_specific\win_x64\widevinecdm.dll.sig msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-notification\de\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-mobile-hub\zh-Hant\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\wallet\wallet-checkout\merchant-site-info.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\manifest.webapp.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1057171067\Filtering Rules msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1057171067\Part-RU msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-shared-components\ko\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-shared-components\it\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\Notification\notification_fast.html msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-notification\es\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-shared-components\pl\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1057171067\Filtering Rules-CA msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-shared-components\ar\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-shared-components\zh-Hans\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\Notification\notification_fast.bundle.js.LICENSE.txt msedge.exe - Executes dropped EXE 64 IoCs
pid Process 6100 Roblox - Windows Installer.exe 5460 RobloxPlayerInstaller-BPPJC9BGQW.exe 5820 RobloxPlayerBeta.exe 1520 RobloxPlayerBeta.exe 4512 RobloxStudioInstaller.exe 5548 RobloxStudioInstaller.exe 3524 RobloxPlayerBeta.exe 8064 RobloxPlayerBeta.exe 6244 RobloxStudioBeta.exe 6284 RobloxCrashHandler.exe 7892 Fishstrap-v3.0.1.0.exe 7436 Bloxstrap-v2.10.0.exe 600 Bloxstrap.exe 5108 Bloxstrap.exe 7356 RobloxPlayerBeta.exe 6892 Fishstrap.exe 7316 RobloxPlayerBeta.exe 5872 Fishstrap.exe 3916 Fishstrap.exe 5280 RobloxPlayerBeta.exe 7040 Fishstrap.exe 7112 RobloxPlayerBeta.exe 8744 BlueStacksInstaller_5.22.153.1026_native_6cfe325a123fbe74e82f5a3f13ef7261_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe 6776 BlueStacksInstaller.exe 5732 HD-CheckCpu.exe 5724 HD-CheckCpu.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 8888 BlueStacksInstaller_5.22.153.1026_native_6cfe325a123fbe74e82f5a3f13ef7261_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe 2828 Bootstrapper.exe 4920 BlueStacksInstaller.exe 2840 7zr.exe 4644 BlueStacksServicesSetup.exe 8132 HD-ForceGPU.exe 7304 HD-GLCheck.exe 9028 HD-GLCheck.exe 7640 HD-GLCheck.exe 4556 HD-GLCheck.exe 7196 HD-GLCheck.exe 8024 HD-GLCheck.exe 9384 BlueStacksServices.exe 9524 BlueStacksServices.exe 9628 BlueStacksServices.exe 10960 BlueStacksServices.exe 6000 BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe 9324 BlueStacksInstaller.exe 9592 HD-CheckCpu.exe 10452 HD-CheckCpu.exe 12020 BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe 9688 Bootstrapper.exe 11636 BlueStacksInstaller.exe 9920 7zr.exe 4968 HD-ForceGPU.exe 6456 HD-GLCheck.exe 5088 HD-GLCheck.exe 7860 HD-GLCheck.exe 6664 HD-GLCheck.exe 5668 HD-GLCheck.exe 6168 HD-GLCheck.exe 5140 BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe 8280 BlueStacksInstaller.exe 3828 HD-CheckCpu.exe 6240 HD-CheckCpu.exe 11048 BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe 12272 Bootstrapper.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 12032 sc.exe - Loads dropped DLL 64 IoCs
pid Process 4936 UbisoftConnectInstaller.exe 4936 UbisoftConnectInstaller.exe 5820 RobloxPlayerBeta.exe 1520 RobloxPlayerBeta.exe 3524 RobloxPlayerBeta.exe 8064 RobloxPlayerBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6284 RobloxCrashHandler.exe 6284 RobloxCrashHandler.exe 6284 RobloxCrashHandler.exe 7356 RobloxPlayerBeta.exe 7316 RobloxPlayerBeta.exe 5280 RobloxPlayerBeta.exe 7112 RobloxPlayerBeta.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe 6004 BSX-Setup-5.22.153.1026_nxt.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 8 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\Fishstrap-v3.0.1.0.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\Bloxstrap-v2.10.0.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Roblox - Windows Installer (1).exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\RobloxPlayerInstaller-BPPJC9BGQW.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_6cfe325a123fbe74e82f5a3f13ef7261_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_6eb21f3f5997e4a506d7fc94c788dd2d_MDs1.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Roblox - Windows Installer.exe:Zone.Identifier chrome.exe - Checks whether UAC is enabled 1 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller-BPPJC9BGQW.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxStudioBeta.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3868 4512 WerFault.exe 198 - System Location Discovery: System Language Discovery 1 TTPs 28 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD-CheckCpu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD-CheckCpu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueStacksInstaller_5.22.153.1026_native_6cfe325a123fbe74e82f5a3f13ef7261_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD-CheckCpu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BSX-Setup-5.22.153.1026_nxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD-CheckCpu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueStacksInstaller_5.22.153.1026_native_6cfe325a123fbe74e82f5a3f13ef7261_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueStacksServicesSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueStacksInstaller_5.22.153.1026_native_6eb21f3f5997e4a506d7fc94c788dd2d_MDs1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxPlayerInstaller-BPPJC9BGQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD-CheckCpu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BlueStacksInstaller_5.22.153.1026_native_6eb21f3f5997e4a506d7fc94c788dd2d_MDs1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UbisoftConnectInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1272 chrome.exe 4660 msedge.exe 1908 msedge.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString BlueStacksInstaller.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 BlueStacksInstaller.exe - Enumerates system info in registry 2 TTPs 20 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioBeta.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioInstaller.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller-BPPJC9BGQW.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioBeta.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller-BPPJC9BGQW.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxStudioInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxStudioInstaller.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller-BPPJC9BGQW.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller-BPPJC9BGQW.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller-BPPJC9BGQW.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller-BPPJC9BGQW.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-STUDIO RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller-BPPJC9BGQW.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller-BPPJC9BGQW.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth RobloxStudioInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio-auth\WarnOnOpen = "0" RobloxStudioInstaller.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5b077c09380f4fe6" RobloxPlayerInstaller-BPPJC9BGQW.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox\shell\open Fishstrap-v3.0.1.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command RobloxPlayerInstaller-BPPJC9BGQW.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\ = "URL: Roblox Protocol" RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX BSX-Setup-5.22.153.1026_nxt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open\command BSX-Setup-5.22.153.1026_nxt.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxStudioInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox-player\URL Protocol Fishstrap-v3.0.1.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open BSX-Setup-5.22.153.1026_nxt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open\command RobloxStudioInstaller.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox\DefaultIcon Fishstrap-v3.0.1.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap-v2.10.0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\ = "Roblox Place" RobloxStudioInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe" Fishstrap-v3.0.1.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerInstaller-BPPJC9BGQW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-5b077c09380f4fe6" RobloxPlayerInstaller-BPPJC9BGQW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Roblox.Place\shell\Open RobloxStudioInstaller.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\bstsrvs BlueStacksServices.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open RobloxPlayerInstaller-BPPJC9BGQW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-34c9847319974d28\\RobloxStudioBeta.exe\" %1" RobloxStudioInstaller.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox\shell Fishstrap-v3.0.1.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-34c9847319974d28" RobloxPlayerInstaller-BPPJC9BGQW.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache BSX-Setup-5.22.153.1026_nxt.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe" Fishstrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe\" -player \"%1\"" Fishstrap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerInstaller-BPPJC9BGQW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon RobloxStudioInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-34c9847319974d28\\RobloxStudioBeta.exe" RobloxStudioInstaller.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox-player\shell Fishstrap-v3.0.1.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command RobloxStudioInstaller.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox-player\DefaultIcon Fishstrap-v3.0.1.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox-player\ = "URL: Roblox Protocol" Fishstrap-v3.0.1.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\DefaultIcon BSX-Setup-5.22.153.1026_nxt.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\bstsrvs\URL Protocol BlueStacksServices.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-STUDIO\DEFAULTICON RobloxStudioInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\URL Protocol BSX-Setup-5.22.153.1026_nxt.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\bstsrvs\shell\open BlueStacksServices.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon RobloxPlayerInstaller-BPPJC9BGQW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell RobloxPlayerInstaller-BPPJC9BGQW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol RobloxStudioInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\URL Protocol RobloxStudioInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open\command\version = "version-34c9847319974d28" RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rbxlx\Roblox.Place\ShellNew RobloxStudioInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" -player \"%1\"" Bloxstrap-v2.10.0.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1137014038-3678899601-2033181133-1000\{65FA22B5-5D5C-44C1-9078-0708BCC4945A} chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1" RobloxPlayerInstaller-BPPJC9BGQW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerInstaller-BPPJC9BGQW.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-STUDIO\SHELL\OPEN\COMMAND RobloxStudioInstaller.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxStudioInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell\open RobloxStudioInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe" Bloxstrap-v2.10.0.exe Key created \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" RobloxPlayerInstaller-BPPJC9BGQW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio-auth\shell RobloxStudioInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000_Classes\roblox\ = "URL: Roblox Protocol" Fishstrap-v3.0.1.0.exe - NTFS ADS 10 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Roblox - Windows Installer.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\Fishstrap-v3.0.1.0.exe:Zone.Identifier chrome.exe File created C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe\:Zone.Identifier:$DATA Fishstrap-v3.0.1.0.exe File created C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe\:Zone.Identifier:$DATA Bloxstrap-v2.10.0.exe File opened for modification C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Roblox - Windows Installer (1).exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\RobloxPlayerInstaller-BPPJC9BGQW.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\Bloxstrap-v2.10.0.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_6cfe325a123fbe74e82f5a3f13ef7261_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_6eb21f3f5997e4a506d7fc94c788dd2d_MDs1.exe:Zone.Identifier msedge.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2000 NOTEPAD.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 6244 RobloxStudioBeta.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 4500 chrome.exe 4500 chrome.exe 1688 msedge.exe 1688 msedge.exe 5460 RobloxPlayerInstaller-BPPJC9BGQW.exe 5460 RobloxPlayerInstaller-BPPJC9BGQW.exe 5820 RobloxPlayerBeta.exe 1520 RobloxPlayerBeta.exe 4376 msedge.exe 4376 msedge.exe 5548 RobloxStudioInstaller.exe 5548 RobloxStudioInstaller.exe 3524 RobloxPlayerBeta.exe 8064 RobloxPlayerBeta.exe 5548 RobloxStudioInstaller.exe 5548 RobloxStudioInstaller.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 6244 RobloxStudioBeta.exe 7892 Fishstrap-v3.0.1.0.exe 7892 Fishstrap-v3.0.1.0.exe 7436 Bloxstrap-v2.10.0.exe 7436 Bloxstrap-v2.10.0.exe 600 Bloxstrap.exe 600 Bloxstrap.exe 5108 Bloxstrap.exe 5108 Bloxstrap.exe 5108 Bloxstrap.exe 5108 Bloxstrap.exe 7356 RobloxPlayerBeta.exe 6892 Fishstrap.exe 6892 Fishstrap.exe 6892 Fishstrap.exe 6892 Fishstrap.exe 6892 Fishstrap.exe 7316 RobloxPlayerBeta.exe 5872 Fishstrap.exe 5872 Fishstrap.exe 5872 Fishstrap.exe 5280 RobloxPlayerBeta.exe 3916 Fishstrap.exe 3916 Fishstrap.exe 3916 Fishstrap.exe 3916 Fishstrap.exe 3916 Fishstrap.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 6244 RobloxStudioBeta.exe 3328 chrome.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 684 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 3328 chrome.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 3328 chrome.exe 1688 msedge.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 7044 msedgewebview2.exe 7044 msedgewebview2.exe 7044 msedgewebview2.exe 3328 chrome.exe 3328 chrome.exe 7044 msedgewebview2.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe Token: SeShutdownPrivilege 3328 chrome.exe Token: SeCreatePagefilePrivilege 3328 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 5996 msedge.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 3328 chrome.exe 9384 BlueStacksServices.exe 9384 BlueStacksServices.exe 9384 BlueStacksServices.exe 9384 BlueStacksServices.exe 9384 BlueStacksServices.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 6244 RobloxStudioBeta.exe 5544 OpenWith.exe 7196 HD-GLCheck.exe 5668 HD-GLCheck.exe 5208 HD-GLCheck.exe 9344 HD-GLCheck.exe 11604 HD-GLCheck.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3328 wrote to memory of 1728 3328 chrome.exe 78 PID 3328 wrote to memory of 5360 3328 chrome.exe 79 PID 3328 wrote to memory of 5360 3328 chrome.exe 79 PID 3328 wrote to memory of 1272 3328 chrome.exe 80 PID 3328 wrote to memory of 6124 3328 chrome.exe 81 PID 3328 wrote to memory of 6124 3328 chrome.exe 81 PID 3328 wrote to memory of 5716 3328 chrome.exe 82 PID 3328 wrote to memory of 2928 3328 chrome.exe 83 PID 3328 wrote to memory of 5716 3328 chrome.exe 82 PID 3328 wrote to memory of 2928 3328 chrome.exe 83 PID 3328 wrote to memory of 3920 3328 chrome.exe 84 PID 3328 wrote to memory of 3920 3328 chrome.exe 84 PID 3328 wrote to memory of 5800 3328 chrome.exe 87 PID 3328 wrote to memory of 5800 3328 chrome.exe 87 PID 3328 wrote to memory of 240 3328 chrome.exe 88 PID 3328 wrote to memory of 240 3328 chrome.exe 88 PID 3328 wrote to memory of 3352 3328 chrome.exe 89 PID 3328 wrote to memory of 3352 3328 chrome.exe 89 PID 3328 wrote to memory of 4756 3328 chrome.exe 90 PID 3328 wrote to memory of 2152 3328 chrome.exe 92 PID 3328 wrote to memory of 2152 3328 chrome.exe 92 PID 3328 wrote to memory of 5316 3328 chrome.exe 93 PID 3328 wrote to memory of 5316 3328 chrome.exe 93 PID 3328 wrote to memory of 4356 3328 chrome.exe 94 PID 3328 wrote to memory of 3440 3328 chrome.exe 95 PID 3328 wrote to memory of 3440 3328 chrome.exe 95 PID 3328 wrote to memory of 5208 3328 chrome.exe 96 PID 3328 wrote to memory of 5208 3328 chrome.exe 96 PID 3328 wrote to memory of 2236 3328 chrome.exe 97 PID 3328 wrote to memory of 2236 3328 chrome.exe 97 PID 3328 wrote to memory of 4596 3328 chrome.exe 98 PID 3328 wrote to memory of 4608 3328 chrome.exe 99 PID 3328 wrote to memory of 4644 3328 chrome.exe 100 PID 3328 wrote to memory of 5928 3328 chrome.exe 101 PID 3328 wrote to memory of 6100 3328 chrome.exe 102 PID 6100 wrote to memory of 5996 6100 Roblox - Windows Installer.exe 103 PID 5996 wrote to memory of 4612 5996 msedge.exe 104 PID 5996 wrote to memory of 4660 5996 msedge.exe 105 PID 5996 wrote to memory of 2180 5996 msedge.exe 106 PID 5996 wrote to memory of 2180 5996 msedge.exe 106 PID 5996 wrote to memory of 2180 5996 msedge.exe 106 PID 5996 wrote to memory of 1356 5996 msedge.exe 107 PID 5996 wrote to memory of 1356 5996 msedge.exe 107 PID 5996 wrote to memory of 1352 5996 msedge.exe 108 PID 5996 wrote to memory of 4512 5996 msedge.exe 109 PID 5996 wrote to memory of 1352 5996 msedge.exe 108 PID 5996 wrote to memory of 1352 5996 msedge.exe 108 PID 5996 wrote to memory of 4512 5996 msedge.exe 109 PID 5996 wrote to memory of 4512 5996 msedge.exe 109 PID 5996 wrote to memory of 4772 5996 msedge.exe 111 PID 5996 wrote to memory of 4772 5996 msedge.exe 111 PID 5996 wrote to memory of 4772 5996 msedge.exe 111 PID 5996 wrote to memory of 232 5996 msedge.exe 113 PID 5996 wrote to memory of 4672 5996 msedge.exe 114 PID 5996 wrote to memory of 232 5996 msedge.exe 113 PID 5996 wrote to memory of 4672 5996 msedge.exe 114 PID 5996 wrote to memory of 2132 5996 msedge.exe 116 PID 5996 wrote to memory of 5716 5996 msedge.exe 117 PID 5716 wrote to memory of 5044 5716 msedge.exe 118 PID 5996 wrote to memory of 1180 5996 msedge.exe 121 PID 5996 wrote to memory of 3784 5996 msedge.exe 122 PID 5996 wrote to memory of 1180 5996 msedge.exe 121 PID 5996 wrote to memory of 3784 5996 msedge.exe 122 PID 5996 wrote to memory of 3784 5996 msedge.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\UbisoftConnectInstaller.exe"C:\Users\Admin\AppData\Local\Temp\UbisoftConnectInstaller.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4936
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ff988d9c728,0x7ff988d9c734,0x7ff988d9c7402⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,9614200981124978409,7813950246156553645,262144 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=1964 /prefetch:22⤵PID:5360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,12115139447589862992,11946087334452999943,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2252 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
PID:1272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,2401248777604806608,4137720158355230278,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2380 /prefetch:132⤵PID:6124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,18095421054558360262,11236091732105162506,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:5716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,7365206826380426957,1430264327733826330,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,4798919224719661863,6784224546444412536,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4236 /prefetch:92⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4576,i,14108400431556609296,8273215047184488664,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4588 /prefetch:142⤵PID:5800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4776,i,13040673140681275398,11001342834943592703,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,4991875038583278660,6300612974132306913,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4936 /prefetch:142⤵PID:3352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,1718659955827136713,11502095098511903684,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4204 /prefetch:142⤵PID:4756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5708,i,9474864847358348178,4526176501248421736,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5448,i,14049517202102495821,16297128570272290979,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5424 /prefetch:12⤵PID:5316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,9293347709403699945,13995432914545447401,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3456 /prefetch:142⤵
- Modifies registry class
PID:4356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,9068030196885770794,8601012706075008465,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3420 /prefetch:122⤵PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3452,i,12735651878227342971,11911218275052501098,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4900 /prefetch:12⤵PID:5208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6056,i,4701377444867604153,17815465989772191989,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6024 /prefetch:12⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=224,i,3644664477404170706,12376038879286896064,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5992 /prefetch:142⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,18246711241219094486,6782081614014674209,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6220 /prefetch:142⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,6235199745187118580,8135365003429322991,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6260 /prefetch:142⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,5432165769844534699,11245009741548204849,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6196 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:5928
-
-
C:\Users\Admin\Downloads\Roblox - Windows Installer.exe"C:\Users\Admin\Downloads\Roblox - Windows Installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9PMF91N3LZ3M?ocid=&referrer=psi3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x368,0x7ff96c79c188,0x7ff96c79c194,0x7ff96c79c1a04⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=280,i,15265374671965660774,15626049699065939150,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:114⤵
- Downloads MZ/PE file
- System Time Discovery
PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,9441673157179219252,2935312036112619788,262144 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:24⤵PID:2180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,2836691869045281440,1494755443571680210,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:134⤵PID:1356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,18305137558591868444,10450391954224308260,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,307351479005117320,15413744035876759138,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4860,i,4587277942237348406,7598857786024210623,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,9692450327068067700,7091475477413423003,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:144⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,15878009041366092233,15429693829016843172,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:144⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,15565261868963786500,3322013270935188730,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:144⤵PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,15565261868963786500,3322013270935188730,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:144⤵PID:2132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,8077103914818174572,4216850389577835585,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵PID:5044
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,9014775103023696130,9732677185380721130,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:144⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6340,i,17153730753937917106,4257570567615119813,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14⤵PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,845819280729193346,8977491299246466862,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:144⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6392,i,14211382488752098715,629215688833369620,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5584,i,5992353601894983094,15724585254112006676,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14⤵PID:1196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5948,i,2440501366976334858,7411554654889302457,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4944,i,16439174005695236669,7769983238429515777,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6896,i,13476973346704198380,3778105307764934658,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4940,i,8961268470017714877,8670318306919535472,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6260,i,2071070477846010148,12733121717114162187,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6960,i,6335472824883990609,7725598246765390887,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,13398302725114990776,11503355133077311832,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:144⤵PID:5692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,14813855680335613692,15644418302107791281,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:144⤵PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,2471403930746218237,12301171145079519795,524288 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:144⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5644,i,1945761223042999004,5997548957347037344,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14⤵PID:3772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6736,i,14078021045716818911,8986769239567193360,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6436,i,10924895920324560039,8843200942254770426,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6888,i,5905851391482898029,7459972996405271496,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14⤵PID:5144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3592,i,8921277226374173631,17623023283658583862,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14⤵PID:5128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3588,i,8284214422742822379,1646872935428120987,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6480,i,3503908892058170802,2715301726352270714,2097152 --field-trial-handle=2308,i,2033035278573732681,16568315929352974360,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1688 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff96c79c188,0x7ff96c79c194,0x7ff96c79c1a05⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1592,i,12850455888582617806,15098620076823592698,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:115⤵
- Downloads MZ/PE file
- System Time Discovery
PID:1908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1464,i,14478841342001538681,17468694836630553605,262144 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:25⤵PID:1016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,4465901446569536633,4624341125410258693,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:135⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,10602952748145701,6749713559522439707,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:145⤵PID:2584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,10602952748145701,6749713559522439707,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:145⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,762913008358891214,4702761430726939760,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:145⤵PID:5260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,6973574904871872959,10330470682016687266,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:145⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,3718531623141861714,7040557238202628460,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:145⤵PID:4608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,3602175623733450553,11876617484817372371,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:145⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5036,i,834065863347128673,12255395350776179987,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:15⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5128,i,308806752417269978,12484999113935309900,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:15⤵PID:5940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,12147750403954888118,6109887647792732832,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:145⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,16081264745169930120,9828014180254416049,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:145⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,17177342956087078818,8672010303398659117,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:145⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6288,i,573875353480565456,5989142454318359756,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:15⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6172,i,14600398399576189428,1724587876860257736,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:15⤵PID:5764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6844,i,5304430734999956678,17116386902392644276,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:15⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7148,i,1710877921343543828,3230258403491741464,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:15⤵PID:2248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7212,i,1601001625339163261,6801606162426015736,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:15⤵PID:972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6612,i,16238379229740564767,3520233761594394445,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:15⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6828,i,6527780474827626021,4710273253156837559,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:15⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7412,i,16900308306879824315,10801145185923292513,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:15⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7272,i,6593787479005797331,9676439758004122211,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:15⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7528,i,3473796807722662322,3884896938910585388,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:15⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7360,i,10830161185810335279,16477396864660726644,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:15⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7572,i,5207565471435079075,6074006456563832010,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:15⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6560,i,467658601744088862,11574602048661077520,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:15⤵PID:5768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7508,i,12757612180926336712,9018345226351545938,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:15⤵PID:5248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7500,i,12641698736400316561,10323028100017148500,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:15⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7776,i,1123744225225982692,9672809995623751881,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:15⤵PID:792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6584,i,10569241785759439854,4184266945144582835,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:15⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7812,i,2702098855708733631,665908551688122325,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:145⤵PID:968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5268,i,4077963362201342403,17510442713845056460,262144 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:105⤵
- Suspicious behavior: EnumeratesProcesses
PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,965416393029023680,4033932448016526781,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:145⤵PID:3516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,3127162649732053090,4054433491162349108,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:145⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,12972692464781339585,8801223634767084672,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:145⤵PID:7144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,17331653410665920233,17845027765780962693,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:145⤵PID:7948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4012,i,14912819642849797986,6700570559119535523,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:145⤵PID:7464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,17571747635164154926,3676479342410574993,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:145⤵PID:6312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,1331632935880796352,343853104824198311,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:145⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6424,i,10181744750057336834,13553532113911320921,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:15⤵PID:10040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,11503361758751849177,10629587665415943695,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:145⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=5908,i,5899027405178570292,13843068593794052673,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:15⤵PID:5780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,12050718237537000886,17386909958036940033,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:145⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:5384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,16826446138829887808,5790066391906871318,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:145⤵PID:1548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7828,i,2799541917451246372,10012057376585944870,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:145⤵PID:6920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,12902572339307849986,16943406407922182217,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:145⤵PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,12902572339307849986,16943406407922182217,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:145⤵PID:5824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5208,i,12728989307205646998,7682267274689452113,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:15⤵PID:344
-
-
C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\7zS07739393\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS07739393\BlueStacksInstaller.exe"6⤵
- Enumerates connected drives
- Executes dropped EXE
PID:9324 -
C:\Users\Admin\AppData\Local\Temp\7zS07739393\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS07739393\HD-CheckCpu.exe" --cmd checkHypervEnabled7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:9592
-
-
C:\Users\Admin\AppData\Local\Temp\7zS07739393\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS07739393\HD-CheckCpu.exe" --cmd checkSSE47⤵
- Executes dropped EXE
PID:10452
-
-
C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe" -versionMachineID=50fc126a-6f0a-4ab6-a87f-0a1f49147619 -machineID=0cab1d5a-b266-4502-ba55-c65f88def59a -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.153.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:12020 -
C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\Bootstrapper.exe" -versionMachineID=50fc126a-6f0a-4ab6-a87f-0a1f49147619 -machineID=0cab1d5a-b266-4502-ba55-c65f88def59a -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.153.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs48⤵
- Executes dropped EXE
PID:9688 -
C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\BlueStacksInstaller.exe" -versionMachineID="50fc126a-6f0a-4ab6-a87f-0a1f49147619" -machineID="0cab1d5a-b266-4502-ba55-c65f88def59a" -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName="Pie64" -imageToLaunch="Pie64" -appToLaunch="bs5" -bsxVersion="10.42.153.1001" -country="GB" -isWalletFeatureEnabled -discordUrl="https://discord.gg/UnXV7taVs4" -parentpath="C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe" -md5=8038ca65e9069377e0dd4e7065e10527 -app64=9⤵
- Executes dropped EXE
PID:11636 -
C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\7zr.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\" -aoa10⤵
- Executes dropped EXE
PID:9920
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-ForceGPU.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_nxt"10⤵
- Executes dropped EXE
PID:4968
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe" 1 210⤵
- Executes dropped EXE
PID:6456
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe" 4 210⤵
- Executes dropped EXE
PID:5088
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe" 2 210⤵
- Executes dropped EXE
PID:7860
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe" 1 110⤵
- Executes dropped EXE
PID:6664
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe" 4 110⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5668
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe" 2 110⤵
- Executes dropped EXE
PID:6168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloud.bluestacks.com/bs3/help_articles?article=update_graphics_card_drivers&oem=nxt&locale=en-US&image_name=Pie6410⤵PID:6404
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=6408,i,14953803219401269014,15027475455679401586,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:15⤵PID:7220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=3508,i,8996117208045030460,12325895670135393013,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:15⤵PID:6740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=4064,i,16577071471693693934,15627595461205988299,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:15⤵PID:6392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7944,i,3966841595371360060,17139129041334728631,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:15⤵PID:9736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8092,i,2419338339025501508,12787663324814812055,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:15⤵PID:8096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,17154736204369821662,14547952014789223696,524288 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:145⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:692
-
-
C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_6eb21f3f5997e4a506d7fc94c788dd2d_MDs1.exe"C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_6eb21f3f5997e4a506d7fc94c788dd2d_MDs1.exe"5⤵
- System Location Discovery: System Language Discovery
PID:6904 -
C:\Users\Admin\AppData\Local\Temp\7zS8FA0AA65\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS8FA0AA65\BlueStacksInstaller.exe"6⤵
- Enumerates connected drives
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\7zS8FA0AA65\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS8FA0AA65\HD-CheckCpu.exe" --cmd checkHypervEnabled7⤵
- System Location Discovery: System Language Discovery
PID:8936
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8FA0AA65\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS8FA0AA65\HD-CheckCpu.exe" --cmd checkSSE47⤵PID:8540
-
-
C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_6eb21f3f5997e4a506d7fc94c788dd2d_MDs1.exe"C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_6eb21f3f5997e4a506d7fc94c788dd2d_MDs1.exe" -versionMachineID=50fc126a-6f0a-4ab6-a87f-0a1f49147619 -machineID=0cab1d5a-b266-4502-ba55-c65f88def59a -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.153.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs47⤵
- System Location Discovery: System Language Discovery
PID:11668 -
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\Bootstrapper.exe" -versionMachineID=50fc126a-6f0a-4ab6-a87f-0a1f49147619 -machineID=0cab1d5a-b266-4502-ba55-c65f88def59a -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.153.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs48⤵PID:8184
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\BlueStacksInstaller.exe" -versionMachineID="50fc126a-6f0a-4ab6-a87f-0a1f49147619" -machineID="0cab1d5a-b266-4502-ba55-c65f88def59a" -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName="Nougat32" -imageToLaunch="Nougat32" -appToLaunch="bs5" -bsxVersion="10.42.153.1001" -country="GB" -isWalletFeatureEnabled -discordUrl="https://discord.gg/UnXV7taVs4" -parentpath="C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_6eb21f3f5997e4a506d7fc94c788dd2d_MDs1.exe" -md5=6eb21f3f5997e4a506d7fc94c788dd2d -app64=9⤵
- Checks processor information in registry
PID:572 -
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\7zr.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\" -aoa10⤵PID:2568
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-ForceGPU.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_nxt"10⤵PID:4488
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe" 1 210⤵PID:6772
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe" 4 210⤵PID:11916
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe" 2 210⤵PID:11360
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe" 1 110⤵PID:11748
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe" 4 110⤵
- Suspicious use of SetWindowsHookEx
PID:9344
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe" 2 110⤵PID:8040
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-CheckCpu.exe" --cmd checkSSE410⤵
- System Location Discovery: System Language Discovery
PID:1820
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\7zr.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\PF.zip" -o"C:\Program Files\BlueStacks_nxt" -aoa10⤵
- Drops file in Program Files directory
PID:9728
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\7zr.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\PD.zip" -o"C:\ProgramData\BlueStacks_nxt" -aoa10⤵PID:9320
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\7zr.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\7zr.exe" x "C:\ProgramData\Nougat32_5.22.153.1026.exe" -o"C:\ProgramData\BlueStacks_nxt\Engine\Nougat32" -aoa10⤵PID:8748
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\\HD-GLCheck.exe" 210⤵PID:11096
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\\HD-GLCheck.exe" 310⤵
- Suspicious use of SetWindowsHookEx
PID:11604
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\\HD-GLCheck.exe" 110⤵PID:11156
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh.exe" advfirewall firewall delete rule name="BlueStacks Service"10⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:12184
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh.exe" advfirewall firewall add rule name="BlueStacks Service" dir=in action=allow program="C:\Program Files\BlueStacks_nxt\HD-Player.exe" enable=yes10⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:10520
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh.exe" advfirewall firewall delete rule name="BlueStacksAppplayerWeb"10⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:11976
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh.exe" advfirewall firewall add rule name="BlueStacksAppplayerWeb" dir=in action=allow program="C:\Program Files\BlueStacks_nxt\BlueStacksAppplayerWeb.exe" enable=yes10⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:11964
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\HD-CheckCpu.exe" --cmd checkSSE310⤵PID:10088
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c "sc.exe delete BlueStacksDrv_nxt"10⤵PID:11676
-
C:\Windows\system32\sc.exesc.exe delete BlueStacksDrv_nxt11⤵
- Launches sc.exe
PID:12032
-
-
-
C:\Windows\SYSTEM32\reg.exe"reg.exe" EXPORT HKLM\Software\BlueStacks_nxt "C:\Users\Admin\AppData\Local\Temp\1dnaz25x.32r\RegHKLM.txt"10⤵PID:12212
-
-
C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\7zr.exe"C:\Users\Admin\AppData\Local\Temp\7zS49D061E6\7zr.exe" a "C:\Users\Admin\AppData\Local\Temp\Installer.zip" -m0=LZMA:a=1 "C:\Users\Admin\AppData\Local\Temp\1dnaz25x.32r\*"10⤵PID:9708
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7992,i,1437575564727043999,14455368907421268077,2097152 --field-trial-handle=2456,i,135041680448237249,9195509224368484634,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:15⤵PID:11380
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6788,i,9435002419616919035,14776936090759969822,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6776 /prefetch:12⤵PID:5468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,11384176455095830265,17394752638923154849,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6028 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6004,i,3353134520345605774,16479764508766310110,262144 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6072 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-BPPJC9BGQW.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-BPPJC9BGQW.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5460 -
C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe" -personalizedToken BPPJC9BGQW --deeplink https://www.roblox.com/games/98936097545088/Retro-Tower-Defense -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 54603⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5820
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,3734523980712483263,5980998248202151756,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6024 /prefetch:142⤵PID:6084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6012,i,766827378415759795,8118142160265626994,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6172 /prefetch:12⤵PID:6128
-
-
C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:WO9fUoFKFAtBns62tJdnCjrpn7sM929jspTLqz-hjkiwrl6pwxBAHysmM6Hdkqwe6JDR9jygCeXBsx6u1VTaBf2AUVbieIOP9oGe9TKFmsKBCbIWMvBjdqN6M0leMZ39zm8rZqXVsdL8cUv-ng7nDY9NMw1B2-6YoQ2QsxihHJVMe5PupRe4xJ0uw8EzrDusAPrVpReOWzyLEMnbxJvvEVTEdbi4O2Ml_ggKrKcDfGiQyXl-E1-soibIsYMEPyDawgaN8pq4XDL2BMxWZmI-fx1oZfxk2fIYvhDkNOL-S1eBj7o-0YO74fCZAEUDDZK8JYBHQPhJ1s1SUym36vUEI1xUEadhw010fjMapiXDaKv0cvaKdJXJvMjC58VdN4K9Bk2j-hRf4jm_JAOwE0qGR2Cic6nK38bHOzmLWOTWDjxLrQTze-u14ocmoOAucf8mfaYcSNWz4-M29zCiQunJlv9bzCjBX4DmyWPWfye-QpYaukbMXOCULvQMIPs0DBegsU4mO7HVG9sYFPE-Aas_mELCn9ctYoAS2uNJcc6uwow+launchtime:1766577904930+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1766577712514003%26placeId%3D98936097545088%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D67c934a7-8a28-4cb5-9d77-1c69826e8a94%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1766577712514003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6876,i,11019447002965444627,13848553875860457692,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6872 /prefetch:12⤵PID:3176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7136,i,4324339069711857243,17272233657273536068,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7144 /prefetch:142⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7260,i,17699723525719690714,13359950648019499631,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7232 /prefetch:12⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7436,i,15302257489138166943,5638458774888786975,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7424 /prefetch:142⤵PID:4020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7572,i,10547197491382415250,5841010313699650734,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7588 /prefetch:12⤵PID:6548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7532,i,10712680564880144623,12629742922239840281,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7444 /prefetch:12⤵PID:6528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5624,i,12464545746487426219,10289272953575990620,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6244 /prefetch:12⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7532,i,15235077023464601121,803353612599266223,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7716 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:7188
-
-
C:\Users\Admin\Downloads\Fishstrap-v3.0.1.0.exe"C:\Users\Admin\Downloads\Fishstrap-v3.0.1.0.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:7892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6828,i,224596218123659656,8501710300738815983,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6056 /prefetch:12⤵PID:7628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7212,i,7832705590648744786,16026362566575704083,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7556 /prefetch:142⤵PID:7912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6772,i,3176188559807082761,12866229240123034570,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6928 /prefetch:12⤵PID:7460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7744,i,9557746924075797450,4409531152754337563,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7708 /prefetch:142⤵PID:8104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6080,i,898726332718863822,6883649533790497581,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3108 /prefetch:12⤵PID:3412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7404,i,9427240776452596645,13778853212965778891,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=1408 /prefetch:12⤵PID:3004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6972,i,2868320049071481355,16573374819495802320,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7476 /prefetch:12⤵PID:7648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6764,i,4536373448373710019,8838153335365811437,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7128 /prefetch:142⤵PID:6792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7180,i,11119136279762359434,7433111269156956241,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6076 /prefetch:12⤵PID:6808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6852,i,8960324560820418071,890379370588349177,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7804 /prefetch:142⤵PID:6764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6768,i,5319122133399972985,15961371240089568261,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7240 /prefetch:12⤵PID:6544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7220,i,18388977699355993199,3151679510540492636,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6136 /prefetch:12⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6848,i,815756650232164700,123108154917892174,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2580 /prefetch:12⤵PID:7872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7472,i,3086199306914912799,13339892265008139231,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7868 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1336
-
-
C:\Users\Admin\Downloads\Bloxstrap-v2.10.0.exe"C:\Users\Admin\Downloads\Bloxstrap-v2.10.0.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:7436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7360,i,10136107255384303907,10931374949545270106,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7320 /prefetch:12⤵PID:6200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,7101501110243216978,13712028471926414970,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6056 /prefetch:142⤵PID:344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7500,i,15681822158845413620,6072668081620014085,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7972 /prefetch:12⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8088,i,1429857901064222817,6552495552304728067,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7368 /prefetch:142⤵PID:7520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=5864,i,11021193680873429716,12735404689271364752,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7056 /prefetch:12⤵PID:6168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7496,i,10642236944294414545,14427512356160896400,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7876 /prefetch:12⤵PID:6468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=5912,i,6457782531331515951,15144373380781248189,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:6492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=6728,i,14182288406917898286,17381437727893879910,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8124 /prefetch:12⤵PID:7552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=7536,i,6180217193349729583,2187122673542187732,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6936 /prefetch:12⤵PID:6444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=8036,i,14493887837033137435,2004731846873637270,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8044 /prefetch:12⤵PID:2244
-
-
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe" -player "roblox-player:1+launchmode:play+gameinfo:OwhcDIhl30eG355U25NWHBvYsMT9cVyEmLfLEWuneBuenkPrQOsIxg9D8BC-JQGO_mtcLoHF9J4HNHPCNyRz8JzRggvOoaQfluo1Pz8IObx1SHYRtnWXGwqx8_FvKZcWp8JVclsIou8GmKTEwk8AviV3Tm0yYb5xevyW57isWv4pehfH6hBsqUwBgwo2n227SjHOFtifSYHpaVrwGCDKOFxM2hqsGeXtUUkUwdM8fFXZt0k1c3BKrfr8VHS88QtX6MvGLnUmX_0HvtddIh0qP85oYCJblkeeYbTd-cgA8MvNqNNmZNRv49I_yypZXT7NQaUjkVqfwXyGx2kmowZAsh3ffj15rYwxYcLyNHmhqnGfkzDok_xHCyUmh0ZO7bkzul2EkIK3vegeT7Ddm92m8vrVprXKW9vn0aF-JWG70rkR1fwEWQwpHc6X2S0yCOCoQX3mjXMxS2vP53S6yZBO1han-65LSBDPNuS46RcgMCVH7tCMub8719p89O4E5SK6b9Ay1da1leAPGiKhf9IWVltx3NVmeSNqVmt5U3Ohd8w+launchtime:1766578108851+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1766577712514003%26placeId%3D98936097545088%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Deeb8d08a-0e97-4c4a-abdd-6b917eb791b5%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1766577712514003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=8012,i,8280259544337762373,3369138538956722253,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4524 /prefetch:12⤵PID:972
-
-
C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe" -player "roblox-player:1+launchmode:play+gameinfo:I2cy_-fDXRrRDnr3xJNQFBeto4jIbE65W15vjQ11hi90IGojUSbbQzX5E9BrUhNYGQQ7f2hWsJUy-iQhGUudFWGTD1vnHobkUd9ft_etg_DKZHnlzP1aP7YOXYs9tWt0zayhongZRWlL0r5HwUq97qnHM5LrqKEhXm0QJtZGJ25i9t7dbtTDbhzMCL980X_Wktb3QVs9Valxl8U5nvjZbHWex6uZiLjK7NS0IJU8rParKvY6xvznmdp3lg-0OjZp6XBUGcfh71d1vyRJE9H8qJU8SS9bbT4WV9V09c992x7f95WNs0LN8OeSQ1BrLpADO90ITB8H1sreLRBqmd1KRSED3upJPW5XgXLeHpLtxuLaeelWGp5NQ-syGDqhEyynd-Nz6Gzs4TcO6mAa4beSR-kYZf3EsqbYI376B2dskLcsIpsdyccnCFsKkuCEaSKuoswL-IRgLGqh4z04kDCpKZAlSMMPF4ax81XW2UXKv1SBhZhFgGoDg_mWKN1wHaV59RwHr7i32P0uLuaJv90JVQi_OmeAVb8TipKAww51VTk+launchtime:1766578123155+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1766577712514003%26placeId%3D98936097545088%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Dffd9d02c-5b0b-49d2-8d42-f5d930abfd7b%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1766577712514003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5108 -
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:I2cy_-fDXRrRDnr3xJNQFBeto4jIbE65W15vjQ11hi90IGojUSbbQzX5E9BrUhNYGQQ7f2hWsJUy-iQhGUudFWGTD1vnHobkUd9ft_etg_DKZHnlzP1aP7YOXYs9tWt0zayhongZRWlL0r5HwUq97qnHM5LrqKEhXm0QJtZGJ25i9t7dbtTDbhzMCL980X_Wktb3QVs9Valxl8U5nvjZbHWex6uZiLjK7NS0IJU8rParKvY6xvznmdp3lg-0OjZp6XBUGcfh71d1vyRJE9H8qJU8SS9bbT4WV9V09c992x7f95WNs0LN8OeSQ1BrLpADO90ITB8H1sreLRBqmd1KRSED3upJPW5XgXLeHpLtxuLaeelWGp5NQ-syGDqhEyynd-Nz6Gzs4TcO6mAa4beSR-kYZf3EsqbYI376B2dskLcsIpsdyccnCFsKkuCEaSKuoswL-IRgLGqh4z04kDCpKZAlSMMPF4ax81XW2UXKv1SBhZhFgGoDg_mWKN1wHaV59RwHr7i32P0uLuaJv90JVQi_OmeAVb8TipKAww51VTk+launchtime:1766578123155+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1766577712514003%26placeId%3D98936097545088%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Dffd9d02c-5b0b-49d2-8d42-f5d930abfd7b%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1766577712514003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:7356
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=7488,i,8624640780933862928,7050240179636873133,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8092 /prefetch:12⤵PID:4224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=7056,i,17438360085681217788,250244725495983561,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7672 /prefetch:12⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=7560,i,5095612575606189547,13837007677953259307,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7344 /prefetch:12⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=6772,i,2461919878196665186,15040476484407608300,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7988 /prefetch:12⤵PID:7728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=4204,i,2868221083828815501,9561181124260203969,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7968 /prefetch:12⤵PID:6772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=7924,i,9986113616475641282,13137487745802267698,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7060 /prefetch:12⤵PID:6812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=4508,i,1041033935279269619,7009416989631745565,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8040 /prefetch:12⤵PID:3816
-
-
C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe"C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe" -player "roblox-player:1+launchmode:play+gameinfo:x69SFv9H7abp-Flt2Rh6C9Xnl9tg5TTcfWah36Zs5ta1XAT8Kv_PKiWZlJZ0Z7t-9p1VnDU0sP_qzgKf56_jKO4pBS3cN-toQVCk5cUJvMY4A03WOTkT16neeXxRtDc0XZtN5PyA14oKWi0Ad6UcKe9Kq-TKh7qZQyF3nLo2W-b1uBU-iUMX3jN2GKT0SHz9z26-YWMskA0dSa1SMwzQGN19bX3ArqpPvOCOyYADGr-if3WX-z06RPs5s1fEd3TX8canXBypZ63Y1_GYXrjZkL7bX_ztH6dZjarjiFOa9CGmtoaqWaOVsHajpKD678oH11SbFmrjVTOXimFm69cJgU2PQLP1SuXIYSkWrCC1IEQIt_HbPrzDsnl-3iTy_JPMuvuruFTSJDSfEElp8F18eT39vNzp4KU-9iWPWweM8wna_rembFJ6EPnKmzxzl7E5ucUewjdqD6xb4UKleETBY53HEl9W4enwCRXsrCO0AgAcH_eBWnOYarMS_LRKLbUsW14UgUSfRJHQPTZQ3nZ7d__dk1cWJj2aIG0WGUkhgIw+launchtime:1766578286890+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1766577712514003%26placeId%3D98936097545088%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D870f9e9d-7035-4928-8483-05c551479d27%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1766577712514003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp"2⤵
- Executes dropped EXE
PID:7040 -
C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:x69SFv9H7abp-Flt2Rh6C9Xnl9tg5TTcfWah36Zs5ta1XAT8Kv_PKiWZlJZ0Z7t-9p1VnDU0sP_qzgKf56_jKO4pBS3cN-toQVCk5cUJvMY4A03WOTkT16neeXxRtDc0XZtN5PyA14oKWi0Ad6UcKe9Kq-TKh7qZQyF3nLo2W-b1uBU-iUMX3jN2GKT0SHz9z26-YWMskA0dSa1SMwzQGN19bX3ArqpPvOCOyYADGr-if3WX-z06RPs5s1fEd3TX8canXBypZ63Y1_GYXrjZkL7bX_ztH6dZjarjiFOa9CGmtoaqWaOVsHajpKD678oH11SbFmrjVTOXimFm69cJgU2PQLP1SuXIYSkWrCC1IEQIt_HbPrzDsnl-3iTy_JPMuvuruFTSJDSfEElp8F18eT39vNzp4KU-9iWPWweM8wna_rembFJ6EPnKmzxzl7E5ucUewjdqD6xb4UKleETBY53HEl9W4enwCRXsrCO0AgAcH_eBWnOYarMS_LRKLbUsW14UgUSfRJHQPTZQ3nZ7d__dk1cWJj2aIG0WGUkhgIw+launchtime:1766578286890+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1766577712514003%26placeId%3D98936097545088%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D870f9e9d-7035-4928-8483-05c551479d27%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1766577712514003+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:7112
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=6016,i,6514152097263203409,10589210751636962290,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:7756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,10697029850434775817,10262102710759105542,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7492 /prefetch:142⤵PID:9100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=8200,i,9365631460148202825,5122678291510089604,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8404 /prefetch:12⤵PID:9084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,13005038595364542318,17912699064782343794,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6700 /prefetch:142⤵PID:8988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=6140,i,14961483987803802383,5680033270632310349,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=6776 /prefetch:12⤵PID:6024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=7700,i,16051970334388768827,3089187043076515776,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8008 /prefetch:12⤵PID:8140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4508,i,4880665476736079884,16471209753349838542,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8420 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:5088
-
-
C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_6cfe325a123fbe74e82f5a3f13ef7261_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_6cfe325a123fbe74e82f5a3f13ef7261_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8744 -
C:\Users\Admin\AppData\Local\Temp\7zS8225E162\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS8225E162\BlueStacksInstaller.exe"3⤵
- Downloads MZ/PE file
- Enumerates connected drives
- Executes dropped EXE
PID:6776 -
C:\Users\Admin\AppData\Local\Temp\7zS8225E162\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS8225E162\HD-CheckCpu.exe" --cmd checkHypervEnabled4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5732
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8225E162\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS8225E162\HD-CheckCpu.exe" --cmd checkSSE44⤵
- Executes dropped EXE
PID:5724
-
-
C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.153.1026_nxt.exe"C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.153.1026_nxt.exe" -s4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6004 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"5⤵
- System Location Discovery: System Language Discovery
PID:5440 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c green.bat6⤵
- System Location Discovery: System Language Discovery
PID:10072 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="BlueStacksWeb"7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:10128
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="Cloud Game"7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4832
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:6524
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:7016
-
-
-
-
-
C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_6cfe325a123fbe74e82f5a3f13ef7261_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_6cfe325a123fbe74e82f5a3f13ef7261_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe" -versionMachineID=50fc126a-6f0a-4ab6-a87f-0a1f49147619 -machineID=0cab1d5a-b266-4502-ba55-c65f88def59a -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.153.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8888 -
C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\Bootstrapper.exe" -versionMachineID=50fc126a-6f0a-4ab6-a87f-0a1f49147619 -machineID=0cab1d5a-b266-4502-ba55-c65f88def59a -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.153.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs45⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\BlueStacksInstaller.exe" -versionMachineID="50fc126a-6f0a-4ab6-a87f-0a1f49147619" -machineID="0cab1d5a-b266-4502-ba55-c65f88def59a" -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName="Pie64" -imageToLaunch="Pie64" -appToLaunch="bs5" -bsxVersion="10.42.153.1001" -country="GB" -isWalletFeatureEnabled -discordUrl="https://discord.gg/UnXV7taVs4" -parentpath="C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_6cfe325a123fbe74e82f5a3f13ef7261_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe" -md5=6cfe325a123fbe74e82f5a3f13ef7261 -app64=6⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\7zr.exe"C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\" -aoa7⤵
- Executes dropped EXE
PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-ForceGPU.exe"C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_nxt"7⤵
- Executes dropped EXE
PID:8132
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe" 1 27⤵
- Executes dropped EXE
PID:7304
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe" 4 27⤵
- Executes dropped EXE
PID:9028
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe" 2 27⤵
- Executes dropped EXE
PID:7640
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe" 1 17⤵
- Executes dropped EXE
PID:4556
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe" 4 17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:7196
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-GLCheck.exe" 2 17⤵
- Executes dropped EXE
PID:8024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bluestacks.com/download.html7⤵PID:10064
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=7468,i,6915194092415984266,11452578271309881736,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8276 /prefetch:12⤵PID:11548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7496,i,10426654630147350134,18220529372735475950,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7632 /prefetch:142⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=8396,i,18127193188757060722,5055010190314629723,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8608 /prefetch:12⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8676,i,15834876400699482,17930248750301602342,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8372 /prefetch:142⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7080,i,2992068999050657400,1106967801582772901,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7820 /prefetch:142⤵PID:11236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8452,i,13593591811029457011,5402607698963462119,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7436 /prefetch:142⤵PID:9640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=8324,i,13021843997793892355,10077768037238771707,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8304 /prefetch:12⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=7200,i,4355937091435290399,1008087024930894684,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8504 /prefetch:12⤵PID:8040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=8488,i,4357261513484108501,14192659791936550049,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8460 /prefetch:12⤵PID:12056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=7992,i,14403452456022326750,17526853274457012800,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7416 /prefetch:12⤵PID:11568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=7496,i,12338953234888594656,4850529249108249215,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7480 /prefetch:12⤵PID:11484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=8028,i,3302349562987880681,13379866628066810474,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=1512 /prefetch:12⤵PID:6016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=8900,i,4940836651290969716,18371311127296482506,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8952 /prefetch:12⤵PID:6864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8320,i,3107820325037003305,10662799081764945460,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8504 /prefetch:142⤵PID:8504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7436,i,8051603031207084030,13576861269380034216,524288 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=8992 /prefetch:142⤵PID:9996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --metrics-shmem-handle=6128,i,7391478105004567805,2916494740762699835,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=7860 /prefetch:12⤵PID:468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=7896,i,7437368449618586988,9810929426560502211,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=9028 /prefetch:12⤵PID:8856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=7784,i,547126506897231692,7632288854259733471,2097152 --field-trial-handle=1968,i,766476098056338210,10719498343057611917,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=872 /prefetch:12⤵PID:10252
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:600
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2168
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4172
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:6104
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1852
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2848
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵PID:3356
-
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe"C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\Roblox\RobloxStudioInstaller_9DC49\RobloxStudioInstaller.exeC:\Users\Admin\AppData\Local\Temp\Roblox\RobloxStudioInstaller_9DC49\RobloxStudioInstaller.exe -relaunch2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5548 -
C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\RobloxStudioBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\RobloxStudioBeta.exe" -startEvent www.roblox.com/robloxQTStudioStartedEvent -firstLaunch3⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6244 -
C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\RobloxCrashHandler.exe"C:\Program Files (x86)\Roblox\Versions\version-34c9847319974d28\RobloxCrashHandler.exe" --no-rate-limit --crashCounter Win-ROBLOXStudio-Crash --baseUrl https://www.roblox.com --studioPid 6244 --attachment=attachment_0.702.2.7020633_20251224T120559Z_Studio_6E241_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.702.2.7020633_20251224T120559Z_Studio_6E241_last.log --attachment=attachment_log_0.702.2.7020633_20251224T120559Z_Studio_6E241_csg3.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.702.2.7020633_20251224T120559Z_Studio_6E241_csg3.log --attachment=attachment_log_0.702.2.7020633_20251224T120559Z_Studio_6E241_dcd.log=C:\Users\Admin\AppData\Local\Roblox\logs\log_0.702.2.7020633_20251224T120559Z_Studio_6E241_dcd.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://uploads.backtrace.rbx.com/post --annotation=AppVersion=0.702.2.7020633 --annotation=Format=minidump --annotation=HardwareModel= --annotation=HasBootstrapper=false --annotation=InstallFolder=ProgramFilesX86 --annotation=OSPlatform=Windows --annotation=RobloxChannel=production --annotation=RobloxGitHash=0c8ad2b9686151619b76d831ddaaf7cc7a7f519c --annotation=RobloxProduct=RobloxStudio --annotation=StudioVersion=0.702.2.7020633 --annotation=UniqueId=8029256478229028636 --annotation=UseCrashpad=True --annotation=app_arch=x86_64 --annotation=application.version=0.702.2.7020633 --annotation=host_arch=x86_64 --initial-client-data=0x418,0x41c,0x420,0x3f0,0x424,0x7ff7ae8f0c58,0x7ff7ae8f0c70,0x7ff7ae8f0c884⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6284
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 702, 2, 7020633" --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=6244.7012.134206155700576809304⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:7044 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0x178,0x7ff96dfab078,0x7ff96dfab084,0x7ff96dfab0905⤵PID:7124
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 702, 2, 7020633" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,8716417674317375092,9841644160745261056,262144 --variations-seed-version --mojo-platform-channel-handle=1668 /prefetch:25⤵PID:7576
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 702, 2, 7020633" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1996,i,8716417674317375092,9841644160745261056,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:115⤵PID:7608
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 702, 2, 7020633" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1700,i,8716417674317375092,9841644160745261056,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:135⤵PID:7828
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 702, 2, 7020633" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3600,i,8716417674317375092,9841644160745261056,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:15⤵PID:8128
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 702, 2, 7020633" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=2428,i,8716417674317375092,9841644160745261056,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:15⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 702, 2, 7020633" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3644,i,8716417674317375092,9841644160745261056,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:15⤵PID:6800
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView" --webview-exe-name=RobloxStudioBeta.exe --webview-exe-version="0, 702, 2, 7020633" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4788,i,8716417674317375092,9841644160745261056,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:15⤵PID:5620
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 8922⤵
- Program crash
PID:3868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4512 -ip 45121⤵PID:3020
-
C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3524
-
C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:8064
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C81⤵PID:6960
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
PID:1776
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:5544
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:772
-
C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe"C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:6892 -
C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:7316
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DisableUnblock.css1⤵
- Opens file in notepad (likely ransom note)
PID:2000
-
C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe"C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5872 -
C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe"C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe" -multiinstancewatcher2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3916
-
-
C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\RobloxPlayerBeta.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5280
-
-
C:\ProgramData\BlueStacksServicesSetup.exe"C:\ProgramData\BlueStacksServicesSetup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"2⤵
- System Location Discovery: System Language Discovery
PID:8392 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3608
-
-
C:\Windows\SysWOW64\find.exefind "BlueStacksServices.exe"3⤵
- System Location Discovery: System Language Discovery
PID:7144
-
-
-
C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe"C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --hidden --initialLaunch1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:9384 -
C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe"C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1712,i,4390789956703011327,14308671107306538552,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Executes dropped EXE
PID:9524
-
-
C:\Windows\system32\cscript.execscript.exe2⤵PID:9540
-
-
C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe"C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --mojo-platform-channel-handle=1920 --field-trial-handle=1712,i,4390789956703011327,14308671107306538552,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Executes dropped EXE
PID:9628
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices2⤵PID:10332
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices2⤵PID:10520
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A2⤵PID:10604
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A2⤵PID:10684
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"2⤵PID:10764
-
-
C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe"C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --app-user-model-id=com.bluestacks.services --app-path="C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2592 --field-trial-handle=1712,i,4390789956703011327,14308671107306538552,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Executes dropped EXE
PID:10960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11256
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11276
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11624
-
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"2⤵PID:12212
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"2⤵PID:12220
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"2⤵PID:12228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:12104
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:12248
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:12120
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:12264
-
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt2⤵PID:12284
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt2⤵PID:9700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9888
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:9924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9960
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10220
-
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"2⤵PID:7016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6660
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8904
-
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt2⤵PID:8244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8772
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:4388
-
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"2⤵PID:9168
-
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt2⤵PID:6360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8416
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:8540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8480
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9444
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9548
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10640
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:10716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1032
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10932
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11032
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11132
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:11168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11528
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11176
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:11824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11188
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10032
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6656
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:7784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:7464
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:8856
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8840
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8244
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8188
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6496
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:6196
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:992
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:5604
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8276
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:3592
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:3648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9256
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6368
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:7092
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9552
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:6348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10060
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:4316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8940
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4552
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10684
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:1684
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10892
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10880
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11008
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:1992
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:4364
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:2996
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:8124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10236
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5768
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9036
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:7832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9932
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7500
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9236
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8244
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7968
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:5332
-
-
-
C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe"C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1712,i,4390789956703011327,14308671107306538552,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:7720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:1352
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:4992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4064
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:4004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8348
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7252
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4776
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:940
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9176
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4100
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:2392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9316
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:2396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8264
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10268
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10276
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10436
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10452
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8204
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8944
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:2548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:3760
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10608
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:8560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:1028
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:1924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:2340
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:4616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11008
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10936
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11144
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10652
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11416
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11152
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11224
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:11208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:5112
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:1200
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:12024
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1484
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:6864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9796
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4336
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:5272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:5268
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8560
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7852
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:5100
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:3280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9872
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:6808
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10724
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10896
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11820
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:2036
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:12248
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10216
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:11736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1456
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10976
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:3864
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:9920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:5088
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4296
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:3104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6424
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11916
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:2884
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11124
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:2928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4928
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5692
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1184
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:5556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:5940
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4484
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:5608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:12092
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:3144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10320
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4788
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6604
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:4376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:3280
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10988
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:4072
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:12060
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11400
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11832
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11452
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1580
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:12048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6804
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4252
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:7132
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7916
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10228
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8600
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:7344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9352
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:1052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1176
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:2896
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7444
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:6812
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9136
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5808
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7380
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8424
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8936
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6120
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8256
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8136
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9156
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7076
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10380
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:7988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10400
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:12192
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:8492
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7232
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:4172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:12068
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:1396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10808
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10756
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11088
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10720
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9692
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11104
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:11536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11812
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10108
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:11824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10220
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:12224
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:12204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9744
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:3156
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:5364
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6652
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11692
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:6236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6736
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7412
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:6152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:3996
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:5928
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:3776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6184
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11468
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1104
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:7884
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:12124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8852
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:3908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10192
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:10448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6304
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9952
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11924
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10576
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8268
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10560
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:2572
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7152
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:3236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:2028
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:2432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7348
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:6624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9760
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:4232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6668
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:5920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4520
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9240
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11348
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:5164
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6192
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8424
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8088
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:3628
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11612
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6480
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:8032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10984
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:6220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4168
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8412
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:3616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6580
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:4780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7844
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:7084
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7072
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10136
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7196
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:3144
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:1556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4556
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:7848
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10468
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11928
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:2548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10160
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10432
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:11108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:780
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:5824
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:5552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:2196
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6468
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4300
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:10952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8992
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10772
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:12052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6320
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:2912
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11584
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:6868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9816
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11620
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:5612
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11764
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11696
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4756
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11616
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:4480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:1604
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10024
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11712
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7296
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:3128
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10524
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:5768
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6452
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:7048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6176
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:5324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:7528
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7452
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6784
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1068
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9940
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:12096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9332
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8112
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:2804
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10600
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4884
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7708
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10248
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6856
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6692
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8784
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:2188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:5852
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:8360
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:2248
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:4380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7036
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:6912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6284
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:4360
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11472
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4004
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:7192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11672
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8960
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1004
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11352
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11748
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:2792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8144
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8700
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8132
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:3828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9128
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8932
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:5264
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:9308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1244
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:9284
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9296
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:9544
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10416
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:5884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4316
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6336
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:6416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10452
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:12056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4364
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9728
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6932
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10484
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10864
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10244
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11020
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7172
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9380
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10832
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:10556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11904
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:5556
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9496
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1200
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7024
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:7364
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9800
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:3648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10224
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7828
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8716
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9392
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:1832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4968
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10476
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10200
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10516
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4912
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:3436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9020
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7656
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4152
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:11892
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4488
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8872
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9780
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:5800
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:4024
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9064
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:8116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10680
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:7904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8056
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:3068
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:4232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:5016
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:5920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:2088
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:2188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6700
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8372
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1036
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:9132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:2704
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7220
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11600
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7192
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:12248
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:3076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6016
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:2332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:5976
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:5352
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:2584
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9264
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:3828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:712
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10444
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8524
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8668
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:7436
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:1776
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:4216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6728
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:9840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8980
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10424
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9564
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7912
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8720
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:5780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10328
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8568
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8352
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:2228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7004
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:9736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:3972
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:8580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9000
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:7720
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:10788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10760
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10244
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11044
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8684
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10528
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8860
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:11240
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11964
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:12264
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:11772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9884
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:12044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:12160
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9792
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵
- Enumerates processes with tasklist
PID:2316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:3288
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:12016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:228
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7296
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9904
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵
- Enumerates processes with tasklist
PID:548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:10476
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7768
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10612
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:3104
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6528
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7184
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:2084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6792
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:7052
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:7336
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:2568
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9480
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:9944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:11292
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:9356
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:12012
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:1548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:12000
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:6352
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:10420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:4652
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:3660
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:6624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6512
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:7836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:10440
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:9680
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:11624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:8360
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:8428
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:8440
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:5984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:9576
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:3192
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:6724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""2⤵PID:4444
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq HD-Player.exe"3⤵PID:7108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""2⤵PID:6832
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq BlueStacks X.exe"3⤵PID:10740
-
-
-
C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\7zS414D63F4\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS414D63F4\BlueStacksInstaller.exe"2⤵
- Enumerates connected drives
- Executes dropped EXE
PID:8280 -
C:\Users\Admin\AppData\Local\Temp\7zS414D63F4\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS414D63F4\HD-CheckCpu.exe" --cmd checkHypervEnabled3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3828
-
-
C:\Users\Admin\AppData\Local\Temp\7zS414D63F4\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS414D63F4\HD-CheckCpu.exe" --cmd checkSSE43⤵
- Executes dropped EXE
PID:6240
-
-
C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe" -versionMachineID=50fc126a-6f0a-4ab6-a87f-0a1f49147619 -machineID=0cab1d5a-b266-4502-ba55-c65f88def59a -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.153.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:11048 -
C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\Bootstrapper.exe" -versionMachineID=50fc126a-6f0a-4ab6-a87f-0a1f49147619 -machineID=0cab1d5a-b266-4502-ba55-c65f88def59a -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.153.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs44⤵
- Executes dropped EXE
PID:12272 -
C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\BlueStacksInstaller.exe" -versionMachineID="50fc126a-6f0a-4ab6-a87f-0a1f49147619" -machineID="0cab1d5a-b266-4502-ba55-c65f88def59a" -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName="Pie64" -imageToLaunch="Pie64" -appToLaunch="bs5" -bsxVersion="10.42.153.1001" -country="GB" -isWalletFeatureEnabled -discordUrl="https://discord.gg/UnXV7taVs4" -parentpath="C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.153.1026_native_8038ca65e9069377e0dd4e7065e10527_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe" -md5=8038ca65e9069377e0dd4e7065e10527 -app64=5⤵PID:11632
-
C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\7zr.exe"C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\" -aoa6⤵PID:11300
-
-
C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-ForceGPU.exe"C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_nxt"6⤵PID:9656
-
-
C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe" 1 26⤵PID:9832
-
-
C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe" 4 26⤵PID:9676
-
-
C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe" 2 26⤵PID:7036
-
-
C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe" 1 16⤵PID:10004
-
-
C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe" 4 16⤵
- Suspicious use of SetWindowsHookEx
PID:5208
-
-
C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe"C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-GLCheck.exe" 2 16⤵PID:9904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bluestacks.com/download.html6⤵PID:9140
-
-
-
-
-
-
C:\Program Files\BlueStacks_nxt\BstkDrv_nxt.sys"C:\Program Files\BlueStacks_nxt\BstkDrv_nxt.sys"1⤵PID:11644
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
4System Information Discovery
5System Location Discovery
1System Language Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg
- Size 569B
- SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
- MD5 e7fdf6a9c8cae1fc1108dc5a803a1905
- SHA1 2853f9ff5e63685ebb1449dcf693176b17e4ab60
- SHA512 a6388b24926934e20ccf7fcab41bd219dc6c0053428481d7f466bf89f26bf1a36fdff716a9ddd9ab268df73b04dff1449c6bac1f5c707e31ae2ee71c2087e0d9
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg
- Size 653B
- SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
- MD5 76166804e6ce35e8a0c92917b8abc071
- SHA1 8bd38726a11a9633ac937b9c6f205ce5d36348b0
- SHA512 93c4f1af7e9f89091a207ab308e05ddd4c92406c039f7465d3b8aca7e0cc7a6c922a22e1eee2f5c88db5e89016ef69294b2a0905d7d6a90fd32835bc11929005
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg
- Size 569B
- SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
- MD5 3221ac69d7facd8aa90ffa15aea991b0
- SHA1 e0571f30f4708ec78addc726a743679ca0f05e45
- SHA512 5e2de0abfe60a4db16ea5e8739260c19962fbfc60869a77bde6ab3547ad8ee3ad88e74e97da31fa23be096afddad018e431d152d6d0fa21a75357a11dacb1328
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg
- Size 653B
- SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
- MD5 dfddf8d0788988c3e48fcbfb2a76cd20
- SHA1 463bb61f0012289e860c32f1885a3a8f57467f2e
- SHA512 e708c5114c60f7574589d6a56c9faedda26ee4a40f0eeb25f5e12eadcf790f24fdbf393fa0aa6ad449b5337d625b092d6f8822472fa8a6ce1339aca59c50c3ca
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
- Size 9.2MB
- SHA256 4548806365098352307f01e9a9fe955e5b54e38fbd51620aace39723eb84ef86
- MD5 45e62d7051fda1d0f2f078cc0a2fb6d7
- SHA1 6f527cba6a1b8255f755f361b5d588d08e179e0f
- SHA512 c0f5e40d67af0209e197b5ab9d2f328e2f9a96f9a23bc15dbbf9f28e703caedf688dbeb604d0cab5457448da9a6ffcb0003a80bfe7cd2fd205ad75f06b043be7
- SSDEEP 196608:hPx09F/Bsc9Q8M6Nj6iLLLhC66ZoABvqq:hEDm6h6iLfhC66Zo0r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\BlueStacks_nxt\Client\Assets\exit_close_click.png
- Size 447B
- SHA256 caa2a8fe9b282939a21b86f8f61fb0c9452222cc3409f06cbb0dcc45613aca8e
- MD5 b09525b48c0023f893d6b64d06add4b1
- SHA1 10ecd439ea04e02eefe17f6c110d0c0a78a1db21
- SHA512 c6f5a7014c24133eb576708ca17d15becf2b45ec278b3f94e5275e47c78cf0f2eb8bb1a17d277d1a665039f38f2e25faf830e275f426b0a94c6a3da096b6204f
- MD5 SHA1 SHA512
- Path C:\ProgramData\BlueStacks_nxt\Client\Assets\radio_selected_hover.png
- Size 577B
- SHA256 4786cfb7c98edcf01d6b670abf19c50891d56a4de87b96a5e17be142b1af666a
- MD5 47ff3e4cc15b8c4a07e3ceb6cb619b62
- SHA1 0318e54c613b8ff00f54d843e90ef88310c1a96f
- SHA512 0212bd7f6cee390d3bc221a22189b75407fa660a0951c7f768645bf97e7b61ee86fa9b1de6f546ff1151560dcb3b071db8c14a7b08b0e771b539a817b31b154e
- MD5 SHA1 SHA512
- Path C:\ProgramData\BlueStacks_nxt\Client\Assets\radio_unselected_hover.png
- Size 480B
- SHA256 0ec39ed4bf89a341f1b5aea56d0e99ff5c923b9c3a6a81adeb9ff21764136f92
- MD5 22efccf38e15df945962ac85ac3aa3b7
- SHA1 b94a8615dc92982e1637680446896080f97c2564
- SHA512 41a4dbb57abed1a16aa84c72c202da461ca45cbaf68f69a10cb3e5529e8dff659e89f7f4459d1e2e8f3549c6fd51f23fc8422f86667577ebed5ab5df149c79ee
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\10461fdfb35f35cca13dbe35dcf21343
- Size 3.5MB
- SHA256 73c9d9a9333623a070ccc1e5f6cf325d83f1ef9ce35c4d255b66a1733f6e6a91
- MD5 10461fdfb35f35cca13dbe35dcf21343
- SHA1 42806bf7d078a0dfeb1e462bc9e5ad6e90159b7e
- SHA512 15b6bc4c957ef618f56188227bcffdbda3ab990ba80362d3fe89f97e74a01763cd46bbbace7548d5a29244dbaa842da0c7f9e449b2df715f33b708a5a629d3ab
- SSDEEP 98304:LnvauOC4zP8kaSRljlFUkXqUU3aSpTMKK7d7RSktipIWcLEq:brOCuP87wlFUgU352KK79toIN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\1d0390337d1a4a58e5514be1a9481ad6
- Size 2.3MB
- SHA256 c79f0eeb2bca4905c585c50333db3c6f727a554f5db82e64948f93668fbc18aa
- MD5 1d0390337d1a4a58e5514be1a9481ad6
- SHA1 0c09b611223f335af2a42dbc371dc95ba4f18979
- SHA512 382e5d7a61398d54bf15bcd928ec7755817fe92a860840efac6f6417229678cb1fd1756c5a7c82e02754a23732f63882c4a640bc6d73d28f30110d0028ae6fb8
- SSDEEP 49152:DejtLQNcZOH6b3nbU/s3lgwvTS2sqQFIPg8Fb5iLcWvFXO2+xPh83+H:iJCcbz4/YlgwvLtQG4mULcz2s583Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\3895cad38200dfade0370f5b28c5167b
- Size 379KB
- SHA256 38d14e78f1ef008ca9e1cbaad344a7aba1a43c70826c7839bf3d9ef9877768a3
- MD5 3895cad38200dfade0370f5b28c5167b
- SHA1 195aa9e6cf2dd93d4c895781bd3503337539a3e5
- SHA512 da4ebadd932feb4369bcf6a31fcf44ab07eca2a3ba055a2a207adc90a9863241c4a77ec1e6140a457f9f3c44f51be6e10d8ccb7ef0611bef982b973ed5abe6d8
- SSDEEP 6144:6vIEkFlF8j41HOuvUrx2lDiDWVVNy7a5grz82XTi23906HSJgMTCBRWf2/1f:6vBQz8UvSyVLzKz82jTi6yJgkgRWM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\697aaa85b0cd30b5198ce95b1da77fee
- Size 593KB
- SHA256 2929780b31f1261c303d5a3b0f699173edcd67a3cc1d95b9f8f2cd579f209b79
- MD5 697aaa85b0cd30b5198ce95b1da77fee
- SHA1 d9ebb3d6b376b27b02e819a764c0368214c725a0
- SHA512 acffa72e8426beb33890feff6d8358d59605fbc8f7b19ec45a8797f4e5d87f8d8a90ba07696d58a520bf7e5d982457c4ed04ee93d7fa13f2e9d7eb8ad7dd0c56
- SSDEEP 12288:P01BG5iXCE+zE5cbi5fssfl5jYFm8h7ifb0JvWJPPCFq06P7lI8:P0nGAyE+zE52i5fsiTjYF54jWvWoFqrD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\7c1119ae6435b35d30a63f1051027dbd
- Size 276KB
- SHA256 eb9473638e2fb1c319ee6cb4c0aee0bb7d790ac0a01dd0c2bf770eca062ad377
- MD5 7c1119ae6435b35d30a63f1051027dbd
- SHA1 004bdcde905aacafbefedc235b7576f35854e2ad
- SHA512 eb86af6f01cbd63410be68fbd1deb6f5cfd8b6d8373bfc8c1ecf168a5b0fa89ccd65b667b2c763e8ead3cfee24806f24f9241811be2026fe4df7f2e0fc4ad236
- SSDEEP 6144:c7bhY6n1SU5QJD2VufLx+F/s7Caa8sjGOFis5:sxwU5ADsO4STa3hF5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\8f379ec2b22ff106b837d79f7fdbf0d8
- Size 13.1MB
- SHA256 6620658a6288e6b58b8d86aaef4e7734e10778974e9a01d364fc7aac4d35f10b
- MD5 8f379ec2b22ff106b837d79f7fdbf0d8
- SHA1 977223c04f192d8a157603c1f18d6d6a301e88b1
- SHA512 1aa837f64e2d9652221ed5bdbf78c353e04a0536d09a3502a230b7f2f034dd404bef0e1a4ce57a42cd03f860f64965d94c2b638aa0994a3dd41fdbc6d751458d
- SSDEEP 393216:DL5briJop9j7Yl/feBa5tMaNqGOGwdCUQUJ9Y2Ondq:npWJehYl/DFNDMJ+2Ondq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\97327884177381d0f42d428110b4c516
- Size 3KB
- SHA256 b8d4802f5c25d188268bf6a3a1c72a00d56a7b3f7fe64bb7f5fc4d6e8f6b8a28
- MD5 97327884177381d0f42d428110b4c516
- SHA1 f1486a304c7b458dcbaa53836632d723f0e87505
- SHA512 9fae3ae92fe1073f7e720eb6da6ad99c19bbcdf6caad9408feff07140d5df9f845f0e5f652ae90a87185bcfb0a90287b4e0da174f1b0ea1e7055cab16baef369
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\a7d45920c6a193206a6abae040eb50d0
- Size 4.8MB
- SHA256 c76180c6cfdf9f9c8f78c05f2e24dcba14424b030ad74db2965fd50ae217ebb8
- MD5 a7d45920c6a193206a6abae040eb50d0
- SHA1 540715b0c6582d5b177c7714e0b26254cb598c9a
- SHA512 541ff8a6cbdafe8c2920a365802dd1b4dd9e04fc35e10e8da8c4ee16655005d3009f6c168ae6f53922bfc3cf9b320ed4438d5e3dfb2d2d7abaa080842e2ae559
- SSDEEP 98304:CITdulYTFdExsVBJc5fqP6PP58ynUaufWGAtUc9oY4zx8t:DglYRYSitU6PB8iUa1vUY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\bebd2d622e4acf2b160878ff02350cf3
- Size 5.9MB
- SHA256 bbd033279d1b5a4d4cc852cc44d61d168519018de37ae61ac14820e77eeac6e4
- MD5 bebd2d622e4acf2b160878ff02350cf3
- SHA1 43d9d629dae1ff068c417ad14bae4b49fddbce9b
- SHA512 d789c549846bd294b51270169f640200fb78b3b399214a5afd0b9f799e8bc5a9335341482bf860978b2ea51ff46856593ec64b0420af0122a2b6a2be5ea94299
- SSDEEP 98304:sVd+l797dCsnCavaYbq4fQXxhpLF/ciKysKLmd7YfSJAcEsnYdTGWaxGEEu8hTlB:XRZ7Rvm4Y1p/NK3KqufSicEsngJ9Intg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\c15bf080c272b587b050fdcf0c920e4e
- Size 297KB
- SHA256 3eafafc63239a030a8e5a06f09b2c6e7837f044ad93c5ef2e1ce29bebc2d3761
- MD5 c15bf080c272b587b050fdcf0c920e4e
- SHA1 ab8cd828109a9a4d74e647aef6cab08e1affb0d6
- SHA512 d8a73698555e201735803325ea43ed3ec45c5276abfd2ca16f4069287e197d8872f02b390a66fbab2ba15dda2567f9ea0981aa6a7d1f3f1cbd8196114b2309b5
- SSDEEP 6144:Ki78p9S7Fag0oVqbuzZ18PAOWPxIeoepYpeRW3BExmWuj8uPlHVxwYXD7:Kik+FaLoVqsZ18PxWZI7eKpe+B01UHLD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\d1e80bdacf3d7f5bd1f63eadfe30606a
- Size 5.7MB
- SHA256 4a8f2cfdf3080c354583b84e1903dbd2f2e7c96a07c7105fd9b4763e02956053
- MD5 d1e80bdacf3d7f5bd1f63eadfe30606a
- SHA1 770f2fd8ac5cd2508872b1947bb28191dd4ddeb8
- SHA512 e495e156b1cd9942b816f5f9bab6df0fa6e00f5ff880a1de4f6afc3c4528ac7210cdda2d091bdf35e5622c5e2075eb30c5a35d1d9a37d41dcba619330bc04158
- SSDEEP 98304:MPozI9K4jo9oagQ0ParlUCuJ9P3Vt3yAcowp7PcA1VyzKSpPd7ibGGg5caGctpTS:Mg94jwoalYarlrG9P3VEZx7PcHf5xiao
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\eb9dd4d0637fd6ae21747e6b6a281d21
- Size 459KB
- SHA256 5a3aae5657899b6452004f3f43f122cb6c166c99b7261efbeb965da906626ed8
- MD5 eb9dd4d0637fd6ae21747e6b6a281d21
- SHA1 387c79caeee5a5a850e328f8b9ce812b5048cefd
- SHA512 f9b87df46149f2fe52690e3c906ee1cfc92e3196b8db50210269312999a56b9aff354b1b5c74da192b37646dcee5305d8afde6d2c80334a484b1a8a375950b5b
- SSDEEP 12288:CtpZwzl7szmrFyHHU8ibAQXgwntX3dh7ZVNx:ClGl78WKHebAKtX3D7ZVNx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bloxstrap\Downloads\ff7510896b3b211e561900b0c26ee502
- Size 278KB
- SHA256 9954e5bd270134d917a3d8eba66e83b59aa6e931ca4bc512c1e955694b1337b0
- MD5 ff7510896b3b211e561900b0c26ee502
- SHA1 3b91c72fcc4cce07514433717dcf2450ac17cce0
- SHA512 28b1eee52d3d1566cb0dccb320d1b26f6be8dd52a0ba00d4840a5a5d1df5a01b0dee0b5df00a8ec4f1f2edf171cc03a119b186b46e6c9006c083aabc1a35dbf2
- SSDEEP 6144:kDDuoEp4kmw9zPJpwf6Mqc6UfditVFI+Q16FZjK8AvXXHhCgSaU2XZ5LVQ:kWoEp4kmwpJpZMqvykVpQog/BCglTp5+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bluestacks\BlueStacks-Installer_5.22.153.1026.log
- Size 193KB
- SHA256 44eca715ee102273e54fbfb1a4e4b820ec16f0357c42bd4ab3d8caf075e5b9ce
- MD5 c4001f4d8335de226f69f71d7bc51a73
- SHA1 604f280d967d581d69a511438f7120eab65e58d9
- SHA512 937dadd4853236d92ab4f572991a9c54cbc7d78a5e8451f9cd859c4d82b296c0451eef56d84d408e686bcb41d4f68c62f52fbef32da09c275ba7cc65bf586464
- SSDEEP 6144:YRWNi+KTCpu0WWSI9LQOM9+qA9LKabCRAIMfibKFQA5Qcc4ZP:YRWNi+KTCpu0WWSI98OM9+qA9LKabCR8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bluestacks\BlueStacksMicroInstaller_5.22.153.1026.log
- Size 51KB
- SHA256 85fcd13f2c887ae585c0c4f1f908fee0e51afe856327e271d8a24d5df1d92ab3
- MD5 8fccd61d01b041334ae5f3ed3f2dd984
- SHA1 4c65436b9edd05581d8379a4b67e233a7dc90269
- SHA512 9e88f2036ba60d8f905cc65ad717fb68249661566e91955f926aa00c9bcf700df4262df88e8b9592ba76ecac9f00e06654fb06ad1b23936f11d0553a15fb6481
- SSDEEP 768:p/7BiiP0pVMPGEYyWzCKx/PL73UTnSY9WhFToTvuRS9g/qE5JV7WBTpAS06fIuFJ:p/7IL7jWc/V7iLz7hx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Fishstrap\Downloads\0212a4ec6a27a9bbc85d2c83fafc7807
- Size 81KB
- SHA256 3d5f355150eb49281583e127a760fb455b7708acf69b07f7db68f74f5a1a7077
- MD5 0212a4ec6a27a9bbc85d2c83fafc7807
- SHA1 f5e51d5f975280cf59773b67ecc066cf197469cc
- SHA512 ee918cfbfb9c87afe65835b71ec1d0530ee08ecfa114756294cbae4398cdd80da9b4eaf6bbd88a3a27602bc59089214e0d918e080e077917e573bedb17ef3805
- SSDEEP 1536:YvP9ZIqELBtsTZs1u++7JT32d4xA8ppYXFpfJ12+42tUES0psc506DrjHL:mP9Z3Qb6+oj2oCv2UQ0e6DPL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Fishstrap\Downloads\51f521ecfa96c8b212ada54aa5ba689b
- Size 802KB
- SHA256 7dbba0b1020a46ab2fcc86ff5954308513c89af22255e4da61c49e0ce289f1fc
- MD5 51f521ecfa96c8b212ada54aa5ba689b
- SHA1 14d9dce1f52090bc871a13f7b9fd65201a8be346
- SHA512 356763329247e62fb110f71c89e29b6433f0b5e8ab58825fc880a7a615d704942965ad3bed3fd158d4bef7cff3372d7e8f77e71313f4298805a0f6f8149f94d3
- SSDEEP 24576:5GaOJFzlvrttFAmgH0ro5yOs2zfhPWqozMw7:Afzlhtq+oDsuZPyH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Fishstrap\Downloads\8414d367a2dc833d19f79dde1285f7e5
- Size 130KB
- SHA256 4d942c675a479533109adfdfcc39a7ecad907f5e0a332007ed372168a91b305b
- MD5 8414d367a2dc833d19f79dde1285f7e5
- SHA1 7dcc005fa614d0ba1bf6b96ef7154ae04fd168bf
- SHA512 7ca614a2463e2637b590c4725d9330c297a9c31cde982a940d6d9bb1cc39390beca1bbfdbe40add7c26a622b079cb6dda1b38e5443fb7ad29e3284009bdc1c4c
- SSDEEP 3072:4TuBZhamBiAUWIiZ5kZANN7EDCBn73fHTS6KTE2prMQ5UFqyQUa:u+mmsP05fNdTSFwWXUFEUa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Fishstrap\Downloads\c01ff29725784be4dd770bf3ecc89689
- Size 7.1MB
- SHA256 24e57794409212c6810d7e6f8971b236c6c5a0cf512252f36197caaa737ba1e6
- MD5 c01ff29725784be4dd770bf3ecc89689
- SHA1 47f6028705ebec04e5bc7f73766fd62e7426beaa
- SHA512 ed01c8b31f3827b935538aadd081fbc6d2d1e8625faa329f723c2d75392c12d87bb8c34bb1380998d8b4f5b9f65a1c82b43f9d36bdb95f5c054b91643770ecfa
- SSDEEP 196608:9hq8lwFp/f8Kt7lRPGDm7PQyqwNm6uikzjhXXvPfc:kH//PPGJyFkZHU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Fishstrap\Downloads\c16a8be4bc52f4b7e48b7e96d715910c
- Size 17.8MB
- SHA256 83f578112f1087d1bcde5700e6812a83f14a6ec894c8102f2154cd79719cd645
- MD5 c16a8be4bc52f4b7e48b7e96d715910c
- SHA1 675b044a40849e7ba668e28386ca51ccf8680979
- SHA512 d54c90f1f508d7ac788f5b327999b44a755e871a4be5fbbe81e45517b5d555fd455cf9534f64ba378f0c734126987cf8e24989eaf26875ce2c6d07181236fbc7
- SSDEEP 393216:EbAo4IyFW4wcTdyhbxvca0HfIYT5O/nSiwQw1/LpCvLLESEHtKNpcWkvo:w9WFWuObx0/I0YLM1eaENpcWL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Fishstrap\Downloads\e257b2ee808288f3c69ad8b1f408303f
- Size 12.3MB
- SHA256 6aff59379ac15347de77cd83013361ac43af98b1634bb62b19980f6c221eb6a0
- MD5 e257b2ee808288f3c69ad8b1f408303f
- SHA1 ae650eb1b6b4f488569d8cc2372b64bcfaa6c7f2
- SHA512 754cc9bda20119fd64e2c9fd09a40c906bd722996deb5b5ba0aacb5697e3cc6779e1859ddc0069cdaa1a4dac2e511b4ff12f9b6d1de0830bb1f04cc5d2729e93
- SSDEEP 393216:Dq2SgoAE7a9YyCWhL8T2Z79T6EU3n4kEAEwtPT/x1V:DdSgoAE7aXCWx8y19fU3e3a7h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Fishstrap\Fishstrap.exe
- Size 14.3MB
- SHA256 285353b592221bdeefd13280a100a46b0ba30c728a9c1a019efbd171f2c73116
- MD5 24a33eacd0a4511ae262271333b469e1
- SHA1 f81cd52ac1aaf90e20fedf1212f768487296151b
- SHA512 774d9eb6b5c7ac31fab715c09bc7b028dc801b634227e26f46fdbd9d20801f3620f0f84c736d809d36bade429d5f30913422a21f438ceb7785902a18dcd71dd8
- SSDEEP 98304:1AHTsyxasIwTsk+ZmD37OYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTlR:1UsyksIysk+ZuObAbN0a
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Fishstrap\RobloxState.json
- Size 1KB
- SHA256 5ae1aed548664e103aeee381bff533d5ed9c1299744a30a2fb953c767731070d
- MD5 689cf2e735f99b43cfcbe8851a95cc30
- SHA1 61109532b6a5f3d7435199332366d3a47bed6285
- SHA512 8cb75d67bb28afc27dbdb26566a558f21a61702e8c13aebd41f56cdb2f19a09f6d408b898ae42f1843e8eb0ceecd67c4cbdcbe84f0865594890942b1daf3dd93
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\ClientSettings\ClientAppSettings.json
- Size 56B
- SHA256 9b14564577c6c9185200d86d6d36aec65db3652c64f5f594587132fe51c71994
- MD5 d858cd3115fea6ed7af33730c08b3908
- SHA1 cbef23640a7afd4e40ca030695139db9710fc827
- SHA512 341506375cba76a8cffa514bf1c113f056408acd5f36ffcbae2a89d875b964c9b86ab7c9401e7074862a3755c1e9163479d82d68953a3e17a8df37a5587edf19
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\ExtraContent\textures\ui\LuaApp\graphic\shimmer_darkTheme.png
- Size 5KB
- SHA256 ecb28d097323d8017b99a86c67d054a74afd0cf54c0171ef7047ec67d5975ce8
- MD5 ab028ee06f20dd0bcbbd63b0d08c162c
- SHA1 43da72e096ce135f941bb1e3005c0de521318426
- SHA512 de5dc3227895419e8e956060a4fefb340ba6231d3f630dfb747f06c7a47f6ae2e71bc18fb9e3dd8c7d6e89f620a1b2b0bec876ef012ad7185eea07d47e92744f
- SSDEEP 96:ELBf33Pf3Xc4+4pCNzBoW8iu19KaJaZcapSfEgwub7YxCAkk1oxuK4lzDeSsEMOZ:CBn//+ySVP85KaJ4c0Lgwu/eo7xuKQsa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\ExtraContent\textures\ui\LuaApp\graphic\[email protected]
- Size 12KB
- SHA256 306f773f482409392931a602bd460d08876ec9e74a9f8b21bb751d45e786a2f4
- MD5 3372f60eb6f3c6b245b6c2dcf479fa76
- SHA1 96e317090937dafd5332c7c9c4eafe402208b642
- SHA512 d6dd7fc7a3e8f1f4833ec4281c1c40814c10d8d7e55660148d288e5fa102563181211cca34977ac46c9ccb865be43d9c37321612514fce882f7c3e083037c36d
- SSDEEP 192:YBnfbNlRp3/QULyzq2yw1DsON2bzD3y/Y5QCl1AVBy9tVd:UbDRVQDq2HmOozD3yACLy9t3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\content\configs\DateTimeLocaleConfigs\zh-cn.json
- Size 2KB
- SHA256 ef7f5de035bf013df39a8c0e6131cc96894784e6a15f7e811ef2cb1cfa313b50
- MD5 260d5505e5fbc365c77933f679697b8f
- SHA1 9138cf932b992f1aa1daf8859c9c0ab3486e5a44
- SHA512 b1c678bdfb30399e95e971db39f83007c726e67bd8e7471050b3ca6c9e42cd4ace074cd34e606417794ef87ea3e8483821df605938187b17832589fbc6a17543
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\content\configs\DateTimeLocaleConfigs\zh-hk.json
- Size 2KB
- SHA256 3575fcb6f219b6db23b8b6997b34d6834957b291ece9cf83c914fe86c74f1421
- MD5 634a3580f3f7fa371a2e88e711d6a487
- SHA1 eda07b251efcb95f93aebde85ea9a326ef835f28
- SHA512 476bda6cc7fd949af6eea5c1c116f7e506c72677fa080ea380a51d7b4921e0c2ae5698311d3d74065c0e9e4de309e6a870acf738e72c6e2dfb158f77ed74f401
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\content\textures\Cursors\Gamepad\IBeamCursor.png
- Size 173B
- SHA256 a4c1df406562c365ffe09341d11d80bad7183bc4b49261d8772f7b7a4a90c114
- MD5 896662fd84cc16af2ee2a365f1bd5ebd
- SHA1 d4cbcf2214ef24f74edf0f5027c5ab9c7cc2ea42
- SHA512 a7a03252777d30dcd83e24ed6f8adfec9b587e175b0be63bbbc1bac304c291d489504f84f12ba38324fafe44565de002b8613ab1b0e9299f4da2e733dc989df6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\content\textures\ui\Controls\PlayStationController\Thumbstick1.png
- Size 428B
- SHA256 6463537cb0af1671f22852f50e334eda0fbb5489278233c18c0413859e37253f
- MD5 b18c405e2f7622cafd138031fee3c695
- SHA1 0a8d56e0e9b52bc3fb4e392592217b40b9c17331
- SHA512 3925c69ddbaa6c8640160395c419906e759fc38c1f0d39611bad26c3cd29f5dcb8d4937fd606c8517bf46ac28bf26c66d094c7ca341c5e8251abd9d3203d8478
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\content\textures\ui\Controls\PlayStationController\[email protected]
- Size 684B
- SHA256 4a918bdfaaae84551a4685957fb87d0f9bb4a290e8d648bc93bba9f644d91331
- MD5 23e90ee86f676edf49af7b9bfe2c9755
- SHA1 585ab86ab99cc4647b08080442a6cebb0b6b762b
- SHA512 6ff1f608672f6126d738f341ba1f109f4f087df809a5870105b779e7bfedaf4d3bfa639c86a1ceab212e7fd791a4ecedc4c531c5bda9977a0857651273fc8689
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\content\textures\ui\Controls\PlayStationController\[email protected]
- Size 964B
- SHA256 2bde947225b1260fae98678f046a3164a87d2ad2216d848810092ff96d8f6191
- MD5 0d489043a86429b35abc19e3808ba6b6
- SHA1 c32d12f69d058a82c0e31bce08903e93e5c08a53
- SHA512 8b1cc82a3e03362badeb44ad9e3ab2a2bac941b139c5ecb264f5f016a87a0e85ab99406bbad5b8b82cbcf960a59b24eaf07c54056dfca1871183d464ec2077d0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\content\textures\ui\Controls\PlayStationController\Thumbstick2.png
- Size 479B
- SHA256 65ec5f1338e3f0327eed444992e39ffee166c49cb7f9f4a861cfbc0ee48e0659
- MD5 dd201ff9573ffc0d1efee8ec5220dc0e
- SHA1 637b7c49c32ed66e726c6862073db26d9d2dc91e
- SHA512 f39a6bb930a6e42a36a274cdf04f4cf8c9c20750b8f713e1bd6c71f220ffda7b6670f8b9df426a914f03f18961bbcfeb5514aa3301092c871b37c64e37b27063
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\content\textures\ui\Controls\PlayStationController\[email protected]
- Size 788B
- SHA256 ac3e0ff3b3f27c3166b2bd094af831aaeefc1ac13b1f08300e3f459d32a3ac01
- MD5 e4952dbb838a2d656c41c868228e7e82
- SHA1 9632b606076579578889ae6387cef652b1469de5
- SHA512 633e9f47999a779b02ef7532751d188525ad807b834b0059160527a98d181c9f17e2d17f8e30e155f192cedf0897d45a2d0780ed86bbd7bac42d676b6b3af1d7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\content\textures\ui\Controls\PlayStationController\[email protected]
- Size 1KB
- SHA256 1205f9bebc6a97ca393ba56c4db5a8ab82e0670a994fe2f0eb7b97408062f805
- MD5 c79d39f61601a4c81c1302fc21ada4ed
- SHA1 a4698ac65de3e5ad169375debedf6119ea7e8ece
- SHA512 afd6993833d678a2ba0ba0cd7f6f3bed3a09bac45b11bb645b91faeb35431d7402adec77f8d9fa7669817ea4bae056e8c93f8bb193787d0c4fad368fcd5db1e4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Fishstrap\Versions\version-5b077c09380f4fe6\content\textures\ui\ErrorPrompt\PrimaryButton.png
- Size 153B
- SHA256 87bee76a03bbf469e4a5f760e17dbc1a834f79ef64e95349f1ab004a57078968
- MD5 4b9b8710aadd6a5bd4b5be5d5c06ebf9
- SHA1 51a030cc4ed8067cbdaa8cd4f84653bd3bf6854b
- SHA512 c0fdd6d9a5ab08463c7e3486ecff6db5fd7cc6fe1bbbd4a4481c1d3d1e3fe12000e302530929e497491847b594128bf2d70af1a3f460839f2309ad9cc5869784
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\57e2fa6d-214e-440d-8699-cd8a29f76f86.tmp
- Size 85KB
- SHA256 3ff8a2bdb503c28f2ceb3ff4455959461b1043db30b215a864710d8cf22165ea
- MD5 b720c5d66af99baeff829b0f0842693f
- SHA1 aaa58e98ed9054e325630e27621da63bada7e3de
- SHA512 de0a787be749241f5c6d619d5cb80b50ee3308454e42c65b7548dc76873ab9b95db820ab09d09a858dcac89d2dbe5dda1de598b910f77b36355d701d4666e34a
- SSDEEP 1536:XHdjxC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:XBxHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 7613f6f49920f54660b0248d305535d2ed86765e109194e470948828c2fbb018
- MD5 31a4cb09eb51993a8734ea0ce16cf71a
- SHA1 3ae1b0a0bd7e6d523fa5feadc54a0c25a137dfe4
- SHA512 cd163ecac7983a16705484ebfceb64457047e46a8c57a3fdac659585193be5c095a08e439c76b383f0753d8aa8504594dc313939ec2c1f9ecb6d15586f5b7031
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00010f
- Size 86KB
- SHA256 297f089dd5b5e8b555aca5d67d41fa00a7448b8af9e2c82ba732f1fd85d7053a
- MD5 333eb48a9e916fddcd055805fd4de880
- SHA1 4ad279baf43f1f22b00c34381cc0e0b31f625d0b
- SHA512 25b5b91baadd7b0cbed83ea8b0b7567401e9a8f05c96cfee44a5752aacad295ba0bbd4e074413eedea82ab00d0c177963a6123bc3a177d8ee8ffb6a99d6a794a
- SSDEEP 1536:R9B4XxDKyIySJChi+qPjYHaLs6OZrrSW3eZ6LLwJ/RksoWAZOGGMP9eCchwJM6CX:Rjv8yo6LtOR9Ch1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000118
- Size 51KB
- SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
- MD5 588ee33c26fe83cb97ca65e3c66b2e87
- SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
- SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
- SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00012d
- Size 354KB
- SHA256 0d4241379bac03562da9b75d71ad9a3d9a98e34eec933dac3300f1eb94a62c68
- MD5 d5a88a50acf2965794ea68f1fa3e1f64
- SHA1 9ccc97ac9d84a4943dd9bd3ebc9395a34b5ca2b1
- SHA512 332526b8e9743fa8980b56d13da14b0d3a7f785b801793cbc877561c3c59317fb7ca32a8b35fe317fb6138c45ed363e163606be7e0a23c528663a86d9e380d0e
- SSDEEP 6144:5FWTF/XtLNhwJjt7ACKS8UJTgEIMy9VT683jojgSyWoMctyO4hrKrrLaAo2DiGB:5FWTlGjpAGHyrTD8gBvMcBgeTorGB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000131
- Size 38KB
- SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
- MD5 9436affc97843765a966b3568fa7e5ec
- SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
- SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
- SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000133
- Size 78KB
- SHA256 7f0fb44e9d5c9b99bddf8a3fc9edfbbdf74fcf1e2014aae95a0612c3a2cb8b4b
- MD5 a9c5c831e5888251f8c2ae5b96c0f4bd
- SHA1 cd245d28f3e131948240ab0fe190e291fd940f06
- SHA512 f3152a434125b8c3795aff8019b31816546e9d794483359ba07b7b417ed24790e274fdabfd5e682d344ebc73bbc91d3df1dba2dc0333b6c1b989844575790123
- SSDEEP 1536:1PTxpas62vaI0SakHTBIUaa/lgqlvKPMeVSrL3anMXT9Mo:0s62CDVUT/+6K0eVSCnC9Mo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000135
- Size 483KB
- SHA256 e62057151469cd98742743abad3735f658186bf4e7721b90a177e4e542d6799d
- MD5 d35ea660c5c97cd42debc9bd6183133c
- SHA1 24525b7f3ae39d809fe7fc59aede025c13ce9ef8
- SHA512 dfac77d6bf2b2489491fd41c38ce3803b69489094dc0d6ab1e643b4a6ee87817f7fcb14c2e4d76103d4dcf55d74059311381accdc8febc18baaeb750496b4a92
- SSDEEP 12288:t+rzVVnk0kbocEYwlegBNIpCRGXng/XVz/uHoYgFn1:A/FcEYgLcQ/XVz/uIYg7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000136
- Size 60KB
- SHA256 ec718c4242334754886274bc99feee1a680e54f795a118d694c482239e378d12
- MD5 7313bd714fa0f465b5223418996c2e2f
- SHA1 6ec49103d3e0982be0a64065db3f1303d66517b8
- SHA512 24e21d32b78919274f6b9ba59be41f77dfe78865e07ae3fa347855f5c9e471604680c1dd7d1e5ccb2012e44b9330c8acf4271326ab3feba19a7207901d9c3e38
- SSDEEP 1536:IryeLJHk+52ewDarWwFxaRPSRMYOpNnEoRQnGA:IrVLJHz5zrWwFxaRPIVOU0QH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000137
- Size 70KB
- SHA256 7ec37b162a7c119c75ac3f9308f777082e5b5c9a8209a620f18397e01a90bcf4
- MD5 4ef45c6b1bcf3e62503b3fff10579f9e
- SHA1 2e8d0b0d6bb33c82ccbf5fc25b560f4a994609da
- SHA512 55e507a3a139b9d784aee9c2a8ea5048c4c8057ff0d1096c7c0616cb0cbcb386dbc2b7e052d9455f455a0298627545b39ef36facad5bd1e87354a9c412188cc8
- SSDEEP 1536:Q5tyyWen5QOeM2J8zOqm/+adPa/UiJB+eIivE/cDnLYtS7lBQ:Qr9We5QOR2yKqmpPYUiJB+eZpYuQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001bb
- Size 39KB
- SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
- MD5 9a01b69183a9604ab3a439e388b30501
- SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
- SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
- SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001d1
- Size 19KB
- SHA256 33f350c03d10d996cc362b8cc25927562231e97abdf2e021b537feb4def58695
- MD5 8564e337da2539ec15ac07d025a91beb
- SHA1 e48a1dce656c25e124943304b55df25cedba02df
- SHA512 fb40782ad377115859aab650c5c96da30b9a2ab24a31b9fc3c6b4d4bfd2fadbe3d8999e258618ff5a79b7f1801d461223d69018442331606dceeb0cb91fd6e50
- SSDEEP 384:JPkTUYe2r6jwTbGI/u359FO6bSXYP3yqekN51OHlmt9kUjQJ:5H26jMbG7JXbykyMD4QteJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001d2
- Size 124KB
- SHA256 c216371b5bf4221d0c0f2b659fdd248325b3fcbf10868266d790237f72042065
- MD5 e55416701d37112b4c869339da1b4f55
- SHA1 1069167b51b25f61d63720ad270fd6ef16667728
- SHA512 abf11be5c329132b7914cd86924659d1b0429e84079b38fab54ba0130cd310f89586ea2607a7861cdee89e35af081188db247004ee0229219babf8a4e0df5fe7
- SSDEEP 3072:me+5ArpS0Qq0yM0oZRvvi20zINV5g4eitgrNL6DG7FOb5qRhz2Im:mv5epEq0n04ngTwcuDGeQPz2v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001d3
- Size 123KB
- SHA256 e5e030164a545738c085dd3fbd998070a003f57a8a8454115f69d6975ad41326
- MD5 1400c1d9992dd3450f640f9650b9b0d7
- SHA1 f6cb3236379cab8dd1c524240c62d3a70d84a56e
- SHA512 07dd2f39967156e10c44575bfa5ad39f92e30c9eaf966c1c39a10056e6ad96194bcf19f645a4f7193ffc9d82848952354ff90fbac6f1f99207b21a6a4e627438
- SSDEEP 3072:uW1W/oaZ9401TeEertrPNYB8t1WgaQiia3alT/I/sLk1yzdv1:k/oaZ9nfMtbNA8mlQLa3M/I11yht
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001d4
- Size 75KB
- SHA256 1318249b021376f3a4ee408c4107180d9872be3990e89428d4fb6eddc034c02e
- MD5 6e36b8150471ec8a473d8ada2fd34a0f
- SHA1 a6fee32037965d9e16217686f436c8c49d2eba8e
- SHA512 43532f3b9da78b4c8fb86391991325be7a1e9eb2d232d41b078e9066e7ec67a8fa2022036326989fb795ddc764e01ffd6e218867397c36228b46c1bc25f995d5
- SSDEEP 1536:je6Bm9AIa6rFQiSfh6QdJrSwRbzr6hSH3vsviphBH5Mn6Wgl:jeD9AIaBfwQHSG6Q3E67R5Mw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001d5
- Size 52KB
- SHA256 c90753f7eb2d3199f9912abddbb45a6ec52ae55449a3a2fe8e8438c29de6a759
- MD5 8cc53b57704188ebe7e495edf1b5a60e
- SHA1 5fed56421c7fabaa3bbf9576f26198de5149580e
- SHA512 98c6e78441a0133a01f91b2aeff1511aebf498062731d5e7c6be31b16aac0c5708e2c727f1ef943e92beb2807b014174c3bcf03a6fe94e27893004f7df746f7d
- SSDEEP 1536:gjtrXaqAZBrBgs4QRh+ZBERF5ceTfxiju740:gjdKqGWrQDEELzTfky5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001d6
- Size 221KB
- SHA256 b580d6a2cebf3b82f0ace4b36a34737f3f73d191c107c35579e417d87580c43f
- MD5 8773ecc40e1af891cbe481d7dbdea2c2
- SHA1 5e3294b59a14674f3a3f6989c96e8d7a81c1c7da
- SHA512 1e38cb4fe4042b6038af358b7c58522064c6f15cbbefb1611a46f8c13d3cb5b8e4dd6dd8b60f09e78c6629fca9368fab05ac82c7cb8a6cf0ab58a47c1281d87b
- SSDEEP 3072:C6ww0LH7YPhfgKNRPSdCe/vNbBGdRKVIPRGZ/nEgQTjQREs48jnp7EJv1JCxRx5:hE7ovMCe/vhBG0LhU87Ni+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001d9
- Size 16KB
- SHA256 ca7a1b8411e1b23389aaadda2f343a844488b81ca155612d8bfd5d09be6b3688
- MD5 d39515ffbd25d581d3b5762e5233faf5
- SHA1 2a588e5a9d491a3fc5881ecb79e6df65ffedc1ef
- SHA512 bec5b3d3f816d354e8b966307953690c7f6cb375127d88d31aca2cb5010b2984fdd04c8aeaa609045929341c2f36577783500f9e051f2ce2c0b9b23af1ee9c0d
- SSDEEP 384:NN7KGw52AAlLEb4ReI4a6N40Rts/wsxdRVptjrBBwv/K3CmP6f8nBg:NN7ZlYjI4nnuzpjCuCma
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001da
- Size 88KB
- SHA256 b3b84c9606eae3b7761feec3023369ce4fdec1bf4df7fb20c45f8fe4b5e1312d
- MD5 de24b57dbac2be4a8506da6bcd176588
- SHA1 909ae0f8497251fe766ddb7bbaf127b8426dd504
- SHA512 d5221c4425d027335c8dac3d7e204f0995d54814747cce95a27428238d1ac85934440d029d681b3364a01bba9e005d20301e77440fd96cd2d78cd07020959a90
- SSDEEP 1536:Mx+ZPB5mttQsLkkUKnH++UXsmKfGBJRs7oXBJeK/p3dvnVyvQG2hS53PoBvdYDxi:MWItQsLk3Kne+UX4faJRxXd3dAr2hS5S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001dd
- Size 41KB
- SHA256 53541c5446cae1f4164ba26558ac5e30bdfa7be45a95ec02067fda31b94dad98
- MD5 08465820efe2641c0b438533788ecbff
- SHA1 11fba31b78879887924f01e757dced22f1e5be7c
- SHA512 07a4f06efd6294f1758c6b74bc353ebbe7c97498e6242934332295d40f0d745b2fc84c3e91d45b04726646df971105f128f64f96d978cb6b5a11d48c7ef8314d
- SSDEEP 768:r5/2EUqaPn8XoeSnXXmie9HSBH36qqV1fBCcJkoPSE492QKS0sVfgpA3:JVlN4LnnWRsH0z7O9nKSnfgpA3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0001e0
- Size 16KB
- SHA256 925fe993dba774b69b734410aad20f58a2c95eccaf7f0662abcc2e61530e105c
- MD5 4801be8e10d90b7f116bd5c0317aecad
- SHA1 7aa7b575011fe38f6e33fbec98e8c92fb1b26957
- SHA512 069f2aa0e6957a0287753abe91df33b88e87d20879e8054a4896f19382fb3db0dad7676931e1571aa3697f466d01b139c22ec1cfacc12ed3598a14d3ec68e512
- SSDEEP 384:XwPft7fEqcJ6iQgDrtyl1BA+OodV8NjKHHu0UqBhBWypt:oft7fEFJLQZl1q+OoAZKHHHUUhBppt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0631264bc371c9d7_0
- Size 3.8MB
- SHA256 1026093a5213345f3c8f02f64451be5be37ed61fac981f24cd770bb2af9f52ca
- MD5 257fcb4e366b67b5075dd98d126bc1b7
- SHA1 19cb590014f8b955b4be674d344ab22c6a343b45
- SHA512 f3ccc1a51a83e496903988f0209aada3dd3908c2363f8a1beb0e72f5d0eee8adbf39429ffa6350ba07ae11d71c47fe36761be15dda1f27c732df04115c422ed0
- SSDEEP 24576:KY9nq9GXWEfyq7AZ6TeC5oOaQ7yN5OxcqmtACicKZAm+lcUAF/cvB9FxWSMwB3xi:xMHYc6czeZ/4vpBhSaKb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\42c524633b386990_0
- Size 18KB
- SHA256 0da14e3d31fe804196fcb0fa6e9a235416ef3948e557d1a612a36b7c06ec61a8
- MD5 ad68e6e802a50bb677221bef9b7dbc74
- SHA1 556290eee84849fc82ad50cf4a64cd54b4ea3c59
- SHA512 a4cd6f8cd7e1b9d1e2563faa91d24a2377ebf1cda0d41a4be3f7f35d35af99e6643554bfafec4ff58831cce277808e5e052c0b9fd747252d28842a0c48676819
- SSDEEP 384:eFkTvBygZuzawjR3sIrrvkgDy0VV0/WQg6Rto7pR2:eFOOt000g2o2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\4b0c6e05941b4fd6_0
- Size 1KB
- SHA256 481bbc64cdc440d5713814a1a180ea09fa8a6435d7ad26cde0182375405359d9
- MD5 0dc76f956658443ac5d47a062db8f644
- SHA1 919c8afe34085d820d5a57d8dea15300cd0a7833
- SHA512 ca65c71c0e3fc8ce1cb219aa21f15ce4eb569f313d59078db8661a220b172cfcd4f267313a9098a32dba7a07c349f0a07cbf8eb7f78d6a5ad0dce2d63663b17c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\624008394472d32a_0
- Size 352B
- SHA256 594f4e66bd6b39f5da948dead299b8855d3f9c114b1717e81ffb313963e8cec9
- MD5 74be84ac27c2396fbef90645976eefd9
- SHA1 33211f78c854c34c5090fec4bb6205eb6429c430
- SHA512 b41a7d2ed0a00d7fac2590d860af86b23cb518182b1a837fb5294a974fb8bf613a294ab37c5e18f6009851d06fceb98f284c475b888c3e58f274b0cb495c5b53
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\7e6de90d733f9c52_0
- Size 21KB
- SHA256 9d313efc013f2e9bfaa280ba7ffbb9e2291bfe3b92b86b88edc6f6019d1e72c0
- MD5 99013001a62dfd03515780a870f3594b
- SHA1 f65eb8943057369acc1367276c1b6c62dfc08fc5
- SHA512 b03349145fc01e7476d9ef9dd12ed8cb0d38160dc2a321171f7699b235d8900251552fc2380f586feeed8693951f45e72e396e319444099230ff578f788377b4
- SSDEEP 384:e+Mq3d/Ssq1GvS+BFubTYbgCnoXfhqaumnyxkprF9ZnaemzIg5Wk+8oWnEXh:e+MM/qYvS+B0vYcCoXf51nBrZaemN5VW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8519ed879205e43f_0
- Size 479KB
- SHA256 584776d2f59ca502805a58997c4278c95256ee417823ed285ab9b180984b9c49
- MD5 783eeea85d016d9ab2ca2618829bc35b
- SHA1 0eb78d0b77f2dee8897ee563e11ef6aef828e6a7
- SHA512 bc915c87eaea3837fc30b7bf716d2ba5a19d13ace299562043c7de66be7263ebb1d392f18c40b7416a27a3520c7e8def4bb65f771c7518d2edc4cfb47641ccfa
- SSDEEP 6144:1U4NAla3IE+4zuXJZnbWqNeWnmK85QWBfmu:1YjbWqNeXK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\865868c80f2d6d6b_0
- Size 3KB
- SHA256 f2c76c23b084612c69525200915f3007fc1e7fc60aee50ca44919122cdbd4146
- MD5 0effad665ab4e49f5f99ba0d8a551028
- SHA1 e7552af29ec85b45d58c4501799e25b9bdf1df4d
- SHA512 435caff5e4ed0dc49b55a99c9c8329cb99e49f66066f958ecb37ec9217d3a43391161c2a662a2a02d846a76365784e279633930c16cffa57c73876d4f36069f0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b6fc62258a230cdf_0
- Size 3KB
- SHA256 6f335163ce507be4402e4620a104713c70479ba2d8d81a11c581a9c8fac8ec31
- MD5 40431d2c6b0a0d618394f448b40efbee
- SHA1 244df9ac3e6a206b0f00701d88e5823307bb10cf
- SHA512 4f0aacd50cf8038c1d61d12e4ae6c6be549bac4ab53cca606370a012eca2fdd0339d67b3bd53e8da07e407475fab35df51a10b4ee0140b5921970abc43e37b21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\cf9446540c1ad273_0
- Size 1KB
- SHA256 2d0cd14944c60f682340fea8a80436520762d78bc5266ca145477e764b315066
- MD5 bf8a40ce031edbb89685b96a5baae9d8
- SHA1 9745c9002ccc1bd329ac01fe0ce503d4c4d93ef5
- SHA512 b03905361fbac656fcf4390acb4dcda9eaa862426a9a97a68b1c3a2f2a080a10ffebabe44e35fcf82419825bd4625d3cd33e153c4876edb2cac6b3e512507480
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d16098bdb111a5d9_0
- Size 280B
- SHA256 6b562fb2a1daa01e3aecf8a940d01700386f7bc780a805b81b320f12de16870f
- MD5 e73412aca83d93edd68eb0e99276ed58
- SHA1 17002bcea8c2930fb550f0bcc9b87f44e1824f9f
- SHA512 fd8baa610d1f9333836bcd52f48acd548ce20a3f2943ef419978e778f1ddbe11f2af12d348965e4bdfc5a31447aa63fdbb3be1ca625c5799bdc0e91483a015c0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d20f010491264fae_0
- Size 296KB
- SHA256 25ed05e479866b8dd5ab420d4a9a3bac76a2749e78c8482e77e2d1e43158e565
- MD5 7ac347ba5277ce80ff0cc55701c7219f
- SHA1 4d042f6bef49fad4f05b8f7f967b10ccf53b26a4
- SHA512 4629f4cccd21a01080ce7b8995e28a87429ed2980d60df107333a492d8b1e7f62bddf9bdc399dcb42b85ce1689d986c1f76a2c0971bc73e6fc8dcdd65d02485d
- SSDEEP 3072:agoh3AarqAXSNMBcCNGp5a7x8P71eYAVPEaYrYn2gkKoeAuj751waEOMLFG8I:af37fXAMBcCNdx8P7uPENg2fSj7Tt2O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ef6365ec6e0de8e1_0
- Size 1KB
- SHA256 952069fdef967adace7c9e7dbaaadca72fe7981c7b1a40457cef1cdd17f8c30b
- MD5 fa3e971de00f6f7656749160f0986bb2
- SHA1 f7622a0f88a33fb3fcc93510386129cb1799f681
- SHA512 d630d3ead7bbb2158459f653bb998f109c364150afce606f5ab0ce56fa534b7efa0a20c41b5a23b0b011c713491f2b8ad97608e24640af2c1684e2214231fc31
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f877ecdf8e655c6b_0
- Size 41KB
- SHA256 e1d99c82c435f19b45c3e33a1bdf18566882d5f6e8fa68252a936857f5f62def
- MD5 6306c9e00b5222b844314e82aa1db47d
- SHA1 c35c8c7d27b0f55a425ac7a22509ddef704bf490
- SHA512 737a5106cb72f88d0c0bbb8122a0983e194a1547b8b0e6b9d314421820c4206b7a28ae0492b249edadb31814595312a67768fb88ea9df8669261981fdfdf86dc
- SSDEEP 768:ULO+ERpMec1Uyjd2zClF4qOPpcGrKublmb5dSK6c2YA:UpERpkUyjdYRcSO5dBA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 7KB
- SHA256 288ee5a3d78b590e4cd8ffd23bf953281196567cccb3335b5bf8c4dfcd720cb4
- MD5 31d332aa72e78d9d3ba035f17ce1aa70
- SHA1 68a1f13c72381f374ad413d96b893cf7ea517063
- SHA512 b539c71e748387912a2b6656a807e377337dbc0f7f0684170636b68fce538a55b855af088db29f67bc0f34b195e421aa0d0e1d3f7af052ac8a2579354b40c1be
- SSDEEP 96:eP0STMoVCAAWZ2n8hXqAt8a3c7WE/yU4sW/iTsSA850hZQtwndwa+:eP3woVC6aAt8IpFsWhNdR+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 6KB
- SHA256 efc661673f58744c770eca6067255b16a1a782b5593720ff9f379fa057f4df45
- MD5 4cd983f7497261dd151a1fc02c0effb1
- SHA1 5e52b50aa9223f6e2cdc06838385dcd6c7c45ee3
- SHA512 9805457dd2a2fe383ed9ec22e24c353966170fcab9922540df5ab141c7fe5779cd808f5ac872d8127c756d706a5b71ab78def2bf0bd890df460c87b7d6cf4dee
- SSDEEP 96:bZSTeoMCxZIGsXqAt8P3c7RXnUysCi5s/h8QK/nq+K:boaoMCmaAt8fujsUaqj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 8KB
- SHA256 5333ba07aa635cb6be68c3f4b2197feec3eb5ba8d4f640e8f4e2f32565942dd2
- MD5 73ad09e0fa0c421a887e964a09ed5a5e
- SHA1 267fabc366b03552c798e956fd0460759845755e
- SHA512 dfd398fefc84211c73492e1f39d3ce9ee17116d2e6432006747eb9cdeeba49f9186b76f57c3d25d44296b0cd31be561ce1cce90c0c275d8236645eea87ce2571
- SSDEEP 96:L/st0STkzOa7ACAAIZMJnP6XqAt8Kwc7QE/yrCS2rhiDsz7b955s0qwQawnsAOqC:zst3mOa7ACcaAt8LD52rvlO/C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 7KB
- SHA256 cfd98573ef90b8ad7d841ace223a084bee7e275373475c5a8576147fa2818fc7
- MD5 4ea3c4e59a3df08bb24075e568f92520
- SHA1 0bf0c836ddf01ec63ec374e47581c5af659836d0
- SHA512 9b1f61bf898cd7431420bd74cabf239a38dd4c3751376827d18c9a18e5aea9c508af8d7a258156f83796410233c4f9b3be8e1d3478002dc3ecb17d2990c0faa6
- SSDEEP 96:6ht0STPQa7GCAAIZ9JnPgXqAt8/Oc7WE/yUAj2/iWsaX5xr0hKQmwn8w/:6ht3zQa7GC9aAt8GpBj2Il8k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 12KB
- SHA256 e106dba165e000e63e7f74808ff54c06ac99b7d5bf828ec30d2eb6a2c9b4f484
- MD5 b020159353aa2dd0e7115c81a35f3fd4
- SHA1 2d0a03699cddc932649807201287a38b76aa4a8e
- SHA512 5ebfdf486a8c32f0e4d74890953a2e38cf29caa8bc4fe70e5547d9dac49c6ab3bd87b51d9faaab485a756675bb7e5a299613cd8e885169972127e68ec41597ef
- SSDEEP 192:boNkDgcWa78CBDjwattEiZlTzXYRtJFrr9kSB5YPJl:boSD18yREiTzIfJrib
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 12KB
- SHA256 648c52406a78ebdb85c9efba1ef25562ba59650e520cc57a201d198691e963da
- MD5 6523086bb32e3bbfb894ca484cfc9977
- SHA1 0e42560dd39fe661ca5a86b95f27c942d55a037b
- SHA512 5c75af8189252578de8bc523e766488a378a3307bef08a9d823c9ec298bd6c17abf98f93e02ab17e5991d9762ef76bb97a6cd6fe8bb735655854f9c84cfad573
- SSDEEP 192:KLoNkeFcRa78C3g8att8iulTKYStJ3r63fb5YPWd:KLoSe98b8iO1KJYUo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 5KB
- SHA256 344dd107ef22f77801d2279677cc9d5c39d44dace73cecbe222c17cf7c9f2606
- MD5 1e05cd9a712908c1c3d0e12d8e75125c
- SHA1 33ec9edfd7ebc4e69352ebf7b4294ba67960ab07
- SHA512 b3ac3a7d20423481fb2a88f478f9fd502ecbea8352b4c0a155e119ff9d93ca83f5899147930a9b0340903937297dead29f8d89ab0c992dbf08673ccd30e1de8e
- SSDEEP 96:4/ETrUCxZ/MsXqAt80uBXnUtC7s7hNQV/nd+Z:4sHUC5aAt80Q8FEdU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 5KB
- SHA256 f26e8ef0c86dd004dc3bdff58492f1e213b34b5072de310244a4e3fcaa7e5bab
- MD5 2bf19260c5dcb249855709abb974854f
- SHA1 8b9528bc5d37933cdda1c4a0ee6a39c9b3aff9e2
- SHA512 ffee4306b2c499143b43dc1eeb0c76f8c89e9c238b6020ebf8ad34a5456dc03e7a748478a5b3594576d1750275fe0754b0cf78d147c8158f68caa4a2bd933bb8
- SSDEEP 96:MxI25ocCBZu8XqAjxugXnURD3GeQY4h/bDe:MxIjcCjaAjxJMKn/bq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 7KB
- SHA256 01fd85989669ec2223373d9ea62d483d35c42bcdaffea0ff7ae5ac5890b56b47
- MD5 1ebf72902b448a67d0174ce446891c02
- SHA1 607b79f026d23e5cce826f2329293de1d2d2474a
- SHA512 65f40558b703aeee2567b486083f1ff4d0db2c384a30cc9ca882b1a994f9bfa24226c378c7b7ab385d8a34d034346cbdfccef9c182f2a01c554e2ada67a22b41
- SSDEEP 96:qhE0STP/VCAAiZ2nPgXqAt8/Oc7WE/yUAfpp/iWs75vr0hKQmwn8wV:qhE3z/VCCaAt8GpBf3Hl86
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000004.log
- Size 34KB
- SHA256 be5f30a18fb7bb3551536b96030176c82dcb23ba6964aac93a57fed8f19b7607
- MD5 a41726b2b68a14f3ae7691d5fabd15f2
- SHA1 0b64c89a5f3f7fd7f36a91e4d36b0dc72b6b6b5f
- SHA512 5dd208cc598f8b4f611c82c931e578fa6b37570ec79f7a529efefb204bdf11f8b525e19f276e012f9d461cbcc1ad0fa5796025d09aafca49e988a8764dc3e77b
- SSDEEP 768:1rzmUGAucuAsH0l/B6zVo9ChV0HzCUfqtPuCzqTTPQn1p3h+TwvDsZ8/Z1vGKD0v:JKEYCYYXONocL8CAmzNyE6ohPFJ3i87Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
- Size 1KB
- SHA256 1aca7a1664ac9a10d93d0b8e6d0420098b9e7644663ea8e4cee5426e62c3d938
- MD5 4a8c4b752705703dcd66f7fa41650cb2
- SHA1 b2bc36984c4fa29f8ec84a33b3df80579f0361a4
- SHA512 9de950f544303c28b8d617b766431fe6f3b4250ad3471f057e35e4c664d44e951813e2ae63871153e79157b64baf81c3d4f608b71584e8317753d0b12af3d3d8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
- Size 387B
- SHA256 a8b5f9211d9f0061e7344c83a9d0c3c276aa5851969320f1f0948230e9082d5f
- MD5 b412f9a3ac77674d0507151dc5d92bbe
- SHA1 7d1e94f0abca8843c7fb7d6853379aca6929a98b
- SHA512 62d73ff9c35acaefd3d52b5332b2503f2490b603093290e8a87850f2206273124fb5ad4a63cf7810036499075cb474383af163a6a196438e9cef056bae1c5362
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
- Size 387B
- SHA256 fefd3b6298971587586c31279bb0f13225ee1635f5604c8113541f2bc8e351f2
- MD5 c91ee88c8b1e0d1c18b95a05ee338416
- SHA1 8d75efbdd826c9fd5f0b3361470d84ed88100b7a
- SHA512 2294fe820a98cc6fb2bf8fb1deb9655979f6d81b8b3f11d93566b1a68af2270560c72ee5679890490870f4a24b101fffa7ab0f1da108fbf2f8d4ad03ea15ad1f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
- Size 387B
- SHA256 6d4da79d62e63234b191429305dc2e6e2dd2ca8e55fcdabc32f6762a94051832
- MD5 0b8b45cd9498baf5c9d7737972ddb980
- SHA1 8aad832ac24874b047d4343cf5ee08d651b57752
- SHA512 e5f98ae94e0b45b5bb9a905f6bb2cf50850b0c507c03c83957f2c9b4cd72fa727dda1a66915b90192c79ce5af8a84db9471ef2a58bb50f768db5253d065bd47f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
- Size 387B
- SHA256 84d7478aef45d80e52f787db0821edb6b572c30691510b1b5ca46afb23a8095c
- MD5 ed848e3d3946d2bea99d561cb4cc1d3b
- SHA1 75a71bf13d36bcc65813e3666d5888ed45b6530a
- SHA512 3b6a8bacc9fd23b9eefa99671e7b9ca2fefab86748fbeb7be6ec4ac6ac4134433d67516c72e9321f3c63558bb39e799f0518340672a5097541ef2d2a3bc24350
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
- Size 387B
- SHA256 fcbc49eac0525a4d5624fda15cd1054f3148b7f3e4e5cd36cc022bb75c4f91b2
- MD5 4f31bc575b7881c171fbe25fbcbc87c9
- SHA1 7b219afd1be01ee31e31e31258f129c1a8a9e4a0
- SHA512 ef7ba3bd6879d82c9522fdcbfb2e64392d2a6171a159687aedb0e26d1c8f1f019d91286643e0eb0167eee2d91fc0eeeabf4659f99fa76c026a4dab4b27f0d895
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
- Size 669B
- SHA256 85d77a768be2ac081e0b70ccb12cd533592ef42c860f86c2c89d8ac6b5801bf3
- MD5 3bdf91e9801638b8c6096bfcf61d3093
- SHA1 b899d107dd53fe47b8712c6f5eab0daf0bc0e993
- SHA512 8bb679e21abba5f0b4847f5344bec212dceaf91486a59e16a3eca0b0104e425a1fa5f0393a2d14d2869ddf8fe16cc2fcfc0cae7956d99b21806b090d6ad53a4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
- Size 387B
- SHA256 c8c1c8a6864ee101cbaf2f03bcc786acd83c5c96d5b355c0145871413dacc621
- MD5 68236b5fea72e572a677fee93486db79
- SHA1 69ef96547e80cbb93cd59bb6b19f93582668120d
- SHA512 e3527f5650cd09485726df75d520f50765c0dc119995e4afd8f7d88a7538efcf6d0483c32cf3cc7c65c884d7f1338f6ddb62d4557c72528447e9a0a115222a4b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
- Size 100B
- SHA256 12c9d55e9848d0a9071994653188f5fd15c71e932052f9afcc202eaff34c9094
- MD5 40d6f2b3a7bda9f11a8dd79bfe4577dd
- SHA1 6ba68cc9c03c6586aa3f8f6719ce1708dd6786ee
- SHA512 907cced7ca367a8bf2b0ba8b3c8abe4ab7329eeb87c82f403a919af79d2fbfe98c3aef68a2591df7b5c5ae1f9dfa1f02c7270718f4bfb1ff599b0937990cb0cb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 16KB
- SHA256 78548b8ada6b60bbe470341dc9f54334affaeb4ae0e954dbe63c6a32f848c5b3
- MD5 04e2ea80e0fefc52bbe0ffa8328432f4
- SHA1 cdb0612f7c73ccc780e4acd4ea69c2190d8313fb
- SHA512 e4357f5a84b5534fa9dd392dccf1139c258aaf93a580b0aa22c12e31eb3f9178676f6e83cbc0c8d014333af658905cb35e5bd5a2ab46bb7ea9a179548d56026c
- SSDEEP 384:DmzH4quwaKrHZy45ybw50ZGgl3AL/jIIQZX1LRHjuMGy+HELwLan5NzT8+fgvaHA:hLSx2atsc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 16KB
- SHA256 a70a48b5705aa349c0d3ace06b7d6eea4dd457a6c7738c77f97e3f9e200c19dd
- MD5 47540128fe8e4d49225a0712347673c9
- SHA1 9010f4c58b5a704b8eb91731a2395583b56b8ba0
- SHA512 884116b2454cb812d5d9aa34e55266ac1f2de4459598a0178ad4a2a33242a6f1ac2b90937692219b694feb8920e1e14b93faa78392e5f63006c9ea52a300e85a
- SSDEEP 384:DmSB4qwaKrHZM45ybw50Zegl3AL/jIIQZX1LRHjuMGy+HELwLan5NzT8+fgvaHI/:XLSbfqLSb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 28KB
- SHA256 15cf93f124a8632d2260f8c8ffa8788eb2ca0edf21cd701bf222759c65128aa2
- MD5 8f04a5fafc6b212e94bd93efbaa20b93
- SHA1 f1381ffa99c38f39afcaefacb15756a79f49351b
- SHA512 76a8789dc01a7e21311d2b52901fcc077732a39c71209ab985447ae15fbce111fad77f3e53392a1fcaaa64006ffe79e4f4ba5bb6388ee5a33170a58751957513
- SSDEEP 384:DmSB4ZpKV/iC8dVaKrHZM45ybw50Zegl3AL/jIIQZX1LRHjuMGy+HELwLan5NzTD:bLSxaqLSCJq8SJV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 28KB
- SHA256 d5a10824f5c64cee843a17c7a47a63fbd72545bca017b9cad607809bf0634074
- MD5 3cedc46685b623f611638cb1a7162c6a
- SHA1 b5ba0f34fe054aa3f967b6aa7c36789db5d8c06e
- SHA512 c7b7435d9d9ff90ac37e9d87f40a7a40914716e3128c0d46c4036a06dd8d85058315fa7febe2f3728a055ecae679f28a44f1b2db5929bc4704093efa60153309
- SSDEEP 384:DmSB4ZpKVBQC8dVaKrHZM45ybw50Zegl3AL/jIIQZX1LRHjuMGy+HELwLan5NzTe:jLSxaqLSCiNVSJF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 23KB
- SHA256 19cc6469d36c1a59ddbf76e83f08f3ab99f59ed62f3a92e5625fc598e5546ccd
- MD5 88f2946ed708232145efc5f4d95f88c3
- SHA1 9f9fac275ab9dd7d87f7aad7a8dd68db99d3ead3
- SHA512 5519a8fd4c77f6225f260b7e4e504d1763654a7507ec623f90ed8b74182703c352cc3801d82a0de352926fd23d93905c80dbf6bc7545cfb360b74bd1959d0c1a
- SSDEEP 384:DmSB4qpKV/faKrHZM45ybw50Zegl3AL/jIIQZX1LRHjuMGy+HELwLan5NzT8+fgx:bLS5aqLSEhKG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 28KB
- SHA256 1ba61d8aa7c6f12f608c132b3b409abd939676b4bb3bbadcec2dd276579e1800
- MD5 a410906861a9770565da1cd88143b1c8
- SHA1 297d6310d3232a39573cf3311ca81e90b04d7364
- SHA512 69befaca18047d261112643d307662b310045c54fa299e650b519da25aa06c8c2ebd83109b5a4fe867cb53226cc40865a66c5868eb9fb39191932b7860f00c52
- SSDEEP 384:DmSB4ZpKV/iCN8dVaKrHZM45ybw50Zegl3AL/jIIQZX1LRHjuMGy+HELwLan5NzZ:dLSxaqLSCJq+sLr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 28KB
- SHA256 6a0bb64ccbe8a8c6db9062b264abd7e8fdbcd142f8166eccd15f515cd9b1d766
- MD5 96798680dacad40affe58a16c572b4ef
- SHA1 c75c7a8f808de5ce0dfeed7dd7013f931acb9e63
- SHA512 ab9922d663aa8495cf60516c3d7d3ad99d66ac02a56d382ab2e22e277626e7f5464d0ea6d7fdc312d29850f57b5adb572db2e1eef14d8d4b7f8bc000d134ebee
- SSDEEP 384:DmSB4ZpKVBQw8dVaKrHZM45ybw50Zegl3AL/jIIQZX1LRHjuMGy+HELwLan5NzTi:ZLSxaqLSCiNOSJ8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 24KB
- SHA256 261c04355aa9fef4cc9001b29b07806ad42e6daea24a79f00ddbf0047caf4458
- MD5 908b1c477832c48cbd67681402e6cecb
- SHA1 61ced09e8e0a81f414e08cd16f9dea719bc44323
- SHA512 b0d55b162c1473c78a924a8e642b492f9bf7a262200c490fea7e9ea4f0810599286f44e447c6a4502b9761e909f67d096a19a8acedb49a383d14ad1e9043f48c
- SSDEEP 384:DmSB4qpKV/i/aKrHZM45ybw50Zegl3AL/jIIQZX1LRHjuMGy+HELwLan5NzT8+f6:+LS5aqLSEoqV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 36KB
- SHA256 a31d85a34bee1e55f9391a1378682e22d58f2498d2ede3ca6cfad57975f680ee
- MD5 1dffd9721e0f7da79dcb401d66bef309
- SHA1 535a80a627522415f4805fa7949039c6cefa467a
- SHA512 867593bbc6ec75a7dfe9df8abf60706f7ce17bff21dae8816a5702a69da8847882220841a5e08028b19def8bf7623eaac0a2368dfe8598c9c4cf4fafd299c011
- SSDEEP 384:DmSBBQwG0Ch1TqP1c3JSRbZqZaKrHZM45ybw50Zegl3AL/jIIQZX1LRHjuMGy+HB:vLSxaFSCiN4DJjFf+8iqJqjfr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 37KB
- SHA256 89453a8f6a459e2d466828a50c8e3d0ed62304a926a0141531fe1da0fc9a6015
- MD5 9e353d6e5e29feb74405aa703dd0f943
- SHA1 79d29eef14409e41fc1cada504a8662d542a0cb8
- SHA512 a04e43671529efb1e98d5d07f76c6fa857574a862d66b998c238443610506c4a11a3c5f31d07510f252d0a8dc2380983060ac936292652ffc1434a5b54102143
- SSDEEP 384:DmSBBQwG0CqP1c3JSRbQoaKrHZM45ybw50Zegl3AL/jIIQZX1LRHjuMGy+HELwLr:iLSxaFSCiN4DJzf+8iqJRrVMjqKv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 37KB
- SHA256 9ba55d3ec94c7794e256fa8bef5e878ef9a40331b0a03c06bb4dcaf3d5bec645
- MD5 791eb53ff1d09859ad91ffa78019e07a
- SHA1 dbd1adedbc0c04a2fa236b882b0984ccd93053e1
- SHA512 3bc15ba18e825aac72c4d0fb4497e458fbf87fdf4d08f2d3b25c6f3e7f66edab751425e5e2aa0b83e12651eef6d3ff8efd4092b4ea0a868d23875b9b988666a9
- SSDEEP 384:DmSBBQwG0CqP1c3JSRbQhYaKrHZM45ybw50Zegl3AL/jIIQZX1LRHjuMGy+HELwl:oLSxaFSCiN4DJzf+8iqJRrVMj8Kz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 10KB
- SHA256 e7a86648fe2ccf766bcf5756c9956c54469e96446d0fd2549c8319e748122e54
- MD5 eaa61b916ce6cbb8e6c89597ec2ee039
- SHA1 325a118eaec53b01dde3efb78523985a43f9fd24
- SHA512 e71f2abe840a3b1addf8f8842940218f934573160a063e0207c0d846aeef6a13f1b5f5534c9154f5caf86c660daf75ab13d009b2bb27820ac63f675a5ecf7565
- SSDEEP 192:DDmzaaKsjDb1HZjcj45ybwPmna0ZGgeG3AL/jIIQZX1LRHjuMGy+HELwLan5NzTl:DDmzaaKsjDBHZy45ybwPmna0ZGgl3ALy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 35KB
- SHA256 a74731523f429ccca6589e45af2a3983019f94b58ecaf289fd943d6e5f374779
- MD5 5cad432c35002e7951831bc29069ce25
- SHA1 86f26468e7935368ae3044709f154b83b4c904ce
- SHA512 f701dee7951bc262af4731eccf856f687520fb08c58a2fab01be4a9ef2bd566a7ac244ba5f07286e9a5c81b0f0eb3b442661e5d1dc5170e2bc48ce7e8ca494f3
- SSDEEP 384:DmSBBQwG0CqGx+eyJVBDmaKrHZM45ybw50Zegl3AL/jIIQZX1LRHjuMGy+HELwLf:dLSxaFSCiN4DJzi+8iqJE1VGjqKD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 9KB
- SHA256 e0d89928280f90dd14c6eb337d8320a74c29324d4f4f8c7c1ea6c77bc98cd944
- MD5 abb44d4717f5d2a2f3ebfbc8de258198
- SHA1 8a05b30fcf21e80570c41c34d109a74d9adf5115
- SHA512 8891015af25c6b64628f2538528615465d72fb3db7ecf6c318154da710f95fb037a0e5584558325ab92aa70d804c3e18e66cca8e88715ea119c83a8efb268d1c
- SSDEEP 192:DDmzaaKsjDb1HMZjcjtHx5ybw5HjHmna8QZGyX1L+R0ZGgNeG3ufwAL/zj0+3O:DDmzaaKsjDBHMZytR5ybw5HjHmna8QZF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 7KB
- SHA256 ced06b2edad42ebf211f362176efaa3082a7a333bfdb3e0b09647440461cd4ca
- MD5 d1c0c36181497a9c169b237628242b0e
- SHA1 75a68bffa781f31711128f0dd448493ecb1893ec
- SHA512 4916dcecda008ecd1cdad2f562a71764db4f6746be8139df141bd487dfb403fb5d27730db7054ab89adb8f2e1940920abb9e62ff5f1f5ff3e26cb2198ced2293
- SSDEEP 192:JAUQUnUvUCkURIU/UqJUB/UyoUBUvUUUVUaUnVU6/UbUgUrUmUaUJWUMzUoUwRUa:eLMc84IMVKUaIPIl2t/MXmzD0WRzLrsa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 9KB
- SHA256 4d168bca54880839e19edcf44b6b25ff49355e2add03136fef79f018d32cddec
- MD5 e3eb13fcc02dc6bc6c69cdc1b6bed087
- SHA1 c46c01ef70cc300c8201b517276b9c49eab685cc
- SHA512 1a90e66754414e4600c834faf05b0b771ad5d917479b39eb6d0e3dc4b88aea2cec799338b00275e712dfa54ea6e8ee3c025b651789daa9f3bc8835752d00bbc1
- SSDEEP 192:JAUQUzTU8UvUCkUKUnUVIUIN0U2JUB/UyoUBUvUTUSUfUBUneUnVU6/UbUgUBUOy:eL89c8JICIwJKUaIUjgkae2t/MXQj+Ma
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 b76e200bc4fb1f47360d3328bec9ee04ad5d439da0192def706bfa05dcbe96c9
- MD5 02001f0823e625cfd904af1d196fb4ec
- SHA1 895a5cc2c95ed0073fc9165f8269cfbf86a5f986
- SHA512 9b7a1d8d774b71f0daef8a8647d3eb05f96da909c22f9a6a6df1f411a51a45283856e7e7d36c1866b5c78bbd2c1822f6b2547e642e67fb9545ac96496f927379
- SSDEEP 192:JRMrcBz2GZflj4ov7zw/PRpkDL6K29tHsb+WNnXMjVL+ZOD3Me8oVyIsnAUgcaJ:JRMrmz2B0/wXLLw8N1Ae15
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 e356823c7649635c7f255b0dfdd2738bae30a19987cc45c407da033a5e995c96
- MD5 9883d234fb7ea2190805261e1abf7ffd
- SHA1 ac00f94dc32235439a01dc605351c30fcf4f2458
- SHA512 9db350275a66048ae8d89d5c47e1b58572711926b1d0136d453a9b55801e1eab2ce5c780b86edbba04bc3db2cc5a5b4267988365e289628f250a62a74213e533
- SSDEEP 192:JRMrcBzxGZflj4ov7zw/PRpkDCD6K29tHsb+WN+KXMjVL+ZOD3Me8oVyIsnAUgcK:JRMrmzxB0/wXMLwaN1Ae15
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 b05f2bbba490a7f9678a4e7426a43e18fb935718dd7178dcf80bed75ce2e7af6
- MD5 f9238187de0fbe4c34218db5ed59ab0e
- SHA1 7c4123394181dee413bc70651829958d583cd35c
- SHA512 5289ffb35834e59f82559a73e823582cbaa4ee0887b89bcc7f952bae4dd3b4d36676bf8e9d5bf3d386f7609bcf95ff1c8012b926d9cf46035d640c8f2de1e4cb
- SSDEEP 192:5RMrcBzkGZfljOov7zw/PRpkDjvRDVK29tHsb+WNmvO1CSVL+YZ53Me/oVyIsnAF:5RMrmzkL0/wXeLwOQ7Oek5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 11f68af67514c394a763ee0667eccf450aabfbaeae145319ac42feb49eada1c3
- MD5 d0c47ebeea233463e7d7c3bec256df61
- SHA1 bf5bd833c4e8265cdfb313acec436628ee86105e
- SHA512 1eedfe0878dd3dc72af11e17d26f0c956b67b28535369bf358e0ec997a3545698b9c54452c01b359aa32141e6b8e870ba31abc6bfa8c4febcd42d7df0fd9fc0a
- SSDEEP 192:5RMrcBzkGZfljOKv7zw/PRpkDjvRDVK29tHsb+WNtAfx+O1CSVL+YZ53Me/oVyIV:5RMrmzkLG/wXeLwxQ7Oek5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 16KB
- SHA256 5c29b3af039c53b2205ca26f6655cde7c693091bcd5affde17a322bb28b30bcf
- MD5 d3ee01cc630790118c6b80d0b41e7a61
- SHA1 defbb021e03117748eb441c22dd199f2f7bec019
- SHA512 2963fb42afddab6ade178ae71178917b6bbb36c9a7c663491a69d061631294154fd2ce6fd189d251fd458b704bcc6efa697482f78748385a5431c3e076eece21
- SSDEEP 192:VRMccBzkGZfljUKv7zM/PRpkAEOMvRD/UK+Y5D9tHsb+WN8GAfv3krAWHuw/rjVd:VRMcmzkVG/sXGLwFrrNelhuOi5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 16KB
- SHA256 4161cbb013282eb7bec3dae410288a3d2c73bbee47b31dba610e11a48c1043e2
- MD5 fd4e72e4de2b891c69e8436cbd3cf4b4
- SHA1 e69efba7b6225b820eb7833f11cf7efd4607c3e9
- SHA512 fede5efcb6d578762495027e8986dd3b62420f9c23719975d31c2ed86e62a27fcdce900b8e3f2868e9b1a0bd69060cb8b8813ba88fb4a27131e32b780f595413
- SSDEEP 192:FRMrcBzk8ZfljSYv7zM/PRpkAEqMvgMDuUK+Y5D9tHsb+WN8GAfv3krAKQu96NVC:FRMrmzkpE/sXdLwFa3eltrMyX5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 16KB
- SHA256 be64527ca031c0f23de0ca64742e4a71f21cac21ac887faf176532b38586485f
- MD5 f91f63b56072f90b6425b78599552943
- SHA1 134dd9be169ae281a3912620dcefc8bba6fa32c1
- SHA512 a8a5cebd4be42d739c7761a0a193d70d6adfe989b5796fc4bca986dfd6e324c47273aedd0616508d0bda47778b9f2434be44282ff56d2221f62f2e616ac6ec66
- SSDEEP 192:FRMrcBzk8ZfljS9v7zM/PRpkAEqMvgMDuUK+Y5D9tHsb+WN8GAfv3krAKQu96NV8:FRMrmzkp9/sXdLwFa3el4trMyG5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 16KB
- SHA256 551259c865451887ca62a2273c13c3adef778de6dd8c05a37dab3996b1a807e7
- MD5 d3467568dfedb6a9aabba5c5ca23168f
- SHA1 4b65ce9bf831cd6b2f7290bc0b0d96f675553b7b
- SHA512 ca10a1d147fd9a3c54f00e676b4076804719da2097d325bde7fb7924538fc5174da5b61ff77472f2eca83a384711080338c9b41cf3f4a3393b5bb028c4dc0c3b
- SSDEEP 192:SRMrcBzk8ZfljS1v7zM/PRpkAEqMvgMDuUK+Y5D9tHsb+WN8GAfv3krAKQuuqHV4:SRMrmzkpF/sXdLwFRZel4trMyy5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 0fd227a3e9ca78bfbeaba6d3a4666f99c083d9b71ded40d87d241880d521955c
- MD5 b916002913ce9ae4de276912e1f8f4a5
- SHA1 4ac026260b02d889e29bd864da41d3d8098ddd6e
- SHA512 b735dc6de74482c9f00db875699dbb7810b639149ab5062a938cba6112a7ea932ef059881334480368c231356b78b664a595281dadbeaf9c0c8b82f792d76afc
- SSDEEP 192:JRMX2GZflj4ov7zw/PRpkdK29tHsb+WNnXMjVLD3MeyoVyIsnAUgcaJ:JRMX2B0/wXeLw8NAeH5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 16KB
- SHA256 e004c85abe3d1054ff7d91398e51554f35ca18446d270cabd9577cf257ea1879
- MD5 4560be64e262c2021cd72804e07680b1
- SHA1 e0d8040c0a433844c61f5ad59edad14619066999
- SHA512 ea528de761da538833638b56af0fc830adf901a5402ed23215a9231ec457ca606f72fd18dd3f47f5f101e7232a6d26f5b4f05d15e49db109d82a95597ad22e2f
- SSDEEP 192:FRMrcBzk8ZfljSqv7zM/PRpkAEqMvgMDuUK+Y5D9tHsb+WN8GAfv3krAKQu96NVC:FRMrmzkpm/sXdLwFa3eltrMyX5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 832c6ed19e79903c5cc9ab852dae4892393699c163797a47a550aefe6a374461
- MD5 a4b99c1b0ecf87a457f855326cd6bcfc
- SHA1 083749cf87b439994b52cc850a060d7a6eb08087
- SHA512 7e41901d93b35fa36688b7f62f8d12e045bb781c00debb6851b79ed3f3ef7f8119d84c0d91d995dc4085c48cdc8fa2dee9bf24f2cb14f974c4e6c433be6def6c
- SSDEEP 192:VRMrcBzkGZfljVKv7zM/PRpkD4vRDiKPk9tHsb+WNtAfxWPw/rjVLBvM+FK53MeD:VRMrmzkUG/sXSLwirNehOel5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 18KB
- SHA256 bc06bb3bce7db40e0089b423f2ad768a3d8db530837aebc92b741aa7fffc3b69
- MD5 73ebb58cce5dd76fe78076945fc73435
- SHA1 c4253e6af524d44c7da7ec5b66088b43f50b68ae
- SHA512 3880e95af36b056408b1bb212b04e686d6e3f684497921a83272843a90988b482d30d3c54109c3e457cbd755dc712200cf24c15431bcda079c84af529e1dc5a5
- SSDEEP 192:hRMrcBzk8ZfljGav7zM/PRpkZOyEjMvgM7hkUcp+Y5D9tHKDHsb+WN8GAfjS3kre:hRMrmzkJ2/sXJ2rwyqQel4x2yy5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 18KB
- SHA256 a0a621db51022bee07dd96748aa7c8284237b9e9f72b0df7797cec8f53abb1bb
- MD5 00f73c9aa6b44c430d2b4a762770bee4
- SHA1 f2a3a80c5018f9c263b93576715fda486dd7ed97
- SHA512 34ea147ebe77ac74d63f7bc19bc1e477f60388227ddd346adf16fe8e1496ff79c4996e48f7d4ef69315eae55498f30002aa1f1e73d66ed71fdf22dc1649478cd
- SSDEEP 192:hRMrcBzk8Zfljmzv7zV/PRpkZOyEQMvgM7hkUcQ+Y5D9tHKDHsb+WN8GAfjS3krp:hRMrmzk9L/RXv2rwyMQel4skolIy65
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 4899ba9814d5ca064d7a2c56aca29056dca1c23bbbedf59750b5c4b3cb178c5d
- MD5 dab734f3b6daea78a5d4991ec42ed225
- SHA1 f32e8e8fcb97dd06ba23e7fd100b768d590c8520
- SHA512 84c189a7a08f4e7a9c06089e3bd6fe87d7f0abc2a8378082e8836b265954032ef76e188169cdeabe8a09734ed8c6d1571f72c5b7d83e63049c0f87efaad302e2
- SSDEEP 192:wRMXZGZfljufv7zpAPRpVRZ9tHsb+WNnDctsVeKXVyIsnAUgtaJ:wRMXZL3/UXFLwo6eA8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 9f9c15d3b021029e779757cc818ca641beb2c2bb0bd75945b0f9927f8ca21a41
- MD5 f898e1ecb6cc93cf7b74b9a36d5c440b
- SHA1 d5bfd0f70cbb96a09324c9c1b205552c49b37876
- SHA512 5aff3e1975cf3b2cb26053a35efb71e000ecd9bf5af24974651ffc34900ba937c23ee6980fc0424bb04b3e8858c6eacd6d9cf57eb8da593e2702d45cf29fb395
- SSDEEP 192:wRzXZGZfljufv7tpAPRp2RZ9tHsb+WNnDctXA2pXVyIsnAUgtaJ:wRzXZL3JUXiLwoC2L8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 18KB
- SHA256 b498a2133c9769c9220afaff72e733df2e759c1abd49306557332db8e0d87e3a
- MD5 6dbc913655e6841706a49a59f921953a
- SHA1 f06c5b29a47a09907d28d0918ffa64156492d1b1
- SHA512 854ce2df52d81a6565077e5e7150b5ce5c45f84e3bcb8e0ed222714ccd863923375f9246ff8fb149bd1174af8a1f2b2c9f6b51b33b8c3dc615378e6e3c2afebf
- SSDEEP 192:hRMrcBhk8Zfljmtv7zV/PRpkZOyErMvgM7hiUcQ+Y5D9tHKDHsb+WN8GAfjS3krf:hRMrmhk9N/RXu2rwyMQel4IkolIyA5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 de4f0ae481ccf6542c5c29f1176dd69553798515214f47ee8d4597391fc51e16
- MD5 538c1cb27e7f4cc9b101a289525f498c
- SHA1 220853bbee7e91520f25f4c55c24134677a9bec2
- SHA512 b883e3d30fcb87aa11dfe31f78431c19adebe33bada2f97128e367efb187824162047bc813fdc6cc2a9748c3b84f9525d2cc32c1ed85ac47773a167d4146b876
- SSDEEP 192:5RMrcBzxGZfljOov7zw/PRpkDjoDVK29tHsb+WNmMM1CSVL+YZ53Me/oVyIsnAUO:5RMrmzxL0/wXdLw7Q7Oek5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 16KB
- SHA256 d62ff0ad3be73b6949f15470aa76ee644c0bdd6a5cf420f54e01ab967c8f68f8
- MD5 032ed47f5203b28660a0b8a3444febf6
- SHA1 63c82254ad9572c079f522f8dc0c807ac957c2cd
- SHA512 f261e2dace496d592f7a5a246a24b357630caa3f4a993866ad5a67e7fe337232bffe6587abcb203de86391c156866727e1daca619230701b384ce3568d02cc5b
- SSDEEP 192:VRMrcBzkGZfljUKv7zM/PRpkAEOMvRD/UK+Y5D9tHsb+WNtAfv3krAWHuw/rjVLO:VRMrmzkVG/sXGLwJrrNehuON5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 16KB
- SHA256 5018bbcf2d8c4ab256fc9b58a9aa75933700e8df5a056315b05a6fc2bde26b72
- MD5 761a752f82e6b29f01866ef6a607a299
- SHA1 176d249100c819f4207edf4b8c85b67d6eb1835e
- SHA512 6a6046c153746c329ac932b7a1d0d7689bfbe9a98b44348f5047545abd2caa0bfe2c2d83c2235100d495238ef085e1fad5f490864131f875ab87afc9b4a89f56
- SSDEEP 192:VRMrcBzk8ZfljUYv7zM/PRpkAEOMvRD/UK+Y5D9tHsb+WN8GAfv3krAWHuw/rjVJ:VRMrmzkTE/sXGLwFrrNelh+yu5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 16KB
- SHA256 64911987a5aeb3063a1d154d03fa63ca8727a4f60251405b2602325e41287524
- MD5 dd3188fd5a1ce2cf73c1e4414c29be95
- SHA1 58bcf101ead0a3885aaf96dd21bf20069cb563a9
- SHA512 355c6400cf99be78f1500b9eb07e1b3d64b90f9db7242b2cc5c6d7da8ce74d47e15aff536039673b6a0d92a127790274436522395b1f030f82b433b1fb4f362e
- SSDEEP 192:VRMrcBzk8ZfljUKv7zM/PRpkAEOMvRD/UK+Y5D9tHsb+WN8GAfv3krAWHuw/rjVd:VRMrmzkTG/sXGLwFrrNelhuOi5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 17KB
- SHA256 a50415431228d109ec3e1b7ebd19636710fa0633529d14fd30e44ad062aab522
- MD5 1f40a11ddcd1342b8dc9310d14dbbd7d
- SHA1 7f9916c2405c7e474264dc8ac1159bb725d0b900
- SHA512 c0b7ea568f79579b48ffa03b29d53a5b39ae434e64d90e7f22d7bc79e06ea100bcc6a7ec70714bb1e9b2e60c09ef6378fa8f88375822eba75d1cfd4320be5222
- SSDEEP 192:hRMrcBzk8ZfljHIv7zM/PRpkAELMvgMDKUK+Y5D9tHKDHsb+WN8GAfv3krAKQutE:hRMrmzkQU/sXk2rwFKQel45Oyg5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 18KB
- SHA256 fbb74f5b099bc9b0af82a93f0f01e2afde5c32353d7eb4f189e7f056d7ac74b5
- MD5 2d7b0194209fb40951acbfbfe1bd2eb4
- SHA1 245db555afa5c0d67d83b8ccfecff755596f8e63
- SHA512 12b915747a7208ce327c87b5aa36971920fc82ebf88e4c7f3ddc9267b3a05923251cadb2534e37a5e262c3cab4f24b68663c3817e250206e550a4778a715e3dd
- SSDEEP 192:hRMrcBhk8Zflj1dv7zM/PRpkZOyErMvgM7hiUcp+Y5D9tHKDHsb+WN8GAfjS3krj:hRMrmhkKd/sXn2rwyxQel4IWyL5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 17KB
- SHA256 d6fd75b06ce4326edbcab7e978c147b059eb8bce7e9bcd7d886d7e7661a20179
- MD5 2fa71f89d56748186a47d895e6502920
- SHA1 020ce18f8f9f7447296c328c50d8c881c94d2bc4
- SHA512 51925d6dcfeaa39a6d77c0ac0ce116239f9a2dfff4472e3496bcc26bb77176e7923455d28d48a17c91698e5113a30bb8b9ccc4735082793b7001c9af244b00f2
- SSDEEP 192:hRMrcBXk8ZfljHav7zM/PRpkZOyELMvgM7htUcU+Y5D9tHKDHsb+WN8GAfjS3krX:hRMrmXkQ2/sX32rwyoQel4xuyR5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 619880725e335f7aa1883452da0e5558770622daf04afcb7e21737f1ab27651b
- MD5 8373eaa09bd0687cdba82ed939821c57
- SHA1 ebd8208a45e0f04d94b8bae8898bc64c80c7a80d
- SHA512 715c0c829e3652973ed02810155e0c26d3fbb3652f0de1935fdb11528b9bc42d86d35870468a29c8ddeacd60a9c55e9a2f0e13cb82e3018d0a38b4c06c278de1
- SSDEEP 192:wRM82GZfljuHv7zp/PRpkdK29tHsb+WNnDcmVLD3MeyoVyIsnAUgcaJ:wRM82LP/FXeLwo8AeH5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 09f62b4e014f274e32b5001cff533347d0d32b6b408098fac934ddca39d7351e
- MD5 80f5d4520b643b00e1f449d7ab3324f0
- SHA1 3d35e1fc22af168d47653d32a6f7778dfaeea59b
- SHA512 b1d76e7edbeacdad547462aad8a35e3b01142fe7e20fd3ff09bfe97f643486b18cef7c48de9bb19cecb97dc5dd0a441562e2cffae094b5e1ba6378a85b0f27a0
- SSDEEP 192:wRMXTGZfljufv7zpAPRpVdKZ9tHsb+WNnDctnQYhiVyIsnAUgcaJ:wRMXTL3/UXCLwoqYo5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 36b88008abe1a36dfafb36327c596740ba1a7b3a013dc51e86391a6d024bc9ba
- MD5 6c6b3f01982177ccbfb2376b6d43c411
- SHA1 7fba0fafd9b67545a582f5947c10720c199b6fca
- SHA512 7c6423e920e8c2c219e10735c4ad7e799ba941263d870e135080012a814590a0bb3fdc067dbd86efd9d8c272859a752ce934d4c2c18c452099516614b68e1873
- SSDEEP 192:wRMXTGZfljuov7zp/PRpkdK29tHsb+WNnDcmVLDI+EKoVyIsnAUgcaJ:wRMXTL0/FXeLwo8hE/5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 e8c9400db2bf9ecc1c98f85fdc7b8ad92a63ed09404212682d7d273d0702869c
- MD5 9733be7f26b34d5af691f3aebea65c31
- SHA1 8d183a3d551e2cb2a00344987252e4d6f0340dcb
- SHA512 21bc958a9b1d48b22b4a508d5cb1ec2b2aefb31cb9d26638383422b96a35f077c63a7cc6b99f6d55d9c1f3a8216db3e8e5621fa8e46e1d88b2d9ea2668055d6a
- SSDEEP 192:wRMX2GZfljuHv7zp/PRpkdK29tHsb+WNnDcmVLD1CcgoVyIsnAUgcaJ:wRMX2LP/FXeLwo80c55
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 8d5f12faa3b222cdd3889424da9e8e4d1b222ecd77e67e8a3d465b04d9d1d36e
- MD5 3ec4bc741a83927d80137a0108026625
- SHA1 9c7c3eef12e47d4baea35b210258da33b1c06c0e
- SHA512 b992006826aac5923ec85bfdf9b06e4d7b08e5a0d647f738d9d3a7e04be369217fddd10eeed7ea9ef9651dff0e43b20f4a2939bb97a12185c2e384cbe177ecfe
- SSDEEP 192:wRMX2GZfljuuv7zp/PRpkdK29tHsb+WNnDcmVLDJmNZgmnoVyIsnAUgcaJ:wRMX2LK/FXeLwo8IgX5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 7610f513f96d56fca12d56694f4a8d20f16bc6d99fed36801f165473d1d83ffd
- MD5 741b9f3630a05376adb74c0c405db05a
- SHA1 f2f58e7b32f3744c22aa99d25d00ad1d9a4e4069
- SHA512 ffc9d2e1c5deaebc66ff63917005c127e8d76c82614302c9122cd6e2fe5eb1fb9ba29123c122601af78f4fdb06d8b7a163d576efc2d7b1fb81291f76746692e0
- SSDEEP 192:wRMX2GZfljuov7zp/PRpkdK29tHsb+WNnDcmVLDI+EKoVyIsnAUgcaJ:wRMX2L0/FXeLwo8hE/5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 9352b51c4b5bfe83033c076fc45cf6b14e910cb51d811e594e0e9e3c14ca8285
- MD5 d1a591c0946a0f08ea3f9afc1644f295
- SHA1 1395837d8febedf672b6a673f019cbf27cd6f265
- SHA512 0e48df9894f1766231503e7cf711f95947e4cad7a0b6b8a4c123086a77cca608bde9a0642e26b80453bde1cb3215e8d6c2a747fb0ea27736d74f8c809223c66d
- SSDEEP 384:ikjuF7KxkXqKf/pUZNCgVLH2Hfgsl3E7pLuLci8sNXODuF+ErU32AHG6DfX:iouF7KxkXqKf/pUZNCgVLH2HfgsRE7pZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\6ac69a8b-70a2-446f-b299-32314ffaca2d\index-dir\the-real-index
- Size 72B
- SHA256 5511703d42ad5544d6d09e7e4cb8846ed9a865e8cf5d5829074f2a1bbc44dcbe
- MD5 d4e38aed0efd7aa1907fe4a6b1713366
- SHA1 81de20ea38ee574a7cf1e8661472242b5b111d7c
- SHA512 667e871287df7a93a4e5d756db153b95d70ed1dc25fe0f478ccf3d6222981d100009826f68f57d3ea53b3d1fd23c07272432b3433fc00282029a4ac60f9b81f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\6ac69a8b-70a2-446f-b299-32314ffaca2d\index-dir\the-real-index~RFe58b159.TMP
- Size 48B
- SHA256 3d01407f93042bb7c9b0dd6d2f43c74bc8f73e3204b1a154e62ea26371dd44bb
- MD5 fdd394c99d128bf74e6b2e3139b9c735
- SHA1 f007d939b2e100f5b6dcd3ad4604ef094a21157f
- SHA512 6b64e817ed111e5f5b233d2ee7d314870d9c9c38e8eee507419b717dd26207d1815d40e0a8930dd54713b25f64604fcadab6f5672a7eb60211319bbc41aa3d0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\cb3a23f7-25d9-4985-a9d7-5a751ba828b8\index-dir\the-real-index
- Size 2KB
- SHA256 4e13b4f624f5dad0ee12c3abf3f24de7b921932b517bf80bb3213552f571fa14
- MD5 326db515ac6407e12a550f4e2d0849a3
- SHA1 7ea03b16bbfb833e28f6c2a1370377a2b2273bca
- SHA512 67c3c7d4384e6f1dd7247455fe0a9f917b5b61766d7fdd7a8ee9221e7ca6a5caef5443550c43728badad6d5dc00f344edf07cef4a63bb4a9098b5a508ada0287
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\cb3a23f7-25d9-4985-a9d7-5a751ba828b8\index-dir\the-real-index~RFe58c55e.TMP
- Size 48B
- SHA256 25aff613303ac40ddf765e3a13ec36d919e7746f3dcbab5f3a6a54f9c53ae78b
- MD5 cd5eaac09f2aa97e9f04a1f031ddbdf5
- SHA1 c56563ad414c6bf0ef7dcafb03f4861f0fda072d
- SHA512 bd8e97a7e23930379dbce460587e6e2f3ed91b2114ee691190e0a0ac98d33af0df66d9dc1bf8b4ed4d11c1392d65adc579df5f8bd191c9958027c436dd3169a2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
- Size 386B
- SHA256 4eff5317e3fc3d30b34ecc4401487992979b15015226c01665da5fb899ccd664
- MD5 5ad35d59f3bec7c275967ec0e30a3595
- SHA1 af0b83b9ccf57963dc906e87546191264378fc07
- SHA512 9a1637d4b77f2df960f3955c66fcf63e1243e7931c0af9f578bf6fd3fbe2dc2629ba3a378d49e1c020fb0a3f1ead4ca378053c17bbf28789cdc7f81e20d23490
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
- Size 383B
- SHA256 303c35ca378f71192f7d2d3f401e25b8b271c37e16072c29a74f4479b90afe15
- MD5 75ba9d9cf45be2bfd4c77b528b66177b
- SHA1 3b27385668e65aa9597959c8609d6093ef08134a
- SHA512 7697bc25a3f85ea9ab9ecd3c68479fdd6bcfb33e20f7ebd2f7b5f1b711a6f2e005068f44069e73d855659695252d9bd7601cfa2e5c918bd8d8f10e3d356ade30
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe58632a.TMP
- Size 195B
- SHA256 46717db3fa14389e1db486ad28a142cbdbde46881f4ebf161af91465c1001a1a
- MD5 7a4a9394824c08a7fd64c2090c93ea7d
- SHA1 3fc6062b82c4255c5f7398dd2259bb58ac45326a
- SHA512 bf2081e050c6703e1abeb046f1e5a001c6c591cad6256287288c64565d32b744e58fe5e044d667ee98fe83e425e7a18c739ae075c79adef6caee77f8893802fe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 5b285f7b554d5ce3a9b135854168aad9a83f59478be5c656fce957ad7d9cfdbc
- MD5 6bdcf8489a7b9af3774a4ef97fc39078
- SHA1 a33e80cecfef8db264d51057d2c6fb5267915630
- SHA512 01bc4a01d3da32e1441ae756baae4a035d9b3090ddbebfd63b3d5c4a00c0098f1ddf5363957739feaa6d76500ce3d1c67991b95de327ca62030d38e6302d102d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 168B
- SHA256 dfbd2c565e2ffb5a2c733b8e0aa3d61fb4ab087806057c12fd7c4232ff59a5cb
- MD5 2d4acdb416cf5e6b102e229e8a6b74c8
- SHA1 1ee9d1834ed9f0fdf93dda55738beec5b14be1a3
- SHA512 55d7457a5a965863686dd24b626977aefa82f88839978eb835e709bc2a90b3c0e21b2b9b76c3558b1d624f08ccd8216e29c77c818ac82faad8f780928bdd6da4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 168B
- SHA256 e57f0c78d910e55d9870bc6e059d2735706c650eb06f903d64e60fe05985881c
- MD5 b3d86b2f39b13da2ca82a763c89668dc
- SHA1 b7185ee21d964e6793279ea8f1795223cca2e982
- SHA512 e8915a73bd117264736d4045c507d7982ecb35ce616118840bca7fea1d2947b69341de5450a3ee385193bb90a45fb1890ff6587b0341a0846c76f39060df82df
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 dcf56b852c688c29df6895e80985bf8943d8180393602c662c54aca7f4a7b648
- MD5 2916e9230b833100f3cc00396058cc26
- SHA1 4701abca8b79663ad421f05c5b8e3bb34300c550
- SHA512 d151d4add4eb69a99abe384e7891a5585d70e34a1abf6b272de486d4adb21092edb1472c635b0cf429db4086d1168c079b80b730114356ed172d7a0db1149dd2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 502087b949703341f6a01860649df8eef96376bf6fa46c198dca3613e867c006
- MD5 fe02b766590309cc15278b97d9e62ffa
- SHA1 b4bb5d6d6b0c0a13b017df5a799a73e6b845ca4e
- SHA512 12ffc4693055c8403dae3c6700ca0bae434b5d4683e25983bf1c389ef06d97c99dd844dd7af3ccc4ddedb485b4c62efb389a6d8c31780039e1f543be06830dcb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583d81.TMP
- Size 96B
- SHA256 e7326b123f9eefaf880a41b53230edcd9b1e45c43a675b102bde2223e2528839
- MD5 f257529f2bd138f0348846a2bd0c227f
- SHA1 e42328ce35e771881f10affb1e455aa1dc154047
- SHA512 5ee463a0a1a3035be0bb086c7c608db7719236c3cefd0b766543328caa4fbe900f38751f28042830c08707c2ef63e668581d0682241711b3ab34599479ea5206
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\2326e7254a250198_0
- Size 255KB
- SHA256 30a0cf83ca4d69ec46cf4156a3ea288feb1454543deb93e52cee70e44dec6b3f
- MD5 85d85289df132e89056a1be84d792f89
- SHA1 0b7fb52d160c4d372bf766a736e333b29078cf42
- SHA512 666a979ddd465a5cc3eae1bb7ddaf9cd7564b163dcce2b0fc2ae58877ade0945fd52413a2feb2a9e98beaa2cd03b575ea22e7f1f5809051f1d880eb001fa1104
- SSDEEP 3072:GGrTeIWRS97ZLmDxhyWXCgsIYTT2tPAAT86Ih/GGaN8S/JweFwVi8:B/DWcZcC9IYTTBAT86Ih/u8L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 72B
- SHA256 47f83b83da4fb198f5567da6e67b32218b3600ec6f72b4cd65de0595d5a74e59
- MD5 b8104185ad16026584f0ac9e7ac7afdb
- SHA1 8e41060a06ae3bc110eede30c0d4499dc42c3c81
- SHA512 7b6d0dc78475526b35e7f79bc87c4d82040c8b82641b83ecef7d81b7850ff5d51677051d01dbc31cede3e70aa57564572241d413ad03925baf7ad8cc37ec8cd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt
- Size 150B
- SHA256 7041313fce33eafc4d0aabd9b024fe568d93f4e46246b914f4e481d4cecca8f3
- MD5 b740208c39027f0c06f2cbabdc1b920d
- SHA1 74e087399aed369436753208a3d50d8c74ee0bd4
- SHA512 fe6b6a8a384de60ab772ea3e09a730892236b05ffe7d1c4be79e9bda5d65d7f0003ba806832ace948eda55141a6ead83bcd99a07aacabcceeedc2678c33f0683
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt~RFe679ba6.TMP
- Size 157B
- SHA256 098412dba9001f7edda9e8bb9380fc2b424697081fac0e8d8ce8f0cdf23690b4
- MD5 e36df124a61134313ef7fc428d5f3ea5
- SHA1 4707aa28fe2049079b3ff45c63a9b062e9b50cba
- SHA512 da00480c16ae437e09979ac05154e5905fb73d82db0049f2706c49292e7963c87b89937351227039201c36ec82d42584590b32f9ef8f4f8aa4994a004b0fee21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 bcb74c6dffc7622c2d7745c39b7b6796c3365bd38376e1109a2bd32aff72a461
- MD5 4471b0ab77d789ed678b654b6d3b203c
- SHA1 561de42cab44270d75fd772d95ba2c079e1f8952
- SHA512 cc46fb7997918dccba99f5dbf2a157b54559120a102ece774b42b83fc380f2a8d780813c13e09e58f4094766866bb8b3b58274cfb752e37daca7935b1bd6c0ac
- SSDEEP 1536:77/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r://xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 6f0bfb771da8dae193fe938a54214009d5d7c81a74cc1ecdff12eef0c3b14716
- MD5 e82ff492f295668f9e49ccf45239a234
- SHA1 ea8ff5d982d8c976a885cb6d03a0c469bc05a7f8
- SHA512 5e6ab8b361a9a185146de838a36e4e3bfedd62562280d5e7d8fda25c55ee8871757a4fd8276c979eb0aee256c296b31c92dca227d3bf2d422bc70eecfa6b1b3d
- SSDEEP 1536:7B/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:9/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 424c889e53bffa29e8e2a68a3408ab802723a38fe6a7e58e209d6140b769ab4e
- MD5 be5d1a0ded77152629d17434c18eb31b
- SHA1 2bc2735f32b75f453ef0eefe6aa88bcad3a3320e
- SHA512 dcb5ac94bdf4a0e69badd01ca28807712ab3cbff75d015b28fc4cb5a8d4ffa2f8afe7d6ac4729f9376a0351c8ac39203f87009027ac7b0624fe7feb46bb80672
- SSDEEP 1536:7P/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:r/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 a2b39dffac61e7443fb615f23e1bec0e14e034c6f0586c17be40dccced0c19cf
- MD5 a8a2d7b9e7bebe5ea6a51e51037e9f1a
- SHA1 723d835577597688d5a035d5c2f06181614eec37
- SHA512 a41451ba701fc2e1e961a14c6d7fdd69ece6fd7fd732489c7755501e7c7be8e176f15b6ecb92ba65a07c60c826d58cccc11a62bc592f5f78d49f94ec0116a469
- SSDEEP 1536:7Y/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:0/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 0e46de9785335190ec7015d2923036a0aa66efc92110b4899a6870a80ddc2081
- MD5 5cb235352a0229a7267281d36157ccdf
- SHA1 464ef26a3ba5a03787e572bb4c045a938f11501b
- SHA512 0b38295a76dd90f9fb6609092f672ba3d9312880b345c52274672c3dde055906df711671d1c9b49ed52c30b69837b493b8edc817e7a00c40d83262e1195ea131
- SSDEEP 1536:7K/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:O/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 599140a994cd5d4dd7fae5de7a386385be58b7231295f113738651977d6be43f
- MD5 8c717bc589ccd4172c1e97a2e703d4e9
- SHA1 0165be432cc5e0ee112bc679217ce72f7ece5336
- SHA512 09ff402ebb488b195938d43d3ca153e3ce0bd170307871ae77982da83ab1c58a9f97b8a64999044634ef5a86d9d0cd5d679488ead941af3beaeddcee4199c086
- SSDEEP 1536:7D/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:3/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 92a83d0178fbf6377c1a6b332f253961319174858f19175cb8d335264e7add40
- MD5 386d9d90069f1ae018d93efe3f2f7969
- SHA1 b6ce932c1fa6c0dd59944a010055367bcd9f7797
- SHA512 6127ef51226f3c3e1c113e2fe42ab50dad12f62a5581e7c49484c2c6c81eaf714e81a960189130f0efb4d9a08448b78377f2a62bcfdbc05a75548edb21dd6558
- SSDEEP 1536:7M/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:g/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 73d1da39146eadef0e56664844b07da49b1396b5998f6d981b90289c93c344ab
- MD5 770a46a951ea19aeb3051bd900526ed1
- SHA1 1e4722538ba72effae16da200da2f6969f39ec2e
- SHA512 97cadaf5f3e62487f8fd86e50d6ab87da0f3ef9466dbdf5ac28f054f1e2be4e0701e8ed1f93821730b3fa11bf7a278c8394decb1e728183384ca386170e4461c
- SSDEEP 1536:7L/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:P/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 70f92b263116d7bf622052a5aa2ddb50e637b48c0ace2ca3c57e51edba86dd37
- MD5 e3de9eaa1476872583b056708bdbd263
- SHA1 e05772240381721308ad54fe46b77f1f8699c671
- SHA512 3eb58fc3db1f79183fdbf999cd80d443da2a8d4ebc75670ccf98fe05c3c828d0d13b530e8bc5c05b9601242edffc481c3df1459cad9d07af2e33fae03ba2379c
- SSDEEP 1536:7A/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:0/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 28c6eab4102f161d3a9f4acb0f437276dd873d552d72ccb3190c1a1155126ec8
- MD5 4311292f4d0e38226908f2c11126adf0
- SHA1 4a51902c843c02a3e19184e0bccfe49681b04e6e
- SHA512 4b0f1a5bfce0dc8acaf16e416e12f687fd5d8c2252d9aaa9d7d36a63e83a0e15e37dd5d5fb1289913c6035af546c3651c5a19a4eed9f84903a44e6c38c87abde
- SSDEEP 1536:7y/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:m/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 9efe402378c178df9703556b329ea5b2dcd71d83e8a73c34c43d74b7d0f04e7a
- MD5 5ed87ddd73bd3449f6813164739f3507
- SHA1 768ff27a720bdcb2d138715de0f68e208d82ac92
- SHA512 28397ccb4e0563646f3cbdfa061e2ddfaf01cf082789435aa79731d9fd7453623959a8ca2e21ec8da82aaff2a69c0f459a112fad8df5004264f56f5bf24f250e
- SSDEEP 1536:7Q/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:s/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 85KB
- SHA256 5225f63bf6c7430eb2b214a50c6b35cb7e8a56a0bc7e8a28a76a41edb51cfb4a
- MD5 b62867fb04242bd13797dc820b2b0f87
- SHA1 146de542fd41c786b04b1d2b5c85b5b90ac8abbc
- SHA512 62b21a3f3a91282210506cb9fbbd938200b71d6fcd4d40454a67c61c1f418ba1bf0230414f0250e80bbfac94c2a03b724a0266ca50e9b6036847c983ed7c45e5
- SSDEEP 1536:IodjxC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:rBxHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 85KB
- SHA256 191865521a09e76f7c12cd3689eadf28118f2922be593fd29ab7039981e96f0c
- MD5 fdba84a2dfc59a41b1256df03d44eaa0
- SHA1 1e919c5edc0b8b0c37a8e0b9cda0d1f830f18fec
- SHA512 6fb07b9d58687404b0930edc160a477cb5f39c87587df653849b5d90505e3fd71c8f28f5ee7e9950c224f8465b8ef961649db2805e23e00e206dee5008c3a8ea
- SSDEEP 1536:XodjxC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:4BxHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 8ebcec2d4d3e6f7b166bfe6267bb9bbeb37d14ea186fb2ed1b7fdc4137c80b06
- MD5 bdf12236a2f3f2291fc3396a5f272c8b
- SHA1 aa507f285fecdccc77476f1d050affd10210d1a1
- SHA512 1530811a537cf95e89c0770f04a97afecce86c3570049a8265b9c14bf8c40771315c1695e1ffa698acaa9df9b856542936fd8f9b856eaf48b8b04eb1c7580aba
- SSDEEP 1536:XA/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:w/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 84KB
- SHA256 6451aaa4558e6d6032303db1362d824e72037cf4c12e381db67aa20159d66c87
- MD5 bce6fcf3e740afc3e6d1a52269ec9447
- SHA1 e7b083a34fd3493e3fedd71420f46e9479d9b454
- SHA512 72b74abc64f804a3398f4b06e0a3f443b80341351027dfb1e393c901330c4421ee05ed8be1c856c94c88ec99fe582ef979c46175454b51ca5013ac1e4646790b
- SSDEEP 1536:i0xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0Z:TxHwL54VOF7pUiw9OTvwqhZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 86KB
- SHA256 cb86bdfa740c83b7f832afe267288353ca94f4215655df0be00b4be145cf72e1
- MD5 173529c1515f51fde7f40a9a79a6247f
- SHA1 bd042dd1eb5956aaacbf8acedec4c62daef66551
- SHA512 2b81a61a6041b0b4c48092803949d82397b5a015cf0f3cfb766ea5d6146df7291c825d9de62f5e02fbd56fe9fbc8ed7ca087e913a411e06d62d1eae67dfb1a44
- SSDEEP 1536:7A/xC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0r:E/xHwL54VOF7pUiw9OTvwqhr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 3c44b9239c7374392cd9609ddd788cdde29ddc384d398b070054bc1f70a9ff33
- MD5 9b24f6b194f9ba51c909b014ed63146c
- SHA1 6193273992dde4182589927b250e33af6b1c5d59
- SHA512 931ad548866c4cb8c4b0babda61b6ea6188ee1bf1d7dc2ea1c7b69f5dd043a8405a321b6b349e9b0cb53ca534c164a75b0f202c6f6054d84c55faec0630aa2aa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 c3172a9bc7795758c90f551c19a6ea809bcae185d349b5d3046676ba36852dce
- MD5 8d81c362ebe697a169f108d4b7e5d2e7
- SHA1 7755d6c20af89fe8fea834cb615eadda2f4e7456
- SHA512 97b06c4414b1848c31c7276960ad30cfd960c50946ee0e2a4896969204309ca1b5759f0bd14412a16c4c23ef5feefeb9f8900aeaeec9d363d0f2d1296cb91dea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 4940450dea5c7e7f78a209c919ff6bbf1a7fe7cf004d8cdd8513542732ecfef5
- MD5 53ca46587ce56c0c75694d062e726fb8
- SHA1 7027222dcec692b205c639500ca42cc37d399217
- SHA512 f85dd874bc6be6c93689be4ce33cf32c6822c2d486e744c64f65bce494865f683b50dd30cf339df3fa4b734706ba58a44ba9110dcb7f36151249109a28684ce9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 b74707c2db6b88b71674ed98541605c8c67029e28dbca1a070debffb13fbaf18
- MD5 eea255fcc844979138eec5746c959bb8
- SHA1 f1a29daae68e9b356540dff3fb4f7cdf25e517af
- SHA512 6488ed5e626e90b8d1e1483501aa0fe754d1ced63f065ce7bbd31e40e538dc10bd5862950c9bac6df238c7a81ef2554a7ed87e1be84893ead272f12e79c7d4d9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 7a5db93b5db8e7da9df9f31f34245169fb4b5054b21f48d03b5e7a6484a425ce
- MD5 492794ce942fcc610b8d504ba4d2aa21
- SHA1 95ecf042e5ace3c4a6d6409b22bee925456a863c
- SHA512 f2009cd0ed83d8f0a8a91b359b3586b556c6a8dabcc3c3b939ac80346176707996aac63e6aa5707f5874668974f87ac9ac695d3f9109ea9351950a17c8d3371a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 bb7568b83453a8e7068510550adae9888713f95a336d2d23b728187ad45f1907
- MD5 4698c7562a66215a94d862c763348ac9
- SHA1 16a367c29bd3dc4107f5e9b3a941bc91f59a829c
- SHA512 b868a2935b5ff892138a52d80b4394c8abf5a5ab6f795007075892d41eef9259db9713c65e0ff74b6d3156c5a62775ce0c975d61e7bc3c7b580f08e72fda9829
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 334B
- SHA256 a1b6b9776dfee41eb888eb4c3ecec0744ef77015a817479538a00372339b8b6a
- MD5 26f1cc78905fb18c806941d4589fc494
- SHA1 5e2c6885ae287f6734141451f4d3b82d2465184f
- SHA512 66e58ac26e9a983f66740484dd611800681459815213c3fc1d1d016aba0eecda03cbf6e9b33f294d8288a26e5f349b88b82088e31ef44d83e6a879e2191aae73
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 0882c53f3cf850ae761f2c76385be776f54e2a979d6156dc42a6f3eca05df9e6
- MD5 4aca2fda15bf8add016d7013a6dd65f8
- SHA1 20df50d5b84be5b83499e4d1b04b69004cbfe3b0
- SHA512 acd560cad6d11b73550437d435dc678174f077b531a4dc6d33c78388668faca8e9b8175aad0e7b6c2d3fdb9874f41ae8292ce89508f4afefdcfcf3a936d6289d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
- Size 38KB
- SHA256 145728682e9c7fae9f9dbf5bf52b48ae69f3ae42c8a0e306f380925eac47c89a
- MD5 961f0dfff2853613109b62918976c37c
- SHA1 940869a7644a34937f618c90392ee708971474bf
- SHA512 b9945df14d8bbeb6ec374d788978186dd4dd7087a43db59e55ef38e4d4b28a4d6162c3d34de3c22ee9cd58a2eae8bf63ef985f847ae77721773de1e12b3a1b9e
- SSDEEP 768:DL1dr3LE9hXydTUnWQJi6TPV2MteqSxSNC/p7vbW330ClU/tvY1:DpdbOuTyWQJi6T9xtesNC03stY1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
- Size 64KB
- SHA256 0b9ec44d5a1aebfca65a84b172b69f6455c2f2c0c0b5e0e088972b7ff4debca4
- MD5 d0d1729feb5a8556e68a00f7987792f1
- SHA1 36bf6514d05bccc3d8b6a68e17d9030a032e4072
- SHA512 02b2e317ef82e1d9bdab33fbae29685a30bdd7089335c3931c3c15c0a4ded055b2ad7cd122bc45db631d34b453aa3fc727d96d5e9e62f6ec409e04f86bc55eb5
- SSDEEP 1536:NsWpJltU+fng4SBd2MyuTXzWAdQgnV4sWh6wLVuGh3ZfM:NsWpJltU+Y4YdnTX6Ad01FV3M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
- Size 23KB
- SHA256 5fe46b274a6a4bcdcce265584ab51e86b981445c5d393ae582af1516fed6f28f
- MD5 78ba4c861c76111b8dc877803d16d0d0
- SHA1 64ab04aa4bbb119ad079a78bd523b8e4bd16357b
- SHA512 aac701d4fca087bed3ec60c8f31a3db81f94c4ba85b0b906ca82108bf2824d7ff6071803cbd11032037290570fc0f5786dc7d664de3abd88da138afd1f504823
- SSDEEP 384:z4hUkWSi4T5cE8gyJiSCO7N83ckXIA/0kvzTb+Up5K48908Ghwm:zXkz89iSC+WXLzTbX18ygm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
- Size 128KB
- SHA256 3170e3205f49d04ae41b4c13237479a3a9a222accf4cdce9f4ea6b1032a7130c
- MD5 e77d4a4bbf9cc52a064b108aa40aadee
- SHA1 52766d1c7dcad3121ce67a9b6cfb5de703c9ded0
- SHA512 0093642af44c9b4c70ae72138dc9d8ba60bdac1f561e2052d0207d5671d40d5d27fc27ce18c7e91465b4aea371332783abae89ec47bce6da39e775168ac63e7f
- SSDEEP 1536:gbGaY+UjklYPPecRyT1vNZB5JbB29AEp5QJFKCpYbPDj2ja8qa:KI7+YPGKoNZ/xBtEp5uFp+PIa8qa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
- Size 46KB
- SHA256 f932e3e299924e5fdf90cac827ea57346e7af391a3ddb4b53618d8508d2c5196
- MD5 ae833292afdb66e095843520e523a80f
- SHA1 73500dc92436fa2eab9b8a6aab4c6264843473b1
- SHA512 a74924d6c33e0ec429cb12d960a7aef8d6b649859e691eabe18e7c95b4cb2436d0be1d2d0a5e78014712fe4a5cf0cfb91a2c1fd63a629933ea5b6ddefa571323
- SSDEEP 768:JcgzThP664PEHQ1my/IPUXXsElUFlF4GEXPerRSlimkoCkUgNeWpNY0xm:J1zTH4PEHQswIPdE7FPqQluBIel
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
- Size 170KB
- SHA256 acd8b6d01e1f070a6a33629ca026039ca862929530f4cabf28a6bd2a5d8c433f
- MD5 bce8ee78d9a298658e003184901b4e6d
- SHA1 3bb5747ea162f7c7d8c165f510b8d3cc0d2a7323
- SHA512 0d672de23db51fd274d366bb72c183f4f2b0e22f2e499f51981bb140e3946fcae11e973e64eef14e94dc0b6ab92594511785cff615ee64796e6eac7abab34494
- SSDEEP 3072:W9PWfhKsgfS983adsjYM59rE/j/n0t6mrBVF1D7wZC6Rsnk2wiASSaseIHO:cPWfN9MJY/j0tbjFyBskCA33XO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cc
- Size 2.8MB
- SHA256 b0458c388fc3b4f53e9d4d9d570359293f8210f352694ce11c8fee33b9a4bddd
- MD5 0572e7d49c11b8ded92f9d41734e946d
- SHA1 87f48efa926a119ff3fbb5cc264fb810d3bc98d2
- SHA512 5314f4e0ab7a1d4e71445958da4099e67456c6945670af082ead2aea8f1aba0faa641d0c44ae4e9a6e34e6712c830cfe9ff0221cb0f41b2c31dc1ecd7076f6a1
- SSDEEP 49152:z6/ax17CFm59ZEkLhk95Wc8wYknuv6ebj8n7cxN6g6SyouUYezjLdjRSdFsR:X7CMfEKWWcEsuvVbQsfznpy0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cd
- Size 5.2MB
- SHA256 67e240f94241797255ce6fae0f611404d671a9a0775291a559c2696619971ffb
- MD5 019e96c5fe744a8d4a133774819dcfe6
- SHA1 13cb3c4020a791daefa66d8b6b6523cc3624604c
- SHA512 3f9920add51f328161632a474129be19206a0fd7fa318e4025b3185b9916fce7aa38bb8cebca826af56335f966e7361517035ba20c9b9a39088a8d7ec1328083
- SSDEEP 98304:Q6KWtfbyZeTcMqasecjTcxqSSSPcmTFQ3zul65YUTqXqmkd:Q6KWtTyZqNcjzSSCQD4MTqamkd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d5
- Size 90KB
- SHA256 9cf1ab377c618138550f3c08efe8c74a7c5f73888a736cddd7d7a48f45ebf54f
- MD5 bbcdf285efa186f3e001184035457b7f
- SHA1 ab1db2f9309d02daee539ccf0d39d5362fed5318
- SHA512 e4d6f34ed0bdef9a16400ef494a00a210d6039c8df20a97216ac0dea60d6562c5a4dffb06cbd13b732c918aa804c0fea20bb16e452f086a2a97958a6f9c02f1c
- SSDEEP 1536:yjhy1Yo9Z/vstc4/yKHDL2231Q0pFsb8vCH2leEnkPbVnHmlXTADed9SBqVSx:yjC5ZMtc+DLnz+hW3kzVHikDs9SkSx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d6
- Size 36KB
- SHA256 af954903b2b69b365248bb1c219f4839025d23c055ff23378b669164ace8f5ea
- MD5 b8f3197b95ee72d5fdedb2a99487bb50
- SHA1 a22c953c9d8a18b48f9f94f71fdb0639fcf24544
- SHA512 496c15dc578b0f858ccfcfef9ae406fc71c1052e76a2cb907ba75f2f3034f4e11c58f96d23e3ac0d1d31c3ceb1015945ee27aa6690ac7aa5766bbe77b42f6aac
- SSDEEP 768:WLx1G8I4TQ/QK2ZyOKwFnDblJrXxFgeXNBn+iL9L:WLxrQ6yOKw9v7xFgSDn+iRL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ed
- Size 168KB
- SHA256 d7183bba95f8312e13e6347ac7abea45dd4d3b2db4e7d86529fc96d27c24fb30
- MD5 558143eb9db6331264de0a4c33060e3c
- SHA1 3144030736839fbade58f9e65f5e1d27edbbdb41
- SHA512 0653634f0db54886a8e8c835dacd184fc039dbc1030ff7f7eeda0dfff53559a6168baf0e332f4d498989d255f8ba8c4527d209631ed342738c92af2cc1051dce
- SSDEEP 3072:ieYalS5MnPVQNBNuWgJP9Pi+H9cmKv/HqOgEhMn4clA13Bta29Dp9xlZoCW9j:79lS5udHJgEd+/HngdFs59DLxjoL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 5KB
- SHA256 66ee5d0c34fdb1562f9fbc6c273a5a29afc09826f63b90883137f3ad6afc84ff
- MD5 7f82041518bcfb324e736f063f2efe58
- SHA1 6b1e900416740617bbc9177acb541bc3bd39c022
- SHA512 04b68a845794808b3e84bb2373953496449c8646c3b2a689e086c36f76e055ac61766240a348bcd4755be8fd42000360f9225ee8a2b32a746d7479aaf3c78290
- SSDEEP 96:i8n4qrSvxi1CTyIsNi3cYt4yzXCN+Ds6mZhdO14dR:i84quXmIsBYt46CN+Df2hAq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 4KB
- SHA256 d79205338a2a8df70af93f504aef7476d1320479edc69c4d2510c2eecf8f1de4
- MD5 1cc4019d419604557d8293b16bf4c1ad
- SHA1 0a93e8d4c570d7edce7bfac622af300b8ca6e1f0
- SHA512 5bb29702dd3124749c77660958bdcddcd3b5c7ddb0217944eead1b81cc0441dc6160b85b8ec0b6e366209ead43765d0cc251fd045798ff34fad8ad8b5ec8238f
- SSDEEP 96:cBfB4qrSBxP1GyIsNi3EYJyyzXCCWDs6Ukh5jE:cBfuquvIstYJy6CCWDfhha
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 5KB
- SHA256 17a884fcbe18aa79364e5d719440865eaa024efb273a39cd9f80e0a7f79f9c07
- MD5 9cce8121486754a0aa2e70dc68cf9dc1
- SHA1 43242c9f6b930c3498034fb03f571cf6c5f28e8d
- SHA512 2b5734c55785ef46560af17423eaa8ff0243adba529f9c69f3a263dde9518f7bbbf0bbbab9beda62eb6f38e32e67e8b1c9bfc6a4cfe77557636c83a485d69330
- SSDEEP 96:+Fn4qrSvO3DCTyIDMi3VYTVyfCCN+Ds6TZhdM14w+:+F4quvmIDHYTVzCN+DfVhK0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 5KB
- SHA256 d379be9d2213514c347d2477a771ab6a75bf1abde6a332c54cad583045e81fce
- MD5 3555dec7b20df0493a4b187ecd1c27c9
- SHA1 5115be73cb1888efd6202fff1221191db18414c1
- SHA512 b4e5a84ddbbae479619c0684c048050d9f80880dd3ccf28be6e332b7bb771b612d7267447bb328182304fbf4fb5579cb5529ee149166849ae4c69deff62f0704
- SSDEEP 96:pFN4MrJvO3NdG6IqEiv7NxtzTnFfCCNSDs6uhuU14e+:pFCMdCFIqhtzTnICNSDfuhtm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 4KB
- SHA256 27cf6d57b8dfea7dd63b787f018be52b707c3f0ac51dea620cccc2cd6f8fa3db
- MD5 e9f738ca73387e8b03c1278cc8dbcaff
- SHA1 36fdf4821de440bc15894be8b9b44ee5956d5ae9
- SHA512 7b0042e970ae430e31b38f2e8a89f070d4f7db15e83781c1e321b9173ba0439968b9f516a64a01e904cd983367c5bb763697455e2c107067fa08b43916345ecc
- SSDEEP 96:jwMqr8Bx8lGysVi3L1UyYCCbDs6Skh5GP:jwMqoOs61UxCCbDfzhc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 8bdcc3d104363953f60b1e9a10f05a863cd16be457f0ed871dbe44e241876c99
- MD5 8583d229faca1dabe2ad69534fe18686
- SHA1 8062d1e81a7cfc7c784d6586bfcfc3392fc9dbef
- SHA512 0c84253d284eff1c68f17fa8d5980aadc414d10564a3ac6d695b939596a6603d792a241f08ccc4be2b15d2b5ad233b20067af09b1738d2b0a60e77cc540dc3e4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5928eb.TMP
- Size 2KB
- SHA256 de17eb9ba755a2962c6344b4b5bc8283c3bec7f26fcfb927dbbe249dd3a219fe
- MD5 7fe1241ea40bb4bf2b181b1120323f89
- SHA1 3798b00078aadc13a1c3faf51f4959e9f13435ab
- SHA512 94f4f979e3f3759d85d0425fc96d2cf42cbda1235aa45fd80749ad7b1e6e6032ab844a945a37cb5614698d6145e6811dbc90aee630844aeeb3026c892219dce0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
- Size 264KB
- SHA256 116eeee9546300ac755c26726784f5a3ed495ab8c2123d3dc92515be5be690f5
- MD5 617ab7b9e37f3122a8df5f280fd35b30
- SHA1 7c92fd488d8a84c85a39d92ecdc6610ea152ff20
- SHA512 7e1dff2da4752aacd3257bcb51bcd8bc9a3d30771bd7c8d5f474b6688dd7241e5d55a734e297b0d209110c995e7321b8f5157792eee68e8027ff02a0f6466092
- SSDEEP 3:MsEllllkEthXllkl2zEklKT9:/M/xT02znKR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
- Size 20KB
- SHA256 06c77f6121f790b27ffe2d66f520c88a97d7e59aff39727637739ab90b2cd859
- MD5 7f11713cee587e7e799152e326d7de4f
- SHA1 80e12cba914e23ef3366765486e7974c9d6eabc8
- SHA512 14f1086f7dafd8968ae46b43c15546ef055e5ceccc2b7bbb99bfae3c7fb4e8164d773ea3720edfff4bf3f3523c9b3512d82e5cba96f2dbfe0b72ef6917776321
- SSDEEP 96:6BCxTubuSulWUuouCTzMIf1sxpuwuBulWDumu0:waxW+TobW/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
- Size 204KB
- SHA256 d970e8b8187f6959b200f6b125a30572b5d29e9a83ef76c75168eea3865326a5
- MD5 42e7fd8cfbe77b7a0a63e904179111b5
- SHA1 f2168835b362b87edaba0e213b91bd0faecf0f4a
- SHA512 3f4f7a6964187fa115526037ed8d2fac058ecab4f3519a949fbe12ea738502f63fec7cd9859dc44e92031c86ebb664b77243cc37dd2dbb4fc8247374a04858ac
- SSDEEP 192:yO2WusjkW0+G83uxXBBK31GkSJfpWNOEJH7DNspUC:iB4kWa83uFBBQ1GkSLgb7DNspUC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 108KB
- SHA256 84ab2d00a9c76d63c3edf4fd0139236f6b94e49bd7889e4f5f63f19941bc1ed1
- MD5 902622d177776fafc9f85d74f2ab73b8
- SHA1 deb767db94129ecffdcd2ff94970687033409107
- SHA512 d219535bf4fd4b1561c34b2e0c9f3938de8a86a85aba4d19f31b413483d01cb6afe611077620907839f4340475f1468c2097318751aeef4a61c64a75751aea2e
- SSDEEP 1536:IdcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHSRiPjU1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_apps.microsoft.com_0.indexeddb.leveldb\000003.log
- Size 66KB
- SHA256 dd196e672161d5c4796bd84e171fa2c4b5426be47095c898c22c330ac2bd8163
- MD5 da388d80b876ea5486c78ba30d0c9b9c
- SHA1 07d58cc0c4de59363526d7ea43ef5557f445d75e
- SHA512 d71d34690814290a9445b1dc391bf00b579f1cd05c0bb011c3c10f3a88359cc235c53dbc859d531905c1873adec980a9e172c1114cd205d067cd870b7a9b6fca
- SSDEEP 1536:r8kGTX1baSUaN3iJRwmnyweMVkAP76clJtOacaHXS9+QMlWukyiys7xTs7:AkGTX1ba1aNiJRwmnyfCkAP76clJtOa1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_apps.microsoft.com_0.indexeddb.leveldb\LOG
- Size 359B
- SHA256 e904478a53b4948af940975205b347846b96644506eeb63405cc0f4bcbbac43a
- MD5 8194e224283554e329074abeaafc01fc
- SHA1 5dcbcea509cc5d7d8ab2bef0374cf0b6c34dda84
- SHA512 ff012eb350c7a40a330668ff92514d29a52170a6f168983978a228eb78faa4b006ee2d5f22159626ec978a84fe4c9f6e46b9138347f5988b3802e42757ed6a92
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_apps.microsoft.com_0.indexeddb.leveldb\MANIFEST-000001
- Size 23B
- SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
- MD5 3fd11ff447c1ee23538dc4d9724427a3
- SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
- SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
- Size 29KB
- SHA256 e91c1eff5c406a34ee60c82552140b59c8455880547068441061fff5986dc7ab
- MD5 584b2da408c2d85aa95e801f68c33031
- SHA1 0e71406abcfcf56a06283d944d3fd2dc2e486993
- SHA512 38a1fce2f228986e524a800bffc8f0a97c44cc5e2ed5881f1bc3758a2b0a1a4493f2f49e4679d09d2b55e8149b1bb96b4cbf49db84f1934804d1decd4a2611bd
- SSDEEP 768:JuCdwAPqyalao4VOIMyx74pkMdMA0i0/sq0xRa0lMGH9GAC089L:eA8ItxkysVxQl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
- Size 386B
- SHA256 ae7b9e52175ab6b6efc5f2f19ca76a42eba249ca95ef1e9ae2cd520841f12486
- MD5 37baa9325f493cc5e4e0eab1d1a5d073
- SHA1 9dae34ca8d90b07f354ff284a97630be80c2f842
- SHA512 8c40382fff6a2507bcd57d12e12f85c7280ff3f2e179a2291fdac077757cd9b3637514b46a24fa27d1dfc17334c6ba49bf4d7357bc331e0650a5a15350d384ce
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 f65d6425c1ce4e2a835f9a1ff213d2c746c8582abb08e956d65628293a77cf92
- MD5 1c792e8b99d56c3e011a123734d2576b
- SHA1 8420a97ce5453c48da8730e6e28f608fb5a1f746
- SHA512 176556048ae5f06598a62270d272e192954cc3836ef898f88f44792481ebff1e73f173559e2eb393d5e5ea76efacb04eb40d84df91be4c30068825064e2adff4
- SSDEEP 96:pePIys4Vj6VzhvBP0BGO5HztjcEBBs5PBb9s50suBA1/3I13A3Cewd7A0y04wp05:pePQsj6VtZI75Ttjcgm5by0L+/41QSeb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 11KB
- SHA256 9ee3c1a33a17e752fc9693010987d65525624f7d9406384df9dd997a084e5d1d
- MD5 bd241900e2ede29e2958cb1a1249dd84
- SHA1 5041bb3da4a378e960e33731c5825a9bb871c133
- SHA512 895eed3cb5d2acc08a8dda6e306f742ee06604227e99e8ec44d619c77c89167bc7f9d556f155b5a46ca42134a0ee5ca16a47549cd74203e83fce042ab42b756f
- SSDEEP 192:DKidl5QSJePQstZI75Ttjcgm5by0L+/41QSeG8Lbj44kj6VLfsIsk4alj+Fc0dDj:DKidl5Q0ePQstZI75Ttjcgm5by0L+/YH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 10KB
- SHA256 09102bebb679d8245152f03876892061642c68ed1604fbdd2901edc72297e35e
- MD5 1272513813655c9c179148fd445a11db
- SHA1 dc4cba9cdcec93af7b60da1f0dc59b2b09797c75
- SHA512 1bbe327d8dcf5152d5f207586cac661537b8ca1674789153ab3e965a5c4ed060a2737670bbbbbf92cf4b24712be2933580cdd09cbfa505edf38590a945f01d3f
- SSDEEP 192:DKidBePQstZI75Ttjcgm5by0L+/41QSeG8Lbj44kj6VD1RJDXDtvf9fsIsk4qQ2d:DKidBePQstZI75Ttjcgm5by0L+/YQSlg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 45a2d313b04933c57e92791c1d9e059c7ca98efa27da13820c7b2f714403cb3c
- MD5 c07f8e7b2c3248ca53f57f74e0a86d0b
- SHA1 fc05ab32da206930de806bd2dfa8f5e588970cd7
- SHA512 264e465e8581b9576bea265352099397960e17689d1a457c111094f55b4a9f0b22ee907487057e0b5cec44a4517627a30de0b68669e73c23b6f6658e77a9b0af
- SSDEEP 96:pePIys4Vj6VzhvBP0BGO5HztjcEBBs5PBb9s5wB0suBA1/3I13A3Cewd7A0y080p:pePQsj6VtZI75Ttjcgm5byk0L+/41QSZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 11KB
- SHA256 62b50751447b21cddfb3a1b794b0bebf800c35d8bfc156321dd1e05d159a5711
- MD5 b36f3feaab8091893819939716fbfde6
- SHA1 ad4cc5655e72ef1f83bc36c14b8fa477dab13fd9
- SHA512 ce2f31e46bc08be552c71661953269a7837753eb53beea8f563a96c0b954ccfc0c683cc046867a19a78ab6bf0f72c00a1b206644fb787e4f3c5574da3c0b5687
- SSDEEP 192:DKidl5QSJePQstZIgm5by0L0eG8Lbj44kj6VLfsIsk4alj+FcSDt+q4Dq/GxC47T:DKidl5Q0ePQstZIgm5by0L0l8LbE4kG/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 10KB
- SHA256 6a9f19779e3725a18dd30921a981f2276343c4a6f5b614a398c9223970e229b7
- MD5 27caf26949d6caf1ce7c0ba042a166a7
- SHA1 662a0b3fb82d1adf58f168a1b9e807a2c26e1bf4
- SHA512 1e63946d012c1d62d772680d91fd14d159dcecc0fd5415c358332442e328b85c6525be5709c9febde823b3529229791b5d2bc050f052c0a21450b0f0cf4045d2
- SSDEEP 192:DjdCjkxtJePQstZIgm5by0L0eG8Lbj44kj6VLfsIsk4alj+PiSDt1O4DsDGxC47A:DjdCjkx3ePQstZIgm5by0L0l8LbE4kGT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 10KB
- SHA256 c0009c0edf44595d6afbdd963de197e58127bb784c94d059f2017bd7f0849846
- MD5 17b7e239bb33b5707ac35be4fc2f2946
- SHA1 944c02f2c68158fca6feec2bec53590573daa851
- SHA512 ef25853a2f0f9d05fe4809da6f5b4edc65f5000515a92b459ed96f2fc43c64deb2a4814420d8feffa3225adfd32004178300d33d7674cd7b35959a1d5623a5ac
- SSDEEP 192:Djddl5QSJePQstZIgm5by0L0eG8Lbj44kj6VLfsIsk4alj+PiSDt+q4Dq/GxC474:Djddl5Q0ePQstZIgm5by0L0l8LbE4kGQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 eea2c5d2a38652502b1e7aa45bc49955e0b851d88f178db557955d0c69e6c38b
- MD5 3eb3dfca41bd71ecb569cb667b1312f2
- SHA1 3f9a4de083a9563e06df151966ec16d8af086094
- SHA512 451970c174b1db836ccc6f5f85b15fdae6a1602f81f2573a96f2bd95aa0d3cf48cbec6d468c44da56e8d937e5f5acce5b92ee528d669ed3f0cbda4447e4b24bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 211B
- SHA256 1c6dfe8769f7190fe48207427efe591ff613dc31a28140f482f124fa0720fffd
- MD5 7846d23d37b4c9c990f755469a86931d
- SHA1 6a8b14dbe09283172ee4dce9658375d74c2efd3c
- SHA512 e8726d07ab1c45a8b246ea878f76e49081ff6311f3110104b875605aab40543cfd1472bbe25ff917cab4884d1a0a17af3018778622414a6eaa80da1e587ae084
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
- Size 2KB
- SHA256 905a138750a7dea5f53d89fd0b7515b9fc51e50565536a7679bdba547e0062d6
- MD5 555c425cb7de01e32c544d8910faa4ee
- SHA1 ce91b77ebf22fb2eea18a907e4553b2bd328d12b
- SHA512 d28bcf46f434ec36d489835808257a918ba6a400991d6b79ae2c166e5bb60cabaf8ade5af06243789a5e89db6b1ab9cac60e5ee3c9282f5bced058c11f4c1afe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
- Size 3KB
- SHA256 b1bca13ee1a4052e74c641ef68b9f25ab5ef2b0c1b5cbfe765ee270e5eb4fc5f
- MD5 7c6f5ef5847e52c3bad1c82ab2ce872c
- SHA1 9c6e034da45303ad9e57a098bb46f62d9377423f
- SHA512 820419bd01ce2ac038d7c6904f191b32d07f84e2148033bdef317b4b5315dede4717f9359145d83f7a86e5053cf2420ce0a2ae8557df93c805df6b1a2598d4b4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 22KB
- SHA256 188a064021a80213d7fa784cfbf8af71fe96c8bf26e4ff212045cd9b1e5e2c20
- MD5 02beb8830650f1d6370e0d8bec95931a
- SHA1 2fc12bdcadd98bc4c19ec87d7ba262c948fa4526
- SHA512 13dc150d08bd9590ff772478f3a0922530198404670db569f6f6287aa93a720f83af6ecd6dc8728a25070244bdf79362643dbdb71888e16954c240dc4033a0cc
- SSDEEP 384:sxZznl1qzzm4r/fjsTWvG3TPVk+/bb1s/FKwrk2suee:s7lk3m4r/fkYG3B/boFfEun
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 16KB
- SHA256 797ec468c67fe05753e00a82108698667208a5bebbd51967b78a5c2c66eab727
- MD5 6cf42b5b4abcf65cd349ca8b8383dda4
- SHA1 0c2a093056caf2d2c2c5341ebe1ccc0bf0bf048e
- SHA512 13d314fb6cb48b7015412670c793b7ec652822f3e00582be2572540fce3f4a28dfbf12b885d58254b9d7c0f1f1f159bfc2d755cff66480862abd59076771a5cb
- SSDEEP 192:sxZBRDyM//K1Ml8W3sr/fjsMWpVp5qqnE4ga8gfEzodp5u/W6+WNGq4ndYUvzfEM:sxZBtLsr/fjsMWvGqTPV/g/bWd2sw+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 38KB
- SHA256 63e659dac847f771a1d8853a7662216dcfc353d1f53b24c910b99c959b24e4e0
- MD5 d9e84a994d7229029c2db44d8dddf1f6
- SHA1 15963bbed98477e9c43e4959e95a8ad25e24c1c5
- SHA512 b8a73e1b9a60f573756b6dd3c69255ee2c0a12103d1bb0f889d6b77dfbaa0782c3f170d6ba5016263a5907a58452265f29011a1b7ef634e4b56377f5fb0f02e7
- SSDEEP 768:s4ePk3mur/fkYGx4Mnc7WeT+xG/ba7TfkvJEun:ak3muoYGCMmWPEa7LkvuS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 38KB
- SHA256 10f0d237e7b7d087d6a2c6e5419ab2ab7161da57250c204fb99dd055c2d35be4
- MD5 73e4cf8b2094e5db49f8f377f077c6ba
- SHA1 1262bd6b53da20c42e67dbbc62b8414bcfbdfecc
- SHA512 eefe33f1ef4a19871baa29aff1ae6d818ec880f7bdb00cd60855fec56cd0703cff69eacfd34a2a0aab32d739098c64e54be88298e0eb0786c114ed26e4feedf2
- SSDEEP 768:sRHPk5mur/fkYGx4Mnc7WeT+x5/balTxkB3Eun:Mk5muoYGCMmWPdaltkBUS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 21KB
- SHA256 7080b87285656fbaa0c284d4e96b9fd2a344a3373c513d2fda2beb0e4117f794
- MD5 47d36f58297113c7d226a1dd2be425ba
- SHA1 30b571960a227f4eb219225da8901a6fbdaa02d6
- SHA512 fbaff68ad69ae48f7764aede4c87f5766469092544088a2d63a8eaa5595663df627c832cbffb4fbd1754a3b4ccdb728a1397afd6884272ed8eef761739696540
- SSDEEP 384:sxZznlqLVm4r/fjsTWvG3TPVk+/bc5s/FAwrk2suee:s7lMm4r/fkYG3B/b1FREun
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 f896bfa305cbecce003f84cf6d944d94b9c3b275b1d4cd973437dde904a15daf
- MD5 e5c6fc9fe379701e45330119722caaba
- SHA1 e2e5382f0eb4b5ff138ab36e76780e7add34d783
- SHA512 4e6db1ed493bfdc26f0949331a17d809ccbdbac6539cf35a2ca0158f6c09a8a0ae2cc286ece1fba7b7e27097f4003c9b48ba09e51344b4e4a7785684f081a994
- SSDEEP 192:sxZBRDyM//K1Ml8M3sr/fjsP5qqnE4ga8gfGzodp5u/W6+WNtHU/YUvz0gq4FQI4:sxZBtPsr/fjsMqTPVlg/by/injX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 37KB
- SHA256 32da7c9eae72897172ed86602578b59103b2434c6cff0649a3dee32e7bbbc3b3
- MD5 7153da69884595941938cf55767665d5
- SHA1 a95472a338b05e49fafe69bb2c1ea72d2f975926
- SHA512 3e7610352a507ff091ab18e0e79d8a2d02cbe84e63ca8a3e1d920007ce8eab18bf1a0753b2fbbc9dbfe562c2d2b91e30fb4793bf4730edd0ccb2a7ab047089f3
- SSDEEP 768:rCQ8Q8Ck2iA7pLuLU/rWRm/lQIZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3hI7Z2Kt:rCQ8Q8Ck2iMEU/rWRm/lQIZu1jaKhI7t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 37KB
- SHA256 c79d215025781d079b09f58b72c333fe3a0c45a017ecc9b4a53a067420092097
- MD5 4191d73e74efab5695884808fe80ea61
- SHA1 3b454ad232bebfc711e26850e1342727e0216ddf
- SHA512 5c0c04970864b22c942992e365e68a197e36df4e147cbe67ac8e13d2e4480d6991153def16b2873ca4084fd77c22b9552a2b63761ec1ad7cd87d37f0210a6247
- SSDEEP 768:rCQ8Q8Ck2iA7pLuLU/rWRm/lQIZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33I7Z2Kq:rCQ8Q8Ck2iMEU/rWRm/lQIZu1jaK3I7q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16a27d5c-9f10-4ab6-af85-941dfd71ac10\623cd082b6202da0_0
- Size 62KB
- SHA256 0675481730eed06b1e7fdd3e10cf454bb94a44dca3063474895668de4c2603c0
- MD5 be44044a5193b5a64800ed760547061d
- SHA1 fddc9ad3dc6193d4235fd452f18bdd6171a0a5c3
- SHA512 ae7ffab994d269ef2065c35af00cab29ff6a2793f897680c82a3bac328bee80df3be261010268a04000dffee15122b68a72457e8dfda5ef3ae47d16e66a05687
- SSDEEP 1536:ogVW7ZQocmWflqYszFN0Unk3MRr8ubhc7gsB2l3MHPwqOady/KN:VM9SEYs/nk8RrfbBd/g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16a27d5c-9f10-4ab6-af85-941dfd71ac10\index-dir\the-real-index
- Size 72B
- SHA256 e0354d09005ace6bfbf1e4a49ad0788ff608a6d1a44fd922798e2465a9aab41c
- MD5 26161ed634bf847c81f64166cf6c7cc4
- SHA1 bd533a4bb25050a652a2d57c7190d8b0f061b216
- SHA512 a75d98eddd37356351fa2b5b4452656474559fa6be8e038f035245dacd8851c0914d0de0c5726c1da2efadd73b87abce18d05648235a86cb6e918e8c081a6304
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16a27d5c-9f10-4ab6-af85-941dfd71ac10\index-dir\the-real-index
- Size 72B
- SHA256 13528952d2d31022f7f6bb1e7da1b064f95e0e5580726e7670793d4b72b9b895
- MD5 6475119725e0a712a1c399382a96a065
- SHA1 b52a88051c1aedbc15f562ec2dc1f6edd2daf99f
- SHA512 aba2aa5baf09f185d52346f136613e0a214aea0c94681331d45885b7ba8d28f616666c66a44a7649aa84946dd7ae7baf71138cc5e21b2a89f2809a88b226d1f7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16a27d5c-9f10-4ab6-af85-941dfd71ac10\index-dir\the-real-index~RFe5afd3d.TMP
- Size 72B
- SHA256 4866f6fbb52038bc2afdf030786fd8c72b8dc0a78f838c12f4612f976dfb5b29
- MD5 0877111a7d6581178789a689f3784b55
- SHA1 dc54cebc1e014837b1e3322f6b7d4374352e0124
- SHA512 7291dd8ca601fd9c78124d23ec72dabaea030209057c9ac2a250ce53b779e9a40f966ecc7e5729e31806b80bf0535ffb75a4cb942bf9a2da573f7fab999b2292
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6bdf2a8a-16c6-48e9-859e-6a5614c22542\index-dir\the-real-index
- Size 2KB
- SHA256 11c64943994d6ad01a8cc8cf56eae00d216c3bcbbdfe07e7e5e67c59e8763674
- MD5 a37d902696b328f734ce87d91bed9bb9
- SHA1 8dc5f0594b78d08596d69dc3eab738a06d9161c6
- SHA512 ff132bf8caccdbda13cdc52847f3b1ee3d9731e1c6f18bb30dfb96141417451b997607767b8098943a20391c7e7aecbaf9fef8f643958dc1d95c693d9e799eb3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6bdf2a8a-16c6-48e9-859e-6a5614c22542\index-dir\the-real-index
- Size 2KB
- SHA256 c8ff86f87d80128a9403983ff696962e0e9fbc1dabcbaf30b1f97ddc3cb5accf
- MD5 95f20a58e7dc39eb5558ea458c3b699a
- SHA1 760331a46120fec4aa9a8dd9534eb80a6b5bedb8
- SHA512 1cdbc41c96c124e3a9a5bca61fe97eb7500dd1a6acb9685484bc68289b5969bc56f90e43f103c2131fd2bf0f3ef33dacf7c1e934344eb4478a94eec8d94162f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\765f26d2-06f0-48f6-bdcd-c5451265fa1b\index-dir\the-real-index
- Size 96B
- SHA256 234f7522223ac214c4cfeac9f0f5e3ff38e3bebf0a0c1d92b4c94e0621a8311d
- MD5 af5e993cdfd5d720af62a0df53dd35d5
- SHA1 ef4f7c74bb21311eb12f41dd2b9418e6b14c7ee7
- SHA512 92f26599f1f41a5be2e2b45636e9dbe5c76afd12e59cf929083f0c40959a4c9e19177f9d2c45fab0b6704699087fa7bf6c05cc0f2831e4aaac7aa3d8c06b5a42
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\765f26d2-06f0-48f6-bdcd-c5451265fa1b\index-dir\the-real-index
- Size 96B
- SHA256 74e5bba425de772b8733aebcc2edc91d700800852b21fa7ea6ccfd2724ec5269
- MD5 9e85bff8078dbffea5da01c020ed550d
- SHA1 b8c2250a24c1184bcada0f405ec58cd1b50291ea
- SHA512 101e8bd5d936927dcff0d666562eca66f40af2b3de84e3e400d31fee7875867bdd26c415a3e28cf89925036e7e47e955799d384dc4a510eeb5cc096428997e62
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\765f26d2-06f0-48f6-bdcd-c5451265fa1b\index-dir\the-real-index~RFe5afc53.TMP
- Size 72B
- SHA256 f29c4258baeab9e9956a43f7d65b6d73ed3b29513fdc6787a0cd5cff1909a5c7
- MD5 0106a34f0d435a798628a4057e72c815
- SHA1 4b41979e8805f08e8d38f59d6b1120c84049d8f5
- SHA512 845217dda9d00f3f984b8d9f8ea13d70f4dcf066eaf9411ca1c27b84b21dbd1241bdf55912f11170d5677999372ab79032f5ac6fa7062e0fcc93088983c996fa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3c47db5-ac47-484c-9062-dc79f22b5269\index-dir\the-real-index
- Size 72B
- SHA256 8a26ff71aefd7f4f28cf8bac5a54efbef632439aad0555b3c04f2788a01ba806
- MD5 f865138c7ee1e61169972a11607d5d8a
- SHA1 04718653c3a72c08b1cda2f996304d36ac30f361
- SHA512 95b025b780f77db402365199b1fe70d96618e1479146d8d9a93dfcfb17e87f831e7f01059476f0f37002ef3e51abe343ddf5a1b6d13622be57315456932648f3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3c47db5-ac47-484c-9062-dc79f22b5269\index-dir\the-real-index
- Size 72B
- SHA256 2c1272d05d7f863d3d10686efb64cacbb58f1be252087a7aa9605d8b96935b7f
- MD5 52957150eb022a59e0a2e5e88de29de8
- SHA1 56181dac063d8566c81bfe605c7d1944ec5d9caa
- SHA512 859e578601261acb0ca75d4c45193987ae2e967a70f752a281530c4a61258ffbe6b5e095ae0880752f8b16e24b9d89e1d44246d6113d271a370b3292d1d95101
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3c47db5-ac47-484c-9062-dc79f22b5269\index-dir\the-real-index~RFe5af771.TMP
- Size 72B
- SHA256 187ee4292512d9963f4c48cd3e350a756928a416e63a06bbe4e0e6ab6c4dc707
- MD5 0dd947eb7b3cc10a9415d554b61166e3
- SHA1 3a0b9122eae47b422b2703707b249e1bc267362d
- SHA512 4cc7ccd4c4775d08b0a0894eb3ffd894146f7eccfba19c130bb16c688302dccead1a5c793ebce1f2e47240c97deb9c18429fe32456478984eadc895f2082ceee
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3c47db5-ac47-484c-9062-dc79f22b5269\index-dir\the-real-index~RFe67984a.TMP
- Size 72B
- SHA256 414f7362a5ff85e25e098556e5593b46db6c644ad7a465bd3270ded69cc165ae
- MD5 87cae5ffe93b1816a76ef34e654daacd
- SHA1 5a048e8461b6b271b57bc38f10202eca2acce5a8
- SHA512 e59ee416df1c54f506f2a17d92ec2da5971b432cfec964863eb3906b53041e3b1e2e8a0b1ca154cf9ea270f81f2a84dc6bf39e617cbdd5246c8c02ebac6e5dcd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3c47db5-ac47-484c-9062-dc79f22b5269\todelete_4f2277ea2139c475_0_1
- Size 61KB
- SHA256 4610a0a90da6bcf2bcdd59174d553ae60eefd381bfba78c29df1dcb387376d53
- MD5 78c5073e6b98d69f1e7b0743f8665457
- SHA1 a83c5f72885f25ba7ddbe3a49bfc60b74a5e8796
- SHA512 2c509b6273903a4e561ec5130aee7d5ffc8452af725f33e0e57171ccd8c3b770af1d4259221aeb5cae56ae5844c412cecba7b5132dad820c355347b1ffadb427
- SSDEEP 1536:cUgvdDRQocmWflqYszFN0Unk3MRr8ubh8DkJudVMHPwqOadt/w:crD9SEYs/nk8RrfbE2/w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 476B
- SHA256 d7b3b1c8bbd2e683ba6efad0240ef657b9b9f42e1149f464a6b3fb48342b352c
- MD5 e3bbcf803b6899195f862a060d75f7d7
- SHA1 18f32e439f6b924f121f1f441c9e5db18f14e33f
- SHA512 a6aeb8601572355ccef67e14d92e1fb560ec8f89807f7d9cae7fd1714a3403c9b581fa32479a8f240c532c021392c61eafb06c93fd4376ca6404c19f4d6c202c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 476B
- SHA256 28077ad93508fc8245f72e95983dfb03dd2bd68bc023df8bd4875947c1aadfe3
- MD5 23156273eb4d66c8a9c9500da3837c40
- SHA1 424001e4c0797a230dc3bc6afb2dc4a914170cf1
- SHA512 9fc81ed499ddd105667d4dc8c61d8e013a267a46e9ab214e0791a7e2eacda47d6e5e7f3ed27a033b2d3715fae0ba806d3eeca4d03d422a906437c61fbaf277f3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 476B
- SHA256 210b4fd395a928f6199f222d1587181c077976e70bde773c570b7b3c5c29ebdc
- MD5 6c7e934f291065a4398e17a69d866f1e
- SHA1 c96e1e4f8c88952b3a86d383d07dc77c15e0ffe8
- SHA512 fb06fd3e9988745d44a12697bed95c55182ed36e23f2e8c4f8c95eba966a8c773c2d93649a7eabfd56788b5bf27985c5c99d8439101f15d2426563bcbc432e55
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\5a1574c5-eb92-4fe9-b884-e5d4ea13d2aa\index-dir\the-real-index
- Size 72B
- SHA256 534b0875c58b7a339f7aef4966b1a3ebab3e310ae2545d402c53b42c58555c4e
- MD5 ed5a2d4c3038b16df27e4ef9f1a51f3e
- SHA1 187c4869babb0829f01e8e80521d236f787a8afe
- SHA512 5e8c89a730e4af636eaf59238ee039cb641c1199bcee88b6198a7476e93bbbef4b44adbf64bc5ea6167cd11507fa12b37db06e58a3e269145a3547ef3c31e9cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\5a1574c5-eb92-4fe9-b884-e5d4ea13d2aa\index-dir\the-real-index~RFe5b124c.TMP
- Size 48B
- SHA256 4bb02fa8828f47958acaf02b01b8df00502230d3e5cf131171b38ded553a565b
- MD5 eb0d18ef4022bf41b0a924e59d7878d1
- SHA1 313f297e0b80e6ae3772cafbe09bf3e4e4b97d7c
- SHA512 3989f583c3c82722b2551da4b5686f8cee04e676eadfc25b6e880030d7e86fff8c0e8a7fdc215efdf3bf6443a72f38d1b0f39fd70500ef278cf4a767d6d9c42f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\6df5a4c7-1337-49ef-a785-b05dc0505f9b\index
- Size 24B
- SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- MD5 54cb446f628b2ea4a5bce5769910512e
- SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
- SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\6df5a4c7-1337-49ef-a785-b05dc0505f9b\index-dir\the-real-index
- Size 216B
- SHA256 7ee40b52011bdf58329014cc727e6679e4e327a9c099514a66a58d594e037003
- MD5 758e1b3d405dea65717fc332d9e7cf0b
- SHA1 f3f289cd4c67d6bd63cb763db73e1f5e95a06d57
- SHA512 1ae65e07c32139b68e4e796dcae741251506f9ae2c92b20b184f7aaad9c490e0ebc1b6cabbd46aa25a8f8a8a8be684d20d8b7f2d54b833f80186a8a2625f0e46
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\6df5a4c7-1337-49ef-a785-b05dc0505f9b\index-dir\the-real-index~RFe5b1307.TMP
- Size 48B
- SHA256 2b004d62b10e434bba475f628ad4eaa52ab06830894641241b4b7ed1631bba82
- MD5 cbec98f9cb9dae5a06a715e9654498f1
- SHA1 05232d828079f45a06fbc5a07a8b8bbf2c924b1f
- SHA512 faca51de56a96d1c5c46d52bb0e25bf6c24b29a1bae826adf81e7105d77402cf4bdd6d11794f0a591cc41f74deea4787bb440a6bce50641f21e3ffe6f78279e8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\be460ee6-e1ce-4451-857d-57c1e54d0b99\index-dir\the-real-index
- Size 72B
- SHA256 e161eedba1a9ab9cbc4575d171d77014a7ad69c638019691502093fd8d3fbeea
- MD5 764fcbcaa1c3a487bfe9803145b769bf
- SHA1 5d9b6d056b47517a41c29c23f71f65f82a8d0d5b
- SHA512 a3a5f1117bb1e9b58dc40283eea53d61445320677fe624108cbe7c34ece1ff7594c873beb15964cac2d710372ad464b4a72626df6fb17b248a1e6501baee32dc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\be460ee6-e1ce-4451-857d-57c1e54d0b99\index-dir\the-real-index~RFe5b121d.TMP
- Size 48B
- SHA256 b77493792e97718ac14b9858887e2968cdf84d4f0deca81bb089c6f501b783de
- MD5 7f8aabb31e0338608513bf7fec80af8a
- SHA1 b222288f79a44ae33d4362b1b569d933366d2513
- SHA512 e03713b0a8735a49ef52b79141e4defb419a9ff707d8429e221027198508d2d29993b1555e8fb578e466098868af69345657bdb5ebd7a2074cbc159584efc208
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\d76e3308-b013-4db6-a3c0-5f6483a35291\index-dir\the-real-index
- Size 2KB
- SHA256 51e281481e080804d9ce442355f0dc78dabb98aff97c1f753d2855f4fbfabbb5
- MD5 7edfbbe5d4d5a89332b847abed681c54
- SHA1 c88ad28e5edf8df2f803c8587140a46a03e3f3a4
- SHA512 bb86b604fa302e6d8f983efe2427e6b1525ccbbd83adefcd8a892d22a301e0bcdb07c6516e4c743c60512b6fc1cf70215b6448731152508a565ee100e6fda5e9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\d76e3308-b013-4db6-a3c0-5f6483a35291\index-dir\the-real-index
- Size 2KB
- SHA256 c9b26d95565d022b5922273c664287c7af224c6621563e487894b88da71ea34e
- MD5 4c93dbb68c3eefba98eea6b60ddef663
- SHA1 5e8f466e5e1c0dabcc93c74c8783baf237a5b84e
- SHA512 a6419bcbf3aa867540e972758667c2d02d502b4c6871c777ad3b5494e0e796caa3888bc8af946a22b0583409f6ecbe1c1ddc72ce5706a45e8100c6b1b3e5ddae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\d76e3308-b013-4db6-a3c0-5f6483a35291\index-dir\the-real-index~RFe59267a.TMP
- Size 48B
- SHA256 17d8a45f46a25e3107cfc448cee16f4b5ff32595df566e4b69ef9143aedb7123
- MD5 950f8b8c788c9b800562863d58321496
- SHA1 88f956b0b390b9057ddf0b4f5b065bda220c84c3
- SHA512 5d5f3b7612d81dc8f0b8cbc2c13e2f69c5c0fb6512137fc4eaa0c9a77da3d70c5b928a361b6a89df09717250560a85167b474743f73033ddd35c314fdf29bc3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\ec5e9a82-0df5-41c8-8939-61b98e59cb76\index-dir\the-real-index
- Size 72B
- SHA256 02e37aebcc2e322200c77a72159cc5768e7a1071443398e1dce8c4a95118778d
- MD5 76a6294062a0acede1ce131740fa1305
- SHA1 83968fa332b2e4dc8a9e753179bc18f82491f36b
- SHA512 016267d4d01f2fbcd8be639cb77c5413ee91d321481cb1b424ec91be61d8a0ab6d92490c681a462e0f9f6001ea62bd11caaf2d467ec1929727c41c2c4a3dd1c5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\ec5e9a82-0df5-41c8-8939-61b98e59cb76\index-dir\the-real-index~RFe590c79.TMP
- Size 48B
- SHA256 7709dabcd11136c82a4d656d87f024ac6ea9de20a40dcfd1ee69d4f40b059809
- MD5 feaa6e1473acfa95a417e87bea340061
- SHA1 6df0558b5571e7a8067ccffd8233f2b1863334cb
- SHA512 b2c4ac34b32967052159e5ed8e24514b1c809003aaa11acb13247c31f5f24b904ce16d6418275da5084c312c6b7e4e2a40094e3acc3296639fdf1157f9ae1176
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\ee66798e-fc1b-46f3-aea7-6af0a77b5ddf\index-dir\the-real-index
- Size 384B
- SHA256 3004c9f4a2ac3e51514fb57df0f4bf33bdcdf3e4f12e188686adbb92bdb34de0
- MD5 3cc55c4771fbedb2a3093051d9110285
- SHA1 eeed3ef77832c849a9b7272cd207b376315afaf9
- SHA512 db123966b41837212cf23a781b50b9d07a730303a71d19d46f52de5af2c4461b1cc7183f700b3c6a56f514c163bd4819ad3d217b3e87579ab51a259b00a20216
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\ee66798e-fc1b-46f3-aea7-6af0a77b5ddf\index-dir\the-real-index~RFe5b1411.TMP
- Size 48B
- SHA256 35aeb6fc936a72732df0fa8ae02ae53a00f3535db453fc20311c96f1cb3bd93c
- MD5 199b54be718548c304bdd9f47dce9f48
- SHA1 8f4048faf4fd957b8b26c97290c44708f0f0a07e
- SHA512 05d4b071b8a524b573f9cf23ddc8616674708bd4e4bbdb19414b75026b242a52bef308d259e4b2ee5200aea86a487240ac17b6e22b90a126aa1acbdf12e06155
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
- Size 488B
- SHA256 f9b6e9a72f7903c52ccea86cd59f6b5b9ff6d9fe2e8cec1bda87de77ffd08f85
- MD5 3581a5e5dc49a3be5cb61154fa4f4b34
- SHA1 7dc7f6a5ef5ee2b12a1af9558dfa3fa2232b763f
- SHA512 7812532e06665e79d140670bf1ba2a363bcfaa09c15d20a1960327c1f1bea9305d8bad680c7825300431b8b919ade7bd47f10d3d408513ae05e30b6a32178889
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
- Size 561B
- SHA256 c7d08f3186e8bea01fd1b348f2fc3bc004c8ea372b629e346396753c89d8aa5c
- MD5 c6b4a557cf646eea921a571afdf5b712
- SHA1 5464a9eebadf6dd8a464a7b7a25381c66f751d47
- SHA512 787c87df6b0dce7f6ac56fccbaae98b1f3bc8703ab1701922a19d1cbde6875f8dce87173c5449c8c3734d264279a9150159ae53ba2be4de9a2bfca560bf232ed
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
- Size 630B
- SHA256 f8a20c99b24fdef278be184e97b3cd181c68cbc3a20ca0daccb4a6553fb93cd6
- MD5 73b41f08a4b1870b440b6a1d3832c27f
- SHA1 e6bac5a2fc8140d58f4a87d4b592a68f89bef05b
- SHA512 c4c46c47d615128b68af4c68a45d3c985c8df68e7f89ed6d73df39fe3de573531cc50b1136c33cb4f3913da789ec33978198ff777c0a06085a091f368c65aeda
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
- Size 713B
- SHA256 36956bb432b85006744d4367aad079d5087dad107d9d6846f237f88dc1bc4695
- MD5 c27d7726a21b5abaaf9580b3cc3b9039
- SHA1 6e8f3577887fefef5d49c7223a3bb003b2be30bc
- SHA512 bdf7e4430480a28cc0e5bfdbae4c2c40aff29d5c1a0a1923921a27d0f5a0c5b2c3aa2d6352f48eabbaed41591a8e84a39383e5f548af313ff77a8c03121823a0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
- Size 712B
- SHA256 85793e0fcb5a4891c6e341a80926bd4698fc392c06144833dd6099097728fb3a
- MD5 c93bacb2e705f6baf6db13a358126c48
- SHA1 cf4b3e6839fa963743b16952c81da597964a8bab
- SHA512 1dae37ca830e4e60eb34e91d5f7114f8eea885f48332536abec74730bf5d55d3ff7121bc8f41dbb6c1236521e1e4c0a919fe646d455e7de49d298ffc0a3549fc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
- Size 386B
- SHA256 97dcb74f1ff41201f3a9e05554a017349ef529b6dda1c6f21f945a8bf368e529
- MD5 672ead19c62be249d27a626cea4fed91
- SHA1 b845a5d42adc69a6c114e3af5770df0d43b7aa32
- SHA512 dcdfc62c3ece00646c7e460186d5027517192556e6746774c82c857675200ec72776e6bece9e9a3fa8075d5aee7841dacaafbb5744efef9bff5683e8d1cd2fcd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
- Size 383B
- SHA256 cfb95094b6884f472c73ce65a933c760915e6248252c56a8bdd34667abfd659e
- MD5 a92474ea75c29fb2d5c658f393fa3f78
- SHA1 e4ed9b76cc22fa6a40803e4c9b73827bc02896ba
- SHA512 5c2ac6dec9a06008a9901f49f62f5fc30aa7e31c82a9d805f78e6715cf4fb7a99ff75af988b9b1bab6473c9d4af91ca3e6c6ec8b14da35c635549f1adc13028d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe58be59.TMP
- Size 195B
- SHA256 4b1c84c757ff10fa7270d5b3c36c6e7748b66fb9cbaba881bd723e18b2313693
- MD5 b0e4dde98016bc3e3ce967f769d47acf
- SHA1 a8199fbeba304acc15bb1d285cde8a008b75fc50
- SHA512 e70b9550d6394b421161e4e6bb02d6647563458b10aefff536e5930b8e78297951ca1b85adeb27ec59e76be386995f04e969ea01e0e9f6fb8121fdaaebffa146
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 4af2ef912e3fe3808218fad6e27389d35b6955858d166bf4ba37e1ebe994b145
- MD5 38d8db2e7a1689ecc2080276c3175f9f
- SHA1 106d22a2def10f7f632158905bc54047040ae916
- SHA512 0ef3c5fce4b90bb9d454d91c58674d69089c87c470ab0a9452eb04c0ad37e712127b4acf3da3372e05a5b8c11ae127894eac00510e695a30007952bfc7084915
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 9c0723cf7848d5bd4e5a0c3b1d5494fd2785d52b5e0258c5bd62e7b131539627
- MD5 b6c52ef9d70c9cd577bf92b72e188ec6
- SHA1 95acfc95b0b8d3f30429248a5fb2884cd793dd98
- SHA512 2131d9cae38e4e9d678a13e31b9656817c62d01a82762e426fc11056b5fa449b57f445859a56bc4b6e6fe19cf515422f9b03c56ebeec041633a090432c9d0ce8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
- Size 323B
- SHA256 694794f4621262869cd3b71371f6349fe574cc923e095d0d47770f48d11e7eee
- MD5 df9858fecb903b8fe10296922c75d772
- SHA1 00817ddcc3612e0c98027ca43e932ec5a7189ba4
- SHA512 7044b66a53b4f853a21444fc7e81bbb0ddfb8e2bb13e2a9803b8703d6af72c651bbe6c41ce4fd3b8141afa81b33df1f3ba4b51c71ace53982ebd0eb05f23868d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 26KB
- SHA256 cac59cfb1f8b4178bb33c53813d6a7bc45057f28d4d4f5f323601ced72fea354
- MD5 b705f6fa52469407d3faa0d29e212e1c
- SHA1 6d33b58e0f87b904b689cbbce190e23deef85b76
- SHA512 762f465be55eec848da5e56872daf0d82860922cb7fb99f8a4f41c942ff82c1349126153f550f6a52590aaa580b515d4004f1ac6f2538e4da7dfc6a024c9bd65
- SSDEEP 192:EiUxiKDzk93Kd53NteZQ9xTp34vHIxNC/2limocAjcXqeKcgzGm3oI:t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
- Size 23KB
- SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
- MD5 ed22bc3ded6df0109b9e594867473559
- SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
- SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
- SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
- Size 804B
- SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
- MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
- SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
- SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
- Size 81KB
- SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
- MD5 46ca0b1726448d9c7ed48735c246336f
- SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
- SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
- SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
- Size 34KB
- SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
- MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
- SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
- SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
- SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
- Size 14B
- SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
- MD5 8297da058a737611abcc3a0ede9ffc24
- SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
- SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 2805b44beba3c2a69715304fd341635d80fab39ed7e45b53ae656c77840891ff
- MD5 17f53ec1f80196952ca5c6c34305f433
- SHA1 53a9caa305a9798dc91a5d168288e44e3e02c1cb
- SHA512 ff15dd372833641f577b5c6399852a981a751ee7f28248ff94389608c79820ec1e59845c3d5c273245147f600b22a58c3bf94d7a38fef646b85e7dab53951a0f
- SSDEEP 768:FFuyKGLwgeZA+4q4YpbYU0mlqrPXqwvRB3o0RZHy59br2/N:ayKGUZXsuaPaqRljzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 44ac53629b4edd6d128a1130beb3761380fefcb209755a9406f265ea42ea61d6
- MD5 5dbb5450ee13d8976363b5ce1327f0c2
- SHA1 3294e37407f31d2fd00f61540d66e1c77ec2e9bb
- SHA512 ffc9642c80b2a0e0f6f7ce57fd642f2c45e054e62e41986d9aee49becafb3d8fa307c34b9b05b6eaf8a488e1dd346596fcf862f7e07aaf31e60a13920f363c66
- SSDEEP 768:FFRyvGLwgeoA+OG4YpXYU0mlqrPXqwvRB3o0RZHy59br2/N:dyvGUoVIuaPaqRljzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 739d157a6075a848d673525d72ca1b8ab5405ea4119e61cb534610f160a0b9cd
- MD5 f1a3b0ec9507c7be4b69ae90fae8c4f0
- SHA1 f42319bd5a618ae4f39cf7bae866a15dcbb971ee
- SHA512 cbf6febb506dd0d13ca873322122f02c82633920838defd202fe7bbf29513be8d41ce10136cac8cc1946e552af5fea8dcf1a27a9ddfbc37c35238605e84483d8
- SSDEEP 768:FFPynGLwgeGA+3m4YppYU0mlqrPXqwvRB3o0RZHy59br2/N:bynGUGk2uaPaqRljzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 ad2ed078b04546673d3af96ddeb47aa4312369c47aab9debbcdcde031d1c7c4b
- MD5 9a410825d424e124814b70e726dd9dec
- SHA1 a488ff95343caf8b6923f6b7efc55e476edc7e8c
- SHA512 e479e8819b90f030a38b96c9c4946ea238f2a5aa00fdcc8d6732c49aa97cd080d34f3a45fbb8c44dc75a9b3618e651b6809fb8f980e41eaa83ac9e9919f4b0a8
- SSDEEP 768:FF1yGGLwgegA+OG4YpXYU0mlqrPXqwvRB3o0RZHy59br2/N:ZyGGUgVIuaPaqRljzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 a3a65a036880102bbf71a2587f71f65a4ac11a35bfb35009ad3bde35ea24afca
- MD5 2333b72140bca37ec9705b4c3edd933a
- SHA1 c5f9dc5fb0b848193c886cbe548447d173c2440e
- SHA512 4700cc8514eba7046d2c8b55ee98184e515245da77c791e7870bd5297196f494db376fbc3560742b8a701e601ff08f78673224d66583261ea02241914d653a09
- SSDEEP 768:FFRyEGLwgeFA+4q4YpMYU0mlqrPXqwvRB3o0RZHy59br2/N:dyEGUFX/uaPaqRljzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 8e976f2fca8257416684b771ca2ce57a3b3b0550afa8b565945c3ed206e65a4d
- MD5 2a8d42466686aabdc997867846925e03
- SHA1 dcac99d098e61de7d28c22c1eb1ea24c4054f454
- SHA512 e67a12f1b5f6dc1a37a7836f3bfc210bae297060961db566dea17abdebbd2669530f6d8964f033d09777c43093c51915a6727f0ad7bcfb1a162acd50938e75ff
- SSDEEP 768:FFRyyGLwgeXA+4q4YpsYU0mlqrPXqwvRB3o0RZHy59br2/N:dyyGUXXfuaPaqRljzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 c67e09397a4ea02ef920f674b0c815a3650f9249b24774350c20c9877e53b47c
- MD5 a022f171729b6539c2b7cc67ccf2cba8
- SHA1 d22b45bcbf9a506a194906206f6bcd11c8b2745b
- SHA512 2975d2371681686c69e16482b26e5ac73b4d63429b3369916c8ddf08d684b4678fde83e30f50f8fb366543d9e22a4977467b043ec865793281e7527e1718aee4
- SSDEEP 768:FFUywkLwgeRA+DC4YpzYU0mlqrPXawvRB3o0RZHy59br2/N:oywkUR40uaPKqRljzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 dd25931c3011c74eb75066e6b976e8fd812850dcb505d3fc6025d7739d23f4b8
- MD5 d8b1033ed15a041971e869753b2f2fbe
- SHA1 ddab3e69d1361a4a6524942004ac0fcd934b23ad
- SHA512 f42d63535c3de26b3abe6ad149c440dad05c289cc23ab4f5101f67066226a5f740fbd3db57ff0c458d53c5269ea684be194c04bf7ecd106fc1ec29abfd18f4a8
- SSDEEP 768:FFpyhGLwgeFA+4q4YpMYU0mlqrPXqwvRB3o0RZHy59br2/N:9yhGUFX/uaPaqRljzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 36KB
- SHA256 de530521d5856bbd7bffac739c24b979a01dd71effb282a9f7a8a50867a0809f
- MD5 630aa24224866e1b3e18d909dde052ff
- SHA1 b1651f3c18a16a8e146e53a09f7f7fe43793ff5c
- SHA512 076a7c0fd975c3a8c5c202f46ef5b010864df7bdf22579c9e92d40dada51a073c468c4137effbe52c3e6faf6efc623e19b8c0ce45ec695220aebbaf07222ba31
- SSDEEP 768:0FsyS/wgDyA+IEV/m8osPwRZmvRB3i0RZHy59br2/N:DySFygoSwRltzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 378156011040edaa6b412caa356cf7aa092f693812b57c197798c052f37becd2
- MD5 0a91332959ede180d39dbba64f946d16
- SHA1 56736769c75b6ea7a6ecb5ef406da3534665451f
- SHA512 90f9bb11d6790c16834f093baf800caabc84f6164b93ec323899a95b1dcf0aa177359222568df6d45c11822f61791513f50660f718504d6c5d71eda93632b218
- SSDEEP 768:FFRySQLwgemA+426YpoYU0mlqrPXqwvRB3o0RZHy59br2/N:dySQUmj7uaPaqRljzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 9ea0b6e71359738ef6361e47a637650e3b8b2cffbacd9403f5a5bc7f48a042e7
- MD5 0c7a8399868b5ee028be803c04c1897e
- SHA1 68acf1e982d0d18bf9a29e8490a93e785bdab318
- SHA512 ae21b2c468d9c8dec78bb1267b1e2671e7ec0f0cb079454a2fb0f3d8b195c8ba031df590737a8cf7b39a71cfd32cb2d6186e22561020cf4c98151f6c4b225055
- SSDEEP 768:FFayXQLwge6A+R2GYpqYU0mlqrPXqwvRB3o0RZHy59br2/N:+yXQU6CRuaPaqRljzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 b439e0f125aa4e3bd4c1049dffd05d5e8fad250a7f2621f4e11abf07bcaf6ee2
- MD5 21dd67639ef6b1f7702c86109eb81edd
- SHA1 ea2456d3cd0849f8fbf7816ea8e37aa734bad3fe
- SHA512 03679eb5c9c9e6fa05c0b0c1b08cf6bf148ac3262e4073b93fec1275e569bc0d021ab1c12cf247c188f7c6c82ca1d4d8cbdec8c91cea273a1cbad1cbdb2b094a
- SSDEEP 384:n7iFavqMg38Ne8TUNTUlIxxcHtk9D5AZ4fyYxq5hMPidk/ACU1itaLdObocxatk/:WFayv3FwgM4DOYosPSkoCaUbj27A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 a5237ceebc2aa4dfb8acfcb324f2d02dfb3333a3a985435d888ed1e3011b6b7f
- MD5 f9aae2fa3c4bde61bc5847d0a59d9db1
- SHA1 6d0a70717f7e427afb39a0b23518556a446ec120
- SHA512 42f58c65fbb8cc0d1318816d4b73505251269cd8d7d85c215a20628c08eed4f4ad1c386e1c51ed964fafa2ba6c938f4af4f333e55b6a066f6bc4713a5be9fa77
- SSDEEP 384:nNiFavqMz8NI8TUNTUlIRUcHt4Sv5zZ4fyYxq5hMPi0jNf0yiZHy52dObAcxatkt:EFayCDwgDvvhYosPbNf0RZHy59br2/M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 5d6740b03ac56da7354fddf749453e36e13f649c72d377f2644973187c2d68f2
- MD5 07a2ee9dbfcf09496f63f04a4893779c
- SHA1 ca73e111cd4285e0a19e47c0816c555a5dde66bb
- SHA512 69fb02c0de4a461d52386324ac2a5ed7332c26dbb4eb451020beaac29544aeb41f15d0d5f3976964ade7ca6ee061628889ced96df11018ec77750155fa932c81
- SSDEEP 768:EFsySDwgDyphYosP7C+1wK8b9bpf0RZHy59br2/M:TySZy4v1wKUp8zy5JOM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 abbccb51d23ff24b0e0e362fd6849a0098089aea2879715e7c1315e4bbfaf488
- MD5 a0225dac657f6b65edc25d6325e70fe8
- SHA1 1ea043e484d00c6849d0980068cfb3c0c8ff39cb
- SHA512 1bcdfb4f4a69798983f7205a2f88d0ac137e7bc908b1d5c2c19aa8a5b6277387af28ed241d53cd4e8ce31ba1543adbab9e0a03f5a72322770c350cb7112df232
- SSDEEP 384:nNiFavqMH8NI8TUNTUlIRUcHt3Sv5zZ4fyYxq5hMPi0jNf0yiZHy52dObAcxatkt:EFaySDwgDcvhYosPbNf0RZHy59br2/M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 b744bf686d01850fee7146788492cc4b0baf309a2ca2678418a9357a91692c37
- MD5 4a43d3566372e2c51c3090f13f374e40
- SHA1 7ad0ad3ab8101ee44fdefef1aba4824e1d49a5e3
- SHA512 fc8876652353c2137c213818780113d1dbc5a41a6fad98c67b6d1024d9c137041d542df1d4bf2356abd8a900a86c28614b6893f2fdadb64c061c05bfb20288dc
- SSDEEP 384:nNiFRvqMH8NI8TUNTUlIRIcHt1Sv5zZ4fyYxq5hMPi0DCNf0yiZHy52dObAcxatU:EFRySDwgDSvhYosP7CNf0RZHy59br2/M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 6ce23a22ac735cf458d2e9eb53383adc3b3fc2f37c0c4e01e5647530346ce5c3
- MD5 117efe75e821cb386f1817f663f2c8b4
- SHA1 bc65d00b670ac6142a580423f4dfbf3e3dd3e503
- SHA512 b16d3c7012ade9453a3bbdd12d12748754eb741ef62bf76b1427520e56618a005122d1104664915c4dcbdeb9a05b1ef38e858acd9ec02403ad53effeb2134e87
- SSDEEP 768:FFAy4QLwgemA+R2GYpoYU0mlqrPXqwvRB3o0RZHy59br2/N:My4QUmC7uaPaqRljzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 deca584597588f8266303f21d7c2fcd334634df5af18164e5aa281ee48eed42b
- MD5 9f4ced1c245468ee08f0304ac16319ec
- SHA1 37825fb98781c560f5e648d7d830cd735321ef87
- SHA512 b5229c92135778b916c8ae4a097950df524e7e7be775879477f07c25d7be0ed2e5053fdacfddae2febd5b6c9a8a35e8f16a7fdfa0aa9218265e5ede598a4c630
- SSDEEP 768:EFsySDwgDTphYosP7C+1wK8b9bpf0RZHy59br2/M:TySZT4v1wKUp8zy5JOM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 33KB
- SHA256 a1889326c0a22b32597b6f1bf120a92360d68fe9152a80b53f8167b5d613bf4e
- MD5 c7d314004da1053bcf0f3f576ea1a391
- SHA1 96e1ddd6996461b2cf062b48e6b420b8355c270d
- SHA512 a4f2e0c40f2c9b83f6efbad852ee152dd27c6225955da9bc6b72bc44054d2564a0e862042a1af4180571e16cdf9049044a117e6d7febff5d695b71c3f3e18bc2
- SSDEEP 768:FFsySQLwgD7A+irYpn2qwvRB370RZHy59br2/N:wySQh7RjqRlwzy5JON
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 cecf6a93372d71d9959022b359741f58d038f3c745f4a8d09dbcf4b58e145b6e
- MD5 0d118bee8fc15d71a42cdfa0c89b24a8
- SHA1 9901401b7572644c1c2a509e362e75aeb2aac384
- SHA512 256cb7aff579b23d6b930e3e04bae173831b11658ea595f973751892151a564b8836f8c94badad3681198b3f11f232c7ad29e92d26abfc121c8fb93465eaadd9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 4fea00bbd761b4e3f041a71edc69e02c230bb20741b407ebdadb8a95fdef480b
- MD5 3fdbdb734af7ce1e11bfdcfdc1b0c9af
- SHA1 57fba64f259711386c98e95e52deea556d74a6c8
- SHA512 19ba8a56abebc1503b0175d00af2e26801888dd0c085057081feb1f4fbf40433a8d864bfe4305b171e3b8df90a58c14607fd63e22b82a3aa62cdbee1c4efcc7b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe64787c.TMP
- Size 392B
- SHA256 5c119a12b88fa8a219122fc15fac9ca80726a21a53ea3d4a5610635257350604
- MD5 dc82d03bc901b3e6047d5cab3accd088
- SHA1 2387870a50700a9df4ab849ad56fa9436df76eb2
- SHA512 a00ed33a7ffa4adf007cfa9d493e95bd3dddf8d038d59ad882682b3ef006896af8e065ad9a071852574df6757fe930b55febc2035d3b996efe944c098cff635c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.81\Filtering Rules
- Size 2.1MB
- SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
- MD5 43f62d9f35fa6597cec4e2ad5643e282
- SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
- SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
- SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.81\LICENSE
- Size 24KB
- SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
- MD5 aad9405766b20014ab3beb08b99536de
- SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
- SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
- SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.12.24.2\manifest.json
- Size 119B
- SHA256 ecdc4de1c5aa924e550beeda06e4083bac5477b852b0f52114f45e28b84dbca7
- MD5 0c3610475ba8231285f0efb851d0792a
- SHA1 aca5046839115cbb9aeee9c3ce81ba1b61c57c95
- SHA512 112810e66e90af2ae68ba4749cc9acf90591e877ddf85f45281885b00167c2b0168d625732001b1377ecc1a2dc383913dc678ed9e8a1f1c65876fcc8401194a8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.12.24.2\typosquatting_list.pb
- Size 1.5MB
- SHA256 09c763c92a623cce455de59bf4f06a42dc818917f4c533093b608f8eda7bb8cf
- MD5 8fd8ba2c7b7b095b83341bc93772f49d
- SHA1 fa2aa4e8de6cd28e1e2d5d83007b5dd6215851f7
- SHA512 50aa90970f0151296c616b3ddffb261fee57fc9075208421fbf3a0a36181409480f62a544a7da7fa9cb9824bcc47f724bf60b263801e5c5248bf28b9f2920bb1
- SSDEEP 12288:EW6PZtrOFD93N/c32GGj9DP+1nkbjkkIENqQ828/EbMVAnt:KPvo1c32GG5+1n+4T28y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
- Size 86B
- SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
- MD5 961e3604f228b0d10541ebf921500c86
- SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
- SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 2KB
- SHA256 34f0f05079a3d8a62903bc633b0266f247269dbbdb9516839a6da543ba1d8c4e
- MD5 20e70e95e79964a79fbff99b33968a74
- SHA1 eb17b0462e6a8082b8d0468a913224562299eb99
- SHA512 0e7f62daf778cd17a7811f37d1e6b19c72d19e5dd1ef4e072f0711315af03413adaff807381a41906528919db9697aacb6a8304962d5b110a895da98fa975c74
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 2KB
- SHA256 58a75c19fbf1e6a935492ddca5b63bd1e5777d93bb7f8e04ea65f79628ec2f14
- MD5 948696fada916f5eb0462798e414d98c
- SHA1 8881123543e94fb4c61bbd8e6f6a1108c5373afc
- SHA512 238908850c61cc8ec31b5d7763fa890b3a919dc6b96f93150ea2e50db956d00fcbc91524f505bd78283ff0d2e5efe154070840f7bc9afed56987380385e302be
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 2KB
- SHA256 b6f0f02124691120351c75f7966d91738ef587777aacac9b558d6e45e4435a89
- MD5 5af509e0a95ba3948bda2c20ebe55cd9
- SHA1 68e36a9c1b6926fee723bed2e2f9d8000a49d3a6
- SHA512 4d24ee0e6de801a9a553a144ca9ace0a5c5c615d09329630f47dc27334ef4a5db20ffaeb12410f6bee89dd25cb78734a53aba36f3ca49c7828e56821b3dff57b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 2KB
- SHA256 3809cd6b07204d6ffd4473b54dd6f6b0ab2b13f55a3a885bd096ade6c7e13398
- MD5 e0ae2f67096e7134b7e795439f10c291
- SHA1 0124d6147ea0e26aae69a5eb5993e1612449f657
- SHA512 bf9aa751d0a2fdad549ff5e8ddcd40ff8e52125bc53c08e4eb1a5d9f9d567cb7e3c41025e081ca0e997cc490f41f004661030c67a29c2b42c5113fae757458ce
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\ac30d21682ff9fb288f30d5cabc8c852
- Size 9.2MB
- SHA256 7c989333737ad30747bad7e591f7e7ad7903797026856516b38bc35213deb899
- MD5 ac30d21682ff9fb288f30d5cabc8c852
- SHA1 e16386cf826c9b993627ef50e459fb5711882e95
- SHA512 e62b5ad374b0ca9c0727f7fcb5981aac2e834ba3c1cdceecb1fac0298eb48107319b0e72b0a27002e73469d674dafe9e8b76514ab061df5ccb7ac03e54ad3a78
- SSDEEP 98304:EuJucgg5cPCfASkwHIn7rX7heScdXnA4+E/+X0vpf90A1LqKe/C0ZfI+iqUV/L/B:QlPCoFwDDXA4+AxeA1WKeanMBvkmS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 606f9dd3b02e086458d7b65f642c97802ed67f90e584dfd9168ce9758c0c6763
- MD5 b1967ff5faf37b58c1c01f245d634266
- SHA1 f42c1edb9acd82265449f030dd1a1bd4cb19dd67
- SHA512 3a1d7b531cb6536b569af80231fa63c59aa7fd649713054eac90b931d57a05f033172bc7284f218065b3c976be1a822559ddd2531263eacca51d04dc471e0bb7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 cc5b3ab48c4b365b60adfa85b9d309b4610675ec0b435bc77d52c863e25fe209
- MD5 fb469f0463277d3346ac358777620fd6
- SHA1 c0667eb27cd8317ec5f859a5776028ae2eadf780
- SHA512 a621ce711cb98a6da6f57125cae08ced03f3c6662ab41751cedf4cceb7c42871837362ebaed706fde639d78bb474f3e2ee084267725e20f6ac7a93b9454a94fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 6a271e76ca93dfa49928a138fb9e0adf67cf3262b152420f950edf8d5989c4eb
- MD5 1ab7d25c84a1f50bc239f69b5cb6ffab
- SHA1 bf3100a1fddbb4eae6410f42a7defbe93d7caa36
- SHA512 9db88873a9721db07deb9675f648a17d9f2ecd29a950dc7bdbfd0a598efeaac684ced259bfd5f55a149c90e7f13b488afc668061d83fbbcd5e23a0b63e3a9ee1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 31aef50da730221164e4b1cb3b71a26e92a948d0f0a5b9c8666b8b3c42d55ab1
- MD5 f5fa8c0955aec2a03d7379d17e974935
- SHA1 de4d65b0d51becc42257dbbdcc73f678c04b5036
- SHA512 87c90f8f9736a633b32a50b83fa10f26a1461ce8f7a9db10aa2d78ad58ddd36269d9e9b8cd476e0146bde1a0428ed65dd769a35661f8f0b3eb44d0f319b4ad3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\ExtensionActivityComp
- Size 4KB
- SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
- MD5 d25d5e1dc1d93430e64ee17e48ce442e
- SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
- SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
- Size 61B
- SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
- MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
- SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
- SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
- Size 1KB
- SHA256 7827522e243eb1f60d32a7269cdacdfef675e26e789d4d0eefb517ecbd49aa43
- MD5 04c77f17e71f3ec129c800d1babc6509
- SHA1 788583aac047120b1f6fc0034aef377b7b09d2d9
- SHA512 77cb382ed8ef012206c3ede5c754ac4dd4438398cffe8cd9519239c656f2b1fa28730e142430ef4ef9f67bb73878465968ee3d0fe6c43ebc4a193b39eab12c6b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
- Size 1KB
- SHA256 764a1c69b6d51b7c41c523f67f680d9950d019cc69cf0556fed6d25c289b8de0
- MD5 babfa8c9d893638ab1a952fec32cdea7
- SHA1 f7929d2ad7deb3c878f4fab4532a25a2e5300dfc
- SHA512 1552f5938c1ac7760c5542852ec1154d6915107f1f301fdf6bd65899638ef942dc7af9036f4c49909de381fd75f8b8b54284b81fc406722817a1d8f7d1b126f9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity
- Size 1KB
- SHA256 cddad0134e4825153cf90beed389659c7110ca87d1f2de370495653c50ac590d
- MD5 e2a902eb9ef52cf24fb967f88797cea9
- SHA1 9097361ae0c9a50b981e5344ced1bd74b613f2e1
- SHA512 3b9f64e3ac980c5456a56b4332ae43edd6a878cb428e27e2c3406c1e09dc54fffb05f18ed7a519d43f50c0896108df4ce768d578736161955ca1490188360558
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5c43c7.TMP
- Size 1KB
- SHA256 5aa0a12fa27bfef98dd7a7f68fcb4d32fb50879bdd512929c9e7b09bc86bfe1f
- MD5 d3c9efea71ba920aa67f883032efb822
- SHA1 3c461d4a9f66d7ee02e52bcf7f4a01c646768993
- SHA512 5008a667365a42d92f4dfee362b99d6e79800a7bdb4c92fc4fe2b5b1364f31a23b9f15e5778d8ee13261c132ead6e37470d5d38a32f3e05aa493237408e9aeb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
- Size 6KB
- SHA256 b962c76fd448011af636a8903ce28213b58ee8fa647e378adca3994e08875f17
- MD5 b0a4b94218120f749163e36ee1d60fce
- SHA1 cb7ee01c2a54dc2c14ad2c849ff37f71ac9af1ce
- SHA512 7ff3d312c04cdf929aaac340373d6dc5a7acf665d88bc4a2547936a1bea499166031c2d72c4b9fb03c4a5866f6d0d91bc8b89e72c35c70a71c60deb632be0653
- SSDEEP 192:st+0KpfnZ8pa2H/S+WiT9bwdQQWxuroM8:stbKpej/VdwNiu18
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
- Size 5KB
- SHA256 8ca19f5443371b1c0917edf625774ad4fc56869ed0d8522b29dd4681d2edf535
- MD5 9c1b99376b5bccc6923afb77d4716b11
- SHA1 c297acfbedc93605ca9da828e4544642abe836f1
- SHA512 d7c5a9a237b4b8bbf7806b2043b7233358ea579b6f9a233cc6d2e167f75001f4c280f5da3de27d4cb62675b30914c19952b17c0b4d5c5bbc6f4340275a52c317
- SSDEEP 96:r+05SxRpSJb9qfftdZ8i0oEwklm/7qx+WVHMSm+uecadQj1+g2UxuDKEB:r+0kx1fPZ8pFi/S+Wi8dQQUxuDK8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Preferences
- Size 7KB
- SHA256 c29e3511764cb32918a36bbd7857471652e186a19dea58bbc5462fd8852b8239
- MD5 24cd7cd6a6a0bd5095ab2316bdd3783a
- SHA1 8aab5eeb99a640823623ccbbae46c620d6fd5d69
- SHA512 3c858e7e3f0ae5edfec04ea7d3bf487e55dc55f9ad5d31610eb418eb9c2aa2dfe7e68f8288159333564deb499b02dc3e2b6318f0b5c8d3aab4cf330c97a32980
- SSDEEP 192:st+0kxfQ6f9Z8pa2H/S+WiT9bwdQQrxurYKC:stbkx46gj/VdwNtu/C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
- Size 1KB
- SHA256 f78b87f0acdfd41ec4314290307d07bba8fe2fb2c7ece0292a758d9a6437749f
- MD5 c402b28b7275866ee815593390d6963f
- SHA1 f75937c3956a72564c21be079dbbec3205536a30
- SHA512 5de89168f7d15c0fa3deb65974fa89901c0310149b1bf8750b18f33b5514f1f39515efdf002ef0b5300824089551a44543fec14a057167294a33dcdc091331d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
- Size 2KB
- SHA256 8b7fc4d5b0d4b84a43a3ce92d7943235fd61a515bd1de2109a428b52787dc9dd
- MD5 631ea43e224ed27bec5209739d1c6de0
- SHA1 0792a6a6f1eb921b3beb6b9877f3cf317accdfa1
- SHA512 687a2707548ffa936e38704eec9e7ffd9507cc00fd9ba16268c1f73d6e83d929ba12d86e92a3ac54d6bad10d7adde3eed7354337ffcfbe4323ce538181729718
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
- Size 3KB
- SHA256 0156e77bc7af606573f3cc1f8458241e2b9ae7199ac1a5e2a4cfe500e4340366
- MD5 906033e3e8d98c14e46a6e78520154bc
- SHA1 8777e9e1b3bafd4f9c9c0bd8af1a08b7da004921
- SHA512 689ba192c4e30e20cc1507e0b8fc3b1d62bcda9e403a0e69b9e601366d12bb50edc5de925ceac46371c96b7fd865179d8890ea5fc13ca86f76799145a471c899
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State
- Size 15KB
- SHA256 0fa08d9b5cb6d4dda5f6bd5cc155d8d8dc40f7f0388c3abd53052af41d39abb8
- MD5 b4461199ebcec3c2bb6e4fc962700ac9
- SHA1 8168c21b14a0381c9f373ba81e5980daffe31988
- SHA512 e10a86e198b4d75d0131b6f5af262e8f71c139b365b43b5100a6002c443d5d5aa82327d05e7d199bef2fbc114ded30027afa94abab580620e1d9bfd1d3eea337
- SSDEEP 384:zYfeJzfbqZkSJLdjqiFDwdWqAj3NbD0D7RjI0hhZuF:AYfJSJLdOuDwLAjylj5hhQF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Roblox\RobloxStudio\WebView2\EBWebView\Local State~RFe5beba5.TMP
- Size 1KB
- SHA256 e5f1d07b3f178cf55d8e2d3ff451970896f43b34a35532f230e432e7aee8f121
- MD5 c08136422cf994e9597256f5bdaa541d
- SHA1 01578dcc80aff5f6c3baa6642cbe12db60a815d0
- SHA512 09ea6513d63f808b8ceebea351294e2783b72c293a5d30b231bd5cfd9b92a7d65ff2630ea2d5dbda40f803e37437374c022e78a848b19999bbb7032fe52036a8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
- Size 230KB
- SHA256 317050276b4372cd7bcd517f0fe98efe9970d39483194dab379b09e610812dfd
- MD5 0d95c0fce1921aaf31caeef1ba1ea913
- SHA1 b56ce59bbfdc20baef57d43077b1ec1ea32abdbf
- SHA512 2958130b3e3cc90ccfd3d89878b11edc71f62025194a40c1b65b1b9abf44875c639ea17e2f902c2b9de5accbe62d99075648f1c8a785ca727a683fa8ba5fbd0d
- SSDEEP 6144:fcRql79NgI6FdZL52dTOgwQh1hV1AP2u2Q:fcOnh6fZL5mOi1hXAPkQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\backicon.png
- Size 15KB
- SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
- MD5 7ff5dc8270b5fa7ef6c4a1420bd67a7f
- SHA1 b224300372feaa97d882ca2552b227c0f2ef4e3e
- SHA512 f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef
- SSDEEP 48:b//6zMh8k29WJsEvda/PSeld0/u1BLW3qLWoxN+Y9rNGZGvsc5uG7yUWT:b/Ss8kEWmkGPMAxNXrNGZGvsc5VyUA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\checked_gray.png
- Size 538B
- SHA256 d8e502fab00b0c6f06ba6abede6922ab3b423fe6f2d2f56941dabc887b229ad3
- MD5 ce144d2aab3bf213af693d4e18f87a59
- SHA1 df59dc3dbba88bdc5ffc25f2e5e7b73ac3de5afa
- SHA512 0f930edd485a0d49ef157f6cc8856609c087c91b77845adeb5cc8c8a80ebc7ec5416df351ffa1af780caad884dbb49dcc778b0b30de6fb7c85ffef22d7220ebe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\checked_gray_hover.png
- Size 412B
- SHA256 d7c79677d2ef897fa0ad1efc90e916c46da29f571208f78f24505603b7165c20
- MD5 ea22933e94c7ab813b639627f2b38286
- SHA1 c5358c5cb7fb1a0744c775f8148c2376928fb509
- SHA512 ba447a1aedec49419e2b4a8de85c6047886f1a5ebb94f1c45e205a3780c6826f412a3892e97115b35e43839f43e346f3c72ffbf0c57d57f6d26b360ae61b3964
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\close_red.png
- Size 15KB
- SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
- MD5 93216b2f9d66d423b3e1311c0573332d
- SHA1 5efaebec5f20f91f164f80d1e36f98c9ddaff805
- SHA512 922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32
- SSDEEP 48:2/6FwMlYk29WJsEvkch6/Clu5tlL88Lem/fLu5A/luaxN+Y97sc52G7Z+EazEyIc:2SFvYkEWmDCccHAxNX7sc5dZabT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\close_red_click.png
- Size 15KB
- SHA256 d5a7e6fc5e92e0b29a4f65625030447f3379b4e3ac4bed051a0646a7932ce0cd
- MD5 6db7460b73a6641c7621d0a6203a0a90
- SHA1 d39b488b96f3e5b5fe93ee3eecb6d28bb5b03cf3
- SHA512 a0e6911853f51d73605e8f1a61442391fad25ff7b50a3f84d140d510fd98e262c971f130fb8a237a63704b8162c24b8440a5f235f51a5c343389f64e67c1c852
- SSDEEP 48:2/6FwMlYk29WJsEvkch6/ilABnlL88L0t/wLAB2/I/dxN+Y97sc52G79dBXjmh9:2SFvYkEWmDiuGHxNX7sc5d5e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\close_red_hover.png
- Size 15KB
- SHA256 7c625ae4668cc03e37e4ffc478b87eace06b49b77e71e3209f431c23d98acdd0
- MD5 5ceab43aa527bc146f9453a1586ddf03
- SHA1 88ffb3cadccb54d4be3aabf31cf4d64210b5f553
- SHA512 8a5c81c048fb7d02b246ed23a098ae5f95cdf6f4ca58fd3d30e4fe3001c933444310ca6391096cfaeed86b13f568236f84df4ea9a3d205c0677e31025616f19e
- SSDEEP 48:2/6FwMlYk29WJsEvkch6/9al3UlL88LHT/7L3D/piWxN+Y97sc52G7+lKM4ONuTM:2SFvYkEWmDcCxNX7sc5d+lvVqM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\custom.png
- Size 17KB
- SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
- MD5 03b17f0b1c067826b0fcc6746cced2cb
- SHA1 e07e4434e10df4d6c81b55fceb6eca2281362477
- SHA512 67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2
- SSDEEP 96:wkEWMrbxNXW5G53p1pCcXdV8WMIPX7kTCM4:wkEdV8WM4YWM4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\custom_click.png
- Size 15KB
- SHA256 1318e0f34a551edae1e82818fdf7de5ac627493db5b24556d919f525052d5b90
- MD5 ced07c9db242115400e159d9a02bb7b7
- SHA1 6f2bebd1714dd7522479b5f3e3f2b3f0d18e8c77
- SHA512 d52e63792a5b4172d4ac4e2d369b22b170578616d04de5a40be15b260a2741bf8158b3aed9509760c334283360dd13a4fa21538fc4547ba464be5dd700a22b70
- SSDEEP 48:zM+k29W8sEvWccxN+Y9hNM/sTpBCq8LRNp/bI7cdp2G7urBubDtxvTJYuEEOr:lkEWR3xNXsfCcXdkBSfrJmEOr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\custom_hover.png
- Size 15KB
- SHA256 d588ef0eaa334ed8482f32e5839a7ee0d0b544d5b8d5f7720b8c57010e080424
- MD5 f3e05f142e742e25a98d4f5af3ae0623
- SHA1 88363e81ddef700803f4859d2f3f0b4af516bbf3
- SHA512 5f07a7163c9834564dc4de5a1a484ac8208151bc244f8e72d64556abf88c35f6a81dd6718a3e6f681265c10e2dbbadb07570fa64c31113342a88fd605019496a
- SSDEEP 48:zM+k29W8sEvWDVDnxN+Y9Ou/1bTOBCus8LeL/DmI7cdp2G78Ainnqu9C:lkEWRrxNXO61SomCcXd89bC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\discord_icon.png
- Size 564B
- SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
- MD5 9354bc445e979c2de9b9eedd9b7c8318
- SHA1 8dc3e8fdcad0fcdad1fe19b0b94b676e8846affd
- SHA512 ad13f6bf46dd8cb48a030e720c1c577a22b0d3dec794ae807aa482474fe6c2bead7fc63dd45983fb3ab82034d74d4f10b6d9967d4ff677d2226c6c18ee03a4d6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\error_icon.png
- Size 1KB
- SHA256 666ad4fe456216ddc06618967846ed31f81d8db5be97da6531842c0667352b89
- MD5 dab2c4538a83422b5deae0e0de9b7a30
- SHA1 78c2ab2271aa4020df1e0289bc3c1ba9a43fd424
- SHA512 24cb30a68ce117ba16edd1e94c7d066343eb265c874cd55467db2f913c01b9d776b2ad846e3414cd820c0ba10d93f132aea27739d16165b6e9dd5fbc8890bfdc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\error_icon_72.png
- Size 1KB
- SHA256 84e59d14d9433e6c3d92daeb8c443063b5e3be6c0b297f0403dbde473a05cb3f
- MD5 4aaf83d2b3fd56ad806708e60474df39
- SHA1 144777a265879b69fadea3eb3ac6939458918578
- SHA512 3b8485f054fe6ed2374bc81cb1786f09741219fbfcb22503707b11cf5db1ab262ba4349633597d5d9ddabc3415b170fa8eebc932f58d211d7092b8fb96fa1304
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\exit_close_hover.png
- Size 575B
- SHA256 bcc053a9a087e077d58114106d29701a34f7851f4052f3157102811355d3e709
- MD5 92c2bf222d6ab81fe7a0c072bf31c107
- SHA1 8853eb08a2aa3e99fae6dabb9cff6461704f2a2e
- SHA512 6548d0038f4bda1db69de0729cc9648725d744953649a396b9147afb16abf018a5aef7ff7d3bb019031863f20c81bc202d6e37d171027ab9fde3b37402e179c7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\folder.png
- Size 298B
- SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
- MD5 8fc519ef684dc58830e462581184eb15
- SHA1 cba35cdbb9b87c359b287b13c30a4d2984289ed6
- SHA512 fb5cd6fde1b04901cc25508e7011250645d74eafd58a415b2702b04860d76266e0d6a8e9686532a946b2e534bce5cddab53f7f030930852dd4a030e1e4e49f8a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\help_icon.png
- Size 1KB
- SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
- MD5 3c955d2be56f76de8a53f77e816f3fb8
- SHA1 0c242256f7934e2d857f657ddc7f50589cf489f1
- SHA512 2b4ce8453960de520bdccb658d72b55be3c3386b1d394f3acf7269405971843083d0e04d3af05758ac4b8d191ea6a61ea5313a07fa849bcdf1f8eb4d5624521c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\info_icon.png
- Size 929B
- SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
- MD5 8f73ec5e7100a0ec232e06e5b3786963
- SHA1 15c7bb268803932192a064a4eedc9db42bd6c37c
- SHA512 c628dede37fec439a849ab6704046210bdabb1bb576a5c5dae9a28b52ad021307347211ba2aecb47ef836f14e914ba18617b21863bce12bc406513f45c9eb66e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\installer_bg.jpg
- Size 78KB
- SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
- MD5 3478e24ba1dd52c80a0ff0d43828b6b5
- SHA1 b5b13bbf3fb645efb81d3562296599e76a2abac0
- SHA512 5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d
- SSDEEP 1536:/8jAVIA5IyKedQSsmprMWI/xKdefJeGhuvIDU1pY7EQGZRV3/X35ev:IAVPVsylI/xJfJHovsU1poEBZP/H5ev
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\installer_logo.png
- Size 9KB
- SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
- MD5 f9db10032266ce8276c922b24de2d60f
- SHA1 9c7bc3e277a58c4b59e35b9622e2b7f076ebb2fc
- SHA512 9e5e1e345815ff9e815f63a892724bccb2b1fe19d5db91750f681899af6ba52aa3fc9214ef6bcc691a1e7ab9a1c16c093c398544e1f57f0ad5dc883776f657b6
- SSDEEP 192:fsCXsMtWAC+DwSuWzRNrk2SEDAnQfQhzNoxiw2H6v3LGAEv3BsBW/V:fsCXs1Az4WVNrLnDAnDboG5AkxeuV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\installer_minimize.png
- Size 113B
- SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
- MD5 38b539a1e4229738e5c196eedb4eb225
- SHA1 f027b08dce77c47aaed75a28a2fce218ff8c936c
- SHA512 2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\installer_minimize_click.png
- Size 112B
- SHA256 2599d6a55a8e12b1f05a6e8982d55559151a25ae3690e6637510b6283622dd95
- MD5 08fc39a69fa17e0f529915919cea1633
- SHA1 2966a3f739698e2ce368585fb7f6ac4eae4497b1
- SHA512 f5eae902f9b631410b03b6d4f9be1b4cf6547a94f1a2eee6bf70b0f3036499c01a42c9d58cf98ffbe10edbe79577a01e64faf0e527a70bc9470a1c3d9263b805
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\installer_minimize_hover.png
- Size 112B
- SHA256 57aae4bf49dcbb0ad6cff6263200015c89d7752dc75c2ad918bf846e1ce9646d
- MD5 18fb6465b029206477d0222e8da6fdf9
- SHA1 b7f91e5e3002a5d3c84a30ca6cebe1a89a65ba7b
- SHA512 f045dfed35ea9ff31336cd354a0dd2e9a7ac2582cea1d25a444fffa3bd01e03d73611f786873a81a27a370e5ddb3a6043713e29f064d274088df1c925eb6785f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\installer_upgrade_image_bg.jpg
- Size 19KB
- SHA256 b7f75233e633107d50f24ca82099225c83a832571cd2ce92901f2db3897f058b
- MD5 3bb85d2c8cef28c89a2d07adf931e955
- SHA1 596d13e7742455afce8a534382b28cfd2f6aa185
- SHA512 7075fe989d69ad5f0f4cca5fbbbabad16e0949c2ab8538f3f96020b831a4ec1cc3a701dcb7332e577b5eceba230449efbbf8e288dad47a53d76e40c2337dc730
- SSDEEP 384:/8iAqLzu1zmpwEUPz9eWAwtHDLlKOHEA3QPVu3cTlf7bW:/8ywhxePkthHzQPVGcT17y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\link.png
- Size 306B
- SHA256 28c0abc6bfe7a155815104883a37a53dd783d142300471064c95eddf3cae0eaf
- MD5 ae2c73ee43d722c327c7fb6fdbee905c
- SHA1 96f238bf53ac80f5b7a9ad6ef2531e8e3f274628
- SHA512 5a1e341f727cf1cb4832cced8e96c5a74971451629603c48bfb91ceb4561d0122ab9ae701f8b34681d5f13115a384467d430ccb8282494b40f4577ebc3ad825b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\loader.png
- Size 279B
- SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
- MD5 03903fd42ed2ee3cb014f0f3b410bcb4
- SHA1 762a95240607fe8a304867a46bc2d677f494f5c2
- SHA512 8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\logo_text.png
- Size 4KB
- SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
- MD5 1fbdb2b7efcae8e9f26b6536ab580968
- SHA1 126386cb7c0e8a03d99acb19ec2b13a70114a7d5
- SHA512 1a0218122948b7d93dd473f21512bd2411f902ff133b15bf80d36ff474cf29d53880ed0ab38ef76d8288784817e6fc49f54d85f106c97f620331e31d03d6fa73
- SSDEEP 96:ucBdj0UbKsYpguE2VTlrtyQnN9EHRs8nTOCCC2Jm0ciOqT3YKU6Y4R4MKYb+OI:u2yVQQYQnARxTGJmxiOKYM6WSOI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\minimize_progress_hover.png
- Size 214B
- SHA256 1a4aaa46893e2a9b011c478fbb0cd0e84c199f9f3520703189640088969ef5cd
- MD5 fc2a0361a751177d3aacdba9c31b2682
- SHA1 0a8f672d7a8777d1106e3b8ee36bd6e45bd322ab
- SHA512 a15542c90972387133d86f6a94c17435432b1493b02502533c4d7978428ed7d44a7d3c5564fe08946561638f8a5a3dd0b35b81979c2929dcc386ee5f6f7ecccb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\powered_by_bs.png
- Size 9KB
- SHA256 3d2afe5236ec813d9e8063bc43eb34b88c2155784e1bce19c6a533c32767af35
- MD5 7a2e5c21140aa8269c2aafd207f5dbaa
- SHA1 4e0d9e7e1b09e67eba10100d73dc51623517821e
- SHA512 63f512559f2068a9702c7c527c126f6017cd8d1d16af52e41b884aa9a64ff4294a57243ec78c3a416f70fb6178a79877d68345357725ff92c935709a2ef8adde
- SSDEEP 192:NwY0zaBp8tTgj/cX/X1OKlY9n8O4pNP6NANqb/MgQJisi9oDxEFGho3R:NwY0zGMTgj/cXon3WPfNi/TQxiWD+3R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\setpath.png
- Size 15KB
- SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
- MD5 b2e7f40179744c74fded932e829cb12a
- SHA1 a0059ab8158a497d2cf583a292b13f87326ec3f0
- SHA512 b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c
- SSDEEP 96:iS5YkEWmE5+W+BxNXrNGyxGvsc5RxZ8af:iSqk6C+z5mf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\setpath_click.png
- Size 15KB
- SHA256 c94924e95a49b175c8fc00bdc2821bb70a85b864cc193becc553b32f0024dde1
- MD5 624e84e9b49bc150043aa9fb0eed2822
- SHA1 f23f2a4ec609e3e9cff9319533e561968ccabb22
- SHA512 288e1954d29bd3d22b56fadb2e0d3d10580a540fa1f2bab1284d957708bad96df5e38b67c6dc14784e1e275b89082c57370b786c0d0c4307601c0d2bf3704460
- SSDEEP 96:iS5YkEWmEZVW/5xZTbxNXrNGyxGvsc5Rz:iSqk6p/5xZTd5g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\setpath_hover.png
- Size 15KB
- SHA256 2da3f9367c847e47131370dd163f611c4639287512a47f487e0025c5665830e0
- MD5 b1e53a76b6ddb3ecff52bfc1a8e5b09d
- SHA1 012b5879e879fa25bf48e4bb62c35ee829eea571
- SHA512 4369891858b4adaf9144636c44b55979290177bcff57f67f341071e42e90f992531024e122c0bc5436ddb8c55e994e7b913ec37137a642dc0164e6e2516f0b68
- SSDEEP 96:iS5YkEWmECF8WgrZxNXrNGyxGvsc5RhZ8af:iSqk6pfM75uf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\unchecked_gray.png
- Size 192B
- SHA256 671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396
- MD5 e50df2a0768f7fc4c3fe8d784564fea3
- SHA1 d1fc4db50fe8e534019eb7ce70a61fd4c954621a
- SHA512 c87a8308a73b17cbdd179737631fb1ba7fdaeb65e82263f6617727519b70a81266bb695867b9e599c1306ee2cf0de525452f77ce367ca89bf870ea3ae7189998
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Assets\unchecked_gray_hover.png
- Size 176B
- SHA256 a631e26bd5b6ea19c8c65b766a056c92ba8a47e1483768dcf12b05293c9a7a0d
- MD5 62d7f14c26608f8392537d68f43dece1
- SHA1 add4f30e7c3af4f7622e6bc55d960db612f3bb0a
- SHA512 e41210a78e6076954f75a2f73c0f7628e8604a09ecbb1d2ee0972741d4ef1d814b366828977c02944736b03ed116bc559a2ae47ddb7cbc6f4e54578c8263edf4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.ar-EG.txt
- Size 28KB
- SHA256 6686465cb54bb125f41c0e378c843a14c4504115b94cd94aeab3290fc02c1498
- MD5 822b8a7e124427ae4058251d139bfa64
- SHA1 6aa4d5306c58a67b203cd2991e937247c281285f
- SHA512 9505e1df353a099e0c4fbbe40229bfe2dce04ccf7d69d66371c4753fa8ea4010a153bcaf03488bdbdaa00b17e8ea9cf5a34c8dffd9b6dd18a642252e7301dd13
- SSDEEP 768:7pkOkxzPHa9nyh/xaULCZhyv9X+ahM8OZMAdXOj3wZQODEQgjrYn64t+d15TwZzK:7pkOkVHa9yh/xaULCZ0v9X+ahM8qMAdU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.ar-IL.txt
- Size 14KB
- SHA256 65e7b0f37b5e2aa805ac8d57969804d803430186f34e9703ca9fa09ba908ef90
- MD5 9fb07e066cc2f213a64d35a97a8c2922
- SHA1 a70db989f5c562bc69caad89a1402c8ad7c9b80e
- SHA512 81680bff55b475a62a4bf29a8c219230b84894c1165f60e372209a5aacdba8e4819c3dfb76f3b55c15d472ababeabf0cd4b30c04e7daa26df63c8a5101970c3c
- SSDEEP 384:yOBwYhy3MToUwSB6128OTHwezHZKaja95x1mYflbAGYTl6kMCeYYbXdHtiDeONER:yOBwSy3MToUJBJ8OTHwezHZKCa95xMYH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.de-DE.txt
- Size 24KB
- SHA256 e829dca27a11d357d67234b858d22969fbc39103e3bce8f6a887e7ab41183303
- MD5 71dc98fc1af171c76f8af29840357f77
- SHA1 bc2a2b6f62927f9372c4a2474515c0eeda9fd080
- SHA512 1353262b81fe5cbf3cb94a05832afbe79e5eed644b3194324501df82b54c5b538ce0c07643290401c9fdd7035cb1b06ffff1ff64f62ef042534e5d74e4791ac5
- SSDEEP 768:W80uF++ll0prMg1sQmgcr7VH3RIw/cQL0ctYhjrGKB+ExqGJpVoA9VOnuOIS8tLe:W80t+30prMg1sQmgcr7VH3RIw/cQL0UX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.en-US.txt
- Size 21KB
- SHA256 945cbd36495c301dcf1cad837a4147479077974bce2790a3cb3961c9c71f22e2
- MD5 b5d651273bada061fcff78edaf4d32ef
- SHA1 9f56763bd4e373b3f186568d323521fdc7271a73
- SHA512 1b1778caf39af7531610e91704a86f41065469c21dbe5ba1723923e2cf9944e812c5be497618f36471b4b002f280da3de25fd348039cbf380c81b598f1fddc23
- SSDEEP 384:aBvGq6rKPsL/ds89JplYTWfUvcABRGjV+qXOJtUmEIpNnU6+FKvtCFV30Y4TWEaj:aBvGqaKPsL/ds893l+WfacWRGjV+qXOc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.es-ES.txt
- Size 23KB
- SHA256 f63122ace78900fa73d94ad2e1cdf230116e7d8d9c39872142b126e839b78165
- MD5 b43fea60adca63d4d17b3710b4518bde
- SHA1 cf5ae6b9adb3a9a4e6a3bf6bd9593373b34ba92c
- SHA512 d7010265a455e0994b063366520752d03230ce508f1b4ba51cd9810285d67601590939fdcc5e4eeb3ea9e9cdc79215fff0ae66a7a655437b8894248010f6905e
- SSDEEP 384:VjeAKX46zHt0V4QZXdomruFXT/Z5QZOFINJ0mOImr6moZvu5a13ZUQjyXIxpnE4l:VjebX3zHte42domruFXT/ZKZOFINJ0mB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.fr-FR.txt
- Size 24KB
- SHA256 47239ca5bd5578436784c12728242f36e2e47e12ce08816a222f358b9ba0eb00
- MD5 9dfeaee4c6a1c21430663c83ae79bc25
- SHA1 ccbca136ccccf4ad2acb97f4914144be7f5b654f
- SHA512 8789fc4b17b88113a489b3796983d33389e6222388a8ca6820fa9c2b6825feb6e928f18c9db3051882a138dc49afdbfff978fefc28d0d25de5c360708148b418
- SSDEEP 768:SJfHJ8TE24kO9oXahek1qlIeDLRwXJmVxxNUL1vbqBkAimby+qHz26E+bKKBfSmU:SJfHJSE24kOqXaheaqlIeDLRwsVxxNUm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.id-ID.txt
- Size 22KB
- SHA256 73abcf287d8494fe1b15d0f55df3820f92e31779b0998b91254289c3e0c6c7f2
- MD5 89165e578a2b7b3181b3889fafe32eef
- SHA1 07e3c48725d1804cd2d59a5a6d3e0f61cfbb1775
- SHA512 c782971465c9e0719db2038eb0be85531463d5edccf9601cea321457aec9288b5df5fcd56e33f44dcb79541b6ba5ac9b00837403f207d5a658ab706303589057
- SSDEEP 384:jVh/rDVUUQxb+MfNqShmJl4Hk9Jwc9QDJabbmLwI+pNcmJ/KhRGv5SWVeszaEJgj:jVh/rDeUQxbTfNqSkX4Hk9JZQ9abbmLn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.it-IT.txt
- Size 23KB
- SHA256 57860d69389b1d5155314cbf1e270a7c61a35f170a04ce550df785e38899f1ff
- MD5 cb939a20b2ed230d60874c0214776bf9
- SHA1 f4625b5541e0d4c4954e64c6348479ae529210ad
- SHA512 fd52eb495285c3059aa0d0179d71ef72b1b257c8a64d83b7abe62675c96e6bfe1af419bc091a60a0113be4e65bdd218c9d46e05658597fd777f190d874121e89
- SSDEEP 384:4g47uG8BIfNU2OfGVmHuFha/HkNLdfXLlmKBeuCrahmD9I5Gc9KlvYq9HVx591Eh:4R7uG8BoNU2QGo+o/HkNLdfXLl34uCrG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.ja-JP.txt
- Size 27KB
- SHA256 0f9815626f26cfb4a90aaa4471e30191f0edcc2130322145c1eff636c5537dd3
- MD5 36ff8c215a61b4e4b8b8947b2a8cb733
- SHA1 be1639adacb72043bd3eecb9efe8ccbef8460aef
- SHA512 0bcfbabc740bb4d1557d14ebbe4596fde7eb485a494673a3d352f7d5e3441f1ef5ea214c9449e365fa5bc4c481cfdbc8a7ed10da9888fe089fe5fd286e60bf53
- SSDEEP 768:dhOFZfOPumlGV/MR8zRMcDultqbcunYdFgtZXgVBWbEs231Y5Lf5GijWY1Zf08un:dhOFZfOPumlG1MR8zRMcDultacuYdFgc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.ko-KR.txt
- Size 24KB
- SHA256 85f4ea4e1e923b798adaeef29729dabab8367582c10c8efc41965b3482ec9e6f
- MD5 b2537fc25c7afc05fa3e2d6bf4be66f5
- SHA1 58f8c7fefb683d8df32753bdd380849d4c68b9ef
- SHA512 4bf7ff169295dafc128ac3aabed3d29b852b9bea2720752637ae6e04d276150ee483c792bd1816981fbd792dd3c7bdc15d788c977d3834b8a73ef90334fae8d6
- SSDEEP 768:Trw8SNRRITzqbpvuoi7Gugcg/UzuY+BnTFbBzpoY9UW3l9sFO+4nJVMmECgZfQcq:Trw8SNRRITzqbpvuoiSugcg/UzuY+BTz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.pl-PL.txt
- Size 23KB
- SHA256 0da7567e1ec905767d53f71b0d2d13f66be67e645f5edfc54fe413e96beb7714
- MD5 e2350d4571ce67ec792f20d7152d5344
- SHA1 cbf153ce11fa9d424120e8267b1de14cc9846659
- SHA512 206e33a6ecc636c44ecb1934f5c93d98ac4dfbec177047ad55cbf42e142ebbc62e97ca128e4713a5df0a49f4121e011d94a1e36b24bff69ae6ddd40045e535f2
- SSDEEP 384:ZfLi/oyBnk/sYSZXA7aV1kymyZ50jjfuXfdEQTBnLWcaYW161gIZtiJWENX/rvEs:ZfLi/oyBk/sYSNA7a7ky9Z50jjfuXfdU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.pt-BR.txt
- Size 23KB
- SHA256 3fb5b9611acd0332ec94e23dc60637fad134cfff39f5b401b8cbc576d7fe6953
- MD5 860e0c31a6f25100284a2ca068f83f37
- SHA1 abf4af6a66c5fc77784a6472a1115880a13409c2
- SHA512 7888285c0254f8eee54037f9b076721575e0ffc00cfdc6b6ea0d28f9bbab85e2f9886aaa6405722103c393a47f71183ac8a5f50830dd77799c6cb35181baee85
- SSDEEP 384:lIQnBaZYmiAJ7ot2OTo9qUs7KJGTYf+CX5IwGgZeIha6gZtvR8Oh1/O8p+NaVcj4:lIQnBaZYm7JMtTTo9qUs7KJGTYf+2IwI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.ru-RU.txt
- Size 32KB
- SHA256 bac2ce43ff30124440a2bae2fb2187f785d4e0287ad1a10839261a03ffccc9fd
- MD5 54f5804e91cf30069f01a7a6efbffd1e
- SHA1 a8a219e59bb6c11d6c1e19b00d29761280e4aa43
- SHA512 ef3f1197ab01fc66411d16e67b0027b479ee1a7f046a6b3ac82ee8da3a1abe497047763fa1814ac78d45af29976215c72a5bf041db06a226285489e7030c1270
- SSDEEP 768:U3Lzj4kLoepGBXY9BhwFdPjokDmu3B9+emNsU6XaDvo7pkkNzJnuJQ47DQfOB/0j:U3Lzj4kLoepGZY9BhwFdPjokDmu3B9+W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.th-TH.txt
- Size 37KB
- SHA256 b723648c0d747e7557daaa52941e9718862d1edb8f96aa85f4b28395a1dfa870
- MD5 4db8635512122df0f2a2739074806238
- SHA1 5d2c1e42913d3c58ed5f613c844861533f3e1101
- SHA512 53c2bf1964db639f241f510d4e8407064a9c9d4b0f6150df8d520735faac62b6dafca2b3214147a5557ad8f5eb6062e45617b3778ecca734f23aa8fa01ab94dc
- SSDEEP 768:JK5FChNcKP+L982kGu5W9d/Tz3mYgzkKg1nCFe1HfB75OWIRyIFFf9c1EMe1g60S:JKvsdmfkGuAPv3T/9MWIbfiEMavlgiFh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.tr-TR.txt
- Size 23KB
- SHA256 1374bd6fe30a6149256c87805e70f3509dacaa7a0642badc5be037fbf732f6cf
- MD5 5c4db1158c88618218c6c9c545636f05
- SHA1 2631340739e239ecdd43b16a7bbfc1a73eacaaa2
- SHA512 441b4a040ad2c3decf28f2d87424def14627a88e3933c1a11a1308e543fc2bcee736e97e7047dda07402320207886574ca98b5093e475e697782e353bb20e373
- SSDEEP 384:HNcbnt7WE3EMQ2yM2lj/EuvNVYyvRelkxe6KyqjefgmdpO32Wr595FXhy9uLLur8:HNWnt7WE3NHyMaj/jNVYyvRwkxe6KyqF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.vi-VN.txt
- Size 26KB
- SHA256 2d0875082c04453666df118b7b2204a43706e9d6ce4db78666da2c5b11be1671
- MD5 b2d93542cd5b67aa6164f9948ba5411b
- SHA1 8ea321b8faaf86e9119eac0dc3fbdd7e2c6bf235
- SHA512 554b8526698186cc40fc65ae88d100429b9979286014fbb508e551f46253a58efb1c6a67e46cda9b2b079c4ccc2fdb4bae405e28f694c829c418d40784f60fb1
- SSDEEP 768:d+YHdtPv3/S38PXY3QZL8OMQ4E83kilmDg9WQ7onzket2V6ZaS4hYigMU8ZFIsGF:d+Y9t33/S38PXY3QZL8OMQp83kiYDg9+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.zh-CN.txt
- Size 19KB
- SHA256 91b5f5dfbc4eeccb59e37af2caa8658ac36f25d3baaf0df783e62e26fb0281a7
- MD5 8cd477f2f0251359e7dd8d545fe4848a
- SHA1 951c9c218d96bc3dcba31bcafc5e452ef3b04b83
- SHA512 331e778902af1544cb6a86475f2374f8209b7129485f2e8d7ac137b93952835ea66ceafa256c42e03db0ca013d473031f631fac932df5d91db4833132a33af55
- SSDEEP 384:YN6Rgh7vvsXikllYeHc1y3N93GcchtmLOoyIEmDIOShx5qcFKkHkCVN41/DjPX6U:YN4gh7vvsikXx81y3H3GcchtcOorEmUE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS07739393\Locales\i18n.zh-TW.txt
- Size 20KB
- SHA256 a50ce58912dc63a21099a7e1caaa43388b1dd105a1dd40bc2565754f50896726
- MD5 529405f461d5221ec35d1b6f5a145c8e
- SHA1 c5713c2e187154e46e326f87308abe92d8d3a85f
- SHA512 be8d6c35022848e9a3e1091974c36cccabecf52f4138df903ff45d702d64ebbc484aac5ce7d3fa673cf04ec97a9e08140f233dc6aba4b3d6247080e6d58d4634
- SSDEEP 384:BjTjZrCeLmvJhD2loWzEgYhhGgm0T4BBBG+mrIjgpFF5kxtlVNzvM9v7ZnegR/Fv:BjTjZrCeLmvTDCpzEgMhGgm0T4BrG+mt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS414D63F4\BlueStacksInstaller.exe.config
- Size 324B
- SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
- MD5 1b456d88546e29f4f007cd0bf1025703
- SHA1 e5c444fcfe5baf2ef71c1813afc3f2c1100cab86
- SHA512 c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS414D63F4\JSON.dll
- Size 411KB
- SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
- MD5 f5fd966e29f5c359f78cb61a571d1be4
- SHA1 a55e7ed593b4bc7a77586da0f1223cfd9d51a233
- SHA512 d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be
- SSDEEP 6144:GmyZXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwd:GmIWtWrnngnnnKnanxNYhX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS414D63F4\ThemeFile
- Size 80KB
- SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
- MD5 c3e6bab4f92ee40b9453821136878993
- SHA1 94493a6b3dfb3135e5775b7d3be227659856fbc4
- SHA512 a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895
- SSDEEP 1536:Vq0UZUzBB6YjhX8knUVXVqlp1D88p/LUP8f/MPFntuevdxG+PchojU1yZwbP8fZS:pUFmL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\7zr.exe
- Size 1.3MB
- SHA256 9f30c03c3ba88154e069b2e9cf320448192351272ae265bcc3009784dd9f7503
- MD5 13b1b7dde164567e1e28b4ef5889808c
- SHA1 490166551251143ac50f37a2d9d6dd1f48c4e7c7
- SHA512 955a18b3d2b0de85b44814fad8b02a83516eb9df52044aa8f91fd7871ebe88e784f17b55165bc0afaa5779009fc26229943e6d154de2c89b7a5351ab4f2073af
- SSDEEP 24576:Vi5MAySNDSx7d+g3VHbnRnM1e5Bypz++IiW9+:V8yPxkg3VHbdyo+9h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\BlueStacksInstaller.exe.config
- Size 392B
- SHA256 4b7df915d706af6459c38d75b09c5e14f951842ae0678078400f204ad1c7a7c2
- MD5 ca0a329097316832e4a6ea5d870c9268
- SHA1 4a36b93361d3dc9df9b00313f2c2b394be9e1e72
- SHA512 51f9a874e84f130be4fa29fcc4bc934105318234b5dd9ceedaf569e3f0e6b38e29f3bec056044724476ae24295a510b16d8a737b994fd6f1268609defa315271
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-ForceGPU.exe
- Size 169KB
- SHA256 fc962ebca9432171a86fc8eabfe4ee2ec53308ce2832c2577f9468061140aa32
- MD5 156eb84017e3796d063b75c1b5aa881d
- SHA1 97ece95738cc44a914bdbdc881b600a9aab3f9bd
- SHA512 88e869bc30cada32eaab956a8c164e2f5eca256939eba9f6c17c59bae8394daa937541f277e067469d5abeb057b5c9f8ce7d71de10330073fcdd3526f03317f8
- SSDEEP 3072:En9IyxOPDY+mVUM+Wwkv3GmpOJjjCNNFTl:E9YE+c1+YWSOJjWVl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS4FE916E4\HD-GLCheck.exe
- Size 223KB
- SHA256 554535f7a3e5a08036ee362693316e7dea4b886dd3781a9a684ba510926c5583
- MD5 3dffb87aa5eacdbf2c84cdb50779c1c8
- SHA1 bbdebc0f60e486bd3708d06da6e1d991f74b449d
- SHA512 41573364c196395b029a38c5d7cc142f71b348490bf08e6c45d89288f547fe051db53294dfab18b569a88d2cfa536a7e29ee93f8a351b04f6b685dac5fb6d52e
- SSDEEP 3072:de+RTeeama4LcmbZA0mkLV4Cfn54qJe9susxmjbpFvB5JBqlMCQVbIoa3gFo:f6eha4Lc+Zlbfn54qgvB5bqlMCQVbDY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS8225E162\Assets\change_hover.png
- Size 310B
- SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
- MD5 57092634754fc26e5515e3ed5ca7d461
- SHA1 3ae4d01db9d6bba535f5292298502193dfc02710
- SHA512 553baf9967847292c8e9249dc3b1d55069f51c79f4d1d3832a0036e79691f433a3ce8296a68c774b5797caf7000037637ce61b8365885d2a4eed3ff0730e5e2a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS8225E162\BlueStacksInstaller.exe
- Size 642KB
- SHA256 08f9645473186b147f1c984e34eb556c75476f6ad6e5842812329afc1d30dc74
- MD5 ff1c095bb95dae633c05ea11ca6fb192
- SHA1 5694da0d0200a32404566f1e5ee95dbb701163b5
- SHA512 c131b85188ef0e0c1a29eefe210c53452490db4f9c5e550f4fb3f2a881af1de840c99933d38d22d40fdab2cb88afde096ad18864252eece96ec34401b90f0ac9
- SSDEEP 6144:yq3WNcXmfpCIwkJFgnF8M338MsRO+WQ66ELvy2p3+uwBlcWzS/YMvB5bqlMCQVbk:yDN7fpCIxcuy93+xBlWYMvB5b6MCyKF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\Assets\BlueStacks.ico
- Size 131KB
- SHA256 3803045963af064936d7071c178de8e40854968b3d3f9171c57a182c869f3697
- MD5 169706218f98a42594a8c5c5a65771fe
- SHA1 b8ded94180212578d86a031eb71ef93dcffe1a26
- SHA512 1c3f18ed0a24ffa78fe938826eb88531eb8be134d6f209b87d7af5d0e8c4829f01947d7b0048996b9755562bbb7f52e000bcd15d07d646cacb2989ac881ce448
- SSDEEP 1536:ujH+9susxmjlVpFvB5Qi/BqlMCnrCtVbRRd9AFUBvQ/:Qe9susxmjbpFvB5JBqlMCQVbIos
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\BlueStacksInstaller.exe
- Size 339KB
- SHA256 2925151ea17c8c6ea3bef20b17219c8c99b1aec14d1b81a21d71247097de9228
- MD5 3d40c94b0bbe4e37a924797ca55cf564
- SHA1 6797b987eaa8482ebf4f33f5b4307bafcd3396b6
- SHA512 0e22afa9a10aa9bb35e8d2c8af06ebde91011c1250679f35e6c3e2e604b0e5ff03ff9574671cc079143a6e9d75d317f89822f7f2e3a82860d6daf347fdb250df
- SSDEEP 3072:p0r2UfeCAI6cWnRg30HPpiTo0YK1dwwkTZEkjLxFpApDo/4LBzyDEx6Tvhw9dd7L:SyUfbEHn6wlJGvB5bqlMCnVbDBi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\BstkTypeLib.dll
- Size 458KB
- SHA256 2f7371613b228bba7669c5c95c8f5f873cdbabaf72871cd4facc67a5148b177d
- MD5 7c5b4a754d8ac44e0d0936c556210235
- SHA1 7dab44fab849e077ca2ab5bb33b6a741cfc0bdc4
- SHA512 36d541877c189e2ede8ca18d496fd91ec842cb43c91d6468e4763ac737632d89375c2aaa12fe719a38239814346825e0c9f03c8044d1964d1a9287696d3e88e3
- SSDEEP 6144:7c7DFhECiSOE3WVhgzS5PLtDSzyahG1kyX1+bDpfEMC:IdhV33tSLQyQp8V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\CPUID.dll
- Size 37KB
- SHA256 e7147c3e38950fe7e7ed2d37e5eacd6dd90046c9553fa81e2f2abe604635f79b
- MD5 f57ff1a4b3cff90aea1a13efe71d79c5
- SHA1 ac478750fb59bb3f0a88cabd0e56550e8a085357
- SHA512 e978d8e29e9788647b577d26506c28705cd7de0226b0e0742905a4d71d871b44c4629f821a3ba06358609186f7915277ec3cc6b5341f8e584ea01424823960a2
- SSDEEP 768:JgzrGtWJWJmmzwTOZiQFy6lGCTnOsLNSZXjkDD6Hy16iFY:JoaYpTOdwlCTVLNiC3v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\CommonInstallUtils.zip
- Size 7.7MB
- SHA256 e0d238e6cfb872a10710c6a6c8be24d94a83c4c9ac82987c48d5955c5af1b775
- MD5 f2191bd39bdad8b86f8710128f3b7cd7
- SHA1 54625773841fea94aad0687d96ea50bc902cd7a4
- SHA512 3481d167ab1ac9ba94cd9aac0f0dd7b1b5614d6dc566b5ab4bef7237848d3be95aa91c7bb559b95ac6a2c14b61c50f0458660b57ac3709f0d0e939f4e8d909dc
- SSDEEP 196608:hfNAnk0QZADkTbS+f0Y1fW9UBve4a+6f5x+mcDjoQ:N+kdZADkTmO1TzeUmcDjx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\Dependencies.7z
- Size 375KB
- SHA256 9b005b39ea526d7e706014c3cd0f77a79901975e5d5ea4efa67f30f133fdb8f7
- MD5 3f849db312b0af458c8a9b6a256f5358
- SHA1 12918e0ea8df5460baa5ca2c801e97635f14f023
- SHA512 cb31a9b8b650640a50c47a70bc48cc6fe2373ae1924a669de393ff70f786b71d61b4c1250bc5869a505cb2f3c5b128562eb4a39d0ed4ac4fd6592810c0059896
- SSDEEP 6144:nehaS8fwNCyqsfECJnyTGZsVsqii5GXrLJiX1ik3U7lhvHrEF6zV:eKgJs8nyMsTHGbL+Ik3U7lhvAy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-Astcdecoder.dll
- Size 99KB
- SHA256 50cbc6f93ad90ab72c257a7ae6dafc0dc97b3fd16ad4f2ede334cb064f5cb4ee
- MD5 c284a9e96bd691975ec1fe2067200579
- SHA1 980ff25d39f8d4afaa228bf828aeccd666d5ed6f
- SHA512 1e1c33823ebabe44a46d8c58546d6203dd2608dcb1cf6cc828646491ee5b531edda5d3594a71020761ffeab7db8a4dd43cc6aca8d1955d92fe30f8fe350d0f68
- SSDEEP 1536:/+MGFVrjoCd5b4YKX7X+H3YEmLJX+iQKaaEAcTKwwgdfG7h2YYxJf7xfT:/mroCfuSqJX/aAcTKwtG7MYYxJfFfT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-Bridge-Native.dll
- Size 843KB
- SHA256 eaeaaac97279fad1d649dff61e122591fd4d6fba6c1a7c2882de1aeaa0363668
- MD5 b3870bdf99af6c59c157ccbb70bc6813
- SHA1 920dd0ffdade8668c968a17f0d6ed0115ef8157b
- SHA512 12953d698d9ab89e10f361a66051f5adef9900b8e438fe28bb035e9384ed4e6860827af14410c77b7c50339d5d0f99a6d87b6b0420c53638d0008464f3bb7576
- SSDEEP 24576:bhjaQVoNF3AdNpO+54g1c8oC6qFwnhezIhSMXlSaB5ebdGN7t6:bhjago0yYBaaYH6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-Common.dll
- Size 935KB
- SHA256 3b3fda7195e8c199b176cd38e0a4338997b7c9aac072ce0cec126fdfe73316c5
- MD5 cd7159d3434b4512024c3f584945e400
- SHA1 35b5566c337147948b25d75949b75ce41fa7a8aa
- SHA512 678cecd10c3b7e33fcd5d0a36349a5d38bc14ec85ec32f586eac3c929a34a61297550335e8cd868c8d08017348b4e047a9727aa448fd1a29ddb8638635e2df0f
- SSDEEP 12288:IOB9ZXVIa93MpXXO2OqvaS9WtWrnngnnnKnanxWYz:jqs36O2xaS9WtWrnngnnnKnanxWy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\HD-Opengl-Native.dll
- Size 5.9MB
- SHA256 061caa9450f8f2805ba4a5dade6a764262d4751954882801a70ad0bb51d0d15a
- MD5 82a2f13f05c543d852626cb2c3f2c8a7
- SHA1 9034251e2f5971b783c0816f590e813cd03b1712
- SHA512 d91f619ae1c8346aabd9cc5aab4e11398e98f9a03bfcdbde835c5013af5cdaf0b8c6b597f26392db03e733488e4b542ee8a28f71daf69af30fcc477cce67b04c
- SSDEEP 49152:ftZF1wY8b9bUi8nolmNLdIECyxLSi19xjJFwNk77/Fc9Vu2iKH2Izdtn5BW4Jaaq:7o9YtZSi19xjJFwxniKWilq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\Microsoft.WindowsAPICodePack.Shell.dll
- Size 540KB
- SHA256 ad8e38854c6bd92b904a6e72a0522698bdfa41b9559db175d79ef024b1cc5253
- MD5 6893bce16ba50c8639256827e26a17b0
- SHA1 8e6f403f429d09ea2d439d7001cd789414a32f45
- SHA512 783258d29185c710464880239d466fce5102612dbf4f5010dfa2166b1ed36cf0859788f24ec1268b000cf5fb942ead707ecd7b19b542ff53cc870b1104d6a496
- SSDEEP 6144:ctIgLGv5WBfXkYlsL/Nz++R1yji08n3uzxRQKEPmBm9C5vEx3tcQ8Vub8xPtwZE9:Mz81Dn3GQ/9C58x3tWXH9gvMB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\Microsoft.WindowsAPICodePack.dll
- Size 121KB
- SHA256 a69d54df0f9cbe2ff7ac0d41ebb043c9c4cbab5a94c5b0e1457031cfadaa40a6
- MD5 b9d6e1604aad5e9587605d4fa46c965e
- SHA1 19fa501a41c099336348500b05bf931023dbf7e6
- SHA512 4e9db1398f12ffb4ee233a2cea6e4edeb3dd02e53c2b963adb7cae25ce07f1869c4889929df94b484e3890236e62d45b2778bd5f044e08733ca256361303311c
- SSDEEP 3072:8pM828whjGQhioSWPCeS20ImL6HKgqYA3FliALFw:8pl282jGSSWPCeSgHxZJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\Newtonsoft.Json.dll
- Size 496KB
- SHA256 de0023e0326e8d7c0602e2042f0a3e10c180d29c37b5ac3249ac42a49da233b6
- MD5 d86e5db3dd1d4848d9eeca8b903153d0
- SHA1 89d75069e6a3d6746e412ed3fa5b38d25aee832a
- SHA512 b4d73cd00e2f662a5cc3bb3107bd6bdfee6774a4874272c6ceca71943e6be239c10f7e0c06a77839446836ab49359c9a3f7817d19ebfe8b3f26410bf334639cb
- SSDEEP 12288:zmKLDa2Tqte5+7OWpP8gkRCj7gBEA+PeKjJc6:lie0/pP8gUwcBEAMeKdc6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\PD.zip
- Size 526KB
- SHA256 b6074342692359f8e524c65862a6165fedaa3b6fc5b72c76ed6b180bff1cdfee
- MD5 22df1f7b2404b026ec2095b156e6e44f
- SHA1 f4def8ac19a490b9e23592fad053254aea608bce
- SHA512 94737a0cdb8c37563999f4cb2378e9d27e9ad4267c5d918263c016c70d56805808cba3faa1b27dd3ca2e97e4fbbb4a0e2cccc5c5f52542e9c2461c8bf491f388
- SSDEEP 12288:HNGTlaYQL7Ypy9nNH8VJZ8rFR5W/vPgp0um/TJj1ab3FSrgD:HUaYSY4nhgKrFR5cvPRuuTJj18ND
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\concrt140.dll
- Size 310KB
- SHA256 39b2df43ab2bc455aa1f46a33440d0880e9bc781c4e03c6081251b56e543f608
- MD5 a4ebc61e61670204712536118523c4f5
- SHA1 bbf24b1eb67dd9a4c4bd3bdc3a003fafff25b2dd
- SHA512 79a00c25c763a95757240feaef4d3c0f824ebd8786aff29c7fb569764923d553d143025ee736bad2d83b362ae8d6bc5ee42ccb58223da338c54582bce80c9e5e
- SSDEEP 6144:UEI93zcNn3dMiBXHxHSSXfPnevwbbeVuw0rp9hnWzgQQf3PfXC:tIlwNqihUSPP9QzsC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\d3dcompiler_47.dll
- Size 4.0MB
- SHA256 bef3c125122bb459434bb02e763454cc21454257a78e63ceabfb5b347d46efd2
- MD5 5faba8b020b313253703b07591d00379
- SHA1 f5ea546901c3faf60122a4ec2d15a86b916d5d10
- SHA512 b23f0df210b25996953e51ceb2304bd85aaed33c41c75ee1577f6d76f37bbd2a2e96be0ba7561270e23b26cf0db2c8ae60567cdf91fbbd2d0577ae88e9ce3939
- SSDEEP 49152:2BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyv:WeZevVKACOvWYQR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\libEGL.dll
- Size 29KB
- SHA256 5e287e7e884504b524dc4610bebe79e013f0bc6f87fe788dd1f5562b70a6dd65
- MD5 be6ff0ec680921380c04331351a1ca2f
- SHA1 164a58758bd929d3f61f5193494dc4ea188c34c2
- SHA512 8603d539b08c32a9777eb5749ea9707a26a025dee72e8b44a34bc7e5270d8d88004a3dc0625986b4814402a3891ce32d815a27c6ec7e0079638a36b68d13890a
- SSDEEP 384:nc90mSCFApy80kzj63iZgbFIYiVLpMNOZiPxh8E9VF0NyeCg:nc93ky80wjSyYidpMN3PxWE4N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\libGLESv2.dll
- Size 3.2MB
- SHA256 5b0acf994cd091c5c07d707219a33de7d5d9ce2038bf93644a7c3d8d64de48d5
- MD5 35b10fb121ff7c4f85636c4ac075307c
- SHA1 ced4a1b68ec66eb8bad69651e8d2d7ea63028f8f
- SHA512 14fad63bbe5bc296206656b1b6075167d4d86278e2db7afe5ec68144e7896227a07ea07d93e3a5b042deae6089984ab1ff9f38f80c9c9b128787871d13f28d71
- SSDEEP 49152:I2YkgGT+ZHeJVb+/0zNQVK4IHMggjsVfRF/m+5SsqferJ+YqEeKxUtLbROY:VhgGT+ZYS/0zNugRy+5Sx+qEewY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\libOpenglRender.dll
- Size 12.1MB
- SHA256 57e7553ad33a53bdeecd4da4a1add3a7931ac5a9c4bac4fbe88aff06da957300
- MD5 775b2738a5acf29042b871ba094f46bb
- SHA1 a69c8963c8662e89e8308f2aa2ab95eec4c32e41
- SHA512 26b01e7416e591189c7a4fdcdc94fa7ffa3572e866f3a3888d877d3560a17e61d3e7894895d1ec2aa88236f5697dc106ccb85baf2c9fb2e4b6124397f0c4454e
- SSDEEP 98304:CqhBqCPwql3YbsQb7MiAakiaB0fCMRJeGwEtZSi19xjJFwxniKWilwQ:CSBxPXGwEtZx9fFGniNRQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\msvcp140.dll
- Size 554KB
- SHA256 75872c426555ac8af55b5a7f6d4aea8831af74353b22612850a2bfc40e3b67e1
- MD5 0ca4a10be84402ce3123ebed2e2c6abb
- SHA1 9e6d9bcb827ee3a108d0b91a99490ee37a4fa1cc
- SHA512 899a4635cf6ed642a2bcd2a4415dd02dbcecfe0a0cf789d1eb4c9781bf86fcc7a44bbf41f20d3d5073f6a3935ed165e6ad3afd38824b7a7af33c7e95855eac1b
- SSDEEP 12288:d7dqZ1EqSGQEwkcz6sm7UtgZ/29z7mnuMG7NaekWdgJMKZ+h7rUh0svaQEKZm+j8:dZNg+h7rKiQEKZm+jWodEERG5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\msvcp140_1.dll
- Size 24KB
- SHA256 9d6a0264a41ef8b3e758cfcced8ab3270c76211b75af6981c991b50cb00f2a85
- MD5 38456a618a1ce450774078018f28f103
- SHA1 e85f33c1122d61e083de44617d9617758f17391e
- SHA512 89d990e2b6d68ce6dbc9c3e9203a2a3d8b7251260d927002f10978b876c1de4c5cf7749a458eedb7cff4f975e3a201faca59dfa2bfefa482a2b8028781d6a255
- SSDEEP 384:oXt9apR9wFSN2GWcn5gWLYzHRN77kXC4deR9zZjQ9MaJ:oXK79wFSEA+7kXC4dC9zZjmFJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\msvcp140_2.dll
- Size 182KB
- SHA256 299d080f793e721d9d18a928c0cd137540b07053979ae19026892372cbe89a88
- MD5 76976b69dc97a6415b958334831a2315
- SHA1 537919cb2a67fde9d220eeb509a019f336179c30
- SHA512 4826a02d2b7206e9a644bcff60a2c1f93320844e76f9ca0e2757c396138a083fa6539042fd5311dee236b12d16b1530b4e37a25e47e4474d63d256df63dbec28
- SSDEEP 3072:yo8fdbDQ2RAIQSP3cNkquWHSWnwTXsY0YqgwAlrX/Fv1Yqler9rwro:yVZgIQDkgyWnZlfgX/1grF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\msvcp140_atomic_wait.dll
- Size 56KB
- SHA256 ae430f3b65c5fc88643b30a344289bfda29811279379c1537cec19983c0938ae
- MD5 8516ad602773658bdc5feddd19550725
- SHA1 1fbbd4f02ba8748a6e2e34b5b2f3348d2bc5953c
- SHA512 f1bc1739965ac25e21459ad858ba9d3db24eac1843f8b96621146695d4ff38d6888879e147c04897579198b48b4cbeeca7e65bb38da766f7c4c136df76872b28
- SSDEEP 768:pHzT4jKeYfXyHSRbYlNlG/X/QL3un61FT9zT:ZT4rpS5KNlG/X/QL3un61Tz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\msvcp140_codecvt_ids.dll
- Size 21KB
- SHA256 9f05310a2330ee37b2f814c1d6ef40be553cc5bfd3f301b84dc221160f687f87
- MD5 8b49843d115ecdf2a33a07ddeedeb334
- SHA1 16eaa574161de62e7865f8a05ec0e1fc7a538e2f
- SHA512 78383502b5990be70cf19bfe01e920fadd99d67563576f4c068de75520507687d1ad35529d628d01605118833be1adbb70c5b7e30d3d1c592593f142128f5a9a
- SSDEEP 192:hCo6lWkp020x+xSxMxp8l3V6rWiHJEWUWXePCsnqrSHnhWgN7acWGVy/hHssDX0T:nYp02F80WipEWuzHRN7xkFDR9zc1nJ3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\oem.cfg
- Size 445B
- SHA256 0d111e0260b3c11e1dae2b5328bcfd2d1fb21f15f5b49064bd07e272a8bb0822
- MD5 880dbbc36b6f1d4a6ca9a73419564776
- SHA1 1b4eaca846ca50a9fecb6a741dd19973eee9e557
- SHA512 19980cae5bd279216d737cdabc9e9980c74f8918234879b9d5fe9aef1e265cf426931e9db798e2582399272258e18dc04d817b0dad6557010d04b6ff7a715322
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\vccorlib140.dll
- Size 328KB
- SHA256 9d9011986ff7eb7c709a81bf47af19ab6fa82d03e84d1389bb74a1e41ba9b93a
- MD5 00f4d05e91e67197de3cad5ece83a9d6
- SHA1 36ac9a66f6d29a7e0ac3bc05e885847712a9d6ee
- SHA512 a3b4086278b3b22f1c130a9b4bb9e60f4cb1b270e6d07d2ede1468eefff6b29e6dc0fa410315b4553e29d0c6ec1fd6462fe2b0fae8d455f66586340324604db0
- SSDEEP 6144:v+dqDim64W44od8wyW9I8RbAE2d4b6JD36al:v1Iud8wy6I8zr6tl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\vcredist_msvc2019_x64.exe
- Size 14.4MB
- SHA256 40ea2955391c9eae3e35619c4c24b5aaf3d17aeaa6d09424ee9672aa9372aeed
- MD5 be433764fa9bbe0f2f9c654f6512c9e0
- SHA1 b87c38d093872d7be7e191f01107b39c87888a5a
- SHA512 8a050ebd392654ce5981af3d0bf99107bfa576529bce8325a7ccc46f92917515744026a2d0ea49afb72bbc4e4278638a0677c6596ad96b7019e47c250e438191
- SSDEEP 393216:0+lptVYmfr7yBG/4oyFN/YuuccKU9oxcS:0upttD7yBG/PcXU9g5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\vcruntime140.dll
- Size 96KB
- SHA256 270ba17bf89cc2eb6e6ce536eb78e4614ab5499f653ab7e07fe9e3d33bf3b6e3
- MD5 665b6299eb326f1b4df4633e391a0063
- SHA1 b24371f2a558840851bb5fc9f0626bcd5403fed5
- SHA512 6893e608f6ddcda945d4d3472798a0e6717e3d5d66832f2e45b064a7e61ed468ea458be8d00b721c57ca287475e065083da9b2f30140891a8e1c11120556b027
- SSDEEP 1536:y7XLjIqMoYdgwdpollAvhkCrlgnpdD+7HkYrecbK556j3z:y77mylIhkoQpdK7HkYrecbK5S3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS82B352A5\vcruntime140_1.dll
- Size 37KB
- SHA256 f3754fc6ec87bcf84e05f3287b5de7bd305a30a0e1db7d478cb6353600682784
- MD5 6471b9621e390f710efb731a51323f3a
- SHA1 9ca664e22d37a5244dcffdb3e011a3edcc82d61c
- SHA512 35205e5da319d747a921fbad477d0afa06ed5b28ca98278e9ac5e751fdfb043ea94d423cb8cb5e24a0fbedffea6d85fc094c85bc6d65d0c9a27c6a2de702c662
- SSDEEP 384:5anvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+Xf5CuncS74GtWrNKWG2OHR2:7Cm5yhUcwrHY/ntTxT6ovT7cp6gU9z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\Assets\discord_icon_click.png
- Size 512B
- SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
- MD5 c11cc6a9edff1694a71584413dd47dfd
- SHA1 3b84fbfab8b53db95e8fb1b409193624fc8359dd
- SHA512 bdf3ff3a1b8022521cba870334b11bd9c877b84bf134fc4710f0c9e8fe3703a2604915a24ae6738a3099b7e80f0f5a8d9b161c74fc36ee217e05581d88d728ee
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\Assets\exit_close.png
- Size 670B
- SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
- MD5 26eb04b9e0105a7b121ea9c6601bbf2a
- SHA1 efc08370d90c8173df8d8c4b122d2bb64c07ccd8
- SHA512 9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\Assets\minimize_progress.png
- Size 212B
- SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
- MD5 1504b80f2a6f2d3fefc305da54a2a6c2
- SHA1 432a9d89ebc2f693836d3c2f0743ea5d2077848d
- SHA512 675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\Bootstrapper.exe
- Size 153KB
- SHA256 96283a381475f417d977d1c7dc4b9bd2a7c0aac9a933c3a126cfc127eafe964b
- MD5 c4d1ea205eb18ce3df6cf94aeefad745
- SHA1 c2dbfcbf8325fd01db42e73f5039c275bd3f77ef
- SHA512 cd96d5feef181b2f186e16b8a3310c4060e8f627153e5591524bb8ecaef89884062fd757d2088af54bf93f2a8597b1d40f869ba58941b837fb2b57c8d38b8ec3
- SSDEEP 3072:Le9iuvxmjbpFvB5JBqlMCIVbIo6Y7woFC/:jvB5bqlMCIVbDb78/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS8B269AF3\HD-CheckCpu.exe
- Size 200KB
- SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
- MD5 81234fd9895897b8d1f5e6772a1b38d0
- SHA1 80b2fec4a85ed90c4db2f09b63bd8f37038db0d3
- SHA512 4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16
- SSDEEP 3072:KjDeWjpu716WoCYv8NBa3eSx8LHGYwj6V4NL1q7HOAg0FujFfnk601hWNxK:opcoCYv8Xa3eSqL8j/3AOpNq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_1.jpg
- Size 30KB
- SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
- MD5 efb63876389c300433587a29ce85f258
- SHA1 8eb00659e003a934c8538b6e5a2be65ea097e5c9
- SHA512 3c4a935f949e70199333889ba54870930858e54bf2ee0ac2a27f814710264ae30c474c4cd9e59835cc9bdc9da8c7eb25b963f02ee34767b3738f43988084059d
- SSDEEP 768:/8PY3wdSnzEdbnEnqTE6PBtA2Gi5DTglr3cBt41FD98/AX16gANg+IL02U:/8zygdbEniHHPZBBtsD98Md+IRU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_2.jpg
- Size 121KB
- SHA256 7cc477b38d05c7002621a51d04d2c2d9f943be5115abae1d8bcbd2def49de54e
- MD5 2f0acb01bbfd565f803eff0e12d4f74f
- SHA1 521f2cde14fa7be049ba11336cd344ce335b487f
- SHA512 c3c97c7a2d66bd6c5f901ba06282fbc1c7cbf8a62d9b3e5c1f63882113addcfc9dfefcf03c6abe96c52bc4c2c4e09939e35a1e8cb9615a82024e0d50d9dd5eef
- SSDEEP 3072:MO0BfDmmSqd4QOELf8PiMZxBrAk40vEGJ/w7hlh:Dgx74ELf8Phz5w7h3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_4.jpg
- Size 93KB
- SHA256 3c947b7946c9e92318880bb5d31fb600b9d32476fade9ed0ee9c9c7c714f6a57
- MD5 3510f0529819708a1594e65e90148be6
- SHA1 0d14b8237d35a17e97135ea6eef03e4851b00b6f
- SHA512 53441e7bf99d462a62cf50c1151bb73702fe14bfa638630995aa1e119498c23cb11ff5bbef8e46310215515ed3284d6d64687a18a2427b40e212409cbad9daef
- SSDEEP 1536:zbmQq2PiLaiUxnCQoD7C+nU4QhvTI96DIwS40ZTUfrqOzTZDq0Re7BasyRPPameX:fvqmiUxCQq7C+UtNIwSRZTkrHDq0RetH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_6.jpg
- Size 87KB
- SHA256 423dba72b462e2595f608bc6e66bfe35869aa5b240791a30432b89b3ab0547ba
- MD5 ffa3db7ab9e75972e5e8ba1f9f2b61de
- SHA1 4229e04326e71bd1eae100377316e6b3c6206901
- SHA512 2afed67571e384f79d3d15ce154166f27c4e5c12f36e8f1a4f497d0d2de1b64d0795692a7ab48bcb71278b3ed67dcb97520ec79932560e348c1d4a59ca8e2d90
- SSDEEP 1536:dlLWkgXW/yGZj6J7G/n1pstd/jHsmx2QlzT+uS4xzevz194od6mHB:dlXgXeyzBGtCv/jHse+uS4YLhfB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_8.jpg
- Size 104KB
- SHA256 1ab4953190aeb9e7e5c2cb7d58aa13508906d982c2a8435ba50c709cd6b597c8
- MD5 55324be215073dbb15e94c8badac14df
- SHA1 175679549fba2d1fe5cde27462165e31464cab01
- SHA512 fb60240ed1d7dc2735a5f458ef2f4361521d8c1ea9e583280bb0c29d10e5a66afbf63113e5b794b559d1db7b29dd32e0d403f971bfe4740c5a68c942455acf9e
- SSDEEP 3072:4kzUwxutc9rdLmcZM65sHdjezHFRWpsWj7ZBTgnJ:4ycwrdLmcTOZsamWDsnJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tmp9834.tmp
- Size 1KB
- SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
- MD5 a10f31fa140f2608ff150125f3687920
- SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
- SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsn9DB2.tmp\BgWorker.dll
- Size 12KB
- SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
- MD5 36c81676ada53ceb99e06693108d8cce
- SHA1 d31fa4aebd584238b3edc4768dd5414494610889
- SHA512 1300de7b3e1ac9e706e0aad0b70e3e2a21db8c860e05b314a52e63dd66b5dffdf6be1e38ab6ede13bfd3a64631cc909486bf4b1403e7d821e3b566edc514c63c
- SSDEEP 192:W9Hsl/fIYiYF8LgaL2AMkKieowU+noPOJB3hy2sE9jBF0NyZKlH6JqEHma:LIYiVLpMNiuPxh8E9VF0NyZ6aJqEHN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsn9DB2.tmp\System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsn9DB2.tmp\nsDui.dll
- Size 3.0MB
- SHA256 9be7551a4db8610cf3add7fcd05f1d22a0ca2bb9254945ebad812e2b59a2c500
- MD5 ac0b9afa2decea46e7f3a067bacbeac5
- SHA1 96f4c569b3a87656272e9717fb4345de863f109e
- SHA512 8622ab7168275aa197ad291c02f16ac9bd4b2624061494100a996d43f19d8b3b7460118e18fc2f316b0a560222db55b9ba9629ced65afaa882fe2d073932c832
- SSDEEP 49152:Ug3eJdDJmTRf9c3F3YshhAzxeOIiu2mhdgWuNMrr5vyxLr2h9:UOVcKsh6zgV2mhKWIMHFyZ2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso836F.tmp\Registry.dll
- Size 24KB
- SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
- MD5 2b7007ed0262ca02ef69d8990815cbeb
- SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
- SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
- SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso836F.tmp\StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso836F.tmp\WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsx8C72.tmp\LangDLL.dll
- Size 5KB
- SHA256 20e642707ef82852bcf153254cb94b629b93ee89a8e8a03f838eef6cbb493319
- MD5 109b201717ab5ef9b5628a9f3efef36f
- SHA1 98db1f0cc5f110438a02015b722778af84d50ea7
- SHA512 174e241863294c12d0705c9d2de92f177eb8f3d91125b183d8d4899c89b9a202a4c7a81e0a541029a4e52513eee98029196a4c3b8663b479e69116347e5de5b4
- SSDEEP 48:S46+/+lTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8m0ofjLl:zMluPbOBtWZBV8jAWiAJCdv2CmHL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsx8C72.tmp\System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
- Size 10KB
- SHA256 fcaed92f716aa5940d9aa61a0ed37d4e9727a6f4c107c2f7e82c3eee600d4502
- MD5 15bf73213a52bcd61599940529421002
- SHA1 2977800eedf2ccb186ffb618bda332f19d091e80
- SHA512 cd4b5a52862dd4453149d37ff6c05dd44353bddf04f6b5b8cfbaf4944f6bb519919fea08bb305f0292a33a525a275946059a212bcb74359a5a0462645f4bd4a3
- SSDEEP 96:D+okcrQer2FkrN+okcrQmlhFrVP+okcrQRWFko+okcrQnB+okcrQgF5:CosM9oosm6os/osEosm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
- Size 10KB
- SHA256 433f43fb5969b161d4cc6d8f34ff083a870fe65839b0a80fb593b8897d2e44f9
- MD5 71e0832ec82d02993ee9d66cfe955c48
- SHA1 12b5589814c99391decc51e2a78c63195d5e44fd
- SHA512 12613782caf5e883c5caeaaf91c6c947a46416db58c38a72e296ccf0349ab01384b2b85604c81a4d9defeda868abb606a4d82790eaa0985539602a47f5778623
- SSDEEP 96:L+okcrQL3W1FK3WUuU+okcrQer2FkrF+okcrQmlhFrVg+okcrQn1+okcrQgF5:aosc3osM9wosmXosgosm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
- Size 10KB
- SHA256 183b3f9c66270dee29e918e8bdde6ed39f73e2e122d57b99983ffa5c22323285
- MD5 70fca7d0e4f854f2d739dff91e537abe
- SHA1 24de2e8f215bb2690e2a3a9749183bc1951d80cb
- SHA512 0be159fea04e999f0e36fca4a45cdf58a75e6a611a139a2eb72a20c7a2a3064e2bfd25c8e0d7c1f978ba923df197ef542b6e7e69492abce34b5e8b02d100ffd6
- SSDEEP 96:E+okGrQmlhFrVo+okcrQRWFkk+okcrQe+xF++++okcrQna+okcrQgF5:nommfosDoshFVosJosm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
- Size 10KB
- SHA256 cce591a7352fe1a107ae8e095fea9e70038225a1003d88f4f0da43a8931cc69a
- MD5 4fc1b609d561823519dbc105efd00991
- SHA1 9cb2125f71ffc49c70490ed164a62a374c59ccc8
- SHA512 3b1ce6ded17a860d882f533654e5a1f95c03649b336115808e213226c40be59438b7c05d358e4299780cc7d8180d3df74a5a63d618746eceb8e72adcd857bf11
- SSDEEP 96:F+okcrQABDRHOF0oDA+okcrQL3W1FK3WUuP+okcrQer2Fkr9+okcrQny+okcrQgX:wosuy7osc2osM9YosRosm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\bluestacks-services\Network\Network Persistent State
- Size 614B
- SHA256 e06a749bd94cb317dd0bf8a9c01f81bcd0ba75820d86788151b4607e61406569
- MD5 200a1201e8d2ea4f717c1a5f6430ad37
- SHA1 c0c4c5f67f8ae5ad79f6ebfcabb65977099c0ff6
- SHA512 087d53b684c60d0cff33b8cdd00e218b8b74dbff6602aa6a2edb9ab58ca5b313cf8e78e7cc3de167ebbfd425b4e4c51b5744de50a8b866e0d5716789687817b9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\bluestacks-services\Network\Network Persistent State~RFe64b017.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
- Size 1KB
- SHA256 c4cc511596491aabe6992b08fdd5f3037aab0f5ba49b37338c71cdc9190c55f4
- MD5 f61a22e8c6f863b9686a52c05dbaad00
- SHA1 81eed803172c9b31c347ccd77b44dd85a731ffd1
- SHA512 448720282e654d9f8e1b9b1a50cf175f02a857e14ceb5fe113be54e89eb7a14d11fac93f40078ec0729b4a99910dcbb0756e604d0f319be1ffd11187cab478bb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
- Size 57B
- SHA256 4ae36905ce1f47bdd0bd297e2e2973c6e558c24da7336a8b598b0f20faf9e6fd
- MD5 278d0a0cd0b21c256d3ffc3449f9f8de
- SHA1 c543697d38d41c8cb86e2117c146626408d3b162
- SHA512 081c3566c1501260b137217575fdea9738ffc55f282feae667cc873f4e3b729c34da4f75d7fac6fe4e86385aa005888b694ceeffa498f377a0eb0f914b1b356f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
- Size 119B
- SHA256 c5ed332256e4d9dc891b2e0d04ebec05edc037623a0329c18c10d494c8dd909c
- MD5 572d694a7f899aab46423f33c50ce840
- SHA1 a165ff12819f23a87ec2496e54470879a0cfebd9
- SHA512 2b0f38bbe96b6748eb5e7a8c4f2524ca1f45c6dcf0b434f8023fcf47fb7e40eb6939aa581eb04b86a29ffabc37db373dbc72842511c9f321dd30a3a824877c8d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-657846649966e88f
- Size 92B
- SHA256 83ed76ff20e75cbe167d804a306f5a4c07107adc641a2283daf9a38f92f96f75
- MD5 bf45b3cd645e52f1413bfc03776cef66
- SHA1 c85004e7d4706b6dec4e1466d6c95675b9607463
- SHA512 2c658e391193f55043d1be7f6bbe25133802089bf2c282627d03d54d86de7c88a99fcac5011eab5766363b7bf9f331755f2573ae66e2fff64ccb6f70a7133711
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-6578478214dd42c1
- Size 2KB
- SHA256 42f4e3e0c236d305fcefecd71275fc6991bffa9a53a73ba54cf8b2e1dacbebde
- MD5 03c5c0ad06383f93e135e913860672ed
- SHA1 7a7f64cbdb31bb926c015d43b542db7b5215d84a
- SHA512 18fc71d4245029916fd28531d6c33df2510fd9954013bc5b54a24165a7bcfab2437ba5d4983933a32af9ef84c03390b7b9e3e73e0d24a905568f6de6c7c8b483
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\Roblox - Windows Installer.exe
- Size 1.1MB
- SHA256 a767a7cb907e63db840ddb756c15e41f3ae1a80725f5b8415a0aa580eb7de537
- MD5 6440425439bf93179bdc8e3306ec2a92
- SHA1 85d9509994e6b9227f02d021779c709f4d632a45
- SHA512 a35c3a387a9ef9ebece33e3c692d6f084f26bd1ad397bcbf5d76165c0b997792de4d0b4a62b528be72f8f5d5a3965e5c469c0e859eb0d9486344fa21c9f687ab
- SSDEEP 12288:6LQP2cqyCx+Tac0RDffXJjyYpCWoNHSy5viczgJ00Iyggot+TRofXJjyNpX30:Dc+2DR7BWYpCWo440UdmoBWNpX30
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\Roblox - Windows Installer.exe:Zone.Identifier
- Size 63B
- SHA256 e4952ff0cb3e37e22753a1e22be03d635b5de24b3e08c422a2b7e3f7c09b033b
- MD5 cb5abcbb271b7964ebf7679ddb729871
- SHA1 f22e422946a570931c2b23ff2184859b89898dd7
- SHA512 abe6263f71802829a2b009bce85904cd6dc0fed8471ebc6a23f190c072bc5bc5c6a8e5ba8630bde1eadf647220c59a0bfc15fc16bce98ef1409b3d64fb044644
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\Unconfirmed 533884.crdownload
- Size 927KB
- SHA256 7ff80f73f0a47e65d4e36d243472c5745b46633a7c5fcc241cef927e857b96d7
- MD5 c69114f4eebfdf13f3e627f69e0141ea
- SHA1 f291811df290483a21e2e9dbaadebe4464f3e1c1
- SHA512 6713e751a41f296462ec14f7645925ab9ff5401077a88b4730912fb531732e1eabb84d880940d7afc503c0718b3e4ab7aa775e57e732a0ee931d970628a9d65a
- SSDEEP 24576:nivtCXWeGKx/NGzTukzxNDL8CbDbeSe9anS:itCXWPM/m3zLXb1e9anS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\Unconfirmed 686269.crdownload
- Size 12.0MB
- SHA256 cc96db7c48a2abfd117657d5dd822e91b43f31205047d56bcce1a82a60d1f9d0
- MD5 50b590c99323b54542f1df9cb9fc9899
- SHA1 d1cb3a47c6a63b178a15880dcaf6b2ea7b01e7e3
- SHA512 bfd8923ec14d2504a819fc402a59f7d1fdcfa86cb8a377d6276071d9b6e141581beb3b2fc768782a5728789200759a3dae1b342b47023ee085e7c626486a5ce9
- SSDEEP 98304:3e/nOITscod5DCasbM0lUs0D3TOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTlK:3ef1scesbM06sgObAbN0h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Videos\Captures\desktop.ini
- Size 190B
- SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
- MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
- SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
- SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
- MD5 SHA1 SHA512
- Path C:\Windows\System32\storage.json
- Size 5B
- SHA256 1245552f1e44239aa0dfdc7aa0af24ac1e588d66abaee3ad10ddcb82a229f2ef
- MD5 75d803935059785011954267bdb0814c
- SHA1 2e7c964d7f6d9abae2aee4bcfc2c3a64f9fb4b38
- SHA512 6bd607670a9f1702c193f672802678e790bbf3fa385043c08f5eeea7ea7598ee20cc8660f36711e1ecce7c29090b505a938b5b4ab23d1bddad7d94f2c22f39e7
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1057171067\manifest.json
- Size 116B
- SHA256 a1774d7a0ac3f90fe6fbed83045377b838af48811380d5ad88809222168c22eb
- MD5 6658e8d6901ebdb2b695444e181b6348
- SHA1 34c4bce8c106ad7c8ba03d56f702b868a9ae67ed
- SHA512 615aa2777141a88f0d0904e7c73de3affadab0e7bff76fd11b98c8970f9b44fff5186bd4ca721c8960f1b57b4e35323826d52d5fc09d10a25b21b4ab46167d70
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_2027170787\manifest.json
- Size 1001B
- SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
- MD5 580786a5ec9eb650dde3e0e75db8588a
- SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
- SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\Notification\notification_fast.bundle.js.LICENSE.txt
- Size 551B
- SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
- MD5 7bf61e84e614585030a26b0b148f4d79
- SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
- SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
- Size 1KB
- SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
- MD5 8595bdd96ab7d24cc60eb749ce1b8b82
- SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
- SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\json\i18n-tokenized-card\fr-CA\strings.json
- Size 2KB
- SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
- MD5 cd247582beb274ca64f720aa588ffbc0
- SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
- SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_64520086\manifest.json
- Size 121B
- SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
- MD5 8083caaf7f5bc5f01ede464e68db1c7e
- SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
- SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
- MD5 SHA1 SHA512