Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1199s
  • max time network
    1112s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/05/2024, 12:14

General

  • Target

    http://delta-executor.com

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks for any installed AV software in registry 1 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "http://delta-executor.com"
    1⤵
      PID:612
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2316
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:2956
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2980
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4500
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:2568
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2616
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4556
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5412
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa864c9758,0x7ffa864c9768,0x7ffa864c9778
        2⤵
          PID:5476
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:2
          2⤵
            PID:5664
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
            2⤵
              PID:5680
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
              2⤵
                PID:5728
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                2⤵
                  PID:5780
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                  2⤵
                    PID:5800
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3972 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                    2⤵
                      PID:6136
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4588 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                      2⤵
                        PID:4352
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                        2⤵
                          PID:1936
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                          2⤵
                            PID:3144
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                            2⤵
                              PID:1116
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                              2⤵
                                PID:2100
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5040 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                2⤵
                                  PID:5136
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5052 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                  2⤵
                                    PID:5220
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3340 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                    2⤵
                                      PID:4804
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3568 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                      2⤵
                                        PID:1248
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                                        2⤵
                                          PID:2644
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3400 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                          2⤵
                                            PID:2688
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4888 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                            2⤵
                                              PID:1876
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4956 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                              2⤵
                                                PID:32
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3320 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                                2⤵
                                                  PID:2192
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5352 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                                  2⤵
                                                    PID:784
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5544 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                                    2⤵
                                                      PID:4540
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2380 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                                                      2⤵
                                                        PID:5340
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5452 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                                        2⤵
                                                          PID:4980
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5744 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                                          2⤵
                                                            PID:4768
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                                                            2⤵
                                                              PID:4532
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6180 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                                                              2⤵
                                                                PID:844
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6220 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                                                                2⤵
                                                                  PID:3468
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                                                                  2⤵
                                                                    PID:1296
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5920 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                                                                    2⤵
                                                                      PID:5028
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6160 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                                                                      2⤵
                                                                        PID:4528
                                                                      • C:\Users\Admin\Downloads\Delta V3.61 b_82497757.exe
                                                                        "C:\Users\Admin\Downloads\Delta V3.61 b_82497757.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:3736
                                                                        • C:\Users\Admin\AppData\Local\setup82497757.exe
                                                                          C:\Users\Admin\AppData\Local\setup82497757.exe hhwnd=459030 hreturntoinstaller hextras=id:d8d090d10951db6-AU-KA1rz
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks for any installed AV software in registry
                                                                          • Modifies system certificate store
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:5988
                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:6000
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
                                                                              5⤵
                                                                                PID:5436
                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                  tasklist /FI "PID eq 6000" /fo csv
                                                                                  6⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  PID:4184
                                                                                • C:\Windows\SysWOW64\find.exe
                                                                                  find /I "6000"
                                                                                  6⤵
                                                                                    PID:380
                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                    timeout 1
                                                                                    6⤵
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:4628
                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                    tasklist /FI "PID eq 6000" /fo csv
                                                                                    6⤵
                                                                                    • Enumerates processes with tasklist
                                                                                    PID:2632
                                                                                  • C:\Windows\SysWOW64\find.exe
                                                                                    find /I "6000"
                                                                                    6⤵
                                                                                      PID:5712
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 5
                                                                                      6⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:5644
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
                                                                                  4⤵
                                                                                    PID:4312
                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                      tasklist /FI "PID eq 5988" /fo csv
                                                                                      5⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      PID:2208
                                                                                    • C:\Windows\SysWOW64\find.exe
                                                                                      find /I "5988"
                                                                                      5⤵
                                                                                        PID:5224
                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                        timeout 5
                                                                                        5⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:4140
                                                                                  • C:\Users\Admin\AppData\Local\setup82497757.exe
                                                                                    C:\Users\Admin\AppData\Local\setup82497757.exe hready
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    PID:3648
                                                                                  • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
                                                                                    3⤵
                                                                                    • Opens file in notepad (likely ransom note)
                                                                                    PID:4756
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5608 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                                                                  2⤵
                                                                                    PID:1924
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=6272 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                                                                    2⤵
                                                                                      PID:5236
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6624 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                                                                                      2⤵
                                                                                        PID:3612
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6768 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                                                                                        2⤵
                                                                                          PID:4228
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=4708 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:1
                                                                                          2⤵
                                                                                            PID:5004
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:8
                                                                                            2⤵
                                                                                              PID:1244
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6992 --field-trial-handle=1772,i,8066216705780920256,11002614248599565189,131072 /prefetch:2
                                                                                              2⤵
                                                                                                PID:4164
                                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                              1⤵
                                                                                                PID:6064
                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                C:\Windows\system32\AUDIODG.EXE 0x418
                                                                                                1⤵
                                                                                                  PID:4188
                                                                                                • C:\Program Files\7-Zip\7zG.exe
                                                                                                  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap32165:80:7zEvent18870
                                                                                                  1⤵
                                                                                                    PID:5184
                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                    1⤵
                                                                                                      PID:4272
                                                                                                    • C:\Users\Admin\Desktop\Delta V3.61\Delta.exe
                                                                                                      "C:\Users\Admin\Desktop\Delta V3.61\Delta.exe"
                                                                                                      1⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      PID:5976
                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                      1⤵
                                                                                                      • Drops file in Windows directory
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:3324
                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                      1⤵
                                                                                                      • Modifies Internet Explorer settings
                                                                                                      PID:4676
                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                      1⤵
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:5024
                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                      1⤵
                                                                                                      • Drops file in Windows directory
                                                                                                      • Modifies registry class
                                                                                                      PID:2784
                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                      1⤵
                                                                                                      • Modifies registry class
                                                                                                      PID:5072

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      d2e7bad999f306c2b3883a9d51a1aeca

                                                                                                      SHA1

                                                                                                      4edbcb14a59f3792f9268378ad3b9485856139bb

                                                                                                      SHA256

                                                                                                      9560bd65c420c5a9037d0f95a0e3b70d2938e6f9c7436481387ef897d792eb1d

                                                                                                      SHA512

                                                                                                      36c8055a498cace0836326a0761e96b1fc7287e63ea1fe9ad5923466b01522223a6f0f4e25a79daa1fc34da7fd68e7e5f6c2d4f469cd6dd9c6a23088e837826c

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      0fa0ed2fb08708ec134749e861a893e2

                                                                                                      SHA1

                                                                                                      fc0b86cebeb1c605dacccd4095890433e4dfe156

                                                                                                      SHA256

                                                                                                      67f302d72125037f3f2f8cdcea2ce858539851902232ad468fb819a7380e3e37

                                                                                                      SHA512

                                                                                                      7866b0d038ca5f19a234c4d6fe8d2484639ce57efb2400c15f1e962b42efb5bfb92686a4365918cee682d68501859c7392237128b412d5528b0afd958a8a4c16

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9ceec8e0-eaa0-4f3e-a9e1-9a6bd0974285.tmp

                                                                                                      Filesize

                                                                                                      1020B

                                                                                                      MD5

                                                                                                      09d67129af6faf92a2a926d9c4716e87

                                                                                                      SHA1

                                                                                                      74de08ff453e002eb169fa2d639175ca25c0b40b

                                                                                                      SHA256

                                                                                                      b142ad580dbb4ef4e7cca9dcb1ffd40460218992d9aa43f7fffac592474a4b45

                                                                                                      SHA512

                                                                                                      20db68453e99484e0211202f1a4b642ce6177a565b77ef9439c62dd09fbd282bcc9ba0df575228585b67788c93a79a1acaa642b8279c78ec787637f8bdac4235

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      fde3406c9798a3d2ab62fc2758e0d8ab

                                                                                                      SHA1

                                                                                                      b8b0230c4a7884e1d923192ba58b9ca6d705fb0a

                                                                                                      SHA256

                                                                                                      8b5b757e39758402ec3cc4dddc1d5d21b3b36e479e1672abc25d5b9fb9066488

                                                                                                      SHA512

                                                                                                      19e90e7890da2d834b898199ef5d871b8a130dd56fd8a60833445fcb30e3d4d4d38cfd90e25e13550f2ea97681096abcace46315ef2566442e9b0b35d97f3fe1

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                      Filesize

                                                                                                      9KB

                                                                                                      MD5

                                                                                                      1820b1f663f54a80b969a0f251cfea4c

                                                                                                      SHA1

                                                                                                      c51e4c5201bce6d055aebe4286a54b9fc0a70138

                                                                                                      SHA256

                                                                                                      007fc9ea68ebc2070f5005064be779dcb41115479a18ef315971fc801ccb04c5

                                                                                                      SHA512

                                                                                                      e0a6e2a9e21d543f4f497accdf502398c4d5621d7e214c7731c3237026c0f5b5d91b74193d3b887957c796eeb1ad30a37b757ac7d005bd1023d4e2e1b764be05

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                      Filesize

                                                                                                      1018B

                                                                                                      MD5

                                                                                                      3acb107b76d815f27bb173d93776144f

                                                                                                      SHA1

                                                                                                      6f30406bce666dffbad12655808b7c67e82a4e06

                                                                                                      SHA256

                                                                                                      d57564db706bc52db016201e03f69f3055d903da6bff61cd2184b45922c4a2d3

                                                                                                      SHA512

                                                                                                      9bc3ef79b37aae277ee39305bf949f87d8c27c56d44c290b8e78f420c16c72f4058b5780f89f0c4547b7264e5a4ccaf6ec8f48ac3335ff962c7e972aae685a30

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                      Filesize

                                                                                                      1018B

                                                                                                      MD5

                                                                                                      5aba602098e7e4b3cfeb7cd4612e9e9d

                                                                                                      SHA1

                                                                                                      36fddbd0a34bb23f78a7aee1e1320692d00c924a

                                                                                                      SHA256

                                                                                                      8055144abcbb958550fe4dc6adf486b76fcb22926343647c1e3773a26b4ed6c7

                                                                                                      SHA512

                                                                                                      d31ec1ad488c2bae24bb58dd9b617b1338f5aae96f7ac94837c3c91ca2d11ed03bd51baff53f2b21af283302ee4e3d6cc3ab881b04c5037e70224f9cb281c87d

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      1e17214b54e95f63c7c34488372692e6

                                                                                                      SHA1

                                                                                                      8ac6b442823d1753c89b734e874671b9abb3eebb

                                                                                                      SHA256

                                                                                                      f6beb6616e783e8a62754246a2e43aa465503a19238a2339a974396b208d0a7c

                                                                                                      SHA512

                                                                                                      e7da1276bbbfbcbfe63018d8ef56a74718c2a1d388d5c95c9b998d1e23a9e2d853cfe45683948f6e6e660b6056ca73213cfac5448514d62827c4821cd6f178fc

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                      Filesize

                                                                                                      9KB

                                                                                                      MD5

                                                                                                      57259c49b0cd24f741e65d89491fd216

                                                                                                      SHA1

                                                                                                      0a41117b74939108811d91c616bf7e71a9eeb74a

                                                                                                      SHA256

                                                                                                      38216d2cd613013f55c2506818be7780704527470f5c5b72bf3ab9735599c769

                                                                                                      SHA512

                                                                                                      63d4e98e7507ce4fe1fda966da72c8e03e24175d8abba31338d5bb2512da0601fcb82106806e8c5fe044b238699eb694e04366de1026d9796a42ca1d11bb433f

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                      Filesize

                                                                                                      1020B

                                                                                                      MD5

                                                                                                      a982d1bd4610693076ff8251466933fa

                                                                                                      SHA1

                                                                                                      74404e9153a4795bd63fcc3d40bafe39dbb238bc

                                                                                                      SHA256

                                                                                                      fd76058625a016b0d1a4eabbcbe2264d9b2c1441be2d6df00a172e1f79b24b67

                                                                                                      SHA512

                                                                                                      5c8df6f7ec6cdc99315a2d70d09e614277bd05c6480dd3b4a29c81dc4c65811c902e72b2597f146720653c9d473f3abb854e2c68aaaf846697c30fd23de137da

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      16c15004268eb3e4e7dd85f92e906f43

                                                                                                      SHA1

                                                                                                      90c8fea5dd4344a2c1a91b5f887c8919728bd314

                                                                                                      SHA256

                                                                                                      d2c913e065fbed8b9e63d6e995d98ee66894937dd9bee62e50bd99ce20ff52cf

                                                                                                      SHA512

                                                                                                      1d7520ee2725230b49b91ab3534a3561388cc35673aed6f8125540528c105b5c8cc17d60baccb7ea4a717d652fd34ead994786be932b54b07423d6b8b2845c12

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                      Filesize

                                                                                                      367B

                                                                                                      MD5

                                                                                                      f5844272d6c6ff0a47bfa4341539331b

                                                                                                      SHA1

                                                                                                      11fae0609ed908adc9ff074f0f5fea79d915f554

                                                                                                      SHA256

                                                                                                      476858d068993cb7dbdccc598b412db422b8b87e0a892e666276f638684b451b

                                                                                                      SHA512

                                                                                                      550f39916c1fda00e55226aa8e5d366b578399fef34227f180a5ca73e586799c7bdf005fa3d4f4ce2cc071eec2f67b3a1aaad3d87e181d6b48fce0088ab8aaf6

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                      Filesize

                                                                                                      1020B

                                                                                                      MD5

                                                                                                      f91bbcc8b1629bc6e4543a2d25e330bf

                                                                                                      SHA1

                                                                                                      a2ef73a98ca173796d137e0521ccc5ce7e467b46

                                                                                                      SHA256

                                                                                                      1e24f991a39c53ca8156e01c82a7caf1d7df6e6c6d8324a6d1629ca4f233d5ab

                                                                                                      SHA512

                                                                                                      efb1cf3047d8a929555b273659912326557161f7ef6c2f0b30f8bc906a6b529aef31707da01cdb853b0e4adb9d951b64cb4a86997b2ffd7ce3d46ef95d3acb18

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      6KB

                                                                                                      MD5

                                                                                                      10cacfc3703988d5e120cd233ba38df3

                                                                                                      SHA1

                                                                                                      fb90c3130c362c98199b3582e52a95d89071d7d2

                                                                                                      SHA256

                                                                                                      ac69ba9c08482f17830e37d3efe288469bdbdd994686ed68005f7392b0061e00

                                                                                                      SHA512

                                                                                                      bad0d66fb13bf9d7541f5ca65a84e6b60e9c55876263648f050f618fcf4c00c22076f7c4a97eb0235bc2b060bd9fac6e44202cf621e10c9cd58d2e1cc233f0d7

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      6KB

                                                                                                      MD5

                                                                                                      cbc949fab88b1d63caf64ef93a7bd225

                                                                                                      SHA1

                                                                                                      85ecea04475b2046962a585e04eb7b90ce5cd8c7

                                                                                                      SHA256

                                                                                                      4aa3a57ea337fb0555db7cb7434cc6bb305f364820ef3ff54a398b54600e5bd5

                                                                                                      SHA512

                                                                                                      9f210c818a91dceb79099f83f9aa66d9ce6bb9b7f862d098226383cfbc55f24f2590dbcd8c75650858c3f08fbd04e2172df8acefb24e0a76e2de1246c537e91f

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      6KB

                                                                                                      MD5

                                                                                                      dd0d70eaa081cf365918be333e805471

                                                                                                      SHA1

                                                                                                      30e6cce693365c24f5a46ee1d8d9441c3c72e9f7

                                                                                                      SHA256

                                                                                                      1b491a8c033748902e8245958d7746741c03409323d505962154f2b1278f3f2c

                                                                                                      SHA512

                                                                                                      3aa5b84b0cfc9c3cb1c825e4bb3ada6993c6ebae11570023461a30510080008659f7557a8f0a68efc1aa31ab8f3c80b793cec9f35736d2b8ede929b6314b42af

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      6KB

                                                                                                      MD5

                                                                                                      1b3b08633ef7459f42cfd004ac3c8402

                                                                                                      SHA1

                                                                                                      48d00cd7d40a24061dc82069f5f2c894108f3419

                                                                                                      SHA256

                                                                                                      dc7394f5feefde6ec985ce46fc4ba98cd318c4c527f4652320fd144667de2a66

                                                                                                      SHA512

                                                                                                      e64e8597d1669a4f1cbd72aa3030c3f267c4d3af838e4601ea7432733c671e42121687f8a280434bc823a630af7500f712f06f8ce6a6b6363ed708a5b4d348b7

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      6KB

                                                                                                      MD5

                                                                                                      6b6ace1511648d05b2fa1ff068b545b5

                                                                                                      SHA1

                                                                                                      7b3b53df709d806cbedcce4b425aff22afdfe32e

                                                                                                      SHA256

                                                                                                      f5f6350ee9617163cf83c68cca472f2e315dc3278e36d3b5afe142bca8926275

                                                                                                      SHA512

                                                                                                      b836f4bb9ebd5b01f156c30b468a6a0b87db96f10dc4c87f6d93f1dd569c764694f05d7e34a8f8ca39221c1f342fe88a12060b6432cba8b206fe273b3f2a44da

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      921f235f44378c0ca824dc82b69050e0

                                                                                                      SHA1

                                                                                                      1fe3996f3ee0903d38dfa69fe059e205d5fe29ab

                                                                                                      SHA256

                                                                                                      5f583bd5860460003b3b1b74ec0e5a789c9bdaa8a5aec09ff6058542ff1c065e

                                                                                                      SHA512

                                                                                                      bc00438aae0c47ad6431717d7c9cf6d605467046ffa689626ff74e19bb6bbc8328c2fcaf7852232919c157b8cb906518b91310614db1fbd13b6f6103dc87c6ca

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                      Filesize

                                                                                                      12KB

                                                                                                      MD5

                                                                                                      c19151d8b0b6ca35548716c945d6945c

                                                                                                      SHA1

                                                                                                      a2f5360a62e45a4784a186143db22cf2280b5573

                                                                                                      SHA256

                                                                                                      3badcc95ce6200566a8a9e5724ad0c086ed0198d3ff02721892ae2e41d23eb69

                                                                                                      SHA512

                                                                                                      1aedc6720aec24242706f9ac0e5c73220a9bf1b0324a121b715751b2be7b2bfa580d132395c1caaeabe6da875b165a7fb7b4238e843ca493b5d864f78d27910d

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                      Filesize

                                                                                                      272KB

                                                                                                      MD5

                                                                                                      87596e7c389ec372fd6db63e78485958

                                                                                                      SHA1

                                                                                                      4e2645dddd236389d8e0786c96cd9225a96f543e

                                                                                                      SHA256

                                                                                                      abdaadb717f3b255bf7e6ad92b9ccccde6f7ded370ca36e2d38e8b45522c71f9

                                                                                                      SHA512

                                                                                                      bd418b4a985464adcdebded73071aea710ea676d757ebae95c3355272184b66e1b5d6fba7002493002eeff71ad3598ed16dd59581bd7b0d163952cc4927f8f4b

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                      Filesize

                                                                                                      272KB

                                                                                                      MD5

                                                                                                      3f05eca364f1e7142c351cb33c377978

                                                                                                      SHA1

                                                                                                      88a73498f951bb7d55a52d206129a3a7c407ce6a

                                                                                                      SHA256

                                                                                                      853f15edf98cb31ab31776d4639fb9d6c8958df93401d99e49a6e58702d934cd

                                                                                                      SHA512

                                                                                                      72e5ab4ce24443f3fb366ce389919167b99764eb1cb3d0453afe9d8e73693f33fe857c0b3a268b33ff0b93602610714ab1e207da994ad4e99c1f6f9a31deb189

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                                      Filesize

                                                                                                      99KB

                                                                                                      MD5

                                                                                                      623e4fc24aee5e13f45952247c1961e0

                                                                                                      SHA1

                                                                                                      41387d92228a9df582765837a160c32836d004b5

                                                                                                      SHA256

                                                                                                      da7ee83cc5f32c6a6c49512165fd507ed142a08a350427110871861982fbbf40

                                                                                                      SHA512

                                                                                                      8015a244b03205429574d43363dde8c4cd481b9812f358fe539029716eae76dff79473ba8e306a802721924860c745616d3f3e7ba12187d37acf762155c110e3

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                                      Filesize

                                                                                                      113KB

                                                                                                      MD5

                                                                                                      f07300d126c9b6b973f85cfddcd85c06

                                                                                                      SHA1

                                                                                                      9f058b3ecf6da97dfffc3a1f9ecee96b80cfe5a8

                                                                                                      SHA256

                                                                                                      27e4b8c1c7b7a6a69d5515d977c5607074eecd3f30f6a671ec63a4bbcf6121ec

                                                                                                      SHA512

                                                                                                      aef6304fbe4e57ba6ffd000a59ea23bd487db55eb1a2a8298eb35d38c5a354ce7f5c7a23ccf31548da3145e1c695ebcbaa0e5cff2f6d7b357d01f247d1ca0e01

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe585dab.TMP

                                                                                                      Filesize

                                                                                                      92KB

                                                                                                      MD5

                                                                                                      67ce82dadf0b3e9fdeb87195f767b031

                                                                                                      SHA1

                                                                                                      8ac99701c874af3bb84e29a5b9f778f44381e238

                                                                                                      SHA256

                                                                                                      5ddd4126489874cad7c521f9dccbe77305dbff2d7989c565faa130943c992464

                                                                                                      SHA512

                                                                                                      b67bbc3fa5b43f93a369814b11cfd8af81dd6cf48ab3a456aeff4196d1b5354959888656d04fff102c04017ea97420cdfaf21f081a0d03e9d87d78f6fb161cd1

                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                                                                      Filesize

                                                                                                      2B

                                                                                                      MD5

                                                                                                      99914b932bd37a50b983c5e7c90ae93b

                                                                                                      SHA1

                                                                                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                      SHA256

                                                                                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                      SHA512

                                                                                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ORZAXET9\edgecompatviewlist[1].xml

                                                                                                      Filesize

                                                                                                      74KB

                                                                                                      MD5

                                                                                                      d4fc49dc14f63895d997fa4940f24378

                                                                                                      SHA1

                                                                                                      3efb1437a7c5e46034147cbbc8db017c69d02c31

                                                                                                      SHA256

                                                                                                      853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                                                                                                      SHA512

                                                                                                      cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      1bfe591a4fe3d91b03cdf26eaacd8f89

                                                                                                      SHA1

                                                                                                      719c37c320f518ac168c86723724891950911cea

                                                                                                      SHA256

                                                                                                      9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

                                                                                                      SHA512

                                                                                                      02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\C7ND021V\favicon[1].ico

                                                                                                      Filesize

                                                                                                      23KB

                                                                                                      MD5

                                                                                                      ec2c34cadd4b5f4594415127380a85e6

                                                                                                      SHA1

                                                                                                      e7e129270da0153510ef04a148d08702b980b679

                                                                                                      SHA256

                                                                                                      128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

                                                                                                      SHA512

                                                                                                      c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\PBYWKLPY\suggestions[1].en-US

                                                                                                      Filesize

                                                                                                      17KB

                                                                                                      MD5

                                                                                                      5a34cb996293fde2cb7a4ac89587393a

                                                                                                      SHA1

                                                                                                      3c96c993500690d1a77873cd62bc639b3a10653f

                                                                                                      SHA256

                                                                                                      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                                                                                      SHA512

                                                                                                      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF8E90E3EB5C845E48.TMP

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                      MD5

                                                                                                      b1a056de706c547804d20a2a7977db1e

                                                                                                      SHA1

                                                                                                      396e1a710a5d18eb24f499e22eadfec13c48b43b

                                                                                                      SHA256

                                                                                                      748c484e2440234e6a0b84aaedeec5db72e9eac4b87496a207a6dc1e6a8cdf46

                                                                                                      SHA512

                                                                                                      e268893ea2aafe6a07e4556ddeb7bc26ac9cac78cef3c6653e132f3ec2226b9d173edd15c1c7bc0fafa881697655b5484bb74e38019f0a42f5df71b4a0f8c888

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OCommonResources.dll

                                                                                                      Filesize

                                                                                                      5.7MB

                                                                                                      MD5

                                                                                                      38cc1b5c2a4c510b8d4930a3821d7e0b

                                                                                                      SHA1

                                                                                                      f06d1d695012ace0aef7a45e340b70981ca023ba

                                                                                                      SHA256

                                                                                                      c2ba8645c5c9507d422961ceaeaf422adf6d378c2a7c02199ed760fb37a727f2

                                                                                                      SHA512

                                                                                                      99170f8094f61109d08a6e7cf25e7fba49160b0009277d10e9f0b9dac6f022e7a52e3d822e9aee3f736c2d285c4c3f62a2e6eb3e70f827ac6e8b867eea77f298

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OResources.dll

                                                                                                      Filesize

                                                                                                      19KB

                                                                                                      MD5

                                                                                                      554c3e1d68c8b5d04ca7a2264ca44e71

                                                                                                      SHA1

                                                                                                      ef749e325f52179e6875e9b2dd397bee2ca41bb4

                                                                                                      SHA256

                                                                                                      1eb0795b1928f6b0459199dace5affdc0842b6fba87be53ca108661275df2f3e

                                                                                                      SHA512

                                                                                                      58ce13c47e0daf99d66af1ea35984344c0bb11ba70fe92bc4ffa4cd6799d6f13bcad652b6883c0e32c6e155e9c1b020319c90da87cb0830f963639d53a51f9c6

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Extension.dll

                                                                                                      Filesize

                                                                                                      168KB

                                                                                                      MD5

                                                                                                      28f1996059e79df241388bd9f89cf0b1

                                                                                                      SHA1

                                                                                                      6ad6f7cde374686a42d9c0fcebadaf00adf21c76

                                                                                                      SHA256

                                                                                                      c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

                                                                                                      SHA512

                                                                                                      9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Newtonsoft.Json.dll

                                                                                                      Filesize

                                                                                                      541KB

                                                                                                      MD5

                                                                                                      9de86cdf74a30602d6baa7affc8c4a0f

                                                                                                      SHA1

                                                                                                      9c79b6fbf85b8b87dd781b20fc38ba2ac0664143

                                                                                                      SHA256

                                                                                                      56032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583

                                                                                                      SHA512

                                                                                                      dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\OfferPage.html

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      9ba0a91b564e22c876e58a8a5921b528

                                                                                                      SHA1

                                                                                                      8eb23cab5effc0d0df63120a4dbad3cffcac6f1e

                                                                                                      SHA256

                                                                                                      2ad742b544e72c245f4e9c2e69f989486222477c7eb06e85d28492bd93040941

                                                                                                      SHA512

                                                                                                      38b5fb0f12887a619facce82779cb66e2592e5922d883b9dc4d5f9d2cb12e0f84324422cd881c948f430575febd510e948a22cd291595e3a0ba0307fce73bec9

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\Config.tis

                                                                                                      Filesize

                                                                                                      291B

                                                                                                      MD5

                                                                                                      bf5328e51e8ab1211c509b5a65ab9972

                                                                                                      SHA1

                                                                                                      480dfb920e926d81bce67113576781815fbd1ea4

                                                                                                      SHA256

                                                                                                      98f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b

                                                                                                      SHA512

                                                                                                      92bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\app.ico

                                                                                                      Filesize

                                                                                                      766B

                                                                                                      MD5

                                                                                                      4003efa6e7d44e2cbd3d7486e2e0451a

                                                                                                      SHA1

                                                                                                      a2a9ab4a88cd4732647faa37bbdf726fd885ea1e

                                                                                                      SHA256

                                                                                                      effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508

                                                                                                      SHA512

                                                                                                      86e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198

                                                                                                    • C:\Users\Admin\AppData\Local\setup82497757.exe

                                                                                                      Filesize

                                                                                                      3.8MB

                                                                                                      MD5

                                                                                                      29d3a70cec060614e1691e64162a6c1e

                                                                                                      SHA1

                                                                                                      ce4daf2b1d39a1a881635b393450e435bfb7f7d1

                                                                                                      SHA256

                                                                                                      cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72

                                                                                                      SHA512

                                                                                                      69d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b

                                                                                                    • C:\Users\Admin\Downloads\Delta V3.61 b_82497757.exe

                                                                                                      Filesize

                                                                                                      9.5MB

                                                                                                      MD5

                                                                                                      1198daaa23f0af650c7cd4555fbef9e8

                                                                                                      SHA1

                                                                                                      783f86460785027a41a84e41b42a05b4d4a1a462

                                                                                                      SHA256

                                                                                                      25c846183e10bd2a146325effecddbabf0f390717fd11d597012a033e6daf600

                                                                                                      SHA512

                                                                                                      1a67d52794c2047936fc4814b70dd6474837b90df7a8b5653eb8a09cf98d4df2c93fb07451a29254e2e161e9e3f0c3f87e9f5e1252a2c89f2b7f95537e80227d

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll

                                                                                                      Filesize

                                                                                                      57KB

                                                                                                      MD5

                                                                                                      6e001f8d0ee4f09a6673a9e8168836b6

                                                                                                      SHA1

                                                                                                      334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38

                                                                                                      SHA256

                                                                                                      6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859

                                                                                                      SHA512

                                                                                                      0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll

                                                                                                      Filesize

                                                                                                      117KB

                                                                                                      MD5

                                                                                                      08112f27dcd8f1d779231a7a3e944cb1

                                                                                                      SHA1

                                                                                                      39a98a95feb1b6295ad762e22aa47854f57c226f

                                                                                                      SHA256

                                                                                                      11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa

                                                                                                      SHA512

                                                                                                      afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2ODAL.dll

                                                                                                      Filesize

                                                                                                      15KB

                                                                                                      MD5

                                                                                                      422be1a0c08185b107050fcf32f8fa40

                                                                                                      SHA1

                                                                                                      c8746a8dad7b4bf18380207b0c7c848362567a92

                                                                                                      SHA256

                                                                                                      723aea78755292d2f4f87ad100a99b37bef951b6b40b62e2e2bbd4df3346d528

                                                                                                      SHA512

                                                                                                      dff51c890cb395665839070d37170d321dc0800981a42f173c6ea570684460146b4936af9d8567a6089bef3a7802ac4931c14031827689ef345ea384ceb47599

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OModels.dll

                                                                                                      Filesize

                                                                                                      75KB

                                                                                                      MD5

                                                                                                      c06ac6dcfa7780cd781fc9af269e33c0

                                                                                                      SHA1

                                                                                                      f6b69337b369df50427f6d5968eb75b6283c199d

                                                                                                      SHA256

                                                                                                      b23b8310265c14d7e530b80defc6d39cdc638c07d07cd2668e387863c463741d

                                                                                                      SHA512

                                                                                                      ad167ad62913243e97efaeaa7bad38714aba7fc11f48001974d4f9c68615e9bdfb83bf623388008e77d61cee0eaba55ce47ebbb1f378d89067e74a05a11d9fe3

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll

                                                                                                      Filesize

                                                                                                      160KB

                                                                                                      MD5

                                                                                                      6df226bda27d26ce4523b80dbf57a9ea

                                                                                                      SHA1

                                                                                                      615f9aba84856026460dc54b581711dad63da469

                                                                                                      SHA256

                                                                                                      17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc

                                                                                                      SHA512

                                                                                                      988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OUtilities.dll

                                                                                                      Filesize

                                                                                                      119KB

                                                                                                      MD5

                                                                                                      9d2c520bfa294a6aa0c5cbc6d87caeec

                                                                                                      SHA1

                                                                                                      20b390db533153e4bf84f3d17225384b924b391f

                                                                                                      SHA256

                                                                                                      669c812cb8f09799083014a199b0deee10237c95fb49ee107376b952fee5bd89

                                                                                                      SHA512

                                                                                                      7e2e569549edb6ddd2b0cb0012386aed1f069e35d1f3045bb57704ef17b97129deb7cde8e23bc49980e908e1a5a90b739f68f36a1d231b1302a5d29b722e7c15

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OViewModels.dll

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      be4c2b0862d2fc399c393fca163094df

                                                                                                      SHA1

                                                                                                      7c03c84b2871c27fa0f1914825e504a090c2a550

                                                                                                      SHA256

                                                                                                      c202e4f92b792d34cb6859361aebdbfc8c61cf9e735edfd95e825839920fb88a

                                                                                                      SHA512

                                                                                                      d9c531687a5051bbfe5050c5088623b3fd5f20b1e53dd4d3ed281c8769c15f45da36620231f6d0d76f8e2aa7de00c2324a4bf35a815cefc70ca97bc4ab253799

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\HtmlAgilityPack.dll

                                                                                                      Filesize

                                                                                                      154KB

                                                                                                      MD5

                                                                                                      17220f65bd242b6a491423d5bb7940c1

                                                                                                      SHA1

                                                                                                      a33fabf2b788e80f0f7f84524fe3ed9b797be7ad

                                                                                                      SHA256

                                                                                                      23056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f

                                                                                                      SHA512

                                                                                                      bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Core.dll

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                      MD5

                                                                                                      f931e960cc4ed0d2f392376525ff44db

                                                                                                      SHA1

                                                                                                      1895aaa8f5b8314d8a4c5938d1405775d3837109

                                                                                                      SHA256

                                                                                                      1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

                                                                                                      SHA512

                                                                                                      7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Ninject.dll

                                                                                                      Filesize

                                                                                                      133KB

                                                                                                      MD5

                                                                                                      8db691813a26e7d0f1db5e2f4d0d05e3

                                                                                                      SHA1

                                                                                                      7c7a33553dd0b50b78bf0ca6974c77088da253eb

                                                                                                      SHA256

                                                                                                      3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701

                                                                                                      SHA512

                                                                                                      d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferSDK.dll

                                                                                                      Filesize

                                                                                                      172KB

                                                                                                      MD5

                                                                                                      b199dcd6824a02522a4d29a69ab65058

                                                                                                      SHA1

                                                                                                      f9c7f8c5c6543b80fa6f1940402430b37fa8dce4

                                                                                                      SHA256

                                                                                                      9310a58f26be8bd453cde5ca6aa05042942832711fbdeb5430a2840232bfa5e4

                                                                                                      SHA512

                                                                                                      1d3e85e13ff24640c76848981ca84bafb32f819a082e390cb06fe13445814f50f8e3fc3a8a8e962aae8867e199c1517d570c07f28d5f7e5f007b2bb6e664ddb1

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll

                                                                                                      Filesize

                                                                                                      134KB

                                                                                                      MD5

                                                                                                      105a9e404f7ac841c46380063cc27f50

                                                                                                      SHA1

                                                                                                      ec27d9e1c3b546848324096283797a8644516ee3

                                                                                                      SHA256

                                                                                                      69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b

                                                                                                      SHA512

                                                                                                      6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.Net.dll

                                                                                                      Filesize

                                                                                                      101KB

                                                                                                      MD5

                                                                                                      83d37fb4f754c7f4e41605ec3c8608ea

                                                                                                      SHA1

                                                                                                      70401de8ce89f809c6e601834d48768c0d65159f

                                                                                                      SHA256

                                                                                                      56db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020

                                                                                                      SHA512

                                                                                                      f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll

                                                                                                      Filesize

                                                                                                      151KB

                                                                                                      MD5

                                                                                                      72990c7e32ee6c811ea3d2ea64523234

                                                                                                      SHA1

                                                                                                      a7fcbf83ec6eefb2235d40f51d0d6172d364b822

                                                                                                      SHA256

                                                                                                      e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3

                                                                                                      SHA512

                                                                                                      2908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dll

                                                                                                      Filesize

                                                                                                      426KB

                                                                                                      MD5

                                                                                                      8ff1898897f3f4391803c7253366a87b

                                                                                                      SHA1

                                                                                                      9bdbeed8f75a892b6b630ef9e634667f4c620fa0

                                                                                                      SHA256

                                                                                                      51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

                                                                                                      SHA512

                                                                                                      cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

                                                                                                    • \Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dll

                                                                                                      Filesize

                                                                                                      74KB

                                                                                                      MD5

                                                                                                      1a84957b6e681fca057160cd04e26b27

                                                                                                      SHA1

                                                                                                      8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

                                                                                                      SHA256

                                                                                                      9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

                                                                                                      SHA512

                                                                                                      5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

                                                                                                    • memory/2316-16-0x0000023601320000-0x0000023601330000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/2316-535-0x00000236003F0000-0x00000236003F1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2316-0-0x0000023601220000-0x0000023601230000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/2316-531-0x0000023605510000-0x0000023605511000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2316-35-0x00000236054E0000-0x00000236054E2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2316-528-0x0000023605690000-0x0000023605692000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2568-96-0x0000020BF8810000-0x0000020BF8812000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2568-92-0x0000020BF7D30000-0x0000020BF7D32000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2568-62-0x0000020BF7570000-0x0000020BF7572000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2568-66-0x0000020BF75B0000-0x0000020BF75B2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2568-64-0x0000020BF7590000-0x0000020BF7592000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2568-82-0x0000020BF75D0000-0x0000020BF75F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/2568-94-0x0000020BF7FE0000-0x0000020BF7FE2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2616-270-0x0000020599C00000-0x0000020599D00000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/2616-288-0x00000205AA880000-0x00000205AA980000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/2616-287-0x00000205AA820000-0x00000205AA840000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/2616-291-0x00000205AC620000-0x00000205AC640000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/2616-269-0x0000020599C00000-0x0000020599D00000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/2616-309-0x00000205ABC40000-0x00000205ABD40000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4500-42-0x00000141906C0000-0x00000141907C0000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/5976-1372-0x0000000006640000-0x0000000006678000-memory.dmp

                                                                                                      Filesize

                                                                                                      224KB

                                                                                                    • memory/5976-1373-0x0000000006830000-0x00000000068E0000-memory.dmp

                                                                                                      Filesize

                                                                                                      704KB

                                                                                                    • memory/5976-1378-0x00000000071C0000-0x0000000007510000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.3MB

                                                                                                    • memory/5976-1374-0x0000000006C60000-0x0000000006CD6000-memory.dmp

                                                                                                      Filesize

                                                                                                      472KB

                                                                                                    • memory/5976-1377-0x0000000006D10000-0x0000000006D2E000-memory.dmp

                                                                                                      Filesize

                                                                                                      120KB

                                                                                                    • memory/5976-1371-0x00000000065F0000-0x00000000065F8000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/5976-1370-0x0000000000AB0000-0x0000000001BB6000-memory.dmp

                                                                                                      Filesize

                                                                                                      17.0MB

                                                                                                    • memory/5976-1379-0x0000000007630000-0x00000000076CC000-memory.dmp

                                                                                                      Filesize

                                                                                                      624KB

                                                                                                    • memory/5976-1380-0x000000000C410000-0x000000000C418000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/5988-1044-0x0000000005530000-0x0000000005558000-memory.dmp

                                                                                                      Filesize

                                                                                                      160KB

                                                                                                    • memory/5988-1118-0x0000000005D20000-0x0000000005D32000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                    • memory/5988-975-0x0000000000740000-0x0000000000B18000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.8MB

                                                                                                    • memory/5988-1167-0x0000000006F30000-0x0000000006FC2000-memory.dmp

                                                                                                      Filesize

                                                                                                      584KB

                                                                                                    • memory/5988-1156-0x0000000007CC0000-0x0000000008274000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.7MB

                                                                                                    • memory/5988-1152-0x0000000007200000-0x00000000076FE000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.0MB

                                                                                                    • memory/5988-1146-0x0000000006CE0000-0x0000000006CEC000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/5988-1142-0x0000000006610000-0x0000000006960000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.3MB

                                                                                                    • memory/5988-1141-0x00000000065E0000-0x0000000006602000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/5988-1140-0x00000000064D0000-0x00000000064DA000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/5988-1135-0x0000000006550000-0x00000000065DC000-memory.dmp

                                                                                                      Filesize

                                                                                                      560KB

                                                                                                    • memory/5988-1190-0x0000000009380000-0x00000000093AE000-memory.dmp

                                                                                                      Filesize

                                                                                                      184KB

                                                                                                    • memory/5988-1102-0x0000000005640000-0x000000000565D000-memory.dmp

                                                                                                      Filesize

                                                                                                      116KB

                                                                                                    • memory/5988-1092-0x00000000056B0000-0x00000000056DC000-memory.dmp

                                                                                                      Filesize

                                                                                                      176KB

                                                                                                    • memory/5988-1084-0x0000000005660000-0x0000000005668000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/5988-1076-0x0000000005590000-0x000000000559A000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/5988-1068-0x0000000005610000-0x0000000005634000-memory.dmp

                                                                                                      Filesize

                                                                                                      144KB

                                                                                                    • memory/5988-1060-0x0000000005560000-0x000000000557A000-memory.dmp

                                                                                                      Filesize

                                                                                                      104KB

                                                                                                    • memory/5988-1052-0x00000000055A0000-0x00000000055D2000-memory.dmp

                                                                                                      Filesize

                                                                                                      200KB

                                                                                                    • memory/5988-1036-0x00000000054D0000-0x00000000054FE000-memory.dmp

                                                                                                      Filesize

                                                                                                      184KB

                                                                                                    • memory/5988-1010-0x00000000054A0000-0x00000000054C8000-memory.dmp

                                                                                                      Filesize

                                                                                                      160KB

                                                                                                    • memory/5988-1002-0x0000000005470000-0x0000000005494000-memory.dmp

                                                                                                      Filesize

                                                                                                      144KB

                                                                                                    • memory/5988-994-0x0000000002DD0000-0x0000000002DE4000-memory.dmp

                                                                                                      Filesize

                                                                                                      80KB

                                                                                                    • memory/6000-1244-0x00000000005F0000-0x00000000005FC000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB