Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1786s
  • max time network
    1787s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 18:19

General

  • Target

    https://www.mediafire.com/file/pw3xg89cewyj47s/Delta-2.635.590_Dwighttheory.apk/file

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks for any installed AV software in registry 1 TTPs 40 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist 1 TTPs 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 55 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 7 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 6 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
  • NTFS ADS 2 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/pw3xg89cewyj47s/Delta-2.635.590_Dwighttheory.apk/file
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4996
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab75f46f8,0x7ffab75f4708,0x7ffab75f4718
      2⤵
        PID:3596
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        2⤵
          PID:400
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4468
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
          2⤵
            PID:2828
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
            2⤵
              PID:232
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
              2⤵
                PID:4324
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
                2⤵
                  PID:2240
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
                  2⤵
                    PID:4940
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
                    2⤵
                      PID:3196
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
                      2⤵
                        PID:4764
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
                        2⤵
                          PID:4296
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
                          2⤵
                            PID:2804
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
                            2⤵
                              PID:392
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
                              2⤵
                                PID:1848
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6088 /prefetch:8
                                2⤵
                                  PID:1940
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
                                  2⤵
                                    PID:4792
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
                                    2⤵
                                      PID:5052
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1768
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
                                      2⤵
                                        PID:3956
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
                                        2⤵
                                          PID:4132
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
                                          2⤵
                                            PID:5076
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
                                            2⤵
                                              PID:2256
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
                                              2⤵
                                                PID:5148
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2596 /prefetch:1
                                                2⤵
                                                  PID:6052
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
                                                  2⤵
                                                    PID:6128
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
                                                    2⤵
                                                      PID:4632
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7252 /prefetch:2
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4948
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7508 /prefetch:1
                                                      2⤵
                                                        PID:5756
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
                                                        2⤵
                                                          PID:436
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
                                                          2⤵
                                                            PID:4640
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
                                                            2⤵
                                                              PID:4172
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
                                                              2⤵
                                                                PID:1684
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
                                                                2⤵
                                                                  PID:5528
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:1
                                                                  2⤵
                                                                    PID:512
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1276 /prefetch:1
                                                                    2⤵
                                                                      PID:1736
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1992 /prefetch:8
                                                                      2⤵
                                                                        PID:692
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5072 /prefetch:8
                                                                        2⤵
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:1192
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
                                                                        2⤵
                                                                          PID:5932
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7768 /prefetch:1
                                                                          2⤵
                                                                            PID:6096
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
                                                                            2⤵
                                                                              PID:5712
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7520 /prefetch:1
                                                                              2⤵
                                                                                PID:1776
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
                                                                                2⤵
                                                                                  PID:4976
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7708 /prefetch:1
                                                                                  2⤵
                                                                                    PID:2792
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
                                                                                    2⤵
                                                                                      PID:4612
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
                                                                                      2⤵
                                                                                        PID:6068
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
                                                                                        2⤵
                                                                                          PID:392
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
                                                                                          2⤵
                                                                                            PID:4768
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5072 /prefetch:8
                                                                                            2⤵
                                                                                              PID:3312
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
                                                                                              2⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:6008
                                                                                            • C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe
                                                                                              "C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry class
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:532
                                                                                              • C:\Users\Admin\AppData\Local\setup92338257.exe
                                                                                                C:\Users\Admin\AppData\Local\setup92338257.exe hhwnd=459418 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-error
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks for any installed AV software in registry
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Modifies system certificate store
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:436
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:6032
                                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                                    tasklist /FI "PID eq 436" /fo csv
                                                                                                    5⤵
                                                                                                    • Enumerates processes with tasklist
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3264
                                                                                                  • C:\Windows\SysWOW64\find.exe
                                                                                                    find /I "436"
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5756
                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                    timeout 5
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:4624
                                                                                              • C:\Users\Admin\AppData\Local\setup92338257.exe
                                                                                                C:\Users\Admin\AppData\Local\setup92338257.exe hready
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4480
                                                                                              • C:\Users\Admin\AppData\Local\OperaGX.exe
                                                                                                C:\Users\Admin\AppData\Local\OperaGX.exe --silent --allusers=0
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:4664
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8328F37C\setup.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS8328F37C\setup.exe --silent --allusers=0 --server-tracking-blob=Y2MyNjFhOTlhYzU2NGM3NDMxYWQ4M2VkYjM1NmQ4ZmZmNmZiMGJiMjAyOGJiZGRhNDllMzY1MjM1YzVjMzQ5Njp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD1lZTllNTNlYTg1NWE0OWM5OGNkMTQyMWI0MjczZWY0NyZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInRpbWVzdGFtcCI6IjE3MjMxNDE0MzAuMjUxMCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdPVzY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfMzU3NSIsImNvbnRlbnQiOiIzNTc1X0ZpbGVETSIsImlkIjoiZWU5ZTUzZWE4NTVhNDljOThjZDE0MjFiNDI3M2VmNDciLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJkYmQ1ZWIzMC0yNWY5LTRmYmQtYjU3NC00ZTFhMTZmMTU4NTEifQ==
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Enumerates connected drives
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:1580
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8328F37C\setup.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8328F37C\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.60 --initial-client-data=0x32c,0x330,0x334,0x310,0x328,0x6ec41b54,0x6ec41b60,0x6ec41b6c
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:1952
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:1052
                                                                                            • C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe
                                                                                              "C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"
                                                                                              2⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:5904
                                                                                              • C:\Users\Admin\AppData\Local\setup92338257.exe
                                                                                                C:\Users\Admin\AppData\Local\setup92338257.exe hhwnd=655632 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-error
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks for any installed AV software in registry
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:3068
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3248
                                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                                    tasklist /FI "PID eq 3068" /fo csv
                                                                                                    5⤵
                                                                                                    • Enumerates processes with tasklist
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1608
                                                                                                  • C:\Windows\SysWOW64\find.exe
                                                                                                    find /I "3068"
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:428
                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                    timeout 5
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:1988
                                                                                              • C:\Users\Admin\AppData\Local\setup92338257.exe
                                                                                                C:\Users\Admin\AppData\Local\setup92338257.exe hready
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4016
                                                                                              • C:\Users\Admin\AppData\Local\OperaGX.exe
                                                                                                C:\Users\Admin\AppData\Local\OperaGX.exe --silent --allusers=0
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:4172
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe --silent --allusers=0 --server-tracking-blob=Y2MyNjFhOTlhYzU2NGM3NDMxYWQ4M2VkYjM1NmQ4ZmZmNmZiMGJiMjAyOGJiZGRhNDllMzY1MjM1YzVjMzQ5Njp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD1lZTllNTNlYTg1NWE0OWM5OGNkMTQyMWI0MjczZWY0NyZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInRpbWVzdGFtcCI6IjE3MjMxNDE0MzAuMjUxMCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdPVzY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfMzU3NSIsImNvbnRlbnQiOiIzNTc1X0ZpbGVETSIsImlkIjoiZWU5ZTUzZWE4NTVhNDljOThjZDE0MjFiNDI3M2VmNDciLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJkYmQ1ZWIzMC0yNWY5LTRmYmQtYjU3NC00ZTFhMTZmMTU4NTEifQ==
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Enumerates connected drives
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies system certificate store
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:5092
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.60 --initial-client-data=0x32c,0x330,0x334,0x304,0x338,0x6ce71b54,0x6ce71b60,0x6ce71b6c
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:5832
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:4420
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=5092 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240808182352" --session-guid=e3ed3f7a-d1f6-4bca-b486-71f05ae6b835 --server-tracking-blob=OTZmZTU0OTc5NzEzNGEwMjgxOWYxNjVhMGQxNDM0YjJkNzY3NjIwYmU2NDQ5ZjI4NjM3MTU0MjUxM2ExYTA0Yjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD1lZTllNTNlYTg1NWE0OWM5OGNkMTQyMWI0MjczZWY0NyZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcyMzE0MTQzMC4yNTEwIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1BCNV8zNTc1IiwiY29udGVudCI6IjM1NzVfRmlsZURNIiwiaWQiOiJlZTllNTNlYTg1NWE0OWM5OGNkMTQyMWI0MjczZWY0NyIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImRiZDVlYjMwLTI1ZjktNGZiZC1iNTc0LTRlMWExNmYxNTg1MSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1806000000000000
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Enumerates connected drives
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:5804
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.60 --initial-client-data=0x324,0x328,0x338,0x300,0x33c,0x6c081b54,0x6c081b60,0x6c081b6c
                                                                                                      6⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:704
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:5424
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\assistant_installer.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\assistant_installer.exe" --version
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:2392
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\assistant_installer.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x284,0x288,0x28c,0xd4,0x290,0x504f48,0x504f58,0x504f64
                                                                                                      6⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:3188
                                                                                              • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                                                                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Opens file in notepad (likely ransom note)
                                                                                                PID:5580
                                                                                              • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                                                                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Opens file in notepad (likely ransom note)
                                                                                                PID:5784
                                                                                            • C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe
                                                                                              "C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:1288
                                                                                              • C:\Users\Admin\AppData\Local\setup92338257.exe
                                                                                                C:\Users\Admin\AppData\Local\setup92338257.exe hhwnd=721608 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-error
                                                                                                3⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Checks for any installed AV software in registry
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Modifies system certificate store
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:3968
                                                                                                • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1864
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5748
                                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                                      tasklist /FI "PID eq 1864" /fo csv
                                                                                                      6⤵
                                                                                                      • Enumerates processes with tasklist
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4104
                                                                                                    • C:\Windows\SysWOW64\find.exe
                                                                                                      find /I "1864"
                                                                                                      6⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3872
                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                      timeout 1
                                                                                                      6⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:4524
                                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                                      tasklist /FI "PID eq 1864" /fo csv
                                                                                                      6⤵
                                                                                                      • Enumerates processes with tasklist
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:3000
                                                                                                    • C:\Windows\SysWOW64\find.exe
                                                                                                      find /I "1864"
                                                                                                      6⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:6032
                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                      timeout 1
                                                                                                      6⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:5648
                                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                                      tasklist /FI "PID eq 1864" /fo csv
                                                                                                      6⤵
                                                                                                      • Enumerates processes with tasklist
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:3400
                                                                                                    • C:\Windows\SysWOW64\find.exe
                                                                                                      find /I "1864"
                                                                                                      6⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:972
                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                      timeout 5
                                                                                                      6⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:648
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5668
                                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                                    tasklist /FI "PID eq 3968" /fo csv
                                                                                                    5⤵
                                                                                                    • Enumerates processes with tasklist
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:5356
                                                                                                  • C:\Windows\SysWOW64\find.exe
                                                                                                    find /I "3968"
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5920
                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                    timeout 5
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:1204
                                                                                              • C:\Users\Admin\AppData\Local\setup92338257.exe
                                                                                                C:\Users\Admin\AppData\Local\setup92338257.exe hready
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1056
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1348 /prefetch:1
                                                                                              2⤵
                                                                                                PID:5032
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:4104
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2844 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:2808
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8020 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:5292
                                                                                                    • C:\Users\Admin\Downloads\Delta V3.61 b_92338257 (1).exe
                                                                                                      "C:\Users\Admin\Downloads\Delta V3.61 b_92338257 (1).exe"
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:180
                                                                                                      • C:\Users\Admin\AppData\Local\setup92338257.exe
                                                                                                        C:\Users\Admin\AppData\Local\setup92338257.exe hhwnd=262702 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-error
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Checks for any installed AV software in registry
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:1864
                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:2712
                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:2392
                                                                                                      • C:\Windows\System32\rundll32.exe
                                                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                        1⤵
                                                                                                          PID:5664
                                                                                                        • C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe
                                                                                                          "C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:1832
                                                                                                          • C:\Users\Admin\AppData\Local\setup92338257.exe
                                                                                                            C:\Users\Admin\AppData\Local\setup92338257.exe hhwnd=197164 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-error
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Checks for any installed AV software in registry
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:3652
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:4792
                                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                tasklist /FI "PID eq 3652" /fo csv
                                                                                                                4⤵
                                                                                                                • Enumerates processes with tasklist
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2500
                                                                                                              • C:\Windows\SysWOW64\find.exe
                                                                                                                find /I "3652"
                                                                                                                4⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2440
                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                timeout 5
                                                                                                                4⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:5400

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Users\Admin\AppData\Local\DT001\setup92338257.exe_Url_vzk3zvd3bsc12dcho1w0u3cpzr50ouz5\2.0.5.6649\upnusczo.newcfg

                                                                                                          Filesize

                                                                                                          798B

                                                                                                          MD5

                                                                                                          f3da41e2f01ec12a28efa662df2fa963

                                                                                                          SHA1

                                                                                                          9760227f497132829ec34fffec6184969043bba1

                                                                                                          SHA256

                                                                                                          a4544f806b5637e45e2e702c7997d0b6a52b805670a72aac518d189c3004d1c2

                                                                                                          SHA512

                                                                                                          ae4f56f93a2386abe8891ba5ba1cc7de166a28c6a2f3913870bed2926ac43469bbbf0b4b18acf2fce7c7f120056e36b3777aabbdf9715cc12d2159403e392e59

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                          Filesize

                                                                                                          152B

                                                                                                          MD5

                                                                                                          d7114a6cd851f9bf56cf771c37d664a2

                                                                                                          SHA1

                                                                                                          769c5d04fd83e583f15ab1ef659de8f883ecab8a

                                                                                                          SHA256

                                                                                                          d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

                                                                                                          SHA512

                                                                                                          33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                          Filesize

                                                                                                          152B

                                                                                                          MD5

                                                                                                          719923124ee00fb57378e0ebcbe894f7

                                                                                                          SHA1

                                                                                                          cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

                                                                                                          SHA256

                                                                                                          aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

                                                                                                          SHA512

                                                                                                          a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                                                                                          Filesize

                                                                                                          20KB

                                                                                                          MD5

                                                                                                          631c4ff7d6e4024e5bdf8eb9fc2a2bcb

                                                                                                          SHA1

                                                                                                          c59d67b2bb027b438d05bd7c3ad9214393ef51c6

                                                                                                          SHA256

                                                                                                          27ccc7fad443790d6f9dc6fbb217fc2bc6e12f6a88e010e76d58cc33e1e99c82

                                                                                                          SHA512

                                                                                                          12517b3522fcc96cfafc031903de605609f91232a965d92473be5c1e7fc9ad4b1a46fa38c554e0613f0b1cfb02fd0a14122eaf77a0bbf3a06bd5868d31d0160e

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

                                                                                                          Filesize

                                                                                                          62KB

                                                                                                          MD5

                                                                                                          c0b6bb8bf06770448a0226486a3fa5c5

                                                                                                          SHA1

                                                                                                          11324fc181adb507aae8bd8f06018dd0980f4cf2

                                                                                                          SHA256

                                                                                                          51b8e76e663104d57b8772579bdd2803c2f0d92e9420f576729e0147d383530b

                                                                                                          SHA512

                                                                                                          4e47255d0cc444f87e367f61a245d83aacb82a911ca0045a25e3aa4ce9bd9c000a4e0d80092b57662cd3c054c3677c0848b5c23afb466ca9b70357ed27b7a097

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

                                                                                                          Filesize

                                                                                                          31KB

                                                                                                          MD5

                                                                                                          a4da976dde535a4f11ff4c9d57a8a56c

                                                                                                          SHA1

                                                                                                          fc4c29049db6d81135507dc3736cb638340f55aa

                                                                                                          SHA256

                                                                                                          6b85680498d0061e6b748f0fd9c904c74eb9f265f7d6ff6b33a37a0656164bf9

                                                                                                          SHA512

                                                                                                          e3db7eb080a2c927ec3a223d16d818cc76f9da51525a91b8eb3cc9e15106e2939ef6d550121b8cdf76d38c001971662d833d70a269ccf35d36278d25cf42aa18

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

                                                                                                          Filesize

                                                                                                          63KB

                                                                                                          MD5

                                                                                                          67e59a06ec50dcd4aebe11bb4a7e99a5

                                                                                                          SHA1

                                                                                                          5d073dbe75e1a8b4ff9c3120df0084f373768dae

                                                                                                          SHA256

                                                                                                          14be8f816315d26d4bc7f78088d502eff79dee045f9e6b239493a707758107fe

                                                                                                          SHA512

                                                                                                          6364515e92ed455f837dcc021cc5d7bbab8eac2a61140de17ff6a67dfdbbd8fbdded5ce739d001a0ba555b6693dafdb6af83424d6643ff6efddc46d391b21d95

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056

                                                                                                          Filesize

                                                                                                          52KB

                                                                                                          MD5

                                                                                                          e786a04218ac8a1f90c5b35b0e82c8a6

                                                                                                          SHA1

                                                                                                          9ecfed7153e84ca358b0b7f4551222a74b862d9f

                                                                                                          SHA256

                                                                                                          a8e9de682b18ba8ca677b5f8b3921f7551d5ac8e3ec9cdb040745070c3773eba

                                                                                                          SHA512

                                                                                                          478f732440044f7424e1387d523ece6bcbd8a3ca2cdaa405af737da3b79d6ac23e3717b1a39d0dd80413b19dcc7bdad52b34343c47f0ac0b70cf073492fcc926

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000064

                                                                                                          Filesize

                                                                                                          20KB

                                                                                                          MD5

                                                                                                          6959c9f88b6fb8554e6f425dde0672b4

                                                                                                          SHA1

                                                                                                          b7b9f19568b87b28475a84e85e4b21ce970a8dda

                                                                                                          SHA256

                                                                                                          4a1f68864b12b9dbb0d41320fbb3f6b96cae14ba4621e6b50f1de88a4ab21d15

                                                                                                          SHA512

                                                                                                          f91a0d3ce5764a291a0a718c4d5b94abff4f272d23586d1d46fc93807608c48e173088936833779b862b7ed661bdf03eae2185fa134dd9d4d52c4f7d82645734

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000069

                                                                                                          Filesize

                                                                                                          210KB

                                                                                                          MD5

                                                                                                          48d2860dd3168b6f06a4f27c6791bcaa

                                                                                                          SHA1

                                                                                                          f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

                                                                                                          SHA256

                                                                                                          04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

                                                                                                          SHA512

                                                                                                          172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2e367b3913539e5f_0

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          0209fda549018044532371a9e7f27552

                                                                                                          SHA1

                                                                                                          33c29a257252ee9625ff9fc223ffc586de26f7c5

                                                                                                          SHA256

                                                                                                          66898f1bb7e09dbff0674941e7e0da6f062e1db34f75abac37b277a902c0f3df

                                                                                                          SHA512

                                                                                                          ce8b3c628090a627bceee32286075942dc98e24007aae6540d6b5136f83988ac23f681b2979de5968be62d3866495e4a64fb227d2ea9ba296061fc8f5d15aad0

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\411dca8eeecf259b_0

                                                                                                          Filesize

                                                                                                          278B

                                                                                                          MD5

                                                                                                          1d8480c5166eb3e6d2bd17be6ce82c3b

                                                                                                          SHA1

                                                                                                          2991d2a57b8f965c004b6e3091f43f8c2b5af5e3

                                                                                                          SHA256

                                                                                                          ac87ead73fa2ec7630e2415f9e4a6f21aeedde9a39d38b74b749889e719d6648

                                                                                                          SHA512

                                                                                                          65af6c54341d7c5d88ad79a149ff746a854dfaace58b12dd57a4664f027f7fd85c7626289bc5197d34315cc6d2bf6935d7f786da3d6ed5390b51b1f7ebd9ed19

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\623f89c3fe829864_0

                                                                                                          Filesize

                                                                                                          84KB

                                                                                                          MD5

                                                                                                          f99d62ee0a60fbaa19c73cc791dc6e48

                                                                                                          SHA1

                                                                                                          4fec66037adffdcd1c89dc1245a3c1b0ad6070de

                                                                                                          SHA256

                                                                                                          ad28e19c8e5428cfb0c048accd726624f80de80e8dbb525cfe5c82cf8b2eacf9

                                                                                                          SHA512

                                                                                                          834ed9dd2842c3078216009b68dfd4d7979738f30d50b70b8116456ab2099f341ac793406ad56f4ad1e51e6f55fa8fe2d44868834fb8b4cc20e178532dce2aba

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6c4af2cb715f69cf_0

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          b9e0dbc90459d2f7a276b1fdc593b2f7

                                                                                                          SHA1

                                                                                                          ed6a260c5c4e9191a87125df75b51e0c2041c7ff

                                                                                                          SHA256

                                                                                                          c80e605b1d3422a8a536f8bc90fcdd73d6e1ff0bbe446bc18e79dfd0e81ee6ce

                                                                                                          SHA512

                                                                                                          a5b13978280a8d37da6b25003057084912dcf8f6b3af715c4a9b5f564139ef4d2b71a0a32aed795b027b6e79a7119ee86660e573cdb043761aacd0e6de01a3bf

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86267b21994d519c_0

                                                                                                          Filesize

                                                                                                          32KB

                                                                                                          MD5

                                                                                                          810bcec88af65835855320fc5651e3fb

                                                                                                          SHA1

                                                                                                          5071c3a4fa2c50d7828b8e431ec79e2d6a0e6fa3

                                                                                                          SHA256

                                                                                                          ce039353f564c976bc25745dc6d3dace2baf7edfe52e0b4c8ac196898e3dfb44

                                                                                                          SHA512

                                                                                                          17cd643b4149c95ef3541714a5ce1cc12b5f6f30d67fc9abff2f326a139e5ffbb271a88fe4599c7325b5f9a5f3e9c51f3988b8267a277cf6778e6b4f340dd75a

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9214c46349c93556_0

                                                                                                          Filesize

                                                                                                          54KB

                                                                                                          MD5

                                                                                                          15d77c769e300507c443a3a9cbcb087e

                                                                                                          SHA1

                                                                                                          b151aae406b1a2fadc25ebb63c2a678523b633b9

                                                                                                          SHA256

                                                                                                          cb6f358b7c0f3441bb2305f6932abe3d8074b59699c2259ceae76a0bd8acfe1f

                                                                                                          SHA512

                                                                                                          8a884a40adbb83c23e4a1f6d59d725a35eecbb9209f8059635dfd71a0e006c5538cbb14c84b406bd78ee9afc7b864f0c6cf7ff6c3f8c62477073d48781b9e4d6

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bd1ca6c0f0418268_0

                                                                                                          Filesize

                                                                                                          54KB

                                                                                                          MD5

                                                                                                          561859735ebe6db607b4d634bfab46ac

                                                                                                          SHA1

                                                                                                          60591b13a9b97d2998efc40b54d78a9c12edf894

                                                                                                          SHA256

                                                                                                          b31d2469851b062ff1ae98c38a288fba5454d8bdd665c00fe3d7001b3ef4812e

                                                                                                          SHA512

                                                                                                          81ccd6a4999bee5dabebc87f18bdce6efcdca2bed63b6da94b503f44bedeac33c516c63aad13f9d6e2be9c389b2e845e5f28f0fe25911fbea04b5e2950469604

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d78cfed0cdd2c292_0

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          MD5

                                                                                                          32332e55ee846364dfc7b87d21c2ad01

                                                                                                          SHA1

                                                                                                          9f7cc360c2541e4e5049ca5975238284ba62ccd7

                                                                                                          SHA256

                                                                                                          7e05eb15ebf3707b323b5c5f47cdc0b03c48b747d1b91adc5eda391ffb64c0ad

                                                                                                          SHA512

                                                                                                          536cf3482f025f42b4b5bc2268bee7c673e2f88a188a99f35d7a97962d7a98d49a348230c605dcc24379a76186f90f768f6c0c44d554342df0bbc3ebbcb3ceb4

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f5d5a4974a40105d_0

                                                                                                          Filesize

                                                                                                          268B

                                                                                                          MD5

                                                                                                          18b5780ffd415ff3a84d2b28b49a409d

                                                                                                          SHA1

                                                                                                          a9d2b201db881c2ab2a94a804f895e0576bce485

                                                                                                          SHA256

                                                                                                          4c15d84a551d722fd2dd61b16257e5b7233d8d427a04afab099352f9eab6d452

                                                                                                          SHA512

                                                                                                          1038d4f5426b4d999ac9ef68a574e05164e65278ddcffc83550148e82721b60509e3b56d4cb84ca3b0b4544a6aa57f6b9ffb83d4e478925c1635a713f660df0b

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f6cd93e099c529da_0

                                                                                                          Filesize

                                                                                                          6KB

                                                                                                          MD5

                                                                                                          eacefd4b9e3a5bcbb720bb645dbf5f04

                                                                                                          SHA1

                                                                                                          15e16514f388c5169aa6c7acb5371595b8cc87e0

                                                                                                          SHA256

                                                                                                          02a60bc575cfd5ad713ee916048b994c58a045d071b8ef5ed0d906a6ffb789ba

                                                                                                          SHA512

                                                                                                          5ea9a660d71a1005515fc1b79f9d2105aaa652d5526bc4a9cb9e9f88ce34b7603196daf05797c9578a2087c85a2d85d8cbc858836838139a1fb0e84c5ac8438b

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          f0ee84b345496a105e8eb94e5727bed9

                                                                                                          SHA1

                                                                                                          dcb400b4a01a7dcc15997ad6a1b629ed4e3fbb63

                                                                                                          SHA256

                                                                                                          ecbbd3a88a3f875ca073c163db7ca7b824a0e8e37880f35d7d93ccc17f795dc9

                                                                                                          SHA512

                                                                                                          81fab19715e7eda5c1c521c1e4800d92b73da7a6aac41d5d77230b0fce1dd43152e236164e5c3c2b905ec9d13c5e94d0db3c5d9998a0e409af5ca32959c9cbac

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          cb7a89fc020bbbb66a1d382aa4fec8f1

                                                                                                          SHA1

                                                                                                          bb5af9644ceb50b5bbf74a57d6b1ea7cb11a3eff

                                                                                                          SHA256

                                                                                                          f302a68fd39a0b9d527ce71292a94eefe80695d1a2be1d61c0e3d202ffe66c91

                                                                                                          SHA512

                                                                                                          110aa290c4a06877b16f120b757fef3500266993840de6b0fe937a315c25257b2c3df767de46469a818f5166bcdab110ce4d8a926009e25d302ee883624e5d40

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          4b11df8a7729370b933cb686c2d5f6cc

                                                                                                          SHA1

                                                                                                          45b56864239d6aa80f8adadc0d42cc8ef635a19b

                                                                                                          SHA256

                                                                                                          16d76ce56090ebc340759ce7bfe2f7bfebf38f7701013835383a74290f9b7f05

                                                                                                          SHA512

                                                                                                          89d58021daf03d9389ce2ada86dcb120e2255908702a61f87e26211237e90a243acbd16ee0202df58ed853e712e60e6af8627b6a5282dc4f10efc133475d6fb9

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          26e96799d1e5e3b30d53e733bdd7bc83

                                                                                                          SHA1

                                                                                                          0aa4f4ffc0a7b1c024070e99415deb435f78043a

                                                                                                          SHA256

                                                                                                          c8d9014b34bded8c22e9d6c5fa7d7dab168a33ebe54cfd35bd996527511a33a9

                                                                                                          SHA512

                                                                                                          a5fa601c9bc719a2fbecf656e9a4ad101bb885658e941274633199994e7379a6bfc761e90f6d89dafcfd1cfa31b4c3bc72d6613fc03fd353f5384a0d6143eb46

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          7e94e29dcd38c64962f50e91b7d31342

                                                                                                          SHA1

                                                                                                          acd7359c45ed15f83967a3bf9487453e257ab69b

                                                                                                          SHA256

                                                                                                          98e00fb69ede6c2dda5b024a6437130d521e57763ae9f5fe32c0d365266c73b6

                                                                                                          SHA512

                                                                                                          b9f6d6050d8988aeb36506f3575a3ddb318724185e1e0a0d51dff405f3f4eefae7a757e9f46d4e8d51c68d296ada0af974d70bce3668389d2c6524bd6a19590c

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          f2027e386ea1162f793fb583e428a212

                                                                                                          SHA1

                                                                                                          84f9b01676c40d25c7d1882ba260dc428d2555c5

                                                                                                          SHA256

                                                                                                          b418d9495960fa9bef178dbcf05b1eb9bfdad0d90bb453a94204cd2e212a090f

                                                                                                          SHA512

                                                                                                          7e400868c44ad557733e8ec70ed93c621111870ee34d5ae69267afb40a6012adb0ca4a8910a655ecd35a5eccdf09ecca0f7185bd4e01605321f42224b7c253ed

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          fca73f23a0412c9b84fb0e585bb4e612

                                                                                                          SHA1

                                                                                                          6f122109b03db1b59d974620e427b06a64dd298c

                                                                                                          SHA256

                                                                                                          a71934de1dba15fdfdca0fc657194026da3ce01bfab22c79ac4d1bd187c0f94e

                                                                                                          SHA512

                                                                                                          33f0450ee0085a23e39ce0cd81ee91c2a2e708f7200caba2a7d1abfb8fa7737767d386cc303524465ce6682bfc73113b5a52319f26b5e09d0e4fe15df935cd4a

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                          Filesize

                                                                                                          9KB

                                                                                                          MD5

                                                                                                          c51f67cd8c0960b29b931764d75c861e

                                                                                                          SHA1

                                                                                                          912ab289386648a7ecc712b8f54b22592004ccee

                                                                                                          SHA256

                                                                                                          6df749bc150eca5e09cc8c0fc02797b9c70c7dc90828f2596685d40f3abdea94

                                                                                                          SHA512

                                                                                                          954618535892e14a9232690543cc4bc464f04ee2b48779f424c450f9d592e9b7ef6a46a749cf7d32bd4a3d922ea7e45733b57c068179399adbace29fd562e22a

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          38de1dd27f6c75c8e48e0fe799ac2e7f

                                                                                                          SHA1

                                                                                                          725d9bd88f38759fcf8af9133e6466ad69af01c3

                                                                                                          SHA256

                                                                                                          a73ccbfb9dba0a0424bd241a1b00ffdb98620ea0f4576c32d01f1cc5b7b2cc22

                                                                                                          SHA512

                                                                                                          b8c1d8af9fdb5ac9a6f23a7c41b172bd6d376e217f980877f7aa18e0fa7895c62a83eabb1c60170964f4dc7e1aff9240fa97124277ca0742f95acbeb622ac3a8

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          da93b435394ef02dc5baa5518b7f69de

                                                                                                          SHA1

                                                                                                          6d6feb5a59453b15573fe83720d94b5501615faf

                                                                                                          SHA256

                                                                                                          143cd0ee2cb1b9e0ae0d6d0987f2dc0d23d3bf124238f428371818d602c12739

                                                                                                          SHA512

                                                                                                          1b127332d524c862bb73b00042056e74e83ef4a0559d81c0cffec7ae04e37284deed8c6bd05b6be9bfe8864f13a6d0b9f7203bf0a6e2cb5d1608c0eacbd29bd6

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                          Filesize

                                                                                                          12KB

                                                                                                          MD5

                                                                                                          eceecc870e111b6cca94feba9882dce1

                                                                                                          SHA1

                                                                                                          dabca5cc1f6c92a4f44ae6ad6887d1d3d90b6015

                                                                                                          SHA256

                                                                                                          e197b5dc8a069c9aa578e1e111d9a99b98a48311216f54dc211a943ed4468419

                                                                                                          SHA512

                                                                                                          73782ce1d7d26d079064b01109e76c8c793fb3822dedd266278213e0b0af33e89aad1cb600ad5627b937676877cae3dc98f5896bac1616592abcbc2309dc6e28

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          6KB

                                                                                                          MD5

                                                                                                          49d2a43ff6062114c385fa97a174da05

                                                                                                          SHA1

                                                                                                          01f7bb30052f93cf3d9bacf075c7645f440f4773

                                                                                                          SHA256

                                                                                                          9673c05e1600966f217ab3a193fae755e534c073d0efa42e47064b266a0b639c

                                                                                                          SHA512

                                                                                                          fab6807f3b23b6cb8efd6a01cc212d1b6ad5bcbab33513a63788e031afe9d145b16eef587f1223ec8eb1fb2e525fa9891549b43310ce187275a57effad79cb4e

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          9KB

                                                                                                          MD5

                                                                                                          f2e20abdac54d6f467eb58881149f847

                                                                                                          SHA1

                                                                                                          9c03dec6bc9e879b5c536623f02939d88f0eb182

                                                                                                          SHA256

                                                                                                          f36016e5964b57d19d12c4052a35bfe16dc79f015392240e7e91abb821579068

                                                                                                          SHA512

                                                                                                          ad6a587fb175d81dd2968ac5ad03e692d8fda4009d0737509898f26a017f0a83f6b8958d99f4b590bdd655b57ef340a1f7eea4001b186040d45b1b8cb11612f3

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          13KB

                                                                                                          MD5

                                                                                                          67ba469977ab9c872cd4a1b924a3108e

                                                                                                          SHA1

                                                                                                          76452a4d954511a86202c70801d4d278c2875fe9

                                                                                                          SHA256

                                                                                                          842540afde1ae6bbac447e99b64f0fc7c8c50d6c76f280b8ca0b9385d3a5cb3d

                                                                                                          SHA512

                                                                                                          e9a82bdd0dda47efeae3bc746bfc88bcdf5f59fa10d2e2ad4afed3a85b78059e2deab571d89c409132953351bdcdd438cc7993973bcbbb868c4616a3c17c7e1c

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          12KB

                                                                                                          MD5

                                                                                                          7da8df22de623a50a765103029c00f0d

                                                                                                          SHA1

                                                                                                          0cf3e6e6a0ba406d47f129676ad1c31d458623b0

                                                                                                          SHA256

                                                                                                          511c47a97667bf2fffb415edf32bc3ff7d46dfb72a28bb2656c33b4c979a72bc

                                                                                                          SHA512

                                                                                                          2e0c5e6d72689da48dcc72db052371777f6ba91b701ea8ec400948557ee9a9de2dd04ae60446030d4e4353575beb97c52873147ad5faf5b3558789b88692e034

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          14KB

                                                                                                          MD5

                                                                                                          11adc736fb2d96fcf917f2813b5da61e

                                                                                                          SHA1

                                                                                                          adf5aa016571fae3f8112e02f865905ece847d34

                                                                                                          SHA256

                                                                                                          059ea5d47a422d61ab83afd97cbafa6b20113d4cee3e9ee382979be97d59afdd

                                                                                                          SHA512

                                                                                                          3bc0a2ba0594bc2fc6b4d93df58f28ab9872ece64ac84b361d61b9780b0329abeba9e2e132f99750d3b96fda19207695fe37fc865886205aa8090f7b53ce6bae

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          12KB

                                                                                                          MD5

                                                                                                          e892b7e007be46929aa64f39501fc560

                                                                                                          SHA1

                                                                                                          6dfd8680e9c643be103fd854d75a7690a96543c8

                                                                                                          SHA256

                                                                                                          750bf427d246a29d304a598e9715984a1b815dad85180c2493f8d74966bf1fe7

                                                                                                          SHA512

                                                                                                          5700fb55e46605e6f494cfb04ac7bcf5331aebd705aab6269f993424ccfefe0b4c0e2d5ad896986c1179cee3c3624770bb2b1b17d8d783c5033378f3ace34101

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          13KB

                                                                                                          MD5

                                                                                                          031052f9c566f5fb121ab9a42472f3d5

                                                                                                          SHA1

                                                                                                          b3c8c4d286a6ff9b82d8e02ef83b19d5c62138a1

                                                                                                          SHA256

                                                                                                          3e290482a760e0768b5cdef101a1edd355d1ee45303cae593d8854441b160b4c

                                                                                                          SHA512

                                                                                                          dd302a79b1e328bd3f81227f574e683b6c1e62721d8f675ec03c5cab63c054c3eef849eff8f577b5a8f4a8721c711682183098660b8d883722d3c351bc907d38

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                          Filesize

                                                                                                          3KB

                                                                                                          MD5

                                                                                                          3fc43a6ec2b5b35a20eb1590109426d7

                                                                                                          SHA1

                                                                                                          8c34f8266a053633047e74589da69a213d61d8c3

                                                                                                          SHA256

                                                                                                          a85d4174d0bd665e1ed1daea624d1b80e43fd015fb3f1aa8a99816bbc90c5663

                                                                                                          SHA512

                                                                                                          5fe95f93a1c203253a4b55370dcef06d04a4012101c40be0bee02fc65aba7a64e477a64d00450de12ab8afcd7c5473b4a778e93cb508e36cdc6efb4ebcc3058f

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                          Filesize

                                                                                                          3KB

                                                                                                          MD5

                                                                                                          3404c6deb4233c52f8d042f05b87c176

                                                                                                          SHA1

                                                                                                          fe7dd47764c70b09f447f1dabd716f16a19262de

                                                                                                          SHA256

                                                                                                          17b3dcd53fb8c5e168f56c42d4cddb3bc77719d9403ab797775dcf0a8aa05b14

                                                                                                          SHA512

                                                                                                          072c91b18a8d8991db3efb38ba659f984911e3f39ac846f15db89fd85d62d5a70c186be6aefd37647c66704cbd21b4733f402db9ce0d7021928e04a23924eeee

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          6b8b008a10027bdc99a18689d5ab6394

                                                                                                          SHA1

                                                                                                          2804a643336ef9e25e0277c6bd27fa27dab81762

                                                                                                          SHA256

                                                                                                          3b7a974670e32b027eb33ebbbe1110e47d338abb3c41ffacf2be09dabbedb1e9

                                                                                                          SHA512

                                                                                                          eeb4e332883155fcc490110191e1a7075f72a307c3f0dda28c790fdc0fbab3a0c8c740a5269e8b3ac41d2556875f74bc00875ea6320fb023dd5c94afa2f92a21

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          8078c4769f1c2b9deba62a58a1a2d437

                                                                                                          SHA1

                                                                                                          953e20f4bc594af173fd432f92c23fba00b9f0e3

                                                                                                          SHA256

                                                                                                          bda6417eec344a54960dbd63b5eeb65786e34f1f89be19ad653eb404c59aa4d4

                                                                                                          SHA512

                                                                                                          6241a70b2c9ab0ba0bb105907b413acbf0ef87274bbdf5a1f99df17e1de115aa6681577f9430529281c448bf771cb61c5b452e140ea52654d128deefabb47d52

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                          Filesize

                                                                                                          3KB

                                                                                                          MD5

                                                                                                          cd8b5c25470f61548628a9cea9b1fd0c

                                                                                                          SHA1

                                                                                                          fa91fce8f3674eb8e90e4ccbefd96d95bcc247c0

                                                                                                          SHA256

                                                                                                          3d2f5a93dfd37110bf17ac42c26549dba1fe5750de208ab3b81289091a37d1fd

                                                                                                          SHA512

                                                                                                          f0544e7a9869d2aaaa91a051f544a55fef153cfc45961444fbae6ea2b4897eab1cefcaad2601e01416d490e5061d931b4ce4b3139e0bc8ec75d7f6f45530f0ad

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5816a0.TMP

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          2d52ef7b8bfb9cf11bf182bf572e755b

                                                                                                          SHA1

                                                                                                          a41abc43b0307e4bfd22db1a2b3f59b49c5633f6

                                                                                                          SHA256

                                                                                                          e6bf2cc994a80050da8931efbac8543656f753f2ee7d6cf5c0e32b9e76d9aeb9

                                                                                                          SHA512

                                                                                                          da3dd99059f9ce2d42128941342ae7ce5cbaf31d15ff0ce176c50dc1093a460df79d9927d8ee973759ed02bbb1ba7886e854f1f239a69ce61e4ec5a8f9dce176

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                          Filesize

                                                                                                          16B

                                                                                                          MD5

                                                                                                          6752a1d65b201c13b62ea44016eb221f

                                                                                                          SHA1

                                                                                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                          SHA256

                                                                                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                          SHA512

                                                                                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          e3c4e5b4746322ddccf1495b83fe82fa

                                                                                                          SHA1

                                                                                                          c8979368f2955337f9331dec35126c5dea38f111

                                                                                                          SHA256

                                                                                                          936ff19a48f1c3e6fa61206180589eddc88707bc3ee2f19f9d974be1b0059df4

                                                                                                          SHA512

                                                                                                          a897acc81f3f67f2cc10eead2d319cd5742aac0d1366f75512e9568a1ac349dfb8c0d4a2569cf4f6d0c3862cb9b2b4bc1891e9578427e58d8674e754dde7a5bb

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          d24664050630084a238c8cc1e0a4c9b6

                                                                                                          SHA1

                                                                                                          2894c0cbf3f8bb1d37f6405ee53b90c4a9d0d1ff

                                                                                                          SHA256

                                                                                                          80beadf42bb1f741a84237fb81cea1cf3db7bf39282bb4fd04aa86f392602b9c

                                                                                                          SHA512

                                                                                                          6e21844b309f1d4d5dc126fc80bc22fc7e91b5cea6969faeb30db9e80ace4b3e72ccc722164dbb84449a77f9a2b6ae2a58b9886a250eeee05241e9145ef0d234

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          50c58a8e3a5153873a264024106be760

                                                                                                          SHA1

                                                                                                          80f3f9663b69520c28a360dffb7c61aeec7cf22e

                                                                                                          SHA256

                                                                                                          35187c86b52a3bbd6357209f85b5a421853867a8c01eaf8461fbe4137b829d64

                                                                                                          SHA512

                                                                                                          e739a78de1c9125cc629d6d667303232a4769cec682103a5a74b47df970e22e9d04d2a66ea01f4ea34d9fec094bd2a76e7ce5ce7f04e80cae1345043c6a7b123

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          31b8da7883bbeacc5b9f19c68c94fb03

                                                                                                          SHA1

                                                                                                          33c017a56d476010d6bd28b65139be5baeb8a7c9

                                                                                                          SHA256

                                                                                                          219a367fbbfc0e95579fde3994bd1ddd288222ce35092d2dbca627238dcda42e

                                                                                                          SHA512

                                                                                                          e587dd45c527b1dab86540c055058bfbb34bcd6763451a12a35725fb04c60f21d1477b35ef686325ae9538da8dadc9efe388ff4a8ab6f4dccc70c7e1520f1ba0

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f4857a67-8e58-42b9-a44c-358fa326f5a1.tmp

                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          4bb54bd4430f8a8a81ac807811d73eb5

                                                                                                          SHA1

                                                                                                          13e9bfed9e45decd55d42dc9ac9ed25ecc94f077

                                                                                                          SHA256

                                                                                                          e339d453957d4cc71db5a8f3c318646544d50edb39575cdc94fc81f27c9b8d13

                                                                                                          SHA512

                                                                                                          ea314c6f4d1d6a174664b48b77bc40d3af69f125af29b16334f90f1cc90f283866bfe469f87474072df1981fe09d0e4a0ce57e43ad1327fed779e1efa7979458

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4329235D\service[1].htm

                                                                                                          Filesize

                                                                                                          5B

                                                                                                          MD5

                                                                                                          cb5e100e5a9a3e7f6d1fd97512215282

                                                                                                          SHA1

                                                                                                          11f9578d05e6f7bb58a3cdd00107e9f4e3882671

                                                                                                          SHA256

                                                                                                          ca00fccfb408989eddc401062c4d1219a6aceb6b9b55412357f1790862e8f178

                                                                                                          SHA512

                                                                                                          6a162d143889f5200e64400bc53e6b998bdfcf5d7600b633ede12a67ad24efccecff529ebe472963ad738bb7c463a158938d2f681f238e21c0d6f795f4fd1d87

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\geo[1].htm

                                                                                                          Filesize

                                                                                                          18B

                                                                                                          MD5

                                                                                                          983adacfd38604b038cefe3056d8b7ad

                                                                                                          SHA1

                                                                                                          7bc8915ef5f9baa92518d15d8d33ab5e5d64d64e

                                                                                                          SHA256

                                                                                                          5bb71f143b55c0f976495d4f72af9fc124273673b592d0f30718a8dab2538360

                                                                                                          SHA512

                                                                                                          a1e8bfe674993a5458927c52c6f8e48a0a39ce6aad41861de8a599b36f45ba78a885f383a65eca8e61b2da1e63f22fb2ff4e9ae22c8bb385ee6294a821060a6c

                                                                                                        • C:\Users\Admin\AppData\Local\OperaGX.exe

                                                                                                          Filesize

                                                                                                          3.1MB

                                                                                                          MD5

                                                                                                          1fc2b42afe1acac3f9faa480d1c10434

                                                                                                          SHA1

                                                                                                          c2d04503008519ea39d72df912d372f39316ea80

                                                                                                          SHA256

                                                                                                          de8930710715ab8f6c040801e316759cc69c7d2e62aae9db7b3eaacc4cf572af

                                                                                                          SHA512

                                                                                                          4b666b5e796513d6122c0dee277ec623f393259e67e106540cefbdcbccc14c6521c6eed0180a6be3886e7307acb31659df5b7b4a7e40679bec4b6c1b0f1833bb

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\additional_file0.tmp

                                                                                                          Filesize

                                                                                                          1.4MB

                                                                                                          MD5

                                                                                                          e9a2209b61f4be34f25069a6e54affea

                                                                                                          SHA1

                                                                                                          6368b0a81608c701b06b97aeff194ce88fd0e3c0

                                                                                                          SHA256

                                                                                                          e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

                                                                                                          SHA512

                                                                                                          59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe

                                                                                                          Filesize

                                                                                                          6.4MB

                                                                                                          MD5

                                                                                                          607fb47ad9d20bb16f90e4a38c93bbfe

                                                                                                          SHA1

                                                                                                          578ea8b4bd0bbd32114bfd61910118c3d9cfc355

                                                                                                          SHA256

                                                                                                          8a82ae5c857123cc6972b93828f3a6202c0db4d325ea6d5b1e36dcfb290c1e09

                                                                                                          SHA512

                                                                                                          23470d0aa5989132efa1fcd4b1d183374384e3b75249910c08e22d2fedf315f084028b7299d6f6c0a5230b2ec78179485d0f187d0a87f710d25f1eac81939e47

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2408081823521505832.dll

                                                                                                          Filesize

                                                                                                          5.9MB

                                                                                                          MD5

                                                                                                          1e6485e90130bb0cffd2ae2ca7fef2a2

                                                                                                          SHA1

                                                                                                          b9c01fddb3921b6f56d8d774eb0364f7024428e8

                                                                                                          SHA256

                                                                                                          907cb59383443ce62fdcd2eb90e4bf32cf3a0de6078e708f694dfc7bd7166b5b

                                                                                                          SHA512

                                                                                                          e28ec73e1465591827f092b71ab740a8de0b7ffcf5af0b3e4c1c8be37f16f1a87ae4fdfe23c25a305741a5aaf30fd2aab77f55061eb729f0dc5e64aef3dd6527

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll

                                                                                                          Filesize

                                                                                                          57KB

                                                                                                          MD5

                                                                                                          6e001f8d0ee4f09a6673a9e8168836b6

                                                                                                          SHA1

                                                                                                          334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38

                                                                                                          SHA256

                                                                                                          6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859

                                                                                                          SHA512

                                                                                                          0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll

                                                                                                          Filesize

                                                                                                          117KB

                                                                                                          MD5

                                                                                                          08112f27dcd8f1d779231a7a3e944cb1

                                                                                                          SHA1

                                                                                                          39a98a95feb1b6295ad762e22aa47854f57c226f

                                                                                                          SHA256

                                                                                                          11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa

                                                                                                          SHA512

                                                                                                          afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OCommonResources.dll

                                                                                                          Filesize

                                                                                                          5.7MB

                                                                                                          MD5

                                                                                                          38cc1b5c2a4c510b8d4930a3821d7e0b

                                                                                                          SHA1

                                                                                                          f06d1d695012ace0aef7a45e340b70981ca023ba

                                                                                                          SHA256

                                                                                                          c2ba8645c5c9507d422961ceaeaf422adf6d378c2a7c02199ed760fb37a727f2

                                                                                                          SHA512

                                                                                                          99170f8094f61109d08a6e7cf25e7fba49160b0009277d10e9f0b9dac6f022e7a52e3d822e9aee3f736c2d285c4c3f62a2e6eb3e70f827ac6e8b867eea77f298

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2ODAL.dll

                                                                                                          Filesize

                                                                                                          15KB

                                                                                                          MD5

                                                                                                          422be1a0c08185b107050fcf32f8fa40

                                                                                                          SHA1

                                                                                                          c8746a8dad7b4bf18380207b0c7c848362567a92

                                                                                                          SHA256

                                                                                                          723aea78755292d2f4f87ad100a99b37bef951b6b40b62e2e2bbd4df3346d528

                                                                                                          SHA512

                                                                                                          dff51c890cb395665839070d37170d321dc0800981a42f173c6ea570684460146b4936af9d8567a6089bef3a7802ac4931c14031827689ef345ea384ceb47599

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OModels.dll

                                                                                                          Filesize

                                                                                                          75KB

                                                                                                          MD5

                                                                                                          c06ac6dcfa7780cd781fc9af269e33c0

                                                                                                          SHA1

                                                                                                          f6b69337b369df50427f6d5968eb75b6283c199d

                                                                                                          SHA256

                                                                                                          b23b8310265c14d7e530b80defc6d39cdc638c07d07cd2668e387863c463741d

                                                                                                          SHA512

                                                                                                          ad167ad62913243e97efaeaa7bad38714aba7fc11f48001974d4f9c68615e9bdfb83bf623388008e77d61cee0eaba55ce47ebbb1f378d89067e74a05a11d9fe3

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OResources.dll

                                                                                                          Filesize

                                                                                                          19KB

                                                                                                          MD5

                                                                                                          554c3e1d68c8b5d04ca7a2264ca44e71

                                                                                                          SHA1

                                                                                                          ef749e325f52179e6875e9b2dd397bee2ca41bb4

                                                                                                          SHA256

                                                                                                          1eb0795b1928f6b0459199dace5affdc0842b6fba87be53ca108661275df2f3e

                                                                                                          SHA512

                                                                                                          58ce13c47e0daf99d66af1ea35984344c0bb11ba70fe92bc4ffa4cd6799d6f13bcad652b6883c0e32c6e155e9c1b020319c90da87cb0830f963639d53a51f9c6

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll

                                                                                                          Filesize

                                                                                                          160KB

                                                                                                          MD5

                                                                                                          6df226bda27d26ce4523b80dbf57a9ea

                                                                                                          SHA1

                                                                                                          615f9aba84856026460dc54b581711dad63da469

                                                                                                          SHA256

                                                                                                          17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc

                                                                                                          SHA512

                                                                                                          988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OUtilities.dll

                                                                                                          Filesize

                                                                                                          119KB

                                                                                                          MD5

                                                                                                          9d2c520bfa294a6aa0c5cbc6d87caeec

                                                                                                          SHA1

                                                                                                          20b390db533153e4bf84f3d17225384b924b391f

                                                                                                          SHA256

                                                                                                          669c812cb8f09799083014a199b0deee10237c95fb49ee107376b952fee5bd89

                                                                                                          SHA512

                                                                                                          7e2e569549edb6ddd2b0cb0012386aed1f069e35d1f3045bb57704ef17b97129deb7cde8e23bc49980e908e1a5a90b739f68f36a1d231b1302a5d29b722e7c15

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OViewModels.dll

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                          MD5

                                                                                                          be4c2b0862d2fc399c393fca163094df

                                                                                                          SHA1

                                                                                                          7c03c84b2871c27fa0f1914825e504a090c2a550

                                                                                                          SHA256

                                                                                                          c202e4f92b792d34cb6859361aebdbfc8c61cf9e735edfd95e825839920fb88a

                                                                                                          SHA512

                                                                                                          d9c531687a5051bbfe5050c5088623b3fd5f20b1e53dd4d3ed281c8769c15f45da36620231f6d0d76f8e2aa7de00c2324a4bf35a815cefc70ca97bc4ab253799

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\HtmlAgilityPack.dll

                                                                                                          Filesize

                                                                                                          154KB

                                                                                                          MD5

                                                                                                          17220f65bd242b6a491423d5bb7940c1

                                                                                                          SHA1

                                                                                                          a33fabf2b788e80f0f7f84524fe3ed9b797be7ad

                                                                                                          SHA256

                                                                                                          23056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f

                                                                                                          SHA512

                                                                                                          bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Core.dll

                                                                                                          Filesize

                                                                                                          56KB

                                                                                                          MD5

                                                                                                          f931e960cc4ed0d2f392376525ff44db

                                                                                                          SHA1

                                                                                                          1895aaa8f5b8314d8a4c5938d1405775d3837109

                                                                                                          SHA256

                                                                                                          1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

                                                                                                          SHA512

                                                                                                          7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Extension.dll

                                                                                                          Filesize

                                                                                                          168KB

                                                                                                          MD5

                                                                                                          28f1996059e79df241388bd9f89cf0b1

                                                                                                          SHA1

                                                                                                          6ad6f7cde374686a42d9c0fcebadaf00adf21c76

                                                                                                          SHA256

                                                                                                          c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

                                                                                                          SHA512

                                                                                                          9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Newtonsoft.Json.dll

                                                                                                          Filesize

                                                                                                          541KB

                                                                                                          MD5

                                                                                                          9de86cdf74a30602d6baa7affc8c4a0f

                                                                                                          SHA1

                                                                                                          9c79b6fbf85b8b87dd781b20fc38ba2ac0664143

                                                                                                          SHA256

                                                                                                          56032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583

                                                                                                          SHA512

                                                                                                          dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Ninject.dll

                                                                                                          Filesize

                                                                                                          133KB

                                                                                                          MD5

                                                                                                          8db691813a26e7d0f1db5e2f4d0d05e3

                                                                                                          SHA1

                                                                                                          7c7a33553dd0b50b78bf0ca6974c77088da253eb

                                                                                                          SHA256

                                                                                                          3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701

                                                                                                          SHA512

                                                                                                          d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe

                                                                                                          Filesize

                                                                                                          26KB

                                                                                                          MD5

                                                                                                          cef027c3341afbcdb83c72080df7f002

                                                                                                          SHA1

                                                                                                          e538f1dd4aee8544d888a616a6ebe4aeecaf1661

                                                                                                          SHA256

                                                                                                          e87db511aa5b8144905cd24d9b425f0d9a7037fface3ca7824b7e23cfddbbbb7

                                                                                                          SHA512

                                                                                                          71ba423c761064937569922f1d1381bd11d23d1d2ed207fc0fead19e9111c1970f2a69b66e0d8a74497277ffc36e0fc119db146b5fd068f4a6b794dc54c5d4bf

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferSDK.dll

                                                                                                          Filesize

                                                                                                          172KB

                                                                                                          MD5

                                                                                                          b199dcd6824a02522a4d29a69ab65058

                                                                                                          SHA1

                                                                                                          f9c7f8c5c6543b80fa6f1940402430b37fa8dce4

                                                                                                          SHA256

                                                                                                          9310a58f26be8bd453cde5ca6aa05042942832711fbdeb5430a2840232bfa5e4

                                                                                                          SHA512

                                                                                                          1d3e85e13ff24640c76848981ca84bafb32f819a082e390cb06fe13445814f50f8e3fc3a8a8e962aae8867e199c1517d570c07f28d5f7e5f007b2bb6e664ddb1

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\InstallingPage.html

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          29f74fbccb8ae8e707cf96ba40dbfa9a

                                                                                                          SHA1

                                                                                                          20e300ad8772ee64504d6f47682aacffc8a8cf1b

                                                                                                          SHA256

                                                                                                          f56bb8fe20b8be18b877dfe0dd46ad3c717fc44797db5ec904f1612f815da120

                                                                                                          SHA512

                                                                                                          2b2bb48472ba92ed7a6b5a83d209d0ceacc937135080c6be8e34a7740c91dec26b67fc2ecf67442d78faa79812b78959a32265a2787434b2ecd4357ce79d354b

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\OfferConsentPage.html

                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          fb18dc96f52616ade6c6fe2a0581ca0c

                                                                                                          SHA1

                                                                                                          6bc728733401a64b93fb91a394d859c3f4d5f1cf

                                                                                                          SHA256

                                                                                                          31002d617a900ce0abcba4809a17711db05040958efee547ef64c1b0cc540cff

                                                                                                          SHA512

                                                                                                          a582c57d693df81b062ba13b4d9c7a70a2881102f4de2ffe788680ff2f17207eab686e2a79c6b330a8cdcfcb61ef649aaca5bd4207e26b943754bd51012eb9c5

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\OfferPage.html

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          9ba0a91b564e22c876e58a8a5921b528

                                                                                                          SHA1

                                                                                                          8eb23cab5effc0d0df63120a4dbad3cffcac6f1e

                                                                                                          SHA256

                                                                                                          2ad742b544e72c245f4e9c2e69f989486222477c7eb06e85d28492bd93040941

                                                                                                          SHA512

                                                                                                          38b5fb0f12887a619facce82779cb66e2592e5922d883b9dc4d5f9d2cb12e0f84324422cd881c948f430575febd510e948a22cd291595e3a0ba0307fce73bec9

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\images\loader.gif

                                                                                                          Filesize

                                                                                                          16KB

                                                                                                          MD5

                                                                                                          2b26f73d382ab69f3914a7d9fda97b0f

                                                                                                          SHA1

                                                                                                          a3f5ad928d4bec107ae2941fa6b23c69d19eedd0

                                                                                                          SHA256

                                                                                                          a6a0b05b1d5c52303dd3e9e2f9cda1e688a490fbe84ea0d6e22a051ab6efd643

                                                                                                          SHA512

                                                                                                          744ff7e91c8d1059f48de97dc816bc7cc0f1a41ea7b8b7e3382ff69bc283255dfdf7b46d708a062967a6c1f2e5138665be2943ed89d7543fc707e752543ac9a7

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\images\warning48x48.png

                                                                                                          Filesize

                                                                                                          749B

                                                                                                          MD5

                                                                                                          d3361cf0d689a1b34d84f483d60ba9c9

                                                                                                          SHA1

                                                                                                          d89a9551137ae90f5889ed66e8dc005f85cf99ff

                                                                                                          SHA256

                                                                                                          56739925aada73f9489f9a6b72bfaaa92892b27d20f4d221380ba3eae17f1442

                                                                                                          SHA512

                                                                                                          247cf4c292d62cea6bf46ac3ab236e11f3d3885cd49fdd28958c7493ebb86ace45c9751424f7312f393932d0a7165e2985f56c764d299b7e37f75457eef2d846

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\style.css

                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          626313d8f4c859ba6473a8d94dfea5e7

                                                                                                          SHA1

                                                                                                          142a57c5e31d7317b7d52b2d4435df53d4123663

                                                                                                          SHA256

                                                                                                          989e5474b74fbdf5abe98b607870bb7f4757967c51412bc940ecab7dd9babd54

                                                                                                          SHA512

                                                                                                          dbaefd7f7409839971ec87bc0e49fbc4992de9dd319e28bea401b35b0a7952e56281084b123b6bbeb06080706ada0ffabcd0cf2fb3f75986d34f844d8cd50de9

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\Config.tis

                                                                                                          Filesize

                                                                                                          291B

                                                                                                          MD5

                                                                                                          bf5328e51e8ab1211c509b5a65ab9972

                                                                                                          SHA1

                                                                                                          480dfb920e926d81bce67113576781815fbd1ea4

                                                                                                          SHA256

                                                                                                          98f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b

                                                                                                          SHA512

                                                                                                          92bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\EventHandler.tis

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          1116d7747130f4552a91e61a3a6000b1

                                                                                                          SHA1

                                                                                                          bc36996a664dab24b941ec263679c9d6322e61a2

                                                                                                          SHA256

                                                                                                          5c09c6784f3fdc4a6b2998c4c9e02e366265ee5314c0f982859825576dc0eafd

                                                                                                          SHA512

                                                                                                          af34413f242b64737ac9f7076e449b0d0485842d653d1cad12b54b868f09817d3595cd935ad7e03003d536127c173d624dd9a031c079fdb8f897ab0b7b9474e8

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\Log.tis

                                                                                                          Filesize

                                                                                                          1014B

                                                                                                          MD5

                                                                                                          cef7a21acf607d44e160eac5a21bdf67

                                                                                                          SHA1

                                                                                                          f24f674250a381d6bf09df16d00dbf617354d315

                                                                                                          SHA256

                                                                                                          73ed0be73f408ab8f15f2da73c839f86fef46d0a269607330b28f9564fae73c7

                                                                                                          SHA512

                                                                                                          5afb4609ef46f156155f7c1b5fed48fd178d7f3395f80fb3a4fb02f454a3f977d8a15f3ef8541af62df83426a3316d31e1b9e2fd77726cf866c75f6d4e7adc2f

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\TranslateOfferTemplate.tis

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          551029a3e046c5ed6390cc85f632a689

                                                                                                          SHA1

                                                                                                          b4bd706f753db6ba3c13551099d4eef55f65b057

                                                                                                          SHA256

                                                                                                          7b8c76a85261c5f9e40e49f97e01a14320e9b224ff3d6af8286632ca94cf96f8

                                                                                                          SHA512

                                                                                                          22a67a8371d2aa2fdbc840c8e5452c650cb161e71c39b49d868c66db8b4c47d3297cf83c711ec1d002bc3e3ae16b1e0e4faf2761954ce56c495827306bab677e

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\ViewStateLoader.tis

                                                                                                          Filesize

                                                                                                          16KB

                                                                                                          MD5

                                                                                                          85c33c8207f5fcb2d31c7ce7322771ac

                                                                                                          SHA1

                                                                                                          6b64f919e6b731447b9add9221b3b7570de25061

                                                                                                          SHA256

                                                                                                          940ef5e9f28da759fbf3676fba6da5cc4199b78ffc4fefe078ab11d53e70fb0a

                                                                                                          SHA512

                                                                                                          904188ab57cfb4f3d8c51eb55746ae2589852f271b9fa3840b82bda93f69c9f985e65f67169302d08818b707f36246f83f245470d5175dba5f0ad3a2482740c4

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll

                                                                                                          Filesize

                                                                                                          134KB

                                                                                                          MD5

                                                                                                          105a9e404f7ac841c46380063cc27f50

                                                                                                          SHA1

                                                                                                          ec27d9e1c3b546848324096283797a8644516ee3

                                                                                                          SHA256

                                                                                                          69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b

                                                                                                          SHA512

                                                                                                          6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.Net.dll

                                                                                                          Filesize

                                                                                                          101KB

                                                                                                          MD5

                                                                                                          83d37fb4f754c7f4e41605ec3c8608ea

                                                                                                          SHA1

                                                                                                          70401de8ce89f809c6e601834d48768c0d65159f

                                                                                                          SHA256

                                                                                                          56db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020

                                                                                                          SHA512

                                                                                                          f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll

                                                                                                          Filesize

                                                                                                          151KB

                                                                                                          MD5

                                                                                                          72990c7e32ee6c811ea3d2ea64523234

                                                                                                          SHA1

                                                                                                          a7fcbf83ec6eefb2235d40f51d0d6172d364b822

                                                                                                          SHA256

                                                                                                          e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3

                                                                                                          SHA512

                                                                                                          2908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\app.ico

                                                                                                          Filesize

                                                                                                          766B

                                                                                                          MD5

                                                                                                          4003efa6e7d44e2cbd3d7486e2e0451a

                                                                                                          SHA1

                                                                                                          a2a9ab4a88cd4732647faa37bbdf726fd885ea1e

                                                                                                          SHA256

                                                                                                          effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508

                                                                                                          SHA512

                                                                                                          86e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dll

                                                                                                          Filesize

                                                                                                          426KB

                                                                                                          MD5

                                                                                                          8ff1898897f3f4391803c7253366a87b

                                                                                                          SHA1

                                                                                                          9bdbeed8f75a892b6b630ef9e634667f4c620fa0

                                                                                                          SHA256

                                                                                                          51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

                                                                                                          SHA512

                                                                                                          cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\sciter32.dll

                                                                                                          Filesize

                                                                                                          5.6MB

                                                                                                          MD5

                                                                                                          b431083586e39d018e19880ad1a5ce8f

                                                                                                          SHA1

                                                                                                          3bbf957ab534d845d485a8698accc0a40b63cedd

                                                                                                          SHA256

                                                                                                          b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b

                                                                                                          SHA512

                                                                                                          7805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dll

                                                                                                          Filesize

                                                                                                          74KB

                                                                                                          MD5

                                                                                                          1a84957b6e681fca057160cd04e26b27

                                                                                                          SHA1

                                                                                                          8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

                                                                                                          SHA256

                                                                                                          9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

                                                                                                          SHA512

                                                                                                          5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

                                                                                                        • C:\Users\Admin\AppData\Local\setup92338257.exe

                                                                                                          Filesize

                                                                                                          3.8MB

                                                                                                          MD5

                                                                                                          29d3a70cec060614e1691e64162a6c1e

                                                                                                          SHA1

                                                                                                          ce4daf2b1d39a1a881635b393450e435bfb7f7d1

                                                                                                          SHA256

                                                                                                          cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72

                                                                                                          SHA512

                                                                                                          69d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b

                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-us\default.dic

                                                                                                          Filesize

                                                                                                          2B

                                                                                                          MD5

                                                                                                          f3b25701fe362ec84616a93a45ce9998

                                                                                                          SHA1

                                                                                                          d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                          SHA256

                                                                                                          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                          SHA512

                                                                                                          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                        • C:\Users\Admin\Downloads\Unconfirmed 424690.crdownload

                                                                                                          Filesize

                                                                                                          9.5MB

                                                                                                          MD5

                                                                                                          dae050afc8508ae428be7e560cf02a49

                                                                                                          SHA1

                                                                                                          1601f3f652eec4081f988e81031b93caf80b9b5d

                                                                                                          SHA256

                                                                                                          83c010d7c668e4fd51f630077ffa10b7be51d373c2bb7008ed9d3f1dbaf226cf

                                                                                                          SHA512

                                                                                                          edbc3f651c2a1b43bfdf7c6240274db16fe7ab28e8ab7640ed066d8d82c60ac96f6c2aa729f4e8750ef38f2d1382cc20789630817f207eedcd3cf5048d9193ef

                                                                                                        • memory/436-1296-0x0000000006D00000-0x0000000006D0C000-memory.dmp

                                                                                                          Filesize

                                                                                                          48KB

                                                                                                        • memory/436-1285-0x0000000006620000-0x00000000066AC000-memory.dmp

                                                                                                          Filesize

                                                                                                          560KB

                                                                                                        • memory/436-1183-0x0000000005620000-0x0000000005634000-memory.dmp

                                                                                                          Filesize

                                                                                                          80KB

                                                                                                        • memory/436-1207-0x00000000056E0000-0x000000000570E000-memory.dmp

                                                                                                          Filesize

                                                                                                          184KB

                                                                                                        • memory/436-1240-0x00000000057A0000-0x00000000057AA000-memory.dmp

                                                                                                          Filesize

                                                                                                          40KB

                                                                                                        • memory/436-1246-0x0000000005870000-0x0000000005878000-memory.dmp

                                                                                                          Filesize

                                                                                                          32KB

                                                                                                        • memory/436-1312-0x0000000006F60000-0x0000000006FF2000-memory.dmp

                                                                                                          Filesize

                                                                                                          584KB

                                                                                                        • memory/436-1199-0x00000000056A0000-0x00000000056C8000-memory.dmp

                                                                                                          Filesize

                                                                                                          160KB

                                                                                                        • memory/436-1292-0x0000000006840000-0x0000000006B94000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.3MB

                                                                                                        • memory/436-1291-0x0000000006810000-0x0000000006832000-memory.dmp

                                                                                                          Filesize

                                                                                                          136KB

                                                                                                        • memory/436-1290-0x00000000065A0000-0x00000000065AA000-memory.dmp

                                                                                                          Filesize

                                                                                                          40KB

                                                                                                        • memory/436-1191-0x0000000005670000-0x0000000005694000-memory.dmp

                                                                                                          Filesize

                                                                                                          144KB

                                                                                                        • memory/436-1274-0x0000000005F30000-0x0000000005F42000-memory.dmp

                                                                                                          Filesize

                                                                                                          72KB

                                                                                                        • memory/436-1234-0x0000000005820000-0x0000000005844000-memory.dmp

                                                                                                          Filesize

                                                                                                          144KB

                                                                                                        • memory/436-1252-0x00000000058C0000-0x00000000058EC000-memory.dmp

                                                                                                          Filesize

                                                                                                          176KB

                                                                                                        • memory/436-1299-0x00000000072E0000-0x0000000007884000-memory.dmp

                                                                                                          Filesize

                                                                                                          5.6MB

                                                                                                        • memory/436-1303-0x0000000007E50000-0x0000000008404000-memory.dmp

                                                                                                          Filesize

                                                                                                          5.7MB

                                                                                                        • memory/436-1260-0x0000000005850000-0x000000000586D000-memory.dmp

                                                                                                          Filesize

                                                                                                          116KB

                                                                                                        • memory/436-1161-0x00000000008A0000-0x0000000000C78000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.8MB

                                                                                                        • memory/436-1215-0x0000000005740000-0x0000000005768000-memory.dmp

                                                                                                          Filesize

                                                                                                          160KB

                                                                                                        • memory/436-1222-0x00000000057B0000-0x00000000057E2000-memory.dmp

                                                                                                          Filesize

                                                                                                          200KB

                                                                                                        • memory/436-1353-0x0000000007E00000-0x0000000007E2E000-memory.dmp

                                                                                                          Filesize

                                                                                                          184KB

                                                                                                        • memory/436-1228-0x0000000005770000-0x000000000578A000-memory.dmp

                                                                                                          Filesize

                                                                                                          104KB

                                                                                                        • memory/1864-1719-0x0000000000DF0000-0x0000000000DFC000-memory.dmp

                                                                                                          Filesize

                                                                                                          48KB