Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1786s -
max time network
1787s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 18:19
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Delta V3.61 b_92338257.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation setup92338257.exe -
Executes dropped EXE 27 IoCs
pid Process 532 Delta V3.61 b_92338257.exe 436 setup92338257.exe 5904 Delta V3.61 b_92338257.exe 3068 setup92338257.exe 4480 setup92338257.exe 4016 setup92338257.exe 4172 OperaGX.exe 5092 setup.exe 5832 setup.exe 4420 setup.exe 5804 setup.exe 704 setup.exe 5424 Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe 2392 assistant_installer.exe 3188 assistant_installer.exe 4664 OperaGX.exe 1580 setup.exe 1952 setup.exe 1052 setup.exe 1288 Delta V3.61 b_92338257.exe 3968 setup92338257.exe 1056 setup92338257.exe 1864 OfferInstaller.exe 1832 Delta V3.61 b_92338257.exe 3652 setup92338257.exe 180 Delta V3.61 b_92338257 (1).exe 1864 setup92338257.exe -
Loads dropped DLL 64 IoCs
pid Process 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 40 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir setup92338257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV setup92338257.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: setup.exe File opened (read-only) \??\D: setup.exe File opened (read-only) \??\F: setup.exe File opened (read-only) \??\D: setup.exe File opened (read-only) \??\F: setup.exe File opened (read-only) \??\D: setup.exe -
Enumerates processes with tasklist 1 TTPs 7 IoCs
pid Process 3264 tasklist.exe 5356 tasklist.exe 4104 tasklist.exe 3000 tasklist.exe 3400 tasklist.exe 2500 tasklist.exe 1608 tasklist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 55 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Delta V3.61 b_92338257 (1).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup92338257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OperaGX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Delta V3.61 b_92338257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assistant_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Delta V3.61 b_92338257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Delta V3.61 b_92338257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assistant_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup92338257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup92338257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Delta V3.61 b_92338257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup92338257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OfferInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup92338257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OperaGX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup92338257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup92338257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup92338257.exe -
Delays execution with timeout.exe 7 IoCs
pid Process 4524 timeout.exe 5648 timeout.exe 648 timeout.exe 5400 timeout.exe 1988 timeout.exe 4624 timeout.exe 1204 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Opera GXStable Delta V3.61 b_92338257.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Opera GXStable Delta V3.61 b_92338257.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings Delta V3.61 b_92338257.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{2B246CCC-212E-43E3-A23B-6A04D99388D7} msedge.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Opera GXStable Delta V3.61 b_92338257.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Opera GXStable Delta V3.61 b_92338257.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e setup92338257.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0400000001000000100000004be2c99196650cf40e5a9392a00afeb20f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d4190000000100000010000000fa46ce7cbb85cfb4310075313a09ee052000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 setup92338257.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 setup92338257.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e setup92338257.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 setup92338257.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 5c000000010000000400000000080000190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd940400000001000000100000004be2c99196650cf40e5a9392a00afeb22000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 setup92338257.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 setup.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 424690.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 827816.crdownload:SmartScreen msedge.exe -
Opens file in notepad (likely ransom note) 2 IoCs
pid Process 5580 NOTEPAD.EXE 5784 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4468 msedge.exe 4468 msedge.exe 4996 msedge.exe 4996 msedge.exe 1768 identity_helper.exe 1768 identity_helper.exe 4948 msedge.exe 4948 msedge.exe 4948 msedge.exe 4948 msedge.exe 1192 msedge.exe 1192 msedge.exe 6008 msedge.exe 6008 msedge.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 436 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 3068 setup92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs
pid Process 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 436 setup92338257.exe Token: SeDebugPrivilege 3068 setup92338257.exe Token: SeDebugPrivilege 1608 tasklist.exe Token: SeDebugPrivilege 3264 tasklist.exe Token: SeDebugPrivilege 3968 setup92338257.exe Token: SeDebugPrivilege 1864 OfferInstaller.exe Token: SeDebugPrivilege 5356 tasklist.exe Token: SeDebugPrivilege 4104 tasklist.exe Token: SeDebugPrivilege 3000 tasklist.exe Token: SeDebugPrivilege 3400 tasklist.exe Token: SeDebugPrivilege 3652 setup92338257.exe Token: SeDebugPrivilege 2500 tasklist.exe Token: SeDebugPrivilege 1864 setup92338257.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe 4996 msedge.exe -
Suspicious use of SetWindowsHookEx 34 IoCs
pid Process 532 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 5904 Delta V3.61 b_92338257.exe 532 Delta V3.61 b_92338257.exe 5904 Delta V3.61 b_92338257.exe 436 setup92338257.exe 3068 setup92338257.exe 5904 Delta V3.61 b_92338257.exe 4172 OperaGX.exe 5092 setup.exe 5832 setup.exe 4420 setup.exe 5804 setup.exe 704 setup.exe 5424 Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe 2392 assistant_installer.exe 3188 assistant_installer.exe 4664 OperaGX.exe 1580 setup.exe 1952 setup.exe 1052 setup.exe 1288 Delta V3.61 b_92338257.exe 1288 Delta V3.61 b_92338257.exe 3968 setup92338257.exe 1288 Delta V3.61 b_92338257.exe 1832 Delta V3.61 b_92338257.exe 1832 Delta V3.61 b_92338257.exe 3652 setup92338257.exe 1832 Delta V3.61 b_92338257.exe 3652 setup92338257.exe 180 Delta V3.61 b_92338257 (1).exe 180 Delta V3.61 b_92338257 (1).exe 1864 setup92338257.exe 180 Delta V3.61 b_92338257 (1).exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 3596 4996 msedge.exe 83 PID 4996 wrote to memory of 3596 4996 msedge.exe 83 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 400 4996 msedge.exe 84 PID 4996 wrote to memory of 4468 4996 msedge.exe 85 PID 4996 wrote to memory of 4468 4996 msedge.exe 85 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86 PID 4996 wrote to memory of 2828 4996 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/pw3xg89cewyj47s/Delta-2.635.590_Dwighttheory.apk/file1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab75f46f8,0x7ffab75f4708,0x7ffab75f47182⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:82⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:12⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:12⤵PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:12⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:12⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:12⤵PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:1848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6088 /prefetch:82⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:12⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:12⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:12⤵PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:12⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:12⤵PID:5148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2596 /prefetch:12⤵PID:6052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:12⤵PID:6128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7252 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7508 /prefetch:12⤵PID:5756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:12⤵PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:12⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:5528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:12⤵PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1276 /prefetch:12⤵PID:1736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1992 /prefetch:82⤵PID:692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5072 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:12⤵PID:5932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7768 /prefetch:12⤵PID:6096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:12⤵PID:5712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7520 /prefetch:12⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7708 /prefetch:12⤵PID:2792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵PID:6068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5072 /prefetch:82⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6008
-
-
C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:532 -
C:\Users\Admin\AppData\Local\setup92338257.exeC:\Users\Admin\AppData\Local\setup92338257.exe hhwnd=459418 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-error3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""4⤵
- System Location Discovery: System Language Discovery
PID:6032 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 436" /fo csv5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Windows\SysWOW64\find.exefind /I "436"5⤵
- System Location Discovery: System Language Discovery
PID:5756
-
-
C:\Windows\SysWOW64\timeout.exetimeout 55⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4624
-
-
-
-
C:\Users\Admin\AppData\Local\setup92338257.exeC:\Users\Admin\AppData\Local\setup92338257.exe hready3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4480
-
-
C:\Users\Admin\AppData\Local\OperaGX.exeC:\Users\Admin\AppData\Local\OperaGX.exe --silent --allusers=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\7zS8328F37C\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS8328F37C\setup.exe --silent --allusers=0 --server-tracking-blob=Y2MyNjFhOTlhYzU2NGM3NDMxYWQ4M2VkYjM1NmQ4ZmZmNmZiMGJiMjAyOGJiZGRhNDllMzY1MjM1YzVjMzQ5Njp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD1lZTllNTNlYTg1NWE0OWM5OGNkMTQyMWI0MjczZWY0NyZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInRpbWVzdGFtcCI6IjE3MjMxNDE0MzAuMjUxMCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdPVzY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfMzU3NSIsImNvbnRlbnQiOiIzNTc1X0ZpbGVETSIsImlkIjoiZWU5ZTUzZWE4NTVhNDljOThjZDE0MjFiNDI3M2VmNDciLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJkYmQ1ZWIzMC0yNWY5LTRmYmQtYjU3NC00ZTFhMTZmMTU4NTEifQ==4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7zS8328F37C\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS8328F37C\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.60 --initial-client-data=0x32c,0x330,0x334,0x310,0x328,0x6ec41b54,0x6ec41b60,0x6ec41b6c5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1052
-
-
-
-
-
C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5904 -
C:\Users\Admin\AppData\Local\setup92338257.exeC:\Users\Admin\AppData\Local\setup92338257.exe hhwnd=655632 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-error3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""4⤵
- System Location Discovery: System Language Discovery
PID:3248 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 3068" /fo csv5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Windows\SysWOW64\find.exefind /I "3068"5⤵
- System Location Discovery: System Language Discovery
PID:428
-
-
C:\Windows\SysWOW64\timeout.exetimeout 55⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1988
-
-
-
-
C:\Users\Admin\AppData\Local\setup92338257.exeC:\Users\Admin\AppData\Local\setup92338257.exe hready3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4016
-
-
C:\Users\Admin\AppData\Local\OperaGX.exeC:\Users\Admin\AppData\Local\OperaGX.exe --silent --allusers=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exeC:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe --silent --allusers=0 --server-tracking-blob=Y2MyNjFhOTlhYzU2NGM3NDMxYWQ4M2VkYjM1NmQ4ZmZmNmZiMGJiMjAyOGJiZGRhNDllMzY1MjM1YzVjMzQ5Njp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD1lZTllNTNlYTg1NWE0OWM5OGNkMTQyMWI0MjczZWY0NyZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInRpbWVzdGFtcCI6IjE3MjMxNDE0MzAuMjUxMCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdPVzY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfMzU3NSIsImNvbnRlbnQiOiIzNTc1X0ZpbGVETSIsImlkIjoiZWU5ZTUzZWE4NTVhNDljOThjZDE0MjFiNDI3M2VmNDciLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJkYmQ1ZWIzMC0yNWY5LTRmYmQtYjU3NC00ZTFhMTZmMTU4NTEifQ==4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exeC:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.60 --initial-client-data=0x32c,0x330,0x334,0x304,0x338,0x6ce71b54,0x6ce71b60,0x6ce71b6c5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5832
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4420
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe"C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=5092 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240808182352" --session-guid=e3ed3f7a-d1f6-4bca-b486-71f05ae6b835 --server-tracking-blob=OTZmZTU0OTc5NzEzNGEwMjgxOWYxNjVhMGQxNDM0YjJkNzY3NjIwYmU2NDQ5ZjI4NjM3MTU0MjUxM2ExYTA0Yjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD1lZTllNTNlYTg1NWE0OWM5OGNkMTQyMWI0MjczZWY0NyZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcyMzE0MTQzMC4yNTEwIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1BCNV8zNTc1IiwiY29udGVudCI6IjM1NzVfRmlsZURNIiwiaWQiOiJlZTllNTNlYTg1NWE0OWM5OGNkMTQyMWI0MjczZWY0NyIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImRiZDVlYjMwLTI1ZjktNGZiZC1iNTc0LTRlMWExNmYxNTg1MSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=18060000000000005⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exeC:\Users\Admin\AppData\Local\Temp\7zSC402A19B\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.60 --initial-client-data=0x324,0x328,0x338,0x300,0x33c,0x6c081b54,0x6c081b60,0x6c081b6c6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:704
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5424
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\assistant_installer.exe" --version5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x284,0x288,0x28c,0xd4,0x290,0x504f48,0x504f58,0x504f646⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3188
-
-
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt3⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:5580
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt3⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:5784
-
-
-
C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1288 -
C:\Users\Admin\AppData\Local\setup92338257.exeC:\Users\Admin\AppData\Local\setup92338257.exe hhwnd=721608 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-error3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""5⤵
- System Location Discovery: System Language Discovery
PID:5748 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 1864" /fo csv6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
-
C:\Windows\SysWOW64\find.exefind /I "1864"6⤵
- System Location Discovery: System Language Discovery
PID:3872
-
-
C:\Windows\SysWOW64\timeout.exetimeout 16⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4524
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 1864" /fo csv6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Windows\SysWOW64\find.exefind /I "1864"6⤵
- System Location Discovery: System Language Discovery
PID:6032
-
-
C:\Windows\SysWOW64\timeout.exetimeout 16⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5648
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 1864" /fo csv6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-
C:\Windows\SysWOW64\find.exefind /I "1864"6⤵
- System Location Discovery: System Language Discovery
PID:972
-
-
C:\Windows\SysWOW64\timeout.exetimeout 56⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:648
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""4⤵
- System Location Discovery: System Language Discovery
PID:5668 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 3968" /fo csv5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5356
-
-
C:\Windows\SysWOW64\find.exefind /I "3968"5⤵
- System Location Discovery: System Language Discovery
PID:5920
-
-
C:\Windows\SysWOW64\timeout.exetimeout 55⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1204
-
-
-
-
C:\Users\Admin\AppData\Local\setup92338257.exeC:\Users\Admin\AppData\Local\setup92338257.exe hready3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1056
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1348 /prefetch:12⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:2808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,4930854331329468990,3566226192803459888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8020 /prefetch:82⤵PID:5292
-
-
C:\Users\Admin\Downloads\Delta V3.61 b_92338257 (1).exe"C:\Users\Admin\Downloads\Delta V3.61 b_92338257 (1).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:180 -
C:\Users\Admin\AppData\Local\setup92338257.exeC:\Users\Admin\AppData\Local\setup92338257.exe hhwnd=262702 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-error3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1864
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2712
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2392
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5664
-
C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"C:\Users\Admin\Downloads\Delta V3.61 b_92338257.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1832 -
C:\Users\Admin\AppData\Local\setup92338257.exeC:\Users\Admin\AppData\Local\setup92338257.exe hhwnd=197164 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-error2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""3⤵
- System Location Discovery: System Language Discovery
PID:4792 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 3652" /fo csv4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\SysWOW64\find.exefind /I "3652"4⤵
- System Location Discovery: System Language Discovery
PID:2440
-
-
C:\Windows\SysWOW64\timeout.exetimeout 54⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5400
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\DT001\setup92338257.exe_Url_vzk3zvd3bsc12dcho1w0u3cpzr50ouz5\2.0.5.6649\upnusczo.newcfg
Filesize798B
MD5f3da41e2f01ec12a28efa662df2fa963
SHA19760227f497132829ec34fffec6184969043bba1
SHA256a4544f806b5637e45e2e702c7997d0b6a52b805670a72aac518d189c3004d1c2
SHA512ae4f56f93a2386abe8891ba5ba1cc7de166a28c6a2f3913870bed2926ac43469bbbf0b4b18acf2fce7c7f120056e36b3777aabbdf9715cc12d2159403e392e59
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
20KB
MD5631c4ff7d6e4024e5bdf8eb9fc2a2bcb
SHA1c59d67b2bb027b438d05bd7c3ad9214393ef51c6
SHA25627ccc7fad443790d6f9dc6fbb217fc2bc6e12f6a88e010e76d58cc33e1e99c82
SHA51212517b3522fcc96cfafc031903de605609f91232a965d92473be5c1e7fc9ad4b1a46fa38c554e0613f0b1cfb02fd0a14122eaf77a0bbf3a06bd5868d31d0160e
-
Filesize
62KB
MD5c0b6bb8bf06770448a0226486a3fa5c5
SHA111324fc181adb507aae8bd8f06018dd0980f4cf2
SHA25651b8e76e663104d57b8772579bdd2803c2f0d92e9420f576729e0147d383530b
SHA5124e47255d0cc444f87e367f61a245d83aacb82a911ca0045a25e3aa4ce9bd9c000a4e0d80092b57662cd3c054c3677c0848b5c23afb466ca9b70357ed27b7a097
-
Filesize
31KB
MD5a4da976dde535a4f11ff4c9d57a8a56c
SHA1fc4c29049db6d81135507dc3736cb638340f55aa
SHA2566b85680498d0061e6b748f0fd9c904c74eb9f265f7d6ff6b33a37a0656164bf9
SHA512e3db7eb080a2c927ec3a223d16d818cc76f9da51525a91b8eb3cc9e15106e2939ef6d550121b8cdf76d38c001971662d833d70a269ccf35d36278d25cf42aa18
-
Filesize
63KB
MD567e59a06ec50dcd4aebe11bb4a7e99a5
SHA15d073dbe75e1a8b4ff9c3120df0084f373768dae
SHA25614be8f816315d26d4bc7f78088d502eff79dee045f9e6b239493a707758107fe
SHA5126364515e92ed455f837dcc021cc5d7bbab8eac2a61140de17ff6a67dfdbbd8fbdded5ce739d001a0ba555b6693dafdb6af83424d6643ff6efddc46d391b21d95
-
Filesize
52KB
MD5e786a04218ac8a1f90c5b35b0e82c8a6
SHA19ecfed7153e84ca358b0b7f4551222a74b862d9f
SHA256a8e9de682b18ba8ca677b5f8b3921f7551d5ac8e3ec9cdb040745070c3773eba
SHA512478f732440044f7424e1387d523ece6bcbd8a3ca2cdaa405af737da3b79d6ac23e3717b1a39d0dd80413b19dcc7bdad52b34343c47f0ac0b70cf073492fcc926
-
Filesize
20KB
MD56959c9f88b6fb8554e6f425dde0672b4
SHA1b7b9f19568b87b28475a84e85e4b21ce970a8dda
SHA2564a1f68864b12b9dbb0d41320fbb3f6b96cae14ba4621e6b50f1de88a4ab21d15
SHA512f91a0d3ce5764a291a0a718c4d5b94abff4f272d23586d1d46fc93807608c48e173088936833779b862b7ed661bdf03eae2185fa134dd9d4d52c4f7d82645734
-
Filesize
210KB
MD548d2860dd3168b6f06a4f27c6791bcaa
SHA1f5f803efed91cd45a36c3d6acdffaaf0e863bf8c
SHA25604d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
SHA512172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e
-
Filesize
2KB
MD50209fda549018044532371a9e7f27552
SHA133c29a257252ee9625ff9fc223ffc586de26f7c5
SHA25666898f1bb7e09dbff0674941e7e0da6f062e1db34f75abac37b277a902c0f3df
SHA512ce8b3c628090a627bceee32286075942dc98e24007aae6540d6b5136f83988ac23f681b2979de5968be62d3866495e4a64fb227d2ea9ba296061fc8f5d15aad0
-
Filesize
278B
MD51d8480c5166eb3e6d2bd17be6ce82c3b
SHA12991d2a57b8f965c004b6e3091f43f8c2b5af5e3
SHA256ac87ead73fa2ec7630e2415f9e4a6f21aeedde9a39d38b74b749889e719d6648
SHA51265af6c54341d7c5d88ad79a149ff746a854dfaace58b12dd57a4664f027f7fd85c7626289bc5197d34315cc6d2bf6935d7f786da3d6ed5390b51b1f7ebd9ed19
-
Filesize
84KB
MD5f99d62ee0a60fbaa19c73cc791dc6e48
SHA14fec66037adffdcd1c89dc1245a3c1b0ad6070de
SHA256ad28e19c8e5428cfb0c048accd726624f80de80e8dbb525cfe5c82cf8b2eacf9
SHA512834ed9dd2842c3078216009b68dfd4d7979738f30d50b70b8116456ab2099f341ac793406ad56f4ad1e51e6f55fa8fe2d44868834fb8b4cc20e178532dce2aba
-
Filesize
10KB
MD5b9e0dbc90459d2f7a276b1fdc593b2f7
SHA1ed6a260c5c4e9191a87125df75b51e0c2041c7ff
SHA256c80e605b1d3422a8a536f8bc90fcdd73d6e1ff0bbe446bc18e79dfd0e81ee6ce
SHA512a5b13978280a8d37da6b25003057084912dcf8f6b3af715c4a9b5f564139ef4d2b71a0a32aed795b027b6e79a7119ee86660e573cdb043761aacd0e6de01a3bf
-
Filesize
32KB
MD5810bcec88af65835855320fc5651e3fb
SHA15071c3a4fa2c50d7828b8e431ec79e2d6a0e6fa3
SHA256ce039353f564c976bc25745dc6d3dace2baf7edfe52e0b4c8ac196898e3dfb44
SHA51217cd643b4149c95ef3541714a5ce1cc12b5f6f30d67fc9abff2f326a139e5ffbb271a88fe4599c7325b5f9a5f3e9c51f3988b8267a277cf6778e6b4f340dd75a
-
Filesize
54KB
MD515d77c769e300507c443a3a9cbcb087e
SHA1b151aae406b1a2fadc25ebb63c2a678523b633b9
SHA256cb6f358b7c0f3441bb2305f6932abe3d8074b59699c2259ceae76a0bd8acfe1f
SHA5128a884a40adbb83c23e4a1f6d59d725a35eecbb9209f8059635dfd71a0e006c5538cbb14c84b406bd78ee9afc7b864f0c6cf7ff6c3f8c62477073d48781b9e4d6
-
Filesize
54KB
MD5561859735ebe6db607b4d634bfab46ac
SHA160591b13a9b97d2998efc40b54d78a9c12edf894
SHA256b31d2469851b062ff1ae98c38a288fba5454d8bdd665c00fe3d7001b3ef4812e
SHA51281ccd6a4999bee5dabebc87f18bdce6efcdca2bed63b6da94b503f44bedeac33c516c63aad13f9d6e2be9c389b2e845e5f28f0fe25911fbea04b5e2950469604
-
Filesize
276KB
MD532332e55ee846364dfc7b87d21c2ad01
SHA19f7cc360c2541e4e5049ca5975238284ba62ccd7
SHA2567e05eb15ebf3707b323b5c5f47cdc0b03c48b747d1b91adc5eda391ffb64c0ad
SHA512536cf3482f025f42b4b5bc2268bee7c673e2f88a188a99f35d7a97962d7a98d49a348230c605dcc24379a76186f90f768f6c0c44d554342df0bbc3ebbcb3ceb4
-
Filesize
268B
MD518b5780ffd415ff3a84d2b28b49a409d
SHA1a9d2b201db881c2ab2a94a804f895e0576bce485
SHA2564c15d84a551d722fd2dd61b16257e5b7233d8d427a04afab099352f9eab6d452
SHA5121038d4f5426b4d999ac9ef68a574e05164e65278ddcffc83550148e82721b60509e3b56d4cb84ca3b0b4544a6aa57f6b9ffb83d4e478925c1635a713f660df0b
-
Filesize
6KB
MD5eacefd4b9e3a5bcbb720bb645dbf5f04
SHA115e16514f388c5169aa6c7acb5371595b8cc87e0
SHA25602a60bc575cfd5ad713ee916048b994c58a045d071b8ef5ed0d906a6ffb789ba
SHA5125ea9a660d71a1005515fc1b79f9d2105aaa652d5526bc4a9cb9e9f88ce34b7603196daf05797c9578a2087c85a2d85d8cbc858836838139a1fb0e84c5ac8438b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5f0ee84b345496a105e8eb94e5727bed9
SHA1dcb400b4a01a7dcc15997ad6a1b629ed4e3fbb63
SHA256ecbbd3a88a3f875ca073c163db7ca7b824a0e8e37880f35d7d93ccc17f795dc9
SHA51281fab19715e7eda5c1c521c1e4800d92b73da7a6aac41d5d77230b0fce1dd43152e236164e5c3c2b905ec9d13c5e94d0db3c5d9998a0e409af5ca32959c9cbac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD5cb7a89fc020bbbb66a1d382aa4fec8f1
SHA1bb5af9644ceb50b5bbf74a57d6b1ea7cb11a3eff
SHA256f302a68fd39a0b9d527ce71292a94eefe80695d1a2be1d61c0e3d202ffe66c91
SHA512110aa290c4a06877b16f120b757fef3500266993840de6b0fe937a315c25257b2c3df767de46469a818f5166bcdab110ce4d8a926009e25d302ee883624e5d40
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD54b11df8a7729370b933cb686c2d5f6cc
SHA145b56864239d6aa80f8adadc0d42cc8ef635a19b
SHA25616d76ce56090ebc340759ce7bfe2f7bfebf38f7701013835383a74290f9b7f05
SHA51289d58021daf03d9389ce2ada86dcb120e2255908702a61f87e26211237e90a243acbd16ee0202df58ed853e712e60e6af8627b6a5282dc4f10efc133475d6fb9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD526e96799d1e5e3b30d53e733bdd7bc83
SHA10aa4f4ffc0a7b1c024070e99415deb435f78043a
SHA256c8d9014b34bded8c22e9d6c5fa7d7dab168a33ebe54cfd35bd996527511a33a9
SHA512a5fa601c9bc719a2fbecf656e9a4ad101bb885658e941274633199994e7379a6bfc761e90f6d89dafcfd1cfa31b4c3bc72d6613fc03fd353f5384a0d6143eb46
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD57e94e29dcd38c64962f50e91b7d31342
SHA1acd7359c45ed15f83967a3bf9487453e257ab69b
SHA25698e00fb69ede6c2dda5b024a6437130d521e57763ae9f5fe32c0d365266c73b6
SHA512b9f6d6050d8988aeb36506f3575a3ddb318724185e1e0a0d51dff405f3f4eefae7a757e9f46d4e8d51c68d296ada0af974d70bce3668389d2c6524bd6a19590c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5f2027e386ea1162f793fb583e428a212
SHA184f9b01676c40d25c7d1882ba260dc428d2555c5
SHA256b418d9495960fa9bef178dbcf05b1eb9bfdad0d90bb453a94204cd2e212a090f
SHA5127e400868c44ad557733e8ec70ed93c621111870ee34d5ae69267afb40a6012adb0ca4a8910a655ecd35a5eccdf09ecca0f7185bd4e01605321f42224b7c253ed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD5fca73f23a0412c9b84fb0e585bb4e612
SHA16f122109b03db1b59d974620e427b06a64dd298c
SHA256a71934de1dba15fdfdca0fc657194026da3ce01bfab22c79ac4d1bd187c0f94e
SHA51233f0450ee0085a23e39ce0cd81ee91c2a2e708f7200caba2a7d1abfb8fa7737767d386cc303524465ce6682bfc73113b5a52319f26b5e09d0e4fe15df935cd4a
-
Filesize
9KB
MD5c51f67cd8c0960b29b931764d75c861e
SHA1912ab289386648a7ecc712b8f54b22592004ccee
SHA2566df749bc150eca5e09cc8c0fc02797b9c70c7dc90828f2596685d40f3abdea94
SHA512954618535892e14a9232690543cc4bc464f04ee2b48779f424c450f9d592e9b7ef6a46a749cf7d32bd4a3d922ea7e45733b57c068179399adbace29fd562e22a
-
Filesize
10KB
MD538de1dd27f6c75c8e48e0fe799ac2e7f
SHA1725d9bd88f38759fcf8af9133e6466ad69af01c3
SHA256a73ccbfb9dba0a0424bd241a1b00ffdb98620ea0f4576c32d01f1cc5b7b2cc22
SHA512b8c1d8af9fdb5ac9a6f23a7c41b172bd6d376e217f980877f7aa18e0fa7895c62a83eabb1c60170964f4dc7e1aff9240fa97124277ca0742f95acbeb622ac3a8
-
Filesize
11KB
MD5da93b435394ef02dc5baa5518b7f69de
SHA16d6feb5a59453b15573fe83720d94b5501615faf
SHA256143cd0ee2cb1b9e0ae0d6d0987f2dc0d23d3bf124238f428371818d602c12739
SHA5121b127332d524c862bb73b00042056e74e83ef4a0559d81c0cffec7ae04e37284deed8c6bd05b6be9bfe8864f13a6d0b9f7203bf0a6e2cb5d1608c0eacbd29bd6
-
Filesize
12KB
MD5eceecc870e111b6cca94feba9882dce1
SHA1dabca5cc1f6c92a4f44ae6ad6887d1d3d90b6015
SHA256e197b5dc8a069c9aa578e1e111d9a99b98a48311216f54dc211a943ed4468419
SHA51273782ce1d7d26d079064b01109e76c8c793fb3822dedd266278213e0b0af33e89aad1cb600ad5627b937676877cae3dc98f5896bac1616592abcbc2309dc6e28
-
Filesize
6KB
MD549d2a43ff6062114c385fa97a174da05
SHA101f7bb30052f93cf3d9bacf075c7645f440f4773
SHA2569673c05e1600966f217ab3a193fae755e534c073d0efa42e47064b266a0b639c
SHA512fab6807f3b23b6cb8efd6a01cc212d1b6ad5bcbab33513a63788e031afe9d145b16eef587f1223ec8eb1fb2e525fa9891549b43310ce187275a57effad79cb4e
-
Filesize
9KB
MD5f2e20abdac54d6f467eb58881149f847
SHA19c03dec6bc9e879b5c536623f02939d88f0eb182
SHA256f36016e5964b57d19d12c4052a35bfe16dc79f015392240e7e91abb821579068
SHA512ad6a587fb175d81dd2968ac5ad03e692d8fda4009d0737509898f26a017f0a83f6b8958d99f4b590bdd655b57ef340a1f7eea4001b186040d45b1b8cb11612f3
-
Filesize
13KB
MD567ba469977ab9c872cd4a1b924a3108e
SHA176452a4d954511a86202c70801d4d278c2875fe9
SHA256842540afde1ae6bbac447e99b64f0fc7c8c50d6c76f280b8ca0b9385d3a5cb3d
SHA512e9a82bdd0dda47efeae3bc746bfc88bcdf5f59fa10d2e2ad4afed3a85b78059e2deab571d89c409132953351bdcdd438cc7993973bcbbb868c4616a3c17c7e1c
-
Filesize
12KB
MD57da8df22de623a50a765103029c00f0d
SHA10cf3e6e6a0ba406d47f129676ad1c31d458623b0
SHA256511c47a97667bf2fffb415edf32bc3ff7d46dfb72a28bb2656c33b4c979a72bc
SHA5122e0c5e6d72689da48dcc72db052371777f6ba91b701ea8ec400948557ee9a9de2dd04ae60446030d4e4353575beb97c52873147ad5faf5b3558789b88692e034
-
Filesize
14KB
MD511adc736fb2d96fcf917f2813b5da61e
SHA1adf5aa016571fae3f8112e02f865905ece847d34
SHA256059ea5d47a422d61ab83afd97cbafa6b20113d4cee3e9ee382979be97d59afdd
SHA5123bc0a2ba0594bc2fc6b4d93df58f28ab9872ece64ac84b361d61b9780b0329abeba9e2e132f99750d3b96fda19207695fe37fc865886205aa8090f7b53ce6bae
-
Filesize
12KB
MD5e892b7e007be46929aa64f39501fc560
SHA16dfd8680e9c643be103fd854d75a7690a96543c8
SHA256750bf427d246a29d304a598e9715984a1b815dad85180c2493f8d74966bf1fe7
SHA5125700fb55e46605e6f494cfb04ac7bcf5331aebd705aab6269f993424ccfefe0b4c0e2d5ad896986c1179cee3c3624770bb2b1b17d8d783c5033378f3ace34101
-
Filesize
13KB
MD5031052f9c566f5fb121ab9a42472f3d5
SHA1b3c8c4d286a6ff9b82d8e02ef83b19d5c62138a1
SHA2563e290482a760e0768b5cdef101a1edd355d1ee45303cae593d8854441b160b4c
SHA512dd302a79b1e328bd3f81227f574e683b6c1e62721d8f675ec03c5cab63c054c3eef849eff8f577b5a8f4a8721c711682183098660b8d883722d3c351bc907d38
-
Filesize
3KB
MD53fc43a6ec2b5b35a20eb1590109426d7
SHA18c34f8266a053633047e74589da69a213d61d8c3
SHA256a85d4174d0bd665e1ed1daea624d1b80e43fd015fb3f1aa8a99816bbc90c5663
SHA5125fe95f93a1c203253a4b55370dcef06d04a4012101c40be0bee02fc65aba7a64e477a64d00450de12ab8afcd7c5473b4a778e93cb508e36cdc6efb4ebcc3058f
-
Filesize
3KB
MD53404c6deb4233c52f8d042f05b87c176
SHA1fe7dd47764c70b09f447f1dabd716f16a19262de
SHA25617b3dcd53fb8c5e168f56c42d4cddb3bc77719d9403ab797775dcf0a8aa05b14
SHA512072c91b18a8d8991db3efb38ba659f984911e3f39ac846f15db89fd85d62d5a70c186be6aefd37647c66704cbd21b4733f402db9ce0d7021928e04a23924eeee
-
Filesize
2KB
MD56b8b008a10027bdc99a18689d5ab6394
SHA12804a643336ef9e25e0277c6bd27fa27dab81762
SHA2563b7a974670e32b027eb33ebbbe1110e47d338abb3c41ffacf2be09dabbedb1e9
SHA512eeb4e332883155fcc490110191e1a7075f72a307c3f0dda28c790fdc0fbab3a0c8c740a5269e8b3ac41d2556875f74bc00875ea6320fb023dd5c94afa2f92a21
-
Filesize
2KB
MD58078c4769f1c2b9deba62a58a1a2d437
SHA1953e20f4bc594af173fd432f92c23fba00b9f0e3
SHA256bda6417eec344a54960dbd63b5eeb65786e34f1f89be19ad653eb404c59aa4d4
SHA5126241a70b2c9ab0ba0bb105907b413acbf0ef87274bbdf5a1f99df17e1de115aa6681577f9430529281c448bf771cb61c5b452e140ea52654d128deefabb47d52
-
Filesize
3KB
MD5cd8b5c25470f61548628a9cea9b1fd0c
SHA1fa91fce8f3674eb8e90e4ccbefd96d95bcc247c0
SHA2563d2f5a93dfd37110bf17ac42c26549dba1fe5750de208ab3b81289091a37d1fd
SHA512f0544e7a9869d2aaaa91a051f544a55fef153cfc45961444fbae6ea2b4897eab1cefcaad2601e01416d490e5061d931b4ce4b3139e0bc8ec75d7f6f45530f0ad
-
Filesize
2KB
MD52d52ef7b8bfb9cf11bf182bf572e755b
SHA1a41abc43b0307e4bfd22db1a2b3f59b49c5633f6
SHA256e6bf2cc994a80050da8931efbac8543656f753f2ee7d6cf5c0e32b9e76d9aeb9
SHA512da3dd99059f9ce2d42128941342ae7ce5cbaf31d15ff0ce176c50dc1093a460df79d9927d8ee973759ed02bbb1ba7886e854f1f239a69ce61e4ec5a8f9dce176
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e3c4e5b4746322ddccf1495b83fe82fa
SHA1c8979368f2955337f9331dec35126c5dea38f111
SHA256936ff19a48f1c3e6fa61206180589eddc88707bc3ee2f19f9d974be1b0059df4
SHA512a897acc81f3f67f2cc10eead2d319cd5742aac0d1366f75512e9568a1ac349dfb8c0d4a2569cf4f6d0c3862cb9b2b4bc1891e9578427e58d8674e754dde7a5bb
-
Filesize
11KB
MD5d24664050630084a238c8cc1e0a4c9b6
SHA12894c0cbf3f8bb1d37f6405ee53b90c4a9d0d1ff
SHA25680beadf42bb1f741a84237fb81cea1cf3db7bf39282bb4fd04aa86f392602b9c
SHA5126e21844b309f1d4d5dc126fc80bc22fc7e91b5cea6969faeb30db9e80ace4b3e72ccc722164dbb84449a77f9a2b6ae2a58b9886a250eeee05241e9145ef0d234
-
Filesize
11KB
MD550c58a8e3a5153873a264024106be760
SHA180f3f9663b69520c28a360dffb7c61aeec7cf22e
SHA25635187c86b52a3bbd6357209f85b5a421853867a8c01eaf8461fbe4137b829d64
SHA512e739a78de1c9125cc629d6d667303232a4769cec682103a5a74b47df970e22e9d04d2a66ea01f4ea34d9fec094bd2a76e7ce5ce7f04e80cae1345043c6a7b123
-
Filesize
11KB
MD531b8da7883bbeacc5b9f19c68c94fb03
SHA133c017a56d476010d6bd28b65139be5baeb8a7c9
SHA256219a367fbbfc0e95579fde3994bd1ddd288222ce35092d2dbca627238dcda42e
SHA512e587dd45c527b1dab86540c055058bfbb34bcd6763451a12a35725fb04c60f21d1477b35ef686325ae9538da8dadc9efe388ff4a8ab6f4dccc70c7e1520f1ba0
-
Filesize
11KB
MD54bb54bd4430f8a8a81ac807811d73eb5
SHA113e9bfed9e45decd55d42dc9ac9ed25ecc94f077
SHA256e339d453957d4cc71db5a8f3c318646544d50edb39575cdc94fc81f27c9b8d13
SHA512ea314c6f4d1d6a174664b48b77bc40d3af69f125af29b16334f90f1cc90f283866bfe469f87474072df1981fe09d0e4a0ce57e43ad1327fed779e1efa7979458
-
Filesize
5B
MD5cb5e100e5a9a3e7f6d1fd97512215282
SHA111f9578d05e6f7bb58a3cdd00107e9f4e3882671
SHA256ca00fccfb408989eddc401062c4d1219a6aceb6b9b55412357f1790862e8f178
SHA5126a162d143889f5200e64400bc53e6b998bdfcf5d7600b633ede12a67ad24efccecff529ebe472963ad738bb7c463a158938d2f681f238e21c0d6f795f4fd1d87
-
Filesize
18B
MD5983adacfd38604b038cefe3056d8b7ad
SHA17bc8915ef5f9baa92518d15d8d33ab5e5d64d64e
SHA2565bb71f143b55c0f976495d4f72af9fc124273673b592d0f30718a8dab2538360
SHA512a1e8bfe674993a5458927c52c6f8e48a0a39ce6aad41861de8a599b36f45ba78a885f383a65eca8e61b2da1e63f22fb2ff4e9ae22c8bb385ee6294a821060a6c
-
Filesize
3.1MB
MD51fc2b42afe1acac3f9faa480d1c10434
SHA1c2d04503008519ea39d72df912d372f39316ea80
SHA256de8930710715ab8f6c040801e316759cc69c7d2e62aae9db7b3eaacc4cf572af
SHA5124b666b5e796513d6122c0dee277ec623f393259e67e106540cefbdcbccc14c6521c6eed0180a6be3886e7307acb31659df5b7b4a7e40679bec4b6c1b0f1833bb
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408081823521\additional_file0.tmp
Filesize1.4MB
MD5e9a2209b61f4be34f25069a6e54affea
SHA16368b0a81608c701b06b97aeff194ce88fd0e3c0
SHA256e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f
SHA51259e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5
-
Filesize
6.4MB
MD5607fb47ad9d20bb16f90e4a38c93bbfe
SHA1578ea8b4bd0bbd32114bfd61910118c3d9cfc355
SHA2568a82ae5c857123cc6972b93828f3a6202c0db4d325ea6d5b1e36dcfb290c1e09
SHA51223470d0aa5989132efa1fcd4b1d183374384e3b75249910c08e22d2fedf315f084028b7299d6f6c0a5230b2ec78179485d0f187d0a87f710d25f1eac81939e47
-
Filesize
5.9MB
MD51e6485e90130bb0cffd2ae2ca7fef2a2
SHA1b9c01fddb3921b6f56d8d774eb0364f7024428e8
SHA256907cb59383443ce62fdcd2eb90e4bf32cf3a0de6078e708f694dfc7bd7166b5b
SHA512e28ec73e1465591827f092b71ab740a8de0b7ffcf5af0b3e4c1c8be37f16f1a87ae4fdfe23c25a305741a5aaf30fd2aab77f55061eb729f0dc5e64aef3dd6527
-
Filesize
57KB
MD56e001f8d0ee4f09a6673a9e8168836b6
SHA1334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38
SHA2566a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859
SHA5120eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6
-
Filesize
117KB
MD508112f27dcd8f1d779231a7a3e944cb1
SHA139a98a95feb1b6295ad762e22aa47854f57c226f
SHA25611c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa
SHA512afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb
-
Filesize
5.7MB
MD538cc1b5c2a4c510b8d4930a3821d7e0b
SHA1f06d1d695012ace0aef7a45e340b70981ca023ba
SHA256c2ba8645c5c9507d422961ceaeaf422adf6d378c2a7c02199ed760fb37a727f2
SHA51299170f8094f61109d08a6e7cf25e7fba49160b0009277d10e9f0b9dac6f022e7a52e3d822e9aee3f736c2d285c4c3f62a2e6eb3e70f827ac6e8b867eea77f298
-
Filesize
15KB
MD5422be1a0c08185b107050fcf32f8fa40
SHA1c8746a8dad7b4bf18380207b0c7c848362567a92
SHA256723aea78755292d2f4f87ad100a99b37bef951b6b40b62e2e2bbd4df3346d528
SHA512dff51c890cb395665839070d37170d321dc0800981a42f173c6ea570684460146b4936af9d8567a6089bef3a7802ac4931c14031827689ef345ea384ceb47599
-
Filesize
75KB
MD5c06ac6dcfa7780cd781fc9af269e33c0
SHA1f6b69337b369df50427f6d5968eb75b6283c199d
SHA256b23b8310265c14d7e530b80defc6d39cdc638c07d07cd2668e387863c463741d
SHA512ad167ad62913243e97efaeaa7bad38714aba7fc11f48001974d4f9c68615e9bdfb83bf623388008e77d61cee0eaba55ce47ebbb1f378d89067e74a05a11d9fe3
-
Filesize
19KB
MD5554c3e1d68c8b5d04ca7a2264ca44e71
SHA1ef749e325f52179e6875e9b2dd397bee2ca41bb4
SHA2561eb0795b1928f6b0459199dace5affdc0842b6fba87be53ca108661275df2f3e
SHA51258ce13c47e0daf99d66af1ea35984344c0bb11ba70fe92bc4ffa4cd6799d6f13bcad652b6883c0e32c6e155e9c1b020319c90da87cb0830f963639d53a51f9c6
-
Filesize
160KB
MD56df226bda27d26ce4523b80dbf57a9ea
SHA1615f9aba84856026460dc54b581711dad63da469
SHA25617d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc
SHA512988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5
-
Filesize
119KB
MD59d2c520bfa294a6aa0c5cbc6d87caeec
SHA120b390db533153e4bf84f3d17225384b924b391f
SHA256669c812cb8f09799083014a199b0deee10237c95fb49ee107376b952fee5bd89
SHA5127e2e569549edb6ddd2b0cb0012386aed1f069e35d1f3045bb57704ef17b97129deb7cde8e23bc49980e908e1a5a90b739f68f36a1d231b1302a5d29b722e7c15
-
Filesize
8KB
MD5be4c2b0862d2fc399c393fca163094df
SHA17c03c84b2871c27fa0f1914825e504a090c2a550
SHA256c202e4f92b792d34cb6859361aebdbfc8c61cf9e735edfd95e825839920fb88a
SHA512d9c531687a5051bbfe5050c5088623b3fd5f20b1e53dd4d3ed281c8769c15f45da36620231f6d0d76f8e2aa7de00c2324a4bf35a815cefc70ca97bc4ab253799
-
Filesize
154KB
MD517220f65bd242b6a491423d5bb7940c1
SHA1a33fabf2b788e80f0f7f84524fe3ed9b797be7ad
SHA25623056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f
SHA512bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e
-
Filesize
56KB
MD5f931e960cc4ed0d2f392376525ff44db
SHA11895aaa8f5b8314d8a4c5938d1405775d3837109
SHA2561c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA5127fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0
-
Filesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
Filesize
541KB
MD59de86cdf74a30602d6baa7affc8c4a0f
SHA19c79b6fbf85b8b87dd781b20fc38ba2ac0664143
SHA25656032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583
SHA512dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641
-
Filesize
133KB
MD58db691813a26e7d0f1db5e2f4d0d05e3
SHA17c7a33553dd0b50b78bf0ca6974c77088da253eb
SHA2563043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701
SHA512d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f
-
Filesize
26KB
MD5cef027c3341afbcdb83c72080df7f002
SHA1e538f1dd4aee8544d888a616a6ebe4aeecaf1661
SHA256e87db511aa5b8144905cd24d9b425f0d9a7037fface3ca7824b7e23cfddbbbb7
SHA51271ba423c761064937569922f1d1381bd11d23d1d2ed207fc0fead19e9111c1970f2a69b66e0d8a74497277ffc36e0fc119db146b5fd068f4a6b794dc54c5d4bf
-
Filesize
172KB
MD5b199dcd6824a02522a4d29a69ab65058
SHA1f9c7f8c5c6543b80fa6f1940402430b37fa8dce4
SHA2569310a58f26be8bd453cde5ca6aa05042942832711fbdeb5430a2840232bfa5e4
SHA5121d3e85e13ff24640c76848981ca84bafb32f819a082e390cb06fe13445814f50f8e3fc3a8a8e962aae8867e199c1517d570c07f28d5f7e5f007b2bb6e664ddb1
-
Filesize
1KB
MD529f74fbccb8ae8e707cf96ba40dbfa9a
SHA120e300ad8772ee64504d6f47682aacffc8a8cf1b
SHA256f56bb8fe20b8be18b877dfe0dd46ad3c717fc44797db5ec904f1612f815da120
SHA5122b2bb48472ba92ed7a6b5a83d209d0ceacc937135080c6be8e34a7740c91dec26b67fc2ecf67442d78faa79812b78959a32265a2787434b2ecd4357ce79d354b
-
Filesize
5KB
MD5fb18dc96f52616ade6c6fe2a0581ca0c
SHA16bc728733401a64b93fb91a394d859c3f4d5f1cf
SHA25631002d617a900ce0abcba4809a17711db05040958efee547ef64c1b0cc540cff
SHA512a582c57d693df81b062ba13b4d9c7a70a2881102f4de2ffe788680ff2f17207eab686e2a79c6b330a8cdcfcb61ef649aaca5bd4207e26b943754bd51012eb9c5
-
Filesize
1KB
MD59ba0a91b564e22c876e58a8a5921b528
SHA18eb23cab5effc0d0df63120a4dbad3cffcac6f1e
SHA2562ad742b544e72c245f4e9c2e69f989486222477c7eb06e85d28492bd93040941
SHA51238b5fb0f12887a619facce82779cb66e2592e5922d883b9dc4d5f9d2cb12e0f84324422cd881c948f430575febd510e948a22cd291595e3a0ba0307fce73bec9
-
Filesize
16KB
MD52b26f73d382ab69f3914a7d9fda97b0f
SHA1a3f5ad928d4bec107ae2941fa6b23c69d19eedd0
SHA256a6a0b05b1d5c52303dd3e9e2f9cda1e688a490fbe84ea0d6e22a051ab6efd643
SHA512744ff7e91c8d1059f48de97dc816bc7cc0f1a41ea7b8b7e3382ff69bc283255dfdf7b46d708a062967a6c1f2e5138665be2943ed89d7543fc707e752543ac9a7
-
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\images\warning48x48.png
Filesize749B
MD5d3361cf0d689a1b34d84f483d60ba9c9
SHA1d89a9551137ae90f5889ed66e8dc005f85cf99ff
SHA25656739925aada73f9489f9a6b72bfaaa92892b27d20f4d221380ba3eae17f1442
SHA512247cf4c292d62cea6bf46ac3ab236e11f3d3885cd49fdd28958c7493ebb86ace45c9751424f7312f393932d0a7165e2985f56c764d299b7e37f75457eef2d846
-
Filesize
5KB
MD5626313d8f4c859ba6473a8d94dfea5e7
SHA1142a57c5e31d7317b7d52b2d4435df53d4123663
SHA256989e5474b74fbdf5abe98b607870bb7f4757967c51412bc940ecab7dd9babd54
SHA512dbaefd7f7409839971ec87bc0e49fbc4992de9dd319e28bea401b35b0a7952e56281084b123b6bbeb06080706ada0ffabcd0cf2fb3f75986d34f844d8cd50de9
-
Filesize
291B
MD5bf5328e51e8ab1211c509b5a65ab9972
SHA1480dfb920e926d81bce67113576781815fbd1ea4
SHA25698f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b
SHA51292bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928
-
Filesize
10KB
MD51116d7747130f4552a91e61a3a6000b1
SHA1bc36996a664dab24b941ec263679c9d6322e61a2
SHA2565c09c6784f3fdc4a6b2998c4c9e02e366265ee5314c0f982859825576dc0eafd
SHA512af34413f242b64737ac9f7076e449b0d0485842d653d1cad12b54b868f09817d3595cd935ad7e03003d536127c173d624dd9a031c079fdb8f897ab0b7b9474e8
-
Filesize
1014B
MD5cef7a21acf607d44e160eac5a21bdf67
SHA1f24f674250a381d6bf09df16d00dbf617354d315
SHA25673ed0be73f408ab8f15f2da73c839f86fef46d0a269607330b28f9564fae73c7
SHA5125afb4609ef46f156155f7c1b5fed48fd178d7f3395f80fb3a4fb02f454a3f977d8a15f3ef8541af62df83426a3316d31e1b9e2fd77726cf866c75f6d4e7adc2f
-
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\TranslateOfferTemplate.tis
Filesize2KB
MD5551029a3e046c5ed6390cc85f632a689
SHA1b4bd706f753db6ba3c13551099d4eef55f65b057
SHA2567b8c76a85261c5f9e40e49f97e01a14320e9b224ff3d6af8286632ca94cf96f8
SHA51222a67a8371d2aa2fdbc840c8e5452c650cb161e71c39b49d868c66db8b4c47d3297cf83c711ec1d002bc3e3ae16b1e0e4faf2761954ce56c495827306bab677e
-
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\ViewStateLoader.tis
Filesize16KB
MD585c33c8207f5fcb2d31c7ce7322771ac
SHA16b64f919e6b731447b9add9221b3b7570de25061
SHA256940ef5e9f28da759fbf3676fba6da5cc4199b78ffc4fefe078ab11d53e70fb0a
SHA512904188ab57cfb4f3d8c51eb55746ae2589852f271b9fa3840b82bda93f69c9f985e65f67169302d08818b707f36246f83f245470d5175dba5f0ad3a2482740c4
-
Filesize
134KB
MD5105a9e404f7ac841c46380063cc27f50
SHA1ec27d9e1c3b546848324096283797a8644516ee3
SHA25669fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b
SHA5126990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940
-
Filesize
101KB
MD583d37fb4f754c7f4e41605ec3c8608ea
SHA170401de8ce89f809c6e601834d48768c0d65159f
SHA25656db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020
SHA512f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f
-
Filesize
151KB
MD572990c7e32ee6c811ea3d2ea64523234
SHA1a7fcbf83ec6eefb2235d40f51d0d6172d364b822
SHA256e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3
SHA5122908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682
-
Filesize
766B
MD54003efa6e7d44e2cbd3d7486e2e0451a
SHA1a2a9ab4a88cd4732647faa37bbdf726fd885ea1e
SHA256effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508
SHA51286e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198
-
Filesize
426KB
MD58ff1898897f3f4391803c7253366a87b
SHA19bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA25651398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03
-
Filesize
5.6MB
MD5b431083586e39d018e19880ad1a5ce8f
SHA13bbf957ab534d845d485a8698accc0a40b63cedd
SHA256b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b
SHA5127805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b
-
Filesize
74KB
MD51a84957b6e681fca057160cd04e26b27
SHA18d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA2569faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA5125f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
-
Filesize
3.8MB
MD529d3a70cec060614e1691e64162a6c1e
SHA1ce4daf2b1d39a1a881635b393450e435bfb7f7d1
SHA256cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72
SHA51269d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
9.5MB
MD5dae050afc8508ae428be7e560cf02a49
SHA11601f3f652eec4081f988e81031b93caf80b9b5d
SHA25683c010d7c668e4fd51f630077ffa10b7be51d373c2bb7008ed9d3f1dbaf226cf
SHA512edbc3f651c2a1b43bfdf7c6240274db16fe7ab28e8ab7640ed066d8d82c60ac96f6c2aa729f4e8750ef38f2d1382cc20789630817f207eedcd3cf5048d9193ef