Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://getmyfilenow...

windows10-2004-x64

8

Resubmissions

14/09/2024, 21:10

240914-zz4ymawern 3

14/09/2024, 21:09

240914-zzqq1awhkh 3

14/09/2024, 21:06

240914-zx4vvawdqr 8

14/09/2024, 21:01

240914-zvc94swera 8

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 21:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://getmyfilenow.com/lp?id=Celery%20DLL_34763689

Score
8/10
discoveryspywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks for any installed AV software in registry 1 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 8 IoCs
  • Modifies system certificate store 2 TTPs 15 IoCs
    evasionspywaretrojan
  • NTFS ADS 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getmyfilenow.com/lp?id=Celery%20DLL_34763689
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b75546f8,0x7ff9b7554708,0x7ff9b7554718
      2⤵
        PID:3384
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
        2⤵
          PID:3572
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3508
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
          2⤵
            PID:1612
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
            2⤵
              PID:864
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
              2⤵
                PID:3980
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
                2⤵
                  PID:1260
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1072
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5452 /prefetch:8
                  2⤵
                    PID:4896
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
                    2⤵
                      PID:628
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6048 /prefetch:8
                      2⤵
                        PID:1524
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
                        2⤵
                          PID:5036
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                          2⤵
                            PID:1484
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
                            2⤵
                              PID:3660
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
                              2⤵
                                PID:4760
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2468
                              • C:\Users\Admin\Downloads\Celery DLL_34763689.exe
                                "C:\Users\Admin\Downloads\Celery DLL_34763689.exe"
                                2⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:1000
                                • C:\Users\Admin\AppData\Local\setup34763689.exe
                                  C:\Users\Admin\AppData\Local\setup34763689.exe hhwnd=197152 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-1WzsC
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks for any installed AV software in registry
                                  • System Location Discovery: System Language Discovery
                                  • Modifies system certificate store
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5012
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6036
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist /FI "PID eq 5012" /fo csv
                                      5⤵
                                      • Enumerates processes with tasklist
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6076
                                    • C:\Windows\SysWOW64\find.exe
                                      find /I "5012"
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:6084
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 5
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • Delays execution with timeout.exe
                                      PID:6120
                                • C:\Users\Admin\AppData\Local\setup34763689.exe
                                  C:\Users\Admin\AppData\Local\setup34763689.exe hready
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:5612
                                • C:\Windows\SysWOW64\NOTEPAD.EXE
                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Opens file in notepad (likely ransom note)
                                  PID:3128
                                • C:\Users\Admin\AppData\Local\OperaGX.exe
                                  C:\Users\Admin\AppData\Local\OperaGX.exe --silent --allusers=0
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5292
                                  • C:\Users\Admin\AppData\Local\Temp\7zSCA493318\setup.exe
                                    C:\Users\Admin\AppData\Local\Temp\7zSCA493318\setup.exe --silent --allusers=0 --server-tracking-blob=NmQzODU0N2RkMjI4MjE4MTJhMTJmMjE4OWRkYzE3MzI3YThhOWE1MDgxYWVhNTlmY2ViM2VlNDliZWFmZGI1Njp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD0zODJmM2MxYThiNzg0YjU4YWJjNDU4YTM0ZjE3YTNkMSZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInRpbWVzdGFtcCI6IjE3MjYzNDc3NzIuMjg5OCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdPVzY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfMzU3NSIsImNvbnRlbnQiOiIzNTc1X0ZpbGVETSIsImlkIjoiMzgyZjNjMWE4Yjc4NGI1OGFiYzQ1OGEzNGYxN2EzZDEiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJiYmFkYjkwOC02ZmFkLTQ0NzAtODc2My0yM2NhMGNlZjZkZWQifQ==
                                    4⤵
                                    • Executes dropped EXE
                                    • Enumerates connected drives
                                    • System Location Discovery: System Language Discovery
                                    • Modifies system certificate store
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5336
                                    • C:\Users\Admin\AppData\Local\Temp\7zSCA493318\setup.exe
                                      C:\Users\Admin\AppData\Local\Temp\7zSCA493318\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=113.0.5230.75 --initial-client-data=0x310,0x330,0x338,0x334,0x33c,0x6ce31864,0x6ce31870,0x6ce3187c
                                      5⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5368
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
                                      5⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5544
                                    • C:\Users\Admin\AppData\Local\Temp\7zSCA493318\setup.exe
                                      "C:\Users\Admin\AppData\Local\Temp\7zSCA493318\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=5336 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240914210255" --session-guid=c5c57208-0783-4fee-8af0-5bb3b3e675f2 --server-tracking-blob=OGRkOGJkNWFjZjU1MWExYjQ4MmVhYTNmNTYyMzA2MmYyYTFkN2E1NDEyYzI1MzM3YjI2ODA4ZmQzMmRlOWY3Mjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD0zODJmM2MxYThiNzg0YjU4YWJjNDU4YTM0ZjE3YTNkMSZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcyNjM0Nzc3Mi4yODk4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1BCNV8zNTc1IiwiY29udGVudCI6IjM1NzVfRmlsZURNIiwiaWQiOiIzODJmM2MxYThiNzg0YjU4YWJjNDU4YTM0ZjE3YTNkMSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImJiYWRiOTA4LTZmYWQtNDQ3MC04NzYzLTIzY2EwY2VmNmRlZCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E805000000000000
                                      5⤵
                                      • Executes dropped EXE
                                      • Enumerates connected drives
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1564
                                      • C:\Users\Admin\AppData\Local\Temp\7zSCA493318\setup.exe
                                        C:\Users\Admin\AppData\Local\Temp\7zSCA493318\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=113.0.5230.75 --initial-client-data=0x308,0x340,0x344,0x33c,0x348,0x6c091864,0x6c091870,0x6c09187c
                                        6⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:5500
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409142102551\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409142102551\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:6052
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409142102551\assistant\assistant_installer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409142102551\assistant\assistant_installer.exe" --version
                                      5⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5372
                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409142102551\assistant\assistant_installer.exe
                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409142102551\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x5e4f48,0x5e4f58,0x5e4f64
                                        6⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:5560
                              • C:\Users\Admin\Downloads\Celery DLL_34763689.exe
                                "C:\Users\Admin\Downloads\Celery DLL_34763689.exe"
                                2⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SetWindowsHookEx
                                PID:5180
                                • C:\Users\Admin\AppData\Local\setup34763689.exe
                                  C:\Users\Admin\AppData\Local\setup34763689.exe hhwnd=589858 hreturntoinstaller hextras=id:964bc9f9d4b9a45-US-1WzsC
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Modifies system certificate store
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5452
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5672
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist /FI "PID eq 5452" /fo csv
                                      5⤵
                                      • Enumerates processes with tasklist
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5712
                                    • C:\Windows\SysWOW64\find.exe
                                      find /I "5452"
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5720
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 5
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • Delays execution with timeout.exe
                                      PID:5768
                                • C:\Users\Admin\AppData\Local\setup34763689.exe
                                  C:\Users\Admin\AppData\Local\setup34763689.exe hready
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:5884
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
                                2⤵
                                  PID:4864
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2216 /prefetch:1
                                  2⤵
                                    PID:2280
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
                                    2⤵
                                      PID:3348
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
                                      2⤵
                                        PID:3904
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
                                        2⤵
                                          PID:6028
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5608 /prefetch:8
                                          2⤵
                                            PID:6112
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6728 /prefetch:8
                                            2⤵
                                              PID:348
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
                                              2⤵
                                                PID:5048
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
                                                2⤵
                                                  PID:5064
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5792 /prefetch:8
                                                  2⤵
                                                    PID:5956
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5536 /prefetch:2
                                                    2⤵
                                                      PID:5200
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
                                                      2⤵
                                                        PID:2168
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
                                                        2⤵
                                                          PID:5920
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                                                          2⤵
                                                            PID:1076
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
                                                            2⤵
                                                              PID:5992
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
                                                              2⤵
                                                                PID:5976
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6328 /prefetch:8
                                                                2⤵
                                                                  PID:3916
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6204 /prefetch:8
                                                                  2⤵
                                                                  • Modifies registry class
                                                                  PID:4400
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15105453259587665246,15954187015494402434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
                                                                  2⤵
                                                                    PID:5548
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:5044
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:1020
                                                                    • C:\Windows\System32\rundll32.exe
                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                      1⤵
                                                                        PID:3104
                                                                      • C:\Windows\system32\OpenWith.exe
                                                                        C:\Windows\system32\OpenWith.exe -Embedding
                                                                        1⤵
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:5172
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\CeleryAPI.dll"
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Checks processor information in registry
                                                                          • Modifies Internet Explorer settings
                                                                          PID:3464
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5228
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=30CB4E1811F6C37494F1962777D7CB41 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3640
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=90B7E1BF752A7F99EBA2BE6A70075ABF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=90B7E1BF752A7F99EBA2BE6A70075ABF --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:764
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=582A782C7E481E1A069380A08FE0471D --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4528
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E0963B142838964DC27453DE58644A5A --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3192
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BB405E6B9507CF68798D001533134227 --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2040
                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                        1⤵
                                                                          PID:1020
                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                          C:\Windows\system32\AUDIODG.EXE 0x488 0x410
                                                                          1⤵
                                                                            PID:1432

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
                                                                            Filesize

                                                                            854B

                                                                            MD5

                                                                            e935bc5762068caf3e24a2683b1b8a88

                                                                            SHA1

                                                                            82b70eb774c0756837fe8d7acbfeec05ecbf5463

                                                                            SHA256

                                                                            a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

                                                                            SHA512

                                                                            bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            91b819a106b3aec08f33b2e76897d275

                                                                            SHA1

                                                                            9b5f13c48178458222836a718b6485062312cb3d

                                                                            SHA256

                                                                            c324f1a9c38e78a8ff17e5f25d3a70293c8dd50fd6499e45157acfa03f94891a

                                                                            SHA512

                                                                            878317e4bc7cadde080e85c57fbd2020d6e641277c3eedbe97ad439d0c324270709a9adca71213e7b9a1751dbe7c36960756224306105780b40a742938eb2670

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7AC808F2E889734EBC6F689B70B91F12_618D34F351E24C6C0410CC0C828FF379
                                                                            Filesize

                                                                            471B

                                                                            MD5

                                                                            df119beeade441c8dce0f53e9138eaa0

                                                                            SHA1

                                                                            2b46b2a8cee729dfbb072387998a4eaf3a117c3d

                                                                            SHA256

                                                                            d9a4cc2c34f103365221a1dcc5db97b0d5bee23ad4565772ea9f4bda187159fe

                                                                            SHA512

                                                                            5d60291801c4767e17a9878440aa411bd8e9f2fd94e5cf645257dd099bdcb6053c60ac6bd76f755190ea6e765869ec40949125aed41b95500f5ddaca550d6db2

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
                                                                            Filesize

                                                                            170B

                                                                            MD5

                                                                            8031fd11058e5b2ed88ba0ca16933ad2

                                                                            SHA1

                                                                            97f47085642e8cac6ab6817a6651d19a69cc7f84

                                                                            SHA256

                                                                            81515f78be32c45bb2a546a8585d6e4b651b1b652ed0738816b92ef2627e839f

                                                                            SHA512

                                                                            2189895da0fd1bbeffc9d17823032bb972adc81719878ca7298b2fb8a749bd6172a90ff835f815bd6a233466352ba399366c4f7a4b643781d2fc8efea23c09b3

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                            Filesize

                                                                            410B

                                                                            MD5

                                                                            949c05565f300f11eb2db80a6d5e3e45

                                                                            SHA1

                                                                            9c41d38469eebe2df2f6ca6048c674de652085be

                                                                            SHA256

                                                                            0194bbebd30ac48a402de014d5ad11c6fea0c77c70b6a2343f5e3ccdb7892c32

                                                                            SHA512

                                                                            afc35881e65127af5609f192b8db04ec9b95998540f6fd59e2107cd136d5da6a0eac41a1072975e587914900eda746a7200f2d5e7e0db88a92ddc19f7adb76bf

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7AC808F2E889734EBC6F689B70B91F12_618D34F351E24C6C0410CC0C828FF379
                                                                            Filesize

                                                                            414B

                                                                            MD5

                                                                            214d26c22d27b76f69855c525e9f3240

                                                                            SHA1

                                                                            5a0a3dee7557c8508e1b0bbbfa07780f5b256940

                                                                            SHA256

                                                                            22fdcbf657fd660734ee68d9bcd84c8ab9f59bbede3ecead287ce02a7d4a5466

                                                                            SHA512

                                                                            156c8f6d151c93a97406c24d81b7aef8ebee18d0ce123b6b7c661ed05ddd97751285270a50147e475ae188ec164811cbd99ba14590243251f679896313d5cd2d

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\DT001\setup34763689.exe_Url_t3gbv5pzdz4mnjiaqevzjjnbrzucesiw\2.0.5.6649\z5uc1mlg.newcfg
                                                                            Filesize

                                                                            798B

                                                                            MD5

                                                                            f3da41e2f01ec12a28efa662df2fa963

                                                                            SHA1

                                                                            9760227f497132829ec34fffec6184969043bba1

                                                                            SHA256

                                                                            a4544f806b5637e45e2e702c7997d0b6a52b805670a72aac518d189c3004d1c2

                                                                            SHA512

                                                                            ae4f56f93a2386abe8891ba5ba1cc7de166a28c6a2f3913870bed2926ac43469bbbf0b4b18acf2fce7c7f120056e36b3777aabbdf9715cc12d2159403e392e59

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                            Filesize

                                                                            152B

                                                                            MD5

                                                                            9e3fc58a8fb86c93d19e1500b873ef6f

                                                                            SHA1

                                                                            c6aae5f4e26f5570db5e14bba8d5061867a33b56

                                                                            SHA256

                                                                            828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

                                                                            SHA512

                                                                            e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                            Filesize

                                                                            152B

                                                                            MD5

                                                                            27304926d60324abe74d7a4b571c35ea

                                                                            SHA1

                                                                            78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

                                                                            SHA256

                                                                            7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

                                                                            SHA512

                                                                            f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                            Filesize

                                                                            473B

                                                                            MD5

                                                                            3d8b3442466ed31cb6b332fb0a8c2124

                                                                            SHA1

                                                                            1b671e74043073fce509cc2fa4d7ec639a1d5d3e

                                                                            SHA256

                                                                            c332638aa16a0a3f1533e919b57b30f38f5815d7bf55d5b592e5925ce85d0eba

                                                                            SHA512

                                                                            9ef289a9117660cf5b4e4a5408ebd35f9aee6f73ba2ddaeed5f9c0be495566223e56618ba21d4776fa26ceeda1c2e1b04ec6852dfe8b7f6fd7595c89c9efb191

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                            Filesize

                                                                            543B

                                                                            MD5

                                                                            4a7dabc31efc23b50b5411b5d1e48ed4

                                                                            SHA1

                                                                            b4cab5208cd2690f4b1797229744212a9d21812c

                                                                            SHA256

                                                                            974d26b5775b29e1c5c609cea5463aebe621545332fc139b116946535792734d

                                                                            SHA512

                                                                            e145cd949048d523d42d841e7954a7fc136ba08bd5b2016986fb4b0e792f2403b6975b794fa9b65efd0b4cf42c8aafaf735ac06591b84635205e88197afb0cf7

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            4469c30ffaa77bd04b0c4c5464e5a549

                                                                            SHA1

                                                                            26214f253c7151688d55d6c3a94057befc4b35d1

                                                                            SHA256

                                                                            659cd5f260477fce68e774e428489f14177f0a4c8f73fc6b230f3156eb2b21ce

                                                                            SHA512

                                                                            a8bab32e417618bfafdf4a6e131b17e6c846260af4f8c4a53c72427fcacf7bc364c63cdeb0787834337d6edfec9f19a569dffba0bdebcc08783e648740a3ad5c

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            137092586eff96f6d437e61c32d846fe

                                                                            SHA1

                                                                            ef7ee19b6e6f2ac44fe019ca97f5243223abc61d

                                                                            SHA256

                                                                            8a8e594b70c1d6b846ad38310873b243888ae0e62fcc0de8aee51afcb5e2e878

                                                                            SHA512

                                                                            96cbe83aa7358336f5067994ff5c9163528a29f518cb1bd37acb35b7fdae89383bb9ff6b68cef1ca3a447297d64423130353e2650c361b1b20cdfd651b777bba

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            Filesize

                                                                            5KB

                                                                            MD5

                                                                            3f8e7e03aa53cebe6ad2d05f5182cd2b

                                                                            SHA1

                                                                            0ebf51e036c8eaee2af79b196069ee7b5c520e0b

                                                                            SHA256

                                                                            34f529aac4129a88357bd4c81776f371c67dcb28581095122a96967360d2506a

                                                                            SHA512

                                                                            efe8de554cf489592065ccae5021668f24c79e040c9a51a9a2c2a34402f84b98da5ee2a00971c856db31798285063105cff79c9ebdefe05f4fce754592eeb7b2

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            5d6f1e5cc4a2434c9bae22d294b9829e

                                                                            SHA1

                                                                            615db733a30752f2f125bd5803340ff4b499eb67

                                                                            SHA256

                                                                            ce6177664ae5842087ec48fdc713f683a07ae66446212f5ebaad7a7d3e807d4a

                                                                            SHA512

                                                                            552c2548e9860b27ae509f84f577ab782bfa8328f51af0609639e4a04210774257f79ceef5991cfdbfe9ae56c6d8e3aa6b023e7bd006ef5b378ffcc0d15bad80

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                            Filesize

                                                                            16B

                                                                            MD5

                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                            SHA1

                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                            SHA256

                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                            SHA512

                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            Filesize

                                                                            10KB

                                                                            MD5

                                                                            4a71cdf7d9f0eef87adff62e5ec2edab

                                                                            SHA1

                                                                            39edcf1339287222dc84f848b9ad14db1bc03418

                                                                            SHA256

                                                                            b4ae50bdad34bd89e73468b46717a264a30d1ae8a1667a3553ce25a6e22a1b01

                                                                            SHA512

                                                                            41bfbdc5b947b5cccea4772aeefd5c98db860af3f452a2a158f5225fc590d9691829cf3ad2f9b003a925b84918a2be81ec35ef8df36ddbd26eea1f21a65580bc

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            Filesize

                                                                            10KB

                                                                            MD5

                                                                            f637ca9d166570db88be7ba0f3eb850b

                                                                            SHA1

                                                                            b68111c7e3b484e5a814205e8043d27993928709

                                                                            SHA256

                                                                            c869a1fc0373944e9fca3b920b6720efef30f20bfd685bea068800bf0e01c15e

                                                                            SHA512

                                                                            36ff274076dc9eb97d1d0119e7e865fa4614f3c931c921bc7b7134e11940037391acbbc16a8b6a80262564b3f86c58cd19906f6db3accb18547ec213f74facc2

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            0ae9de72236e0ef66a5f85a5f2b811ee

                                                                            SHA1

                                                                            f9c480f47c5e247ad75b36d3be63fcb68725c219

                                                                            SHA256

                                                                            ad732da26fd45eafa99949681d1bae261d8d70c52ac41dbb8006dded1a8330eb

                                                                            SHA512

                                                                            c1796f2b700211dc1501d7ad9f6c2c610a76f4d59da71901c485a9ebbd63d7d387b15d54cec5ce8bd051bfb0fdc524976e47bf7b281f235b6923acdafd429ca2

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KQ3665LB\geo[1].htm
                                                                            Filesize

                                                                            18B

                                                                            MD5

                                                                            983adacfd38604b038cefe3056d8b7ad

                                                                            SHA1

                                                                            7bc8915ef5f9baa92518d15d8d33ab5e5d64d64e

                                                                            SHA256

                                                                            5bb71f143b55c0f976495d4f72af9fc124273673b592d0f30718a8dab2538360

                                                                            SHA512

                                                                            a1e8bfe674993a5458927c52c6f8e48a0a39ce6aad41861de8a599b36f45ba78a885f383a65eca8e61b2da1e63f22fb2ff4e9ae22c8bb385ee6294a821060a6c

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\OperaGX.exe
                                                                            Filesize

                                                                            3.1MB

                                                                            MD5

                                                                            bc3b3edd11177010b34b4ec816b7ee54

                                                                            SHA1

                                                                            d9c53992f35976478e2dd47844f00180417e2401

                                                                            SHA256

                                                                            5e396651cfc64fc8cbf515b038780e8f822ed4cd83d565ee6ee6d2085560cc4a

                                                                            SHA512

                                                                            35578bf2f91194fd5fd126ee3d0606671581ae7e10afd8302b74930ab4bab42d47647a63d3802afd3f5e3ba3dab8d636fb89bc74aef852cd240a192fda132374

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409142102551\additional_file0.tmp
                                                                            Filesize

                                                                            1.4MB

                                                                            MD5

                                                                            e9a2209b61f4be34f25069a6e54affea

                                                                            SHA1

                                                                            6368b0a81608c701b06b97aeff194ce88fd0e3c0

                                                                            SHA256

                                                                            e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

                                                                            SHA512

                                                                            59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                                            Filesize

                                                                            6.3MB

                                                                            MD5

                                                                            eb798e91d503b97614756193e195a7b1

                                                                            SHA1

                                                                            06367f70a0b4c6de9e208c419beb84fa10c0eeef

                                                                            SHA256

                                                                            406b5edbd94bc38ce345d3c0f34b6b5fcd0405bd290a2ad0fd55c08b0695eed8

                                                                            SHA512

                                                                            5738431f355f599e88ec8b603f692a23a779ef41183ee1ebad3f7c81a9296a3df626d852cca1256791cc665d912f8f73c4ac00a15e4f96259c253290a40ba020

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2409142102546545368.dll
                                                                            Filesize

                                                                            5.8MB

                                                                            MD5

                                                                            d9566efedb5ea286e12826594a40e623

                                                                            SHA1

                                                                            eba69b688be145e73103ec9587db22e072ee9fb5

                                                                            SHA256

                                                                            d09af4042577f9c1c72863df791b0114d25086cbf9fa3012b765157ddcbbdf33

                                                                            SHA512

                                                                            daa4adc5f254088d3b8d22d27b5af3d3663630017903f64377579cba46c0b8e4ffa427b7e51ccdc214e70ed835e2ff9ec2baf4a28a194a1c22dd2ee2abf653bb

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll
                                                                            Filesize

                                                                            57KB

                                                                            MD5

                                                                            6e001f8d0ee4f09a6673a9e8168836b6

                                                                            SHA1

                                                                            334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38

                                                                            SHA256

                                                                            6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859

                                                                            SHA512

                                                                            0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll
                                                                            Filesize

                                                                            117KB

                                                                            MD5

                                                                            08112f27dcd8f1d779231a7a3e944cb1

                                                                            SHA1

                                                                            39a98a95feb1b6295ad762e22aa47854f57c226f

                                                                            SHA256

                                                                            11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa

                                                                            SHA512

                                                                            afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OCommonResources.dll
                                                                            Filesize

                                                                            5.7MB

                                                                            MD5

                                                                            38cc1b5c2a4c510b8d4930a3821d7e0b

                                                                            SHA1

                                                                            f06d1d695012ace0aef7a45e340b70981ca023ba

                                                                            SHA256

                                                                            c2ba8645c5c9507d422961ceaeaf422adf6d378c2a7c02199ed760fb37a727f2

                                                                            SHA512

                                                                            99170f8094f61109d08a6e7cf25e7fba49160b0009277d10e9f0b9dac6f022e7a52e3d822e9aee3f736c2d285c4c3f62a2e6eb3e70f827ac6e8b867eea77f298

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2ODAL.dll
                                                                            Filesize

                                                                            15KB

                                                                            MD5

                                                                            422be1a0c08185b107050fcf32f8fa40

                                                                            SHA1

                                                                            c8746a8dad7b4bf18380207b0c7c848362567a92

                                                                            SHA256

                                                                            723aea78755292d2f4f87ad100a99b37bef951b6b40b62e2e2bbd4df3346d528

                                                                            SHA512

                                                                            dff51c890cb395665839070d37170d321dc0800981a42f173c6ea570684460146b4936af9d8567a6089bef3a7802ac4931c14031827689ef345ea384ceb47599

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OModels.dll
                                                                            Filesize

                                                                            75KB

                                                                            MD5

                                                                            c06ac6dcfa7780cd781fc9af269e33c0

                                                                            SHA1

                                                                            f6b69337b369df50427f6d5968eb75b6283c199d

                                                                            SHA256

                                                                            b23b8310265c14d7e530b80defc6d39cdc638c07d07cd2668e387863c463741d

                                                                            SHA512

                                                                            ad167ad62913243e97efaeaa7bad38714aba7fc11f48001974d4f9c68615e9bdfb83bf623388008e77d61cee0eaba55ce47ebbb1f378d89067e74a05a11d9fe3

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OResources.dll
                                                                            Filesize

                                                                            19KB

                                                                            MD5

                                                                            554c3e1d68c8b5d04ca7a2264ca44e71

                                                                            SHA1

                                                                            ef749e325f52179e6875e9b2dd397bee2ca41bb4

                                                                            SHA256

                                                                            1eb0795b1928f6b0459199dace5affdc0842b6fba87be53ca108661275df2f3e

                                                                            SHA512

                                                                            58ce13c47e0daf99d66af1ea35984344c0bb11ba70fe92bc4ffa4cd6799d6f13bcad652b6883c0e32c6e155e9c1b020319c90da87cb0830f963639d53a51f9c6

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll
                                                                            Filesize

                                                                            160KB

                                                                            MD5

                                                                            6df226bda27d26ce4523b80dbf57a9ea

                                                                            SHA1

                                                                            615f9aba84856026460dc54b581711dad63da469

                                                                            SHA256

                                                                            17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc

                                                                            SHA512

                                                                            988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OUtilities.dll
                                                                            Filesize

                                                                            119KB

                                                                            MD5

                                                                            9d2c520bfa294a6aa0c5cbc6d87caeec

                                                                            SHA1

                                                                            20b390db533153e4bf84f3d17225384b924b391f

                                                                            SHA256

                                                                            669c812cb8f09799083014a199b0deee10237c95fb49ee107376b952fee5bd89

                                                                            SHA512

                                                                            7e2e569549edb6ddd2b0cb0012386aed1f069e35d1f3045bb57704ef17b97129deb7cde8e23bc49980e908e1a5a90b739f68f36a1d231b1302a5d29b722e7c15

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OViewModels.dll
                                                                            Filesize

                                                                            8KB

                                                                            MD5

                                                                            be4c2b0862d2fc399c393fca163094df

                                                                            SHA1

                                                                            7c03c84b2871c27fa0f1914825e504a090c2a550

                                                                            SHA256

                                                                            c202e4f92b792d34cb6859361aebdbfc8c61cf9e735edfd95e825839920fb88a

                                                                            SHA512

                                                                            d9c531687a5051bbfe5050c5088623b3fd5f20b1e53dd4d3ed281c8769c15f45da36620231f6d0d76f8e2aa7de00c2324a4bf35a815cefc70ca97bc4ab253799

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\HtmlAgilityPack.dll
                                                                            Filesize

                                                                            154KB

                                                                            MD5

                                                                            17220f65bd242b6a491423d5bb7940c1

                                                                            SHA1

                                                                            a33fabf2b788e80f0f7f84524fe3ed9b797be7ad

                                                                            SHA256

                                                                            23056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f

                                                                            SHA512

                                                                            bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Core.dll
                                                                            Filesize

                                                                            56KB

                                                                            MD5

                                                                            f931e960cc4ed0d2f392376525ff44db

                                                                            SHA1

                                                                            1895aaa8f5b8314d8a4c5938d1405775d3837109

                                                                            SHA256

                                                                            1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

                                                                            SHA512

                                                                            7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Extension.dll
                                                                            Filesize

                                                                            168KB

                                                                            MD5

                                                                            28f1996059e79df241388bd9f89cf0b1

                                                                            SHA1

                                                                            6ad6f7cde374686a42d9c0fcebadaf00adf21c76

                                                                            SHA256

                                                                            c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

                                                                            SHA512

                                                                            9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Newtonsoft.Json.dll
                                                                            Filesize

                                                                            541KB

                                                                            MD5

                                                                            9de86cdf74a30602d6baa7affc8c4a0f

                                                                            SHA1

                                                                            9c79b6fbf85b8b87dd781b20fc38ba2ac0664143

                                                                            SHA256

                                                                            56032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583

                                                                            SHA512

                                                                            dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Ninject.dll
                                                                            Filesize

                                                                            133KB

                                                                            MD5

                                                                            8db691813a26e7d0f1db5e2f4d0d05e3

                                                                            SHA1

                                                                            7c7a33553dd0b50b78bf0ca6974c77088da253eb

                                                                            SHA256

                                                                            3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701

                                                                            SHA512

                                                                            d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferSDK.dll
                                                                            Filesize

                                                                            172KB

                                                                            MD5

                                                                            b199dcd6824a02522a4d29a69ab65058

                                                                            SHA1

                                                                            f9c7f8c5c6543b80fa6f1940402430b37fa8dce4

                                                                            SHA256

                                                                            9310a58f26be8bd453cde5ca6aa05042942832711fbdeb5430a2840232bfa5e4

                                                                            SHA512

                                                                            1d3e85e13ff24640c76848981ca84bafb32f819a082e390cb06fe13445814f50f8e3fc3a8a8e962aae8867e199c1517d570c07f28d5f7e5f007b2bb6e664ddb1

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\OfferPage.html
                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            9ba0a91b564e22c876e58a8a5921b528

                                                                            SHA1

                                                                            8eb23cab5effc0d0df63120a4dbad3cffcac6f1e

                                                                            SHA256

                                                                            2ad742b544e72c245f4e9c2e69f989486222477c7eb06e85d28492bd93040941

                                                                            SHA512

                                                                            38b5fb0f12887a619facce82779cb66e2592e5922d883b9dc4d5f9d2cb12e0f84324422cd881c948f430575febd510e948a22cd291595e3a0ba0307fce73bec9

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll
                                                                            Filesize

                                                                            134KB

                                                                            MD5

                                                                            105a9e404f7ac841c46380063cc27f50

                                                                            SHA1

                                                                            ec27d9e1c3b546848324096283797a8644516ee3

                                                                            SHA256

                                                                            69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b

                                                                            SHA512

                                                                            6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.Net.dll
                                                                            Filesize

                                                                            101KB

                                                                            MD5

                                                                            83d37fb4f754c7f4e41605ec3c8608ea

                                                                            SHA1

                                                                            70401de8ce89f809c6e601834d48768c0d65159f

                                                                            SHA256

                                                                            56db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020

                                                                            SHA512

                                                                            f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll
                                                                            Filesize

                                                                            151KB

                                                                            MD5

                                                                            72990c7e32ee6c811ea3d2ea64523234

                                                                            SHA1

                                                                            a7fcbf83ec6eefb2235d40f51d0d6172d364b822

                                                                            SHA256

                                                                            e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3

                                                                            SHA512

                                                                            2908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dll
                                                                            Filesize

                                                                            426KB

                                                                            MD5

                                                                            8ff1898897f3f4391803c7253366a87b

                                                                            SHA1

                                                                            9bdbeed8f75a892b6b630ef9e634667f4c620fa0

                                                                            SHA256

                                                                            51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

                                                                            SHA512

                                                                            cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\sciter32.dll
                                                                            Filesize

                                                                            5.6MB

                                                                            MD5

                                                                            b431083586e39d018e19880ad1a5ce8f

                                                                            SHA1

                                                                            3bbf957ab534d845d485a8698accc0a40b63cedd

                                                                            SHA256

                                                                            b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b

                                                                            SHA512

                                                                            7805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dll
                                                                            Filesize

                                                                            74KB

                                                                            MD5

                                                                            1a84957b6e681fca057160cd04e26b27

                                                                            SHA1

                                                                            8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

                                                                            SHA256

                                                                            9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

                                                                            SHA512

                                                                            5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\setup34763689.exe
                                                                            Filesize

                                                                            3.8MB

                                                                            MD5

                                                                            29d3a70cec060614e1691e64162a6c1e

                                                                            SHA1

                                                                            ce4daf2b1d39a1a881635b393450e435bfb7f7d1

                                                                            SHA256

                                                                            cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72

                                                                            SHA512

                                                                            69d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b

                                                                            Download Submit

                                                                          • C:\Users\Admin\Downloads\Celery DLL_34763689.exe
                                                                            Filesize

                                                                            9.5MB

                                                                            MD5

                                                                            2ba8c3c68e800a1d528f5b02fbc5e239

                                                                            SHA1

                                                                            44ce2f4f9028724899b2dd1ff36864f9c82d1840

                                                                            SHA256

                                                                            bbadb6ccbd7d9d7dee928cf1c31b377b8b5732390bb22b76ed8b2015ac69aa3f

                                                                            SHA512

                                                                            0e947fef1616c2a189e56c341bd29f2dbe91b9f45272f5f83cd0c0fe299dc36da758434d58a97d04b31d44662faee1e4838df6446da49e4a39986430e4713958

                                                                            Download Submit

                                                                          • C:\Users\Admin\Downloads\CeleryAPI.dll
                                                                            Filesize

                                                                            21KB

                                                                            MD5

                                                                            99a217bdc8c685c3b0a319d9ea8a14db

                                                                            SHA1

                                                                            4033ddd18b8050575fdc6c59476469e681c6a5d2

                                                                            SHA256

                                                                            77d28d642ae0933ae522351fdb0b610045bbbf7911cfc8d8febbdea981a4ca19

                                                                            SHA512

                                                                            2675b79714d748339bc041508c4ace30ea5a19e931f1b85ca3010e2642e3859c5089763a54346d02da7788b8daa3500664b3e471be63c5c6282e242272a8bdf5

                                                                            Download Submit

                                                                          • memory/5012-276-0x0000000006920000-0x00000000069B2000-memory.dmp

                                                                            Filesize

                                                                            584KB

                                                                            Download

                                                                          • memory/5012-151-0x0000000004F10000-0x0000000004F38000-memory.dmp

                                                                            Filesize

                                                                            160KB

                                                                            Download

                                                                          • memory/5012-250-0x0000000005D50000-0x0000000005D5A000-memory.dmp

                                                                            Filesize

                                                                            40KB

                                                                            Download

                                                                          • memory/5012-297-0x0000000005410000-0x000000000543E000-memory.dmp

                                                                            Filesize

                                                                            184KB

                                                                            Download

                                                                          • memory/5012-199-0x0000000005080000-0x00000000050AC000-memory.dmp

                                                                            Filesize

                                                                            176KB

                                                                            Download

                                                                          • memory/5012-191-0x0000000005030000-0x0000000005038000-memory.dmp

                                                                            Filesize

                                                                            32KB

                                                                            Download

                                                                          • memory/5012-175-0x0000000004FF0000-0x0000000005014000-memory.dmp

                                                                            Filesize

                                                                            144KB

                                                                            Download

                                                                          • memory/5012-183-0x0000000004F60000-0x0000000004F6A000-memory.dmp

                                                                            Filesize

                                                                            40KB

                                                                            Download

                                                                          • memory/5012-167-0x0000000004F40000-0x0000000004F5A000-memory.dmp

                                                                            Filesize

                                                                            104KB

                                                                            Download

                                                                          • memory/5012-159-0x0000000004F80000-0x0000000004FB2000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                            Download

                                                                          • memory/5012-143-0x0000000004E90000-0x0000000004EBE000-memory.dmp

                                                                            Filesize

                                                                            184KB

                                                                            Download

                                                                          • memory/5012-209-0x0000000005050000-0x000000000506D000-memory.dmp

                                                                            Filesize

                                                                            116KB

                                                                            Download

                                                                          • memory/5012-135-0x0000000004E60000-0x0000000004E88000-memory.dmp

                                                                            Filesize

                                                                            160KB

                                                                            Download

                                                                          • memory/5012-127-0x0000000004E30000-0x0000000004E54000-memory.dmp

                                                                            Filesize

                                                                            144KB

                                                                            Download

                                                                          • memory/5012-119-0x0000000004DE0000-0x0000000004DF4000-memory.dmp

                                                                            Filesize

                                                                            80KB

                                                                            Download

                                                                          • memory/5012-267-0x0000000007810000-0x0000000007DC4000-memory.dmp

                                                                            Filesize

                                                                            5.7MB

                                                                            Download

                                                                          • memory/5012-226-0x00000000056F0000-0x0000000005702000-memory.dmp

                                                                            Filesize

                                                                            72KB

                                                                            Download

                                                                          • memory/5012-261-0x0000000006CA0000-0x0000000007244000-memory.dmp

                                                                            Filesize

                                                                            5.6MB

                                                                            Download

                                                                          • memory/5012-258-0x00000000066C0000-0x00000000066CC000-memory.dmp

                                                                            Filesize

                                                                            48KB

                                                                            Download

                                                                          • memory/5012-97-0x0000000000060000-0x0000000000438000-memory.dmp

                                                                            Filesize

                                                                            3.8MB

                                                                            Download

                                                                          • memory/5012-245-0x0000000005DD0000-0x0000000005E5C000-memory.dmp

                                                                            Filesize

                                                                            560KB

                                                                            Download

                                                                          • memory/5012-252-0x0000000006000000-0x0000000006354000-memory.dmp

                                                                            Filesize

                                                                            3.3MB

                                                                            Download

                                                                          • memory/5012-251-0x0000000005FD0000-0x0000000005FF2000-memory.dmp

                                                                            Filesize

                                                                            136KB

                                                                            Download