Overview

overview

8

Static

static

1

URLScan

urlscan

https://deltaexploit...

windows11-21h2-x64

8

Analysis

  • max time kernel
    303s
  • max time network
    316s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/11/2024, 05:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://deltaexploits.gg/

Score
8/10
defense_evasiondiscoveryspywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery
  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 44 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 57 IoCs
  • Modifies registry class 4 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • NTFS ADS 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    1⤵
    • Executes dropped EXE
    PID:1152
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://deltaexploits.gg/
    1⤵
    • Loads dropped DLL
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0x88,0x108,0x7ffedfe1cc40,0x7ffedfe1cc4c,0x7ffedfe1cc58
      2⤵
        PID:3856
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1796 /prefetch:2
        2⤵
          PID:1596
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2032,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2096 /prefetch:3
          2⤵
            PID:4752
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1216,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2396 /prefetch:8
            2⤵
              PID:2792
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3116 /prefetch:1
              2⤵
                PID:1956
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3156 /prefetch:1
                2⤵
                  PID:1068
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3520,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4484 /prefetch:1
                  2⤵
                    PID:2040
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4652,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4616 /prefetch:1
                    2⤵
                      PID:3044
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3152,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4596 /prefetch:1
                      2⤵
                        PID:4960
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4872,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4864 /prefetch:8
                        2⤵
                          PID:1180
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4624,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4768 /prefetch:1
                          2⤵
                            PID:2232
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5136,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5152 /prefetch:8
                            2⤵
                              PID:3912
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5132,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5292 /prefetch:8
                              2⤵
                                PID:1588
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5440,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5452 /prefetch:8
                                2⤵
                                  PID:3332
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5404,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5180 /prefetch:1
                                  2⤵
                                    PID:3948
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4784,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4724 /prefetch:1
                                    2⤵
                                      PID:1312
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5420,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3200 /prefetch:1
                                      2⤵
                                        PID:4088
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3080,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5208 /prefetch:1
                                        2⤵
                                          PID:3940
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5304,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1040 /prefetch:1
                                          2⤵
                                            PID:1492
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5216,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5392 /prefetch:1
                                            2⤵
                                              PID:2876
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5344,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4804 /prefetch:8
                                              2⤵
                                                PID:5020
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5600,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5412 /prefetch:8
                                                2⤵
                                                  PID:3468
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4892,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5320 /prefetch:8
                                                  2⤵
                                                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                  • NTFS ADS
                                                  PID:2092
                                                • C:\Users\Admin\Downloads\Delta V3.61 b_07996328.exe
                                                  "C:\Users\Admin\Downloads\Delta V3.61 b_07996328.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2224
                                                  • C:\Users\Admin\AppData\Local\OperaGX.exe
                                                    C:\Users\Admin\AppData\Local\OperaGX.exe --silent --allusers=0
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1644
                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC66A5E79\setup.exe
                                                      C:\Users\Admin\AppData\Local\Temp\7zSC66A5E79\setup.exe --silent --allusers=0 --server-tracking-blob=YTIwN2UyMTE0NDAyYzVjN2I5ZWVhMTYyZjY2MWYxMWYxZDMwOGU3OTM3MDllMWNiNDg3NjVmNGE1YjNjYTA2ZTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD02YThiMGYxNGJjYTI0MzFhYTIyZTAwY2NlODNlMjU2MiZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInRpbWVzdGFtcCI6IjE3MzIwNzk5OTguMDU0OCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdPVzY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfMzU3NSIsImNvbnRlbnQiOiIzNTc1X0ZpbGVETSIsImlkIjoiNmE4YjBmMTRiY2EyNDMxYWEyMmUwMGNjZTgzZTI1NjIiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiIxNjUzMDdiYy1hNTc1LTQ1YTAtOTY2Yy02ZmY0MDE0NTZlMzIifQ==
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Enumerates connected drives
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies system certificate store
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2556
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC66A5E79\setup.exe
                                                        C:\Users\Admin\AppData\Local\Temp\7zSC66A5E79\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.202 --initial-client-data=0x334,0x338,0x33c,0x310,0x340,0x71c68c5c,0x71c68c68,0x71c68c74
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4832
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2972
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC66A5E79\setup.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\7zSC66A5E79\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2556 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241120052001" --session-guid=9cc13139-f23d-401d-b775-09dfd57be703 --server-tracking-blob=Nzg4ZjM5ZjFmNzBiYTcxMjI3MGY4OTU2YTU1ZTE0YmRhZGUyZjAwNGU0MzA0MTFlMmFjYmY2MTE5YmVlY2I1ODp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD02YThiMGYxNGJjYTI0MzFhYTIyZTAwY2NlODNlMjU2MiZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMjA3OTk5OC4wNTQ4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1BCNV8zNTc1IiwiY29udGVudCI6IjM1NzVfRmlsZURNIiwiaWQiOiI2YThiMGYxNGJjYTI0MzFhYTIyZTAwY2NlODNlMjU2MiIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6IjE2NTMwN2JjLWE1NzUtNDVhMC05NjZjLTZmZjQwMTQ1NmUzMiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=5006000000000000
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Enumerates connected drives
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:960
                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC66A5E79\setup.exe
                                                          C:\Users\Admin\AppData\Local\Temp\7zSC66A5E79\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.202 --initial-client-data=0x340,0x344,0x348,0x310,0x34c,0x70d28c5c,0x70d28c68,0x70d28c74
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:464
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411200520011\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411200520011\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1064
                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411200520011\assistant\assistant_installer.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411200520011\assistant\assistant_installer.exe" --version
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1688
                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411200520011\assistant\assistant_installer.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411200520011\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0xb24f48,0xb24f58,0xb24f64
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2248
                                                  • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4968
                                                    • C:\Program Files (x86)\PremierOpinion\pmropn.exe
                                                      C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:oY_ECkrVQNv8meHBr7POPN -o:0
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies system certificate store
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3052
                                                  • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Opens file in notepad (likely ransom note)
                                                    PID:4992
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5952,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4252 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4208
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6260,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4836 /prefetch:1
                                                  2⤵
                                                    PID:3480
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6440,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6420 /prefetch:1
                                                    2⤵
                                                      PID:4428
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6648,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6604 /prefetch:1
                                                      2⤵
                                                        PID:2756
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6392,i,5909073933796110733,15816604083179565973,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6416 /prefetch:8
                                                        2⤵
                                                        • NTFS ADS
                                                        PID:1012
                                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                      1⤵
                                                        PID:4052
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                        1⤵
                                                          PID:5048
                                                        • C:\Program Files (x86)\PremierOpinion\pmservice.exe
                                                          "C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies data under HKEY_USERS
                                                          • Modifies system certificate store
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:580
                                                          • C:\Windows\system32\rundll32.exe
                                                            C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1152
                                                            2⤵
                                                            • Loads dropped DLL
                                                            PID:4548
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2832
                                                          • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                            "c:\program files (x86)\premieropinion\pmropn.exe" -boot
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Drops file in System32 directory
                                                            • Drops file in Program Files directory
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Checks SCSI registry key(s)
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of SendNotifyMessage
                                                            PID:4548
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -s
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5684
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -s
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5364
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell Get-AppxPackage
                                                              3⤵
                                                              • Loads dropped DLL
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:6108
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C C:\PROGRA~2\PREMIE~1\pmropn32.exe 4548
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1656
                                                            • C:\PROGRA~2\PREMIE~1\pmropn32.exe
                                                              C:\PROGRA~2\PREMIE~1\pmropn32.exe 4548
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2828
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C C:\PROGRA~2\PREMIE~1\pmropn64.exe 4548
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3052
                                                            • C:\PROGRA~2\PREMIE~1\pmropn64.exe
                                                              C:\PROGRA~2\PREMIE~1\pmropn64.exe 4548
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:4740
                                                          • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                            "c:\program files (x86)\premieropinion\pmropn.exe" -updateapps
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5736
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5752
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5796
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5844
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=f46d4000-fd22-4db4-ac8e-4e1ddde828fe_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5888
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.aad.brokerplugin_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5928
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.accountscontrol_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5968
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.asynctextservice_8wekyb3d8bbwe
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:6016
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.bioenrollment_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:6064
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.creddialoghost_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:6116
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.desktopappinstaller_8wekyb3d8bbwe
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5228
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ecapp_8wekyb3d8bbwe
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5368
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.lockapp_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5436
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge_8wekyb3d8bbwe
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5480
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedgedevtoolsclient_8wekyb3d8bbwe
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5524
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.onedrivesync_8wekyb3d8bbwe
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5572
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.cbs_8wekyb3d8bbwe
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1772
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00.uwpdesktop_8wekyb3d8bbwe
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5668
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00_8wekyb3d8bbwe
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5720
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.win32webviewhost_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5764
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.apprep.chxapp_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5832
                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5892
                                                              • C:\Windows\System32\Conhost.exe
                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                4⤵
                                                                  PID:5888
                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.callingshellapp_cw5n1h2txyewy
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5948
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  4⤵
                                                                    PID:5928
                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.capturepicker_cw5n1h2txyewy
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5980
                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.cloudexperiencehost_cw5n1h2txyewy
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:6032
                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.contentdeliverymanager_cw5n1h2txyewy
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:6024
                                                                • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                  CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.narratorquickstart_8wekyb3d8bbwe
                                                                  3⤵
                                                                    PID:6128
                                                                  • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy
                                                                    3⤵
                                                                      PID:6124
                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5424
                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.parentalcontrols_cw5n1h2txyewy
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5476
                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.peopleexperiencehost_cw5n1h2txyewy
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5432
                                                                    • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                      CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.pinningconfirmationdialog_cw5n1h2txyewy
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5564
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        4⤵
                                                                          PID:5524
                                                                      • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                        CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.search_cw5n1h2txyewy
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5588
                                                                        • C:\Windows\System32\Conhost.exe
                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          4⤵
                                                                            PID:5572
                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1772
                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.shellexperiencehost_cw5n1h2txyewy
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5668
                                                                        • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                          CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5784
                                                                          • C:\Windows\System32\Conhost.exe
                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            4⤵
                                                                              PID:5720
                                                                          • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                            CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.xgpuejectdialog_cw5n1h2txyewy
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5796
                                                                            • C:\Windows\System32\Conhost.exe
                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                              4⤵
                                                                                PID:5764
                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.xboxgamecallableui_cw5n1h2txyewy
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5832
                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.client.cbs_cw5n1h2txyewy
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5940
                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.undockeddevkit_cw5n1h2txyewy
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5752
                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=ncsiuwpapp_8wekyb3d8bbwe
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:6004
                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=windows.cbspreview_cw5n1h2txyewy
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:6048
                                                                            • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                              CheckNetIsolation.exe LoopbackExempt -a -n=windows.printdialog_cw5n1h2txyewy
                                                                              3⤵
                                                                                PID:6088
                                                                              • C:\Windows\SysWOW64\CheckNetIsolation.exe
                                                                                CheckNetIsolation.exe LoopbackExempt -a -n=windows_ie_ac_001
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:6096
                                                                            • \??\c:\program files (x86)\premieropinion\pmropn.exe
                                                                              "c:\program files (x86)\premieropinion\pmropn.exe" -installmenu:PremierOpinion -v:NONE
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Drops file in System32 directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:6828
                                                                          • C:\Windows\System32\rundll32.exe
                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                            1⤵
                                                                              PID:1544
                                                                            • C:\Windows\system32\wbem\unsecapp.exe
                                                                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                              1⤵
                                                                              • Loads dropped DLL
                                                                              PID:4224
                                                                            • C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\Delta.exe
                                                                              "C:\Users\Admin\Downloads\Delta V3.61\Delta V3.61\Delta.exe"
                                                                              1⤵
                                                                              • Loads dropped DLL
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5264
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/4TfpR6wUUu
                                                                                2⤵
                                                                                • Loads dropped DLL
                                                                                • Enumerates system info in registry
                                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:5708
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0xfc,0x130,0x7ffeca4c3cb8,0x7ffeca4c3cc8,0x7ffeca4c3cd8
                                                                                  3⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:5788
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,8660329677367914031,15478740472063582759,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
                                                                                  3⤵
                                                                                    PID:5992
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,8660329677367914031,15478740472063582759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
                                                                                    3⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:5972
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,8660329677367914031,15478740472063582759,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
                                                                                    3⤵
                                                                                      PID:6040
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8660329677367914031,15478740472063582759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                                                                                      3⤵
                                                                                        PID:5576
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8660329677367914031,15478740472063582759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                                                                                        3⤵
                                                                                          PID:5540
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8660329677367914031,15478740472063582759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
                                                                                          3⤵
                                                                                            PID:5748
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                        • Loads dropped DLL
                                                                                        PID:5744
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                        • Loads dropped DLL
                                                                                        PID:5496

                                                                                      Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\PROGRA~2\PREMIE~1\snt.dat
                                                                                        Filesize

                                                                                        3.1MB

                                                                                        MD5

                                                                                        20b268c791cda4e36df5edd2dae22e8e

                                                                                        SHA1

                                                                                        d2ac7c93580699cb3a9c7a5f44f8e67f2e2fe123

                                                                                        SHA256

                                                                                        c9579adb279e7694db14595fb870cce2271af32b4f025a854069c8fa06721b17

                                                                                        SHA512

                                                                                        3f4c5dcb1e394891ed59917f01388897c204377411e6abbb4e822fef10eaa4811c529533e855535a4efdf7fb58408c936683df89afe7f456f7396761a9e66bbc

                                                                                        Download Submit

                                                                                      • C:\Program Files (x86)\PremierOpinion\cacert.pem
                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        77eb3ade4c5b0db67c6e8a26f131073c

                                                                                        SHA1

                                                                                        ad9e8c00174cc2e707f59df671f89a9d7fc2ffc7

                                                                                        SHA256

                                                                                        9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87

                                                                                        SHA512

                                                                                        20eb7d34c80bb8d8a415bcdccf8e46cb36396c095ed1468b69c0cb91da915e3a14c7fd55247f68e64ff71cf8d336cc286c3662710ca6281840fdc2f1eb7ac6a1

                                                                                        Download Submit

                                                                                      • C:\Program Files (x86)\PremierOpinion\pmls.dll
                                                                                        Filesize

                                                                                        885KB

                                                                                        MD5

                                                                                        50a0c6c01cdc5d2690ccd1f1541f6670

                                                                                        SHA1

                                                                                        c5e017a468efb70eabb1f861784edac62acb0e17

                                                                                        SHA256

                                                                                        f9a853830949bb22d6f4d128d71a0ab923d9b5549c0dc8785c7de7d1a4eabf99

                                                                                        SHA512

                                                                                        028d5a56c581d3751628c7503e83aa52c332678495943c3648049ae0b26a7190e98395ad205cf60896140d1a802c14a346a2d1553e7b53090c3f5beefd66e9b1

                                                                                        Download Submit

                                                                                      • C:\Program Files (x86)\PremierOpinion\pmls64.dll
                                                                                        Filesize

                                                                                        1.1MB

                                                                                        MD5

                                                                                        aa56cb7fd83150c3a75cd6a0de97eb78

                                                                                        SHA1

                                                                                        34415c5c8e57cfe9a7b4a498eacfe1403f3191ec

                                                                                        SHA256

                                                                                        034e066829d28bbc81604250f6df721a35ab1c0898ab82bef6305ffada240765

                                                                                        SHA512

                                                                                        765f12e5e060db934d0f4e8159bb9bd10cdbe797d79488a0dc88215a73e49101e279ca69e10c1775a5e161bb4dd02585724c7c87bbefdcdd047adb4277804fa2

                                                                                        Download Submit

                                                                                      • C:\Program Files (x86)\PremierOpinion\pmph.dll
                                                                                        Filesize

                                                                                        807KB

                                                                                        MD5

                                                                                        9d96ccb0d5ab5541b61d5c138d91796f

                                                                                        SHA1

                                                                                        cf3ee3e66c8f9c23e3efd29978215461347e650d

                                                                                        SHA256

                                                                                        379a1f1f02c8cb704f248c2f1ff79c8986f73c350a3bf6d9bbc93aeacd286e36

                                                                                        SHA512

                                                                                        69ca7d96896d872eefa63f0c0bd9613526a914e99c4cf12b5d221315277aa64894d99d0f5ce9c5e0ef640d61c9202cd3d51ddb2ab4c55f8fdf60d24a8c1ff6ac

                                                                                        Download Submit

                                                                                      • C:\Program Files (x86)\PremierOpinion\pmropn.exe
                                                                                        Filesize

                                                                                        6.7MB

                                                                                        MD5

                                                                                        f27f98c1a877f9ca6f06c23bed4014ca

                                                                                        SHA1

                                                                                        25a231319659c30d6f86a5c9cdd1747d7c471542

                                                                                        SHA256

                                                                                        1ed47933c9f33c4860ecc0bf1ba7525212aa00054037a9a51a8d8f5ce3b821bd

                                                                                        SHA512

                                                                                        f054a618d2f8e7a829c26548312b436e21058ee1ff64b40e7c19be2bde037003c21332af3c60e2fd92675af80526ef6faf84b8c1d7a095bb2c4d0b799e66599c

                                                                                        Download Submit

                                                                                      • C:\Program Files (x86)\PremierOpinion\pmropn32.exe
                                                                                        Filesize

                                                                                        245KB

                                                                                        MD5

                                                                                        6e4d6b68e9565c4cc7791b00c2094ff9

                                                                                        SHA1

                                                                                        965a00a5a8bb05b35fbaa357951779ea3b71e392

                                                                                        SHA256

                                                                                        65d6f18e1b366aff5343c3f6628041329e7c1375d18ba57076b19bf5f48bc483

                                                                                        SHA512

                                                                                        0cb1396822c7350057cfc7280e1c67ccf1e1a2206347a10025e285f00e9364563685ba5282775960a9329511fd321a631222c87ae7ca8106eca00fb78722b20f

                                                                                        Download Submit

                                                                                      • C:\Program Files (x86)\PremierOpinion\pmropn64.exe
                                                                                        Filesize

                                                                                        304KB

                                                                                        MD5

                                                                                        ae5bbcc69b05359d0d5cc72ca6a1262e

                                                                                        SHA1

                                                                                        6843bd883d50216be44065411a983a4bcccdcc91

                                                                                        SHA256

                                                                                        12bfd1007634138b22c56ead24db02a1fe3a4d4b7fe04d30cd07a0ff5d4c8425

                                                                                        SHA512

                                                                                        6417aaeb4ccd86504bc1f83e32c91a60920e98fff833c02fdbef974819a3288cab0c96d6b114ceed4432c305d49120cacbc7e0da69c911f4035aadfbec7a91de

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        67e486b2f148a3fca863728242b6273e

                                                                                        SHA1

                                                                                        452a84c183d7ea5b7c015b597e94af8eef66d44a

                                                                                        SHA256

                                                                                        facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

                                                                                        SHA512

                                                                                        d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                                                                                        Filesize

                                                                                        436B

                                                                                        MD5

                                                                                        971c514f84bba0785f80aa1c23edfd79

                                                                                        SHA1

                                                                                        732acea710a87530c6b08ecdf32a110d254a54c8

                                                                                        SHA256

                                                                                        f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

                                                                                        SHA512

                                                                                        43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                        Filesize

                                                                                        174B

                                                                                        MD5

                                                                                        893cefe3bb45bf5658ee2edd4bdda320

                                                                                        SHA1

                                                                                        3587a30490eb09d15193603b8c5c775065bc9ba2

                                                                                        SHA256

                                                                                        c49224caf28853de0363d25c32d9e6d5dc646faed33c08d3f5b86f4f6103cb4c

                                                                                        SHA512

                                                                                        a31070cfc9a93f85485237e8f4d83e6980630648a856062354b7afba831bd72576eccbc96afa80474555eb084e02054e4e348c68f4306e45cb8b88c615ef2a1a

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                                                                                        Filesize

                                                                                        170B

                                                                                        MD5

                                                                                        4841a22dce8de73006fbf3a07ecdc7bb

                                                                                        SHA1

                                                                                        29aea90a731818b7fa0beedfcdfe12bdbc269bf4

                                                                                        SHA256

                                                                                        9641c7d46fd8558dd7a361b4d3eb994960f406dd4220d4c3b05aa1b95093409d

                                                                                        SHA512

                                                                                        68f73254e55dd88e669c1ba5c16d99e1d4b77ab104284375dbc187b62cbe5c89784a6cffe8374551edd0cfafaabc123e3cb16627ebb5ae8beb48fbfd4735d573

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\3231ae299a0af0b2\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                        Filesize

                                                                                        64KB

                                                                                        MD5

                                                                                        0083b29045af4f4d3ecd49f5fd541bfe

                                                                                        SHA1

                                                                                        83b92c5187e7b93298f86d83826c73da1098850c

                                                                                        SHA256

                                                                                        cc62ff55c91b10f17b0543d59486a3fb907d7be658043a3b23ece70dbfac797d

                                                                                        SHA512

                                                                                        006257f5be6341184434d071f7c38984d9f1aee74602475f38ca0637c66a5169856e21603d758c3f3a47fbf1aa65aa5f798e2e49b598f75147c4fd47207bbc51

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\3231ae299a0af0b2\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                        Filesize

                                                                                        992B

                                                                                        MD5

                                                                                        2e56822cad031b72223f47167d62bf5b

                                                                                        SHA1

                                                                                        1403ee99a61e9ae9d15a22106700044e30873b91

                                                                                        SHA256

                                                                                        8200a2554862473fb558df7f62dea2553e92d883ff9c808aba22d7c9572185fa

                                                                                        SHA512

                                                                                        852b024b63259d5a6b6690f94761faed40bac758662f23496fb1c3839e99062fe37d6487b423cf1d145265e1bbdfb3d4bda37b3e74eaa136bd5b8e61838d5817

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                        Filesize

                                                                                        64KB

                                                                                        MD5

                                                                                        b5ad5caaaee00cb8cf445427975ae66c

                                                                                        SHA1

                                                                                        dcde6527290a326e048f9c3a85280d3fa71e1e22

                                                                                        SHA256

                                                                                        b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                                                                                        SHA512

                                                                                        92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                        Filesize

                                                                                        4B

                                                                                        MD5

                                                                                        f49655f856acb8884cc0ace29216f511

                                                                                        SHA1

                                                                                        cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                        SHA256

                                                                                        7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                        SHA512

                                                                                        599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                        Filesize

                                                                                        1008B

                                                                                        MD5

                                                                                        d222b77a61527f2c177b0869e7babc24

                                                                                        SHA1

                                                                                        3f23acb984307a4aeba41ebbb70439c97ad1f268

                                                                                        SHA256

                                                                                        80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                                                                                        SHA512

                                                                                        d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                        Filesize

                                                                                        649B

                                                                                        MD5

                                                                                        ee4fc70f12d8d3dc54d0962cfc593ae9

                                                                                        SHA1

                                                                                        8795eea18e4a1ad6c6a5b5ba899b2d722a8757a8

                                                                                        SHA256

                                                                                        a0953392e20f2da18ade730157c4415eeb8c023a600a457d5fef16ff91cac1f7

                                                                                        SHA512

                                                                                        40926821c2d89956ded5338d732a7269f1c0b29cf7dfe563683371db7d95f178c622b3ebda4ba53524025f228b173a89228531d1c5a25d33076da5c2ddaaebdf

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                        Filesize

                                                                                        552B

                                                                                        MD5

                                                                                        f58c67a79101a88df7f93861aefef9ab

                                                                                        SHA1

                                                                                        3df074edd5591c83a5f3b47059f5d27e3ca6a621

                                                                                        SHA256

                                                                                        0f882163633644ba9dbe006dfa317c74429eac89a8f43bd784132c8d373f8059

                                                                                        SHA512

                                                                                        91bf78fb9896e966b46bda0a0f11a0774c5668ede9ea87b5ab1d12fb3eea79db1b252aa2d837d59ddb065de752ed6dd02d4e8c374d988b8de777629517749211

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                        Filesize

                                                                                        408B

                                                                                        MD5

                                                                                        5e8453e200b363ef35aae8ff6ea28cc8

                                                                                        SHA1

                                                                                        7a2bf2c9e21876738208fe82ea6c8e752899b46e

                                                                                        SHA256

                                                                                        0711ef313303a5f0a290bbfc87099723538d7c5c9f9499a9aee58660f7329630

                                                                                        SHA512

                                                                                        60852578931e912435d90cbbb34ce14b69815a37cef23534fa0904b852e53e767efac094438b782e43232ddba3526375f668e72ee6b5535e3052e42dacfd4d9e

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                        Filesize

                                                                                        5KB

                                                                                        MD5

                                                                                        eb2e342296b291690eb8f1ed1c1991ea

                                                                                        SHA1

                                                                                        38603a4f52e449ca637b61a33f3d244757f2b7c5

                                                                                        SHA256

                                                                                        a9cfa41c5fd1c14a41ddeac92a0cb5cb79d427737966d6d5cd3a370d76bdb7c0

                                                                                        SHA512

                                                                                        ef00c3ee26b6215e14d013b0924c2fea9ed3e069551a2ee77d0910653e938b59e293d11078fed6053510815857cc05b5ea358000126d8fe85ca503f5a7b33645

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                        Filesize

                                                                                        7KB

                                                                                        MD5

                                                                                        386b56e0d39c59d8f3c6fe0fb46ecef2

                                                                                        SHA1

                                                                                        3074119f6d66bcb8f7896b525973a9a5b8d1a608

                                                                                        SHA256

                                                                                        76cf0571ba6e3dc1bec83ed5d8538cc9b69b3243380cbd07a0b535a53f77b869

                                                                                        SHA512

                                                                                        3371355500766311845ed73aa73c70f82205ce354f97fc41849dc9c534948f1e2f3257594a31a315d1cca6921b74f1452ffd3c6abd76d7d7c4f6972d54320148

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                        Filesize

                                                                                        7KB

                                                                                        MD5

                                                                                        f0aa60459e8517448afb40d03d4a44e6

                                                                                        SHA1

                                                                                        c6db654b8e39ed3502ce21ab9b631e2049d901d9

                                                                                        SHA256

                                                                                        f099f5c4a21f15e4d2a0dd8fac5a1f4d0a4a15cd16ff519678c7f79500991ea8

                                                                                        SHA512

                                                                                        63d1ef5ce9d86b913cc69557c536f63fe9c62b4fc0ceab0ff669063cfcd10e50a79869ffe8657f362fe1c59143afa504b71e758bbd14171c08a67012e767b68e

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                        Filesize

                                                                                        2B

                                                                                        MD5

                                                                                        d751713988987e9331980363e24189ce

                                                                                        SHA1

                                                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                                                        SHA256

                                                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                        SHA512

                                                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        50bcb55d81b7965d7ce987f74001f113

                                                                                        SHA1

                                                                                        647361a0a0e5391e4620a78b18b79e6795971af9

                                                                                        SHA256

                                                                                        b78c3719b98994bb54111322467057f0f6219f924543dac2ff42523638c97691

                                                                                        SHA512

                                                                                        dde1c13c64750c109704a5a0fc0897c6e7a8cf9541f6c61f327528aba828fde8053cfe60ca5c5bab79e3bbacff55908e56befa79c3548469069264fb84c8bb29

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                        Filesize

                                                                                        859B

                                                                                        MD5

                                                                                        0e1fe620aaf3edb22fbb2cfc2b7c9bf8

                                                                                        SHA1

                                                                                        d08f806e51833f28503711e607eee4efcf60ae2f

                                                                                        SHA256

                                                                                        fea3c6ee811d5984aa98a2e6150ac493cf6b71e166dacfc5c275256454f4a8e5

                                                                                        SHA512

                                                                                        ed254c93c0b9b62241f4e3be551bff86b76cebcf22f8f7eb952089daa70dba08fa048e6eccbe6300d32f3f4184da0b5fa75d8e2bf1959074bbe9be06b7e4861f

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        1b57219861276895e1a1ee561577c983

                                                                                        SHA1

                                                                                        3a8493ee523090d37a84425745ffbeb60762d42c

                                                                                        SHA256

                                                                                        ac08ccd3012b124ecdc78508bb8bbe64a342525f6c5ddc5e812e777017193f98

                                                                                        SHA512

                                                                                        7054986487b934db13bd957aa4c39a8a0d9680a1e52e09864b82bcea89396684630a723085701e977bf0f87df0fabf7aae64a857a2771e3f89b302bb34f55ae2

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                        Filesize

                                                                                        859B

                                                                                        MD5

                                                                                        67f93d8b23233558c1db95506cb19f8f

                                                                                        SHA1

                                                                                        b99f8788b5998785b8219586ef46624cd694d388

                                                                                        SHA256

                                                                                        cdf6b2d21af626920e9a431b6e5b0a3f79d167f5e3fb6e8798695c7ef4227c78

                                                                                        SHA512

                                                                                        fe37e39b7252416fd20d0260ee4a5a8e0186427acf6a5ac1ad6bebb830868027454469bb8d5591964c1983189e5fd7c99d1880552902759ea6d7bcd991b7b029

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                        Filesize

                                                                                        9KB

                                                                                        MD5

                                                                                        d828ec23bdfdda32a306c93350f3a9a8

                                                                                        SHA1

                                                                                        f17dd8d657205c9041729e9d7e3302e901c26450

                                                                                        SHA256

                                                                                        956a8fd6355013649ba828b1d1c9bd5ded0a704a4855e8354eb3b58429e5d9f3

                                                                                        SHA512

                                                                                        865354c5f15f2a56323e62e9a5881c301ac0e2754f3f4be7cf1067f11f6782751b6f66fa6523b42387050ba577d50e10bb223548587ac04c9d6db50734cf2fb5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                        Filesize

                                                                                        13KB

                                                                                        MD5

                                                                                        69cbeda8c7a646a065a14c19ab9600f0

                                                                                        SHA1

                                                                                        0f5d25a7d0e8d162a6d8f22682dfe64d59b318af

                                                                                        SHA256

                                                                                        67a3adb704b2428304c3a4a19ef2bae8eeaa1532904146c6f5f689160e8788df

                                                                                        SHA512

                                                                                        a89d2a222203c67c448880e98260487e7cf302af300a59953600ae064a74ea4ef87debc48b6c0463d43092ec53c0169d00210e5f63a6d999becec5bda2101dc8

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                        Filesize

                                                                                        9KB

                                                                                        MD5

                                                                                        eb112163275c98a053a94cfcf30b958c

                                                                                        SHA1

                                                                                        732c18f7d1d4dd83c3c7bcd55f3d7dfc287b677c

                                                                                        SHA256

                                                                                        d9e2d7ecfdf18b76b943ff402e7389481e22d4b45004c6950f53c811a8e6d916

                                                                                        SHA512

                                                                                        bda47e58feefb6a6ff9e01f9f0808b3d3b624913a2113c491ac5591324ef6dcfc1d43d8e682bcb5e28628df9e10fcb06d75fee8d3cfbe31b3617587443cf5843

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                        Filesize

                                                                                        9KB

                                                                                        MD5

                                                                                        ba2fe33895d962548f4b11d49ee70274

                                                                                        SHA1

                                                                                        09240036cb91a8fbe1c96b396d4241d2cd2767b2

                                                                                        SHA256

                                                                                        9b2fc7c0053e318ed33f0ed154038c9ad82522fa8037139217f9c7dfdb7378a6

                                                                                        SHA512

                                                                                        aca181455fde3e219c2ca28b03d3376258a7514ab6aca8ac1b993c10919a96d19f055202f714fcf515f85c0f31a2d6ffa09363ea130c3faa3cde661add8caee7

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                        Filesize

                                                                                        9KB

                                                                                        MD5

                                                                                        fe54f7409deb05ce1c3761c10f7dc74a

                                                                                        SHA1

                                                                                        509c7dd52061852dcef0a7edc63fdf71431ef040

                                                                                        SHA256

                                                                                        1d86cf5e54cd584a2c3f3b73c549a21bf39ad4d9fa637f7000d232edded16113

                                                                                        SHA512

                                                                                        bed99b5621d9dcdc8042b2b4667543db0f449cd81975ca90ab2d4f4aa58b83f3ec9df6a2cc18b6efe783fdf61c761e78c01300612a79255a8508be62be02d4e9

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                        Filesize

                                                                                        12KB

                                                                                        MD5

                                                                                        884424461975e061460da32ba0e1fcb5

                                                                                        SHA1

                                                                                        504ee96276ebf86e7bf770c9da1af42a9dff1f10

                                                                                        SHA256

                                                                                        207ded1da6b9152be3493ac8fbd250c7b635b8c2b0fedb47517f19a7406963bf

                                                                                        SHA512

                                                                                        18bfbb9bb9bd7fcbbc892c8d143c8834089ffce71594c2562149cc84ca57612286a0e68c67d6dad60d4d4106b4d672e92eab8e2475df8ad1c8c9ed8b21f2d4c2

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                        Filesize

                                                                                        13KB

                                                                                        MD5

                                                                                        3f4eba1231ddf91131cb0f2dc83bf6ed

                                                                                        SHA1

                                                                                        d48eb6c56f648980db91d81d3a4d1292ed3ebfd1

                                                                                        SHA256

                                                                                        bd8a9fd43aedb5d881783bff12f6b1caef929706c1fed40995e09274f958b0c7

                                                                                        SHA512

                                                                                        54db412dac9e1e5fac99766fd38acd073045638bbbe744d663a777f92b3d775650aee560b809e212752aa4699cb6b4831180e60dcc79b754838e6f149865505a

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                        Filesize

                                                                                        116KB

                                                                                        MD5

                                                                                        ea0717b2673a31343c051ba7ce90a56f

                                                                                        SHA1

                                                                                        d3a075557a9b30f15d78203e10350641a72d80ab

                                                                                        SHA256

                                                                                        e8a9c5ba0758d78b82879cbc2363d8aa72ac39b86d66397b79940a1cb18de095

                                                                                        SHA512

                                                                                        5439e26ad6204c4a11e9f8a53b9923ca820d1ca7d092d3c193c3ea5d755f8f6bbcca5af424680b7b05e40c48afeb1ad0e99525fb8b80b494aeb9f41d56922321

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                        Filesize

                                                                                        116KB

                                                                                        MD5

                                                                                        16a16f91af7a9f7a1de731df6d663798

                                                                                        SHA1

                                                                                        9cb641f6864e50cc73b4b47d3b44a0e9f35be2e6

                                                                                        SHA256

                                                                                        3d838438788413f09024af04fda4ab555049e6b42c242287c009033d75ccbc0a

                                                                                        SHA512

                                                                                        264a04da9a9e3248d628269a80be6ed0a49fc689aed2c39e23d304a273486e82673b3583f2456876380bdaf173b293df68ea4c5a54e8af1835b74ce8dfd73556

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                        Filesize

                                                                                        116KB

                                                                                        MD5

                                                                                        422218786d020020261029872cfccdaf

                                                                                        SHA1

                                                                                        44f16a7f370f5d3ea190b6ac1e4606f75e8c9365

                                                                                        SHA256

                                                                                        85b4536e1fa2cbaf50e7ea586f82c3d8369dcfc76b5f889ab89e413ae17d560b

                                                                                        SHA512

                                                                                        6ad3c312b6628c7c3d3ff7fc7baf55fc404a929a5524876944104d16defc7c71696d4ce06e1e52532d683cafa03d0a6476a8a5485ce64de42562e97d62133bb4

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                        Filesize

                                                                                        116KB

                                                                                        MD5

                                                                                        d28480110846e85a6d381f9cbec7f0c8

                                                                                        SHA1

                                                                                        17231d8a68c34a2db3c373277dce46b796508743

                                                                                        SHA256

                                                                                        bfb36a3418051d7a798420ae7e939b6110a81d44cdbbe1d785374e132545d678

                                                                                        SHA512

                                                                                        008c35b031ca98fe80e7d02f414985abf607a02984080e73120c5a9980a9083e6858925230daea4ffdc482ffecb20643b6d92d8b17e2dfe9e55dad2ddd38fc7d

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                        Filesize

                                                                                        152B

                                                                                        MD5

                                                                                        02a4b762e84a74f9ee8a7d8ddd34fedb

                                                                                        SHA1

                                                                                        4a870e3bd7fd56235062789d780610f95e3b8785

                                                                                        SHA256

                                                                                        366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

                                                                                        SHA512

                                                                                        19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                        Filesize

                                                                                        152B

                                                                                        MD5

                                                                                        826c7cac03e3ae47bfe2a7e50281605e

                                                                                        SHA1

                                                                                        100fbea3e078edec43db48c3312fbbf83f11fca0

                                                                                        SHA256

                                                                                        239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

                                                                                        SHA512

                                                                                        a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                        Filesize

                                                                                        5KB

                                                                                        MD5

                                                                                        b8c0c314f786c20c353248d3d91e3c8c

                                                                                        SHA1

                                                                                        2c0b1342a122cc046daf29cede2f5f5b78373466

                                                                                        SHA256

                                                                                        e4024f2bda0fb65df7762d0c05bcd9df5a22ab5caac180649bbffa5881a7b2fa

                                                                                        SHA512

                                                                                        0a7d9ea7afc87f5be8ba29002b352ee13f44195c472d0f1d237de6fcada791a0e10c929714544ac430194fa6a9a944feb2c582d24798253bde3fd1eff7c9dd2f

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                        Filesize

                                                                                        6KB

                                                                                        MD5

                                                                                        5b0fa4ebb5460ce478158deb9dd562ab

                                                                                        SHA1

                                                                                        071e0cbb8b0693ac67428359e7cb406bf0573787

                                                                                        SHA256

                                                                                        6891dfe495f03a663a8b66a85dabb94b30cd434947db80b52146dae17fa82efa

                                                                                        SHA512

                                                                                        235195cd2ba5592d094b0d04466c202a552569becccc4c0837c872d31d9c58208e4f08da303f1d15ba0405f08fb1ce852de9aef4c39b03707decadec57708743

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        Filesize

                                                                                        10KB

                                                                                        MD5

                                                                                        0584662e8589bc980b96fd1744982343

                                                                                        SHA1

                                                                                        62f916f3dd61ddf1c40c601392024035daa22cff

                                                                                        SHA256

                                                                                        5f3b6ac3bf6b9274ae5add06222f8495daa0ae492cf940c0af3a77040c270600

                                                                                        SHA512

                                                                                        5a3995bab140f36434a00ee919179fff8bde4256057bc66e71e77c54a618f5c192655d5d18b62ceb7ab70f28e187fd18d5e288f0dc79bfeb4b796b9b4fde3da7

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3UZNLR3Y\POicon[1].bin
                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        3ef9efb5c3c17e2b685057beac484e0b

                                                                                        SHA1

                                                                                        92e7ae0ebf2b57d72ea4091f065f29187cdf76fa

                                                                                        SHA256

                                                                                        20b0f94844860501e115fccd5c1462b2e2c932041d7989dc51c6d885b3429d8a

                                                                                        SHA512

                                                                                        6631ba4269375b502eccbcf601b0daccc98538f36bc0e1e2e5e48a28b4b9f523e06cb46d14b7ac2c60f70ce258b873fc42e31ebfb5237cb43cba7fb6a428eafc

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPFCD9E.tmp
                                                                                        Filesize

                                                                                        22KB

                                                                                        MD5

                                                                                        e5c5cabc831ac67fa17b6cb1c0316f38

                                                                                        SHA1

                                                                                        fe65ce82a8b30c1572ff57fac37cc56b0750a750

                                                                                        SHA256

                                                                                        bf9f130c75a63bf20968bb015d0e1ff106fcc386126c762dd4e6faa23a5f0753

                                                                                        SHA512

                                                                                        426ff0ecff29fab7f0d2ea1323e9d1dd55602630d659fdd65fcaf50d3819119f2588bed7d18c0fb73980ebfcfd6cf30c85ff2be3e50eab10373db03bb4f355d4

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\OperaGX.exe
                                                                                        Filesize

                                                                                        3.2MB

                                                                                        MD5

                                                                                        9c490df50fbc53bdcc99060e9b71d848

                                                                                        SHA1

                                                                                        7640ba44d346b46c36d19789f98011b62a3a5c7d

                                                                                        SHA256

                                                                                        58745cc24cc0814239a385c86bed68cf4d5c9bc7833291025c538cd4c0717540

                                                                                        SHA512

                                                                                        e4f51c2efa8e57a076a1cc13690efa432956620a39cd9a631c84f32ff4e42ecf5b48a9e2e441056dc2441fd72cad56f6c40e19e3e41358fc2ac1f554e6a553d4

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411200520011\additional_file0.tmp
                                                                                        Filesize

                                                                                        1.4MB

                                                                                        MD5

                                                                                        e9a2209b61f4be34f25069a6e54affea

                                                                                        SHA1

                                                                                        6368b0a81608c701b06b97aeff194ce88fd0e3c0

                                                                                        SHA256

                                                                                        e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

                                                                                        SHA512

                                                                                        59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411200520011\assistant\assistant_installer.exe
                                                                                        Filesize

                                                                                        1.8MB

                                                                                        MD5

                                                                                        4c8fbed0044da34ad25f781c3d117a66

                                                                                        SHA1

                                                                                        8dd93340e3d09de993c3bc12db82680a8e69d653

                                                                                        SHA256

                                                                                        afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

                                                                                        SHA512

                                                                                        a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC66A5E79\setup.exe
                                                                                        Filesize

                                                                                        6.5MB

                                                                                        MD5

                                                                                        a16e857704e7635dde8cd009062b2aae

                                                                                        SHA1

                                                                                        677a0463e9af29ba2d450e6312b250ac627adb24

                                                                                        SHA256

                                                                                        f4a67d808955567da2212a980afaa0bdc003ed2c5be4017781e3985a63fa0c68

                                                                                        SHA512

                                                                                        0f933d04534212d35c2a691c440662508ce81c7c091c9ce0198640859421d3099546475b91289a2459454e67c4b9e8989f799a9a1c2579d1c935cdc8edf31a16

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2411200519599992556.dll
                                                                                        Filesize

                                                                                        6.0MB

                                                                                        MD5

                                                                                        3d0b13763c6696221cd6e7524b974ca8

                                                                                        SHA1

                                                                                        eeb708cbcd0ccb345c73306eb878d4199f8ee85b

                                                                                        SHA256

                                                                                        528508786ad5fa13459642873f63d50b627b97f61af806ea3435c42551e1e368

                                                                                        SHA512

                                                                                        454277b795acc603c4c952962a41962d0f4ff879eaf1af664e6c65c577c410738bde6cff56eabc604304aa1b2e0e4c031d8236f5ba8821406fdeff60b7d09885

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
                                                                                        Filesize

                                                                                        3.8MB

                                                                                        MD5

                                                                                        bf6eed6cdc17a0130189a33a55ef5209

                                                                                        SHA1

                                                                                        e337f5a0931f69c464f162385f1330b4d27b372f

                                                                                        SHA256

                                                                                        ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168

                                                                                        SHA512

                                                                                        90d23fd84007343e85f9fc003cf826b112fd930216a24d8c1488468443ae2a4b0c3cc2426b91c81a8228e125050e922fce05672e010e65247709fc4a7b856f1d

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lawl2ug2.00n.ps1
                                                                                        Filesize

                                                                                        60B

                                                                                        MD5

                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                        SHA1

                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                        SHA256

                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                        SHA512

                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\~osE40E.tmp\pmservice.exe
                                                                                        Filesize

                                                                                        4.2MB

                                                                                        MD5

                                                                                        4ef95918e313c7ca01084629416fc714

                                                                                        SHA1

                                                                                        5bdaba6920d3f4d1f8ea47ce693276530b5f2a9c

                                                                                        SHA256

                                                                                        303707068aab06ab0341178558c28ce1670d10f16c39522859c4f21097a87ee9

                                                                                        SHA512

                                                                                        75861731e9ec1a43741b2b84f60677e9fdf26d5db8d6e4e91297f826fc2c357272c18cede7f64c42798f5459900b33d693ababe4e1140e4cfc54ef7a04af633a

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\link.txt
                                                                                        Filesize

                                                                                        56B

                                                                                        MD5

                                                                                        b14d3bf3d8ada26a516bcdd56716ff89

                                                                                        SHA1

                                                                                        eaace93c9f1bdc3e6406b0d1040cd6a2491ed27d

                                                                                        SHA256

                                                                                        5696e9c3aad059cb8a6b0cb5c147288e29f939da5a3e757090255394a33d5d1f

                                                                                        SHA512

                                                                                        e83791b0f326c07f2c7346364ef4dc9cc9a106ca3dc96e63ffc90eb38f23e099b14843fa2d9cee6c2a07f7c4a7f5fd0562adb5e8ab996de5a7bd46484512eeca

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                        Filesize

                                                                                        40B

                                                                                        MD5

                                                                                        fe4af281f542744ce50357cbda63f2ba

                                                                                        SHA1

                                                                                        5488c6a7506a8163f80e37b7fc99daf8c7468807

                                                                                        SHA256

                                                                                        ce4f1840c6ccea2677d0039b582a0529b6c8d5869e071fdcb4ef5c5ba57235ab

                                                                                        SHA512

                                                                                        ee4edae4af8067a80a82bab7fb93c5573ca1dd66ac86632c67d7d3b7218b947c7f2ede04251503423d18adfb72b21815643f85c8791adb135ec86516bb8f6739

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
                                                                                        Filesize

                                                                                        40B

                                                                                        MD5

                                                                                        85504effa31f5b2168a3c618628a8361

                                                                                        SHA1

                                                                                        048b3fbaf0692eb8c04537b2cec4b8acedd2fe02

                                                                                        SHA256

                                                                                        bf2309a3f766db8654fd86bbcc250a89958b1e3700d76e9813ce796785f143b2

                                                                                        SHA512

                                                                                        30dc22bf96d8879aea3d15833d005b050e948ef988c6698833bd13a79d5a890eb4985f9869f8510150da15b1d7e2554156a582f6a586ce357e07ae26e0075c98

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\Downloads\Delta V3.61 b_07996328.exe
                                                                                        Filesize

                                                                                        5.7MB

                                                                                        MD5

                                                                                        15d1c495ff66bf7cea8a6d14bfdf0a20

                                                                                        SHA1

                                                                                        942814521fa406a225522f208ac67f90dbde0ae7

                                                                                        SHA256

                                                                                        61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42

                                                                                        SHA512

                                                                                        063169f22108ac97a3ccb6f8e97380b1e48eef7a07b8fb20870b9bd5f03d7279d3fb10a69c09868beb4a1672ebe826198ae2d0ea81df4d29f9a288ea4f2b98d8

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\Downloads\Delta V3.61 b_07996328.exe:Zone.Identifier
                                                                                        Filesize

                                                                                        26B

                                                                                        MD5

                                                                                        fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                        SHA1

                                                                                        d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                        SHA256

                                                                                        eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                        SHA512

                                                                                        aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                        Download Submit

                                                                                      • C:\Windows\SystemTemp\REGF89F.tmp
                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        97be0bafaf0641b73e2c15644fd1cd01

                                                                                        SHA1

                                                                                        d1fe2b795cdb086cf284378f7071ff7f4b7950aa

                                                                                        SHA256

                                                                                        a4f83b5b54ddffd69429a72376253560b2d570c7b38718a4f6f58b8dceac2d57

                                                                                        SHA512

                                                                                        4c7b569702eea47d82ce12a71d8f36d40f684c50b12456f3ee50bd0a44bd74e8155ecb7a25a58bd9e0affc98d1f3d32f8afddc0f7b116fd9a4e6b4d6c1ec99ec

                                                                                        Download Submit

                                                                                      • memory/3052-606-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3052-602-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3052-597-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3052-598-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3052-596-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3052-608-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3052-607-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3052-603-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3052-605-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3052-604-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/4548-672-0x00007FFEEE510000-0x00007FFEEE5CD000-memory.dmp

                                                                                        Filesize

                                                                                        756KB

                                                                                        Download

                                                                                      • memory/4548-749-0x0000000005A80000-0x0000000005A81000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/4548-680-0x00007FFEEE900000-0x00007FFEEE96F000-memory.dmp

                                                                                        Filesize

                                                                                        444KB

                                                                                        Download

                                                                                      • memory/4548-673-0x00007FFEEC310000-0x00007FFEEC684000-memory.dmp

                                                                                        Filesize

                                                                                        3.5MB

                                                                                        Download

                                                                                      • memory/4548-684-0x00007FFEE53E0000-0x00007FFEE54EC000-memory.dmp

                                                                                        Filesize

                                                                                        1.0MB

                                                                                        Download

                                                                                      • memory/4548-683-0x00007FFEEB7A0000-0x00007FFEEB807000-memory.dmp

                                                                                        Filesize

                                                                                        412KB

                                                                                        Download

                                                                                      • memory/4548-681-0x00007FFED8420000-0x00007FFED891A000-memory.dmp

                                                                                        Filesize

                                                                                        5.0MB

                                                                                        Download

                                                                                      • memory/4548-686-0x00007FFEECF00000-0x00007FFEED6AE000-memory.dmp

                                                                                        Filesize

                                                                                        7.7MB

                                                                                        Download

                                                                                      • memory/4548-685-0x00007FFEEB590000-0x00007FFEEB5D2000-memory.dmp

                                                                                        Filesize

                                                                                        264KB

                                                                                        Download

                                                                                      • memory/4548-748-0x0000000005A80000-0x0000000005A81000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/5264-1074-0x0000000008F70000-0x0000000009002000-memory.dmp

                                                                                        Filesize

                                                                                        584KB

                                                                                        Download

                                                                                      • memory/5264-949-0x000000000C720000-0x000000000C728000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                        Download

                                                                                      • memory/5264-939-0x0000000007AF0000-0x0000000007B8C000-memory.dmp

                                                                                        Filesize

                                                                                        624KB

                                                                                        Download

                                                                                      • memory/5264-938-0x0000000007680000-0x00000000079D7000-memory.dmp

                                                                                        Filesize

                                                                                        3.3MB

                                                                                        Download

                                                                                      • memory/5264-937-0x00000000071D0000-0x00000000071EE000-memory.dmp

                                                                                        Filesize

                                                                                        120KB

                                                                                        Download

                                                                                      • memory/5264-936-0x0000000007100000-0x0000000007122000-memory.dmp

                                                                                        Filesize

                                                                                        136KB

                                                                                        Download

                                                                                      • memory/5264-933-0x0000000007150000-0x00000000071C6000-memory.dmp

                                                                                        Filesize

                                                                                        472KB

                                                                                        Download

                                                                                      • memory/5264-932-0x0000000006CE0000-0x0000000006D90000-memory.dmp

                                                                                        Filesize

                                                                                        704KB

                                                                                        Download

                                                                                      • memory/5264-1073-0x000000000F380000-0x000000000F926000-memory.dmp

                                                                                        Filesize

                                                                                        5.6MB

                                                                                        Download

                                                                                      • memory/5264-928-0x00000000007F0000-0x00000000018F6000-memory.dmp

                                                                                        Filesize

                                                                                        17.0MB

                                                                                        Download

                                                                                      • memory/5264-1127-0x000000000E610000-0x000000000E798000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        Download

                                                                                      • memory/5264-930-0x0000000006BF0000-0x0000000006C28000-memory.dmp

                                                                                        Filesize

                                                                                        224KB

                                                                                        Download

                                                                                      • memory/5264-929-0x0000000006BA0000-0x0000000006BA8000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                        Download

                                                                                      • memory/5264-931-0x0000000006BB0000-0x0000000006BBE000-memory.dmp

                                                                                        Filesize

                                                                                        56KB

                                                                                        Download

                                                                                      • memory/6108-1219-0x0000000005AB0000-0x0000000005B16000-memory.dmp

                                                                                        Filesize

                                                                                        408KB

                                                                                        Download

                                                                                      • memory/6108-1270-0x0000000006770000-0x000000000678E000-memory.dmp

                                                                                        Filesize

                                                                                        120KB

                                                                                        Download

                                                                                      • memory/6108-1217-0x0000000005350000-0x000000000597A000-memory.dmp

                                                                                        Filesize

                                                                                        6.2MB

                                                                                        Download

                                                                                      • memory/6108-1237-0x0000000005FA0000-0x0000000005FBE000-memory.dmp

                                                                                        Filesize

                                                                                        120KB

                                                                                        Download

                                                                                      • memory/6108-1238-0x0000000006250000-0x000000000629C000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                        Download

                                                                                      • memory/6108-1260-0x0000000007160000-0x0000000007194000-memory.dmp

                                                                                        Filesize

                                                                                        208KB

                                                                                        Download

                                                                                      • memory/6108-1261-0x0000000067C90000-0x0000000067CDC000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                        Download

                                                                                      • memory/6108-1218-0x00000000052C0000-0x0000000005326000-memory.dmp

                                                                                        Filesize

                                                                                        408KB

                                                                                        Download

                                                                                      • memory/6108-1271-0x00000000071A0000-0x0000000007244000-memory.dmp

                                                                                        Filesize

                                                                                        656KB

                                                                                        Download

                                                                                      • memory/6108-1272-0x0000000007960000-0x0000000007FDA000-memory.dmp

                                                                                        Filesize

                                                                                        6.5MB

                                                                                        Download

                                                                                      • memory/6108-1273-0x0000000007310000-0x000000000732A000-memory.dmp

                                                                                        Filesize

                                                                                        104KB

                                                                                        Download

                                                                                      • memory/6108-1274-0x0000000007390000-0x00000000073AC000-memory.dmp

                                                                                        Filesize

                                                                                        112KB

                                                                                        Download

                                                                                      • memory/6108-1275-0x0000000006780000-0x000000000678A000-memory.dmp

                                                                                        Filesize

                                                                                        40KB

                                                                                        Download

                                                                                      • memory/6108-1276-0x0000000007580000-0x00000000075A6000-memory.dmp

                                                                                        Filesize

                                                                                        152KB

                                                                                        Download

                                                                                      • memory/6108-1216-0x0000000004C00000-0x0000000004C36000-memory.dmp

                                                                                        Filesize

                                                                                        216KB

                                                                                        Download