hxxps://d226ryxb715ss0[.]cloudfront[.]net/OPNC-v1[.]1[.]25[.]0[.]msi

Analysis

max time kernel
113s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msi

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
74	5924	powershell.exe
83	5736	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3280	MSI7013.tmp

Loads dropped DLL 14 IoCs

pid	Process
5860	MsiExec.exe
5860	MsiExec.exe
5860	MsiExec.exe
5860	MsiExec.exe
5860	MsiExec.exe
5860	MsiExec.exe
5860	MsiExec.exe
5860	MsiExec.exe
5736	powershell.exe
5736	powershell.exe
5736	powershell.exe
5860	MsiExec.exe
5860	MsiExec.exe
5860	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI67C0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6995.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DC0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI87C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI991A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5829ca.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2AA5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C37.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{529DBCA3-E717-45E5-8D8E-CBDC13C13456}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7013.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7014.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA59E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51C6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BAA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CB5.tmp	msiexec.exe
File created	C:\Windows\Installer\e5829ce.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5829ca.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003bdb789d3f9a74d00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003bdb789d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003bdb789d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3bdb789d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003bdb789d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 791219.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
3384	msedge.exe
3384	msedge.exe
4772	identity_helper.exe
4772	identity_helper.exe
2976	msedge.exe
2976	msedge.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
2540	powershell.exe
2540	powershell.exe
2540	powershell.exe
8	msiexec.exe
8	msiexec.exe
5736	powershell.exe
5736	powershell.exe
6056	powershell.exe
6056	powershell.exe
5736	powershell.exe
6056	powershell.exe
4824	powershell.exe
4824	powershell.exe
4824	powershell.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
5536	powershell.exe
5536	powershell.exe
5536	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4776	msiexec.exe
Token: SeSecurityPrivilege	8	msiexec.exe
Token: SeCreateTokenPrivilege	4776	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4776	msiexec.exe
Token: SeLockMemoryPrivilege	4776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4776	msiexec.exe
Token: SeMachineAccountPrivilege	4776	msiexec.exe
Token: SeTcbPrivilege	4776	msiexec.exe
Token: SeSecurityPrivilege	4776	msiexec.exe
Token: SeTakeOwnershipPrivilege	4776	msiexec.exe
Token: SeLoadDriverPrivilege	4776	msiexec.exe
Token: SeSystemProfilePrivilege	4776	msiexec.exe
Token: SeSystemtimePrivilege	4776	msiexec.exe
Token: SeProfSingleProcessPrivilege	4776	msiexec.exe
Token: SeIncBasePriorityPrivilege	4776	msiexec.exe
Token: SeCreatePagefilePrivilege	4776	msiexec.exe
Token: SeCreatePermanentPrivilege	4776	msiexec.exe
Token: SeBackupPrivilege	4776	msiexec.exe
Token: SeRestorePrivilege	4776	msiexec.exe
Token: SeShutdownPrivilege	4776	msiexec.exe
Token: SeDebugPrivilege	4776	msiexec.exe
Token: SeAuditPrivilege	4776	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4776	msiexec.exe
Token: SeChangeNotifyPrivilege	4776	msiexec.exe
Token: SeRemoteShutdownPrivilege	4776	msiexec.exe
Token: SeUndockPrivilege	4776	msiexec.exe
Token: SeSyncAgentPrivilege	4776	msiexec.exe
Token: SeEnableDelegationPrivilege	4776	msiexec.exe
Token: SeManageVolumePrivilege	4776	msiexec.exe
Token: SeImpersonatePrivilege	4776	msiexec.exe
Token: SeCreateGlobalPrivilege	4776	msiexec.exe
Token: SeBackupPrivilege	4956	vssvc.exe
Token: SeRestorePrivilege	4956	vssvc.exe
Token: SeAuditPrivilege	4956	vssvc.exe
Token: SeBackupPrivilege	8	msiexec.exe
Token: SeRestorePrivilege	8	msiexec.exe
Token: SeRestorePrivilege	8	msiexec.exe
Token: SeTakeOwnershipPrivilege	8	msiexec.exe
Token: SeRestorePrivilege	8	msiexec.exe
Token: SeTakeOwnershipPrivilege	8	msiexec.exe
Token: SeDebugPrivilege	5924	powershell.exe
Token: SeRestorePrivilege	8	msiexec.exe
Token: SeTakeOwnershipPrivilege	8	msiexec.exe
Token: SeBackupPrivilege	5756	srtasks.exe
Token: SeRestorePrivilege	5756	srtasks.exe
Token: SeSecurityPrivilege	5756	srtasks.exe
Token: SeTakeOwnershipPrivilege	5756	srtasks.exe
Token: SeBackupPrivilege	5756	srtasks.exe
Token: SeRestorePrivilege	5756	srtasks.exe
Token: SeSecurityPrivilege	5756	srtasks.exe
Token: SeTakeOwnershipPrivilege	5756	srtasks.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeRestorePrivilege	8	msiexec.exe
Token: SeTakeOwnershipPrivilege	8	msiexec.exe
Token: SeRestorePrivilege	8	msiexec.exe
Token: SeTakeOwnershipPrivilege	8	msiexec.exe
Token: SeRestorePrivilege	8	msiexec.exe
Token: SeTakeOwnershipPrivilege	8	msiexec.exe
Token: SeRestorePrivilege	8	msiexec.exe
Token: SeTakeOwnershipPrivilege	8	msiexec.exe
Token: SeRestorePrivilege	8	msiexec.exe
Token: SeTakeOwnershipPrivilege	8	msiexec.exe
Token: SeRestorePrivilege	8	msiexec.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
4776	msiexec.exe
4776	msiexec.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 1564	3384	msedge.exe	51
PID 3384 wrote to memory of 1564	3384	msedge.exe	51
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 416	3384	msedge.exe	88
PID 3384 wrote to memory of 4060	3384	msedge.exe	87
PID 3384 wrote to memory of 4060	3384	msedge.exe	87
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89
PID 3384 wrote to memory of 4020	3384	msedge.exe	89

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msi
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d6c846f8,0x7ff8d6c84708,0x7ff8d6c84718
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\OPNC-v1.1.25.0.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3762218886954856806,10962716667585444865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5756
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6DAF1004FE4668AF4C01F62AA6843ABF
  2⤵
  - Loads dropped DLL
  PID:5860
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss30C2.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi3081.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr3082.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr3083.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss56FD.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi56EA.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr56FB.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr56FC.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /end /tn OpStartupTask
      4⤵
      PID:5276
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /delete /tn OpStartupTask /F
      4⤵
      PID:5396
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /end /tn OpStartupTaskP
      4⤵
      PID:5392
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /delete /tn OpStartupTaskP /F
      4⤵
      PID:2456
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\OPWC\pss7401.ps1" -propFile "C:\Users\Admin\AppData\Local\OPWC\msi73EE.txt" -scriptFile "C:\Users\Admin\AppData\Local\OPWC\scr73EF.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\OPWC\scr73F0.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6056
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss8D89.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi8D86.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr8D87.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr8D88.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4824
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\OPWC\pss9CB2.ps1" -propFile "C:\Users\Admin\AppData\Local\OPWC\msi9C90.txt" -scriptFile "C:\Users\Admin\AppData\Local\OPWC\scr9CB0.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\OPWC\scr9CB1.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4872
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\OPWC\pssA6F9.ps1" -propFile "C:\Users\Admin\AppData\Local\OPWC\msiA6E6.txt" -scriptFile "C:\Users\Admin\AppData\Local\OPWC\scrA6E7.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\OPWC\scrA6E8.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5536
- C:\Windows\Installer\MSI7013.tmp
  "C:\Windows\Installer\MSI7013.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Local\OPWC\" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noninteractive -ExecutionPolicy bypass -c "$w="$env:LOCALAPPDATA"+'/OPWC/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'OperaSharpDLL.dll'));[OperaSharpDLL.Helper]::Startup(1)"
  2⤵
  - Executes dropped EXE
  PID:3280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noninteractive -ExecutionPolicy bypass -c "$w="$env:LOCALAPPDATA"+'/OPWC/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'OperaSharpDLL.dll'));[OperaSharpDLL.Helper]::Startup(1)"
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5829cd.rbs

Filesize
10KB

MD5
6b771a4034668eb10559b26ffd694d20

SHA1
3d7ba845ec88f8f2dc76ca4fffdacf00eb55bb27

SHA256
b39edf9fbd705bb526e05c85738d966804ddb39ad39333c59718b52f417bd1e5

SHA512
e1f93da1a56e3ea03af84cc9a7cac704c466058e1c953dcc8aad752ce9934985bde2bb64ed1bf5384d06930bec753a1fb78210778e73e665e1cd862fa54400c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_311960E55A58A05BBAEDC1F153C508C0

Filesize
1KB

MD5
f820325e9738d84acff978e5fb24b4e2

SHA1
194116e6e002b6cf57f2ba2724adc93568090a46

SHA256
f5c57c8e859c71a8110a9002dd16e73d0039deab66004c824e5cb05939b91e36

SHA512
4bc81612ddd0722ab95c6ef1e4065641f7e4145a18df630de15097dc143d7651e09f6df3d95b0f6c48d3acdf282d3c0e7eede048b916a1ebaadffb1b0af82a01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
1KB

MD5
940e0d9a9f54e3ae9447318ee2d9fb2b

SHA1
146f0d267b3ce97d353923a47d6f147488cd48b7

SHA256
0e90a11c1f2fcc8c4fe3bd408914e39ad7f5f50a3774fe3b8112ae7ceb523703

SHA512
eba9136a99eac4f4c526d34d3f37117b6e099ac80af1dc36ede9fba5acc5b367e694e136875b2aff364ad5b669f4146561e7e9267134c6b2c36e2fc59893523f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_311960E55A58A05BBAEDC1F153C508C0

Filesize
536B

MD5
b752186fcfe4276d6cbc67c2a9179d84

SHA1
4a49e53d4f77c12a838ad7319ca8367fb6702d86

SHA256
166fb03e96eb0d56c23212edddf063a5710a6b0ae6b02e4ecc1f1b464eb99efa

SHA512
4c6fca57840b75fdb69cb93faa10add246c2027ab3c9f03e4e91e31bdf4b5fb8cd35d5bb8842f5ea2c61a805b277bd4a5f97380702871459ec41b7e5cebba1f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
536B

MD5
a1974b6e74be1d743954313245cd7c00

SHA1
0c7bc4b4cdf9d9c48c8c3506a0337746d919b19c

SHA256
559e09228d4046a0eb1066187eaab2c1ff3d2dba392f8629aebad3f29931b85f

SHA512
f9b129c412b30fdb887d088c5b4a9f6461bd7801de57dd0f5efccf43760ff23e7937b8741ef89055a12d82f9c7d93358b1446916b3db30ecd6ff69c0bc2fb5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
94ffef7920f75c8ae16b9537320ecd44

SHA1
a18b55a7898b3539b61c35115f6c532a3f9b4ee7

SHA256
bf4b691779f18d30aec12dda2c4da79cac83f7aa72e55d62ac6a447f11687a76

SHA512
4527cfabfa328acda234703318d24a4d67b86d6e88a206dbd0583a713fcc01efdcc92efd6a638d6a73a82fe8d3f30178a219fe4dc2d37292013127562ddc1b3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
197B

MD5
aa7ee073a5559d671a3dfda05653c02b

SHA1
b99766217dfb07256e80ab11a31a54c3c1d3567c

SHA256
1884124621c94524b2e4faa7b6743aa6843da718ae68fc1c445fce340d25c73f

SHA512
5de5a6003de065b94c95d17dc3082209b06a38aaf14c4f9940aa40e5dd3faf9bdc1dca6d87c1252ba4c87d5bd193a09ab57443c1a2630cc6136b8c1f625354ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29379044a641e08e11416bf75796e2be

SHA1
0221f3e2935f81349df3e6b937e88bed6357e8b1

SHA256
e3d12d162dd51aa7c3c853aee5dc4d3bd9da2d4d59b3299090fc1362dbd634d0

SHA512
f0106cd92ee8abb9122d8dc03c792f2053b2bba8a1787cfdd35ebabf2b0512090d5bbf190ac977fb72032ce0f3139688ade96393edd046d6eee922a657e974d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69c43b49c758399165cb0779914a3d4b

SHA1
ac1202de6be2a568e0b25971443d273e210f9913

SHA256
d147f15799bb26308159a793486ba83f947e7713c6fa61598f7e634a8d82ebd3

SHA512
5574fe72d829df9f53b4a5f7ae19f114c88bf26b95a0de2b69f77a81ccd93aa344a1d5c7cc396e5090fd01481bdcfd8c40ce9d7c10726c10116556dcf7a34fbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aa5a8f660bf76dd81f195737a8878455

SHA1
37773523bcaddd07dce286d07cfc82959a03a68e

SHA256
c314a53056fc1e2e4df22869794973d097729b4af10f183ab205fd55d1c085a7

SHA512
0a9910b0f876a5e1edd5ad416408e1e0a30e3a79500d12888ccfc9ff421cb3a6118ac082d416c6e7dc6762fcf2bf4c3336ec0dd24bb23fbc7c3ef09d6150bc4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
358108e19d3a32584ac33e023b937b00

SHA1
1a38d5a874dbd9958d552cc0e1efc6c6ca567dab

SHA256
08449613045d545db440114994a50e77ff2f07d4b191054d4f58a559b20e11c9

SHA512
46108ec02eca7072d9ef83fcbc70375b16653a0cade16ce1f2026e41a48a3381bcfdd793bc6d4d487daf43c931e90abe072332d6c229c86031fd319d520b1516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
28c9147b30d1c9e8e51211160413166f

SHA1
4363c8e59d085f6fb112cb8b15c21ef1a7ccc71a

SHA256
3dbc600d165b7a1ac8a580ab2d90bb84ea826779b7acbb2cc5a12c0a5423d4d4

SHA512
54f5fbc279b3b286c651d60419377fc55312a495c9708602310b1a55ca6f35d4eb450b3dbde74bb350c5961be2f37d573c1f16141e9fe5a93316e0c3b79b2cea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
c73c945206ade1485df82328a4e55907

SHA1
75e192b0971723f2530f8d2b399ab472755c591f

SHA256
16cf8ab36ecbe0b11b75bca5949c9c5b6ac3c02461ac8dc25fa0c5e7a523c364

SHA512
c2ddd279dda3877ae3bff467644899af81439382ba8e845a50138cb9a7a8846f018cceefcff79ec4ee3c749431a7893f3b91377b21c64d014af98af7c1414b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
13KB

MD5
af39c8b89ed71a2112734edae7050eeb

SHA1
c7448b0167ceebfff0ec96b3fcfc7d4557620b2c

SHA256
ea0b2a6ad1daed993e0bfe2fc6046e4abf3899d7b100915fb322ac5376f00330

SHA512
c4e6117d2ded11a4580edd2e6aa211095a07c833f89eb548a32e5812ea905b790141a13fea0c358fbb969e3ea8c6bf55c518e82ca7361014c5ff555febc969cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
6f037b3b17b050db80aa1656ea82260f

SHA1
7544d98724df5a36294173e7afc0f993187c8bfd

SHA256
3103d6ee073862e70475c1fa9899e8f28c381bcaa1d1803935788a9000bea816

SHA512
bdee051104cc82ee1a4db2e949d8f22258e92c8e8056d6f900bf476b4b1e535cdeb780ca994ee83f41d1d4b338f64b437e49379e0985db15ec3cea49ebf793db

Download Submit
C:\Users\Admin\AppData\Local\OPWC\OperaSharpDLL.dll

Filesize
10KB

MD5
e5f8942ba463e0d4a8d16954c0c34af0

SHA1
5624b0ffaa7c54ed3901272eef657e6d6d9a8f8b

SHA256
97fdcb62ff66d28d68013d9743f7952bfab5046b3654c847bbd9bdf6d9069421

SHA512
52bd35e7e77804dd072551646402098b25ebe7966be637c6a15a62858aaa33d691e68757d1e0fa41ad99d092ab36682e0bef09d36e2470794c5c5f61bf4b249f

Download Submit
C:\Users\Admin\AppData\Local\OPWC\libcurl.dll

Filesize
537KB

MD5
da0da3c5f2e455efe92ef3dde3dbc0db

SHA1
434e5ffdeb1eade3a0b2608ff9126c872781b0da

SHA256
baf9f90729adf2b87e0968ef18cb1f567e1a12fd4fcbefa20a1a697d89890702

SHA512
8d0cb8e90fa85939b8bf8df04b8351bd568e04d7d527d58bf09d59576ccb005376fc83ac3c6cf64f4c8be5a17050d2acb1cd85cfd9a4a143972badc88e35ff28

Download Submit
C:\Users\Admin\AppData\Local\OPWC\libnet.dll

Filesize
528KB

MD5
c963f79e44d93368f7a1bafd130db89d

SHA1
31f53ea81b34e60227a4ca5cc65127c443de21c9

SHA256
1fb4d1f6f10c062d65de7f7ddc9e03704ff2883c8dc48fe03ecaa63e2a2fb2c1

SHA512
98f1591e543b4648976f68b467bcfdcdf8ade5af132a398ed41ef264e2ec01021dcc9fcf2a1cb042c3b83e2f5d82950660ca60cf1182656cbebe8237c18fea60

Download Submit
C:\Users\Admin\AppData\Local\OPWC\libopensslw.dll

Filesize
2.4MB

MD5
b6a5dd3f71bed50f8051317492c0b8da

SHA1
daa72491c4d4edf02a8b15297e9a0dd449eb3631

SHA256
715fa8bc9ae9f1ab5526940c228e993d516a0613cfebf2c22580ca2d3e37b3d1

SHA512
f172d4df9272c00cb85137b2523919cbcc3c435785068e13a76133adcc1c36fdf1bd96daa2095cb8109ec7788a153fdd89df1bdc7f0261c93085482a3201f061

Download Submit
C:\Users\Admin\AppData\Local\OPWC\scr73EF.ps1

Filesize
17KB

MD5
3c6fde154b98b92675c49a420f51284e

SHA1
cf76561c15ccfd36927649a0e29dd69d2cb87310

SHA256
41d75767b23fb6211d11c4d63c9f1263825388c3f701f56dc964d77fc65ec438

SHA512
7d362617f5423f37116b04f4e10b11bba93352eb8bb86a12e540a20dfc8485b7b24d2bb0e492129861129bec5dac6b571c51b091d7e93b90c4f2ada239dd849e

Download Submit
C:\Users\Admin\AppData\Local\OPWC\scr9CB0.ps1

Filesize
15KB

MD5
963bdadd8769693000d6c225abf643bf

SHA1
0ecdcc70ad5fff7c51cd163ff78ca92b79b8599e

SHA256
682362b55a99680c711b575bb858d4d3dadb013e58e2036e95fe233909f4fd47

SHA512
566ce6883f4fac77d37bfb0a9827e3ad4a9c55fe8a8fe44941feb721b0768baa328dd5de660c3ce50b27315306640ce56b21b15bfc8df5d2370464cbc7f87628

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3jc2j055.wtp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss30C2.ps1

Filesize
19KB

MD5
f9c5172a2db91d4d2be57b20e1ca4642

SHA1
b75496c847d57775a1b42c3dc996846312d1cb82

SHA256
13f4288acb0a11dae33caca361f5e6e569265431963eeab7d37abe6e16c95702

SHA512
b66673f7d82486cca5810b34db23323271925b85d87c08db543234c3bcc0daf83248604d1d2c4a1da1c7305c320331c4b10eb281ccdcdb7011e74ca3d4b1602a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss8D89.ps1

Filesize
6KB

MD5
30c30ef2cb47e35101d13402b5661179

SHA1
25696b2aab86a9233f19017539e2dd83b2f75d4e

SHA256
53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f

SHA512
882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458

Download Submit
C:\Users\Admin\AppData\Local\Temp\scr3082.ps1

Filesize
14KB

MD5
5421cfec8544f468221df1c1bc811254

SHA1
bbe2cbcd163cdea0c27c16b213c9d4f60e46b023

SHA256
a0b7aa43e915e4934af5924cdc3d78a79067c5ec715106d76cfbb85c9c08aa88

SHA512
2b0fb0ae1fd45667f51653673e4cc87e48177d556a3f72828c8af44899c54f306e12b732cf74d890362b83953c952b3527bbaef223836a738d84146b2794d063

Download Submit
C:\Users\Admin\AppData\Local\Temp\scr56FB.ps1

Filesize
13KB

MD5
72405f8a8f7cb190a44322e8972f064f

SHA1
5667d9e66a674450fff7ccc4a203ffcb5c5461d9

SHA256
90875a123b3c61d791ba72dc7d671291f6d37ca9c30c85b7a05d9fc97ab2fdbf

SHA512
fd646de7ff2401d181f24919ca2c64d4b7bd4b9f50ca774f47c1224e650b505d62e87dfa33eed6f69c3788e3521ef3ef9861ace7c10e17249cd7bf98a74da88a

Download Submit
C:\Users\Admin\AppData\Local\Temp\scr8D87.ps1

Filesize
1KB

MD5
82cdd39907c9a7c9a0d5071037971aba

SHA1
19cfe9beef5099994506ef0644ee6825e42223dd

SHA256
2c54def32c82d4c966e20aca2f99f4fa815ed2afa92bdbe1d7adaeaadf6631c8

SHA512
25aaca7889d7260f11c75c9d7a5faa52b2d6a541d2bcf34b1638657b89d40b11a370e22f3ce96b1f7cc5a86df699866268f54517dfb62937d42af7f1d8e924a7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 791219.crdownload

Filesize
4.6MB

MD5
895e6ab696385230c6c1622f6473c22e

SHA1
3890dd7f09d8efd502f068c7119609365b7330d8

SHA256
b14596ed4072d55fe447dababdbe0d03a6c41873381d1f2de66e159702269a3b

SHA512
cd59ecbaa2c02759e8f3cf88235eb35d2bee8679aa5bcdf52a6951c339751e64a04dd80d5556126be2379faf17b3000933dbc2a0e6dec422e322719a7219f594

Download Submit
C:\Windows\Installer\MSI2AA5.tmp

Filesize
758KB

MD5
fb4665320c9da54598321c59cc5ed623

SHA1
89e87b3cc569edd26b5805244cfacb2f9c892bc7

SHA256
9fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59

SHA512
b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf

Download Submit
C:\Windows\Installer\MSI51C6.tmp

Filesize
192KB

MD5
f3b351edb8623ed951599b33e36657b4

SHA1
43faa430df8b7f7924a3e74ff42c50fd97f06450

SHA256
ba2196195677c1ca3ed4a9438a4b5a3177e957c4544a10f47db7422788e8ef1e

SHA512
d1d4133d2ec74bf8bd7da457cd130a98ee3bdaa12d21ff3cc73adee202de2fa86117f16e2219c1a08f074669aa8c3f0aeb574c3cb662f5b27353ae99be8db137

Download Submit
C:\Windows\Installer\MSI67C0.tmp

Filesize
738KB

MD5
b158d8d605571ea47a238df5ab43dfaa

SHA1
bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

SHA256
ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

SHA512
56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

Download Submit
C:\Windows\Installer\MSI6995.tmp

Filesize
704KB

MD5
701d9f1f640fa0c7482de06eab16c5ca

SHA1
47e2db562ec07fbf4508fcbc101bcc64938c1e17

SHA256
6220b91e3917149d2fa64e2b27360f1a7adacdc8060db475111fa966f1b0a041

SHA512
78f1c4b631cd69e97e7e4b77ac9bae94e2cc4713def33492472bf9f25aa1674cd46a2447b09a8be7817d442a04b037610a1bb60e3cca591aba1cd7221744b2ae

Download Submit
C:\Windows\Installer\MSI6995.tmp

Filesize
64KB

MD5
5bf120f9734d63cafc02f171bc5ecc6b

SHA1
130b030943e7546a74ce13edcf24a856ef707cdb

SHA256
148f8cdda75bdbf48938d0387d1a6d5264d7f3814d908ed585295a3957edba59

SHA512
7c414d71554b328ff4f04706b1e4f5e01b29069aa116628fd54f86c6e6bcc168ee44a1a690aff866832ffb0ea1793bae892cbb4f27c00500c71dc9679bb548c3

Download Submit
C:\Windows\Installer\MSI7013.tmp

Filesize
410KB

MD5
a02c1c595456894586003bea6a20696d

SHA1
453d30e0fa6ac136f2a471ac371d22e67a660b3c

SHA256
ae2bbe263dd46a9454a83b5ca94595b0e364a14a9e012639de356edbddfb2411

SHA512
ed17249227f5d5f26e0452aa4c57df98be9ccdb34f193f6140b100367e7d111bcdc871a7b40301ba777eeffa9dd75f4a0be0a1cc65d53a4cfa7b267c900c439e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
15.7MB

MD5
ec65d5012fd711606e7b052a5855d327

SHA1
e689670dd16d3f1bbe7c0e1702ac723edd4d5942

SHA256
8b16550ada25a9f759ca061ba5372b4224f9bb5215726f3f8779074f673eed44

SHA512
1d6640107e0b7c9ca6dc3fdc2e1cf784418f40b61c8a8344ce68fd2cacc50a53310da63b8605f3de954bb70fea64fba235ce99fe967e4970643da93edd72dbfa

Download Submit
\??\Volume{9d78db3b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6a25f3e4-6237-4ce6-83aa-50d0761b81a8}_OnDiskSnapshotProp

Filesize
6KB

MD5
12937536e7264041e4c427b20c67e691

SHA1
6e9751889535b5079908022941674265b028910a

SHA256
8cd735834eb972e59222c8af67be157bc036d15afffd59d99d87d8309eca46f3

SHA512
f42b9cc782caa8785f5e9f226ca7263a3944fc386e2abe74e3ea100ea749275f2656bb038b626886931f4e96dfc167d26e18e0f0168a32c076626c0dfb9f077e

Download Submit
memory/2540-184-0x0000000002E90000-0x0000000002EA0000-memory.dmp

Filesize
64KB

Download
memory/2540-171-0x0000000002E90000-0x0000000002EA0000-memory.dmp

Filesize
64KB

Download
memory/2540-170-0x0000000073260000-0x0000000073A10000-memory.dmp

Filesize
7.7MB

Download
memory/2540-177-0x0000000005DA0000-0x00000000060F4000-memory.dmp

Filesize
3.3MB

Download
memory/2540-188-0x0000000073260000-0x0000000073A10000-memory.dmp

Filesize
7.7MB

Download
memory/4824-305-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/4824-345-0x00000000726C0000-0x0000000072E70000-memory.dmp

Filesize
7.7MB

Download
memory/4824-337-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/4824-303-0x00000000726C0000-0x0000000072E70000-memory.dmp

Filesize
7.7MB

Download
memory/4824-315-0x0000000005A70000-0x0000000005DC4000-memory.dmp

Filesize
3.3MB

Download
memory/4824-335-0x00000000066B0000-0x00000000066FC000-memory.dmp

Filesize
304KB

Download
memory/4824-304-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/4872-357-0x0000000002D50000-0x0000000002D60000-memory.dmp

Filesize
64KB

Download
memory/4872-377-0x00000000726C0000-0x0000000072E70000-memory.dmp

Filesize
7.7MB

Download
memory/4872-358-0x0000000005D20000-0x0000000006074000-memory.dmp

Filesize
3.3MB

Download
memory/4872-373-0x0000000002D50000-0x0000000002D60000-memory.dmp

Filesize
64KB

Download
memory/4872-356-0x0000000002D50000-0x0000000002D60000-memory.dmp

Filesize
64KB

Download
memory/4872-355-0x00000000726C0000-0x0000000072E70000-memory.dmp

Filesize
7.7MB

Download
memory/5536-386-0x00000000726C0000-0x0000000072E70000-memory.dmp

Filesize
7.7MB

Download
memory/5536-388-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/5536-387-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/5536-398-0x00000000060B0000-0x0000000006404000-memory.dmp

Filesize
3.3MB

Download
memory/5536-400-0x00000000726C0000-0x0000000072E70000-memory.dmp

Filesize
7.7MB

Download
memory/5736-296-0x0000000072490000-0x0000000072C40000-memory.dmp

Filesize
7.7MB

Download
memory/5736-253-0x00000000056E0000-0x0000000005A34000-memory.dmp

Filesize
3.3MB

Download
memory/5736-278-0x00000000062E0000-0x00000000062E8000-memory.dmp

Filesize
32KB

Download
memory/5736-279-0x00000000026E0000-0x00000000026F0000-memory.dmp

Filesize
64KB

Download
memory/5736-276-0x0000000006270000-0x00000000062BC000-memory.dmp

Filesize
304KB

Download
memory/5736-248-0x0000000072490000-0x0000000072C40000-memory.dmp

Filesize
7.7MB

Download
memory/5736-249-0x00000000026E0000-0x00000000026F0000-memory.dmp

Filesize
64KB

Download
memory/5736-250-0x00000000026E0000-0x00000000026F0000-memory.dmp

Filesize
64KB

Download
memory/5924-150-0x00000000089B0000-0x0000000008F54000-memory.dmp

Filesize
5.6MB

Download
memory/5924-146-0x0000000008330000-0x00000000089AA000-memory.dmp

Filesize
6.5MB

Download
memory/5924-116-0x0000000073260000-0x0000000073A10000-memory.dmp

Filesize
7.7MB

Download
memory/5924-117-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/5924-118-0x0000000005410000-0x0000000005446000-memory.dmp

Filesize
216KB

Download
memory/5924-157-0x0000000073260000-0x0000000073A10000-memory.dmp

Filesize
7.7MB

Download
memory/5924-154-0x0000000007FB0000-0x0000000008042000-memory.dmp

Filesize
584KB

Download
memory/5924-153-0x0000000009490000-0x00000000099BC000-memory.dmp

Filesize
5.2MB

Download
memory/5924-152-0x0000000008080000-0x0000000008242000-memory.dmp

Filesize
1.8MB

Download
memory/5924-119-0x0000000005A80000-0x00000000060A8000-memory.dmp

Filesize
6.2MB

Download
memory/5924-149-0x0000000006FA0000-0x0000000006FC2000-memory.dmp

Filesize
136KB

Download
memory/5924-148-0x0000000007CB0000-0x0000000007D46000-memory.dmp

Filesize
600KB

Download
memory/5924-147-0x0000000006EF0000-0x0000000006F0A000-memory.dmp

Filesize
104KB

Download
memory/5924-120-0x0000000005A00000-0x0000000005A22000-memory.dmp

Filesize
136KB

Download
memory/5924-145-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/5924-134-0x0000000006A60000-0x0000000006AAC000-memory.dmp

Filesize
304KB

Download
memory/5924-133-0x00000000069C0000-0x00000000069DE000-memory.dmp

Filesize
120KB

Download
memory/5924-132-0x00000000063F0000-0x0000000006744000-memory.dmp

Filesize
3.3MB

Download
memory/5924-122-0x0000000006380000-0x00000000063E6000-memory.dmp

Filesize
408KB

Download
memory/5924-121-0x0000000006260000-0x00000000062C6000-memory.dmp

Filesize
408KB

Download
memory/6056-292-0x0000000072490000-0x0000000072C40000-memory.dmp

Filesize
7.7MB

Download
memory/6056-282-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/6056-265-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/6056-266-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/6056-264-0x0000000072490000-0x0000000072C40000-memory.dmp

Filesize
7.7MB

Download