Analysis

  • max time kernel
    144s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-10-2024 02:00

General

  • Target

    '''.exe

  • Size

    2.0MB

  • MD5

    60b42e43178ad0ed1484e4afef56e740

  • SHA1

    45d484903388cd149f9e2e5afbfe247c90a00031

  • SHA256

    ed0cc4ec1b8de4c0e315f3caa855892f7ace7cccd3b8e98c7589316ef9fd1972

  • SHA512

    1d397050fe7969993404ee0313ee071ec6a5bd316a40210c72404600057b9a7cca2c78302d28e9f576a42c74ddfec37856b7188c7dd64d173afce043d9b2bc7f

  • SSDEEP

    49152:4VAbwcf0qplQ9rQ7JC+zQlQTLw9Lqb4tBr9mPrIdq1AT2v:0Aa+lQp85Q59mb47r9mDLm2v

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\'''.exe
    "C:\Users\Admin\AppData\Local\Temp\'''.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Users\Admin\AppData\Local\Temp\7zS06F5AE67\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS06F5AE67\setup.exe --server-tracking-blob=NTdiY2VkZTZjZjIxY2ZlZTE3NTFjYTIyZDc4OGQwYmJmYmIyODgwNzIwMWZiZWY4OTBjOTE5MmQ1Zjg4YTZmYjp7ImNvdW50cnkiOiJDQSIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYSIsInF1ZXJ5IjoiL29wZXJhL3N0YWJsZS93aW5kb3dzP3V0bV9zb3VyY2U9Z29vZ2xlLWFkcyZ1dG1fbWVkaXVtPWJhX29zZSZ1dG1fY2FtcGFpZ249JTI1MjMwOCUyNTIwLSUyNTIwQ0ElMjUyMC0lMjUyMFNlYXJjaCUyNTIwLSUyNTIwRU4lMjUyMC0lMjUyMEJyYW5kZWQlMjUyMC0lMjUyMDIwMTcmdXRtX2NvbnRlbnQ9Z29vZ2xlK2NwYyZ1dG1faWQ9Z2NsaWRDandLQ0FqdzBhUzNCaEEzRWl3QUthRDJaWEFVdENvQUh4THN4V25PYW9maUNaVEJaYTM1RC1xNFRlb2tKS0dteWNGam82dVdaT09zQ3hvQ0Y1OFFBdkRfQndFJmh0dHBfcmVmZXJyZXI9aHR0cHMlM0ElMkYlMkZ3d3cuZ29vZ2xlLmNvbSUyRiZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRiZkbF90b2tlbj05NzU3NjY1NyIsInRpbWVzdGFtcCI6IjE3MjY1NTkwNzAuMTA4MSIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjguMC4wLjAgU2FmYXJpLzUzNy4zNiIsInV0bSI6eyJjYW1wYWlnbiI6IiUyMzA4JTIwLSUyMENBJTIwLSUyMFNlYXJjaCUyMC0lMjBFTiUyMC0lMjBCcmFuZGVkJTIwLSUyMDIwMTciLCJjb250ZW50IjoiZ29vZ2xlIGNwYyIsImlkIjoiZ2NsaWRDandLQ0FqdzBhUzNCaEEzRWl3QUthRDJaWEFVdENvQUh4THN4V25PYW9maUNaVEJaYTM1RC1xNFRlb2tKS0dteWNGam82dVdaT09zQ3hvQ0Y1OFFBdkRfQndFIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vIiwibWVkaXVtIjoiYmFfb3NlIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6Imdvb2dsZS1hZHMifSwidXVpZCI6IjAzNzBlZmUwLWE4NWQtNDA5Ny04NmY2LThhOGVmM2VjYjg3MiJ9
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Users\Admin\AppData\Local\Temp\7zS06F5AE67\setup.exe
        C:\Users\Admin\AppData\Local\Temp\7zS06F5AE67\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=113.0.5230.62 --initial-client-data=0x324,0x32c,0x330,0x2e4,0x334,0x74daae8c,0x74daae98,0x74daaea4
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3824
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:8
      • C:\Users\Admin\AppData\Local\Temp\7zS06F5AE67\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS06F5AE67\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1124 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20241028020052" --session-guid=70563157-f6f1-4770-95d5-713ed75066b8 --server-tracking-blob="NTAxNjA4NTg4NmYyYjQ2YjA3ZTA5NzM3ZDI2NDlhMWJkMDkyNTFlMTAyNzNhZWZmNjEzNDM3NjI0MmQwYjU3ODp7ImNvdW50cnkiOiJDQSIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhIn0sInF1ZXJ5IjoiL29wZXJhL3N0YWJsZS93aW5kb3dzP3V0bV9zb3VyY2U9Z29vZ2xlLWFkcyZ1dG1fbWVkaXVtPWJhX29zZSZ1dG1fY2FtcGFpZ249JTI1MjMwOCUyNTIwLSUyNTIwQ0ElMjUyMC0lMjUyMFNlYXJjaCUyNTIwLSUyNTIwRU4lMjUyMC0lMjUyMEJyYW5kZWQlMjUyMC0lMjUyMDIwMTcmdXRtX2NvbnRlbnQ9Z29vZ2xlK2NwYyZ1dG1faWQ9Z2NsaWRDandLQ0FqdzBhUzNCaEEzRWl3QUthRDJaWEFVdENvQUh4THN4V25PYW9maUNaVEJaYTM1RC1xNFRlb2tKS0dteWNGam82dVdaT09zQ3hvQ0Y1OFFBdkRfQndFJmh0dHBfcmVmZXJyZXI9aHR0cHMlM0ElMkYlMkZ3d3cuZ29vZ2xlLmNvbSUyRiZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRiZkbF90b2tlbj05NzU3NjY1NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcyNjU1OTA3MC4xMDgxIiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyOC4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoiJTIzMDglMjAtJTIwQ0ElMjAtJTIwU2VhcmNoJTIwLSUyMEVOJTIwLSUyMEJyYW5kZWQlMjAtJTIwMjAxNyIsImNvbnRlbnQiOiJnb29nbGUgY3BjIiwiaWQiOiJnY2xpZENqd0tDQWp3MGFTM0JoQTNFaXdBS2FEMlpYQVV0Q29BSHhMc3hXbk9hb2ZpQ1pUQlphMzVELXE0VGVva0pLR215Y0ZqbzZ1V1pPT3NDeG9DRjU4UUF2RF9Cd0UiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS8iLCJtZWRpdW0iOiJiYV9vc2UiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiZ29vZ2xlLWFkcyJ9LCJ1dWlkIjoiMDM3MGVmZTAtYTg1ZC00MDk3LTg2ZjYtOGE4ZWYzZWNiODcyIn0= " --desktopshortcut=1 --wait-for-package --initial-proc-handle=7C09000000000000
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:432
        • C:\Users\Admin\AppData\Local\Temp\7zS06F5AE67\setup.exe
          C:\Users\Admin\AppData\Local\Temp\7zS06F5AE67\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=113.0.5230.62 --initial-client-data=0x31c,0x320,0x328,0x2f8,0x334,0x728bae8c,0x728bae98,0x728baea4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3304
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
        3⤵
        • Enumerates system info in registry
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3348
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef4e46f8,0x7ffaef4e4708,0x7ffaef4e4718
          4⤵
            PID:4372
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
            4⤵
              PID:3856
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2936
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
              4⤵
                PID:4424
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
                4⤵
                  PID:4444
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
                  4⤵
                    PID:668
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                    4⤵
                      PID:3752
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
                      4⤵
                        PID:3636
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
                        4⤵
                          PID:2760
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4564
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5680 /prefetch:8
                          4⤵
                            PID:1880
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
                            4⤵
                              PID:5032
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
                              4⤵
                                PID:4464
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
                                4⤵
                                  PID:3500
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6456 /prefetch:8
                                  4⤵
                                    PID:1864
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
                                    4⤵
                                      PID:5364
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
                                      4⤵
                                        PID:5372
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,15889744443863013255,1129757977937346085,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4244 /prefetch:2
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5588
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4052
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4264

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

                                      Filesize

                                      471B

                                      MD5

                                      a7ace7a352ba4b229c3562e1cfb0f17a

                                      SHA1

                                      64b631fde52bd98bd358ae2e72274c1f2e8635d0

                                      SHA256

                                      662e5b1f41d1b0e9908f0047b292548837471d9503b46060f1a2c84a678501d5

                                      SHA512

                                      550d24b96618678b06961ce9b8d55cc8ac8df6dad457844302bba693abb27784e8ec0302bc7635b4e99d6c10f93d05eb651fb33279df87b552763a5dad040306

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0F90096E7DCB862ED66CE39084FC7811

                                      Filesize

                                      727B

                                      MD5

                                      f92f0494102f1f71e6e3ffc015b38de5

                                      SHA1

                                      28c85b17496bb0f8955f30df145bc5d00d82781c

                                      SHA256

                                      627fdaa7e770c890adfa5a2cbeef2f04112f76b32cca4b92254eec26eec166ce

                                      SHA512

                                      d709ac533d6bff0b5bb115d98fd6838049a6eb6463a6b7a3e43989fc6403ea2f070b7a73def839f40366c8441584bd393593f719d467336aba7cd7df91b53835

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                      Filesize

                                      471B

                                      MD5

                                      b9fd62a72a2f6a16a2de4292e8e6fc27

                                      SHA1

                                      03717f814ab6968f77399543d39fab015cf53d72

                                      SHA256

                                      00a7eb032faccfbcb6c8c260d2ae747b2c4b86e87664ac4581eae29fedc507e2

                                      SHA512

                                      d889b3deb9b1893a8b49b19d8d15026ea83d5175dd5564ff73d79e9591fe970b67880f9f67d39c84769fa04e47b84d8069b043eafa50162569ba3c890226d54e

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

                                      Filesize

                                      727B

                                      MD5

                                      fb3ad0052022397d5a1c8b766288d0ec

                                      SHA1

                                      cf5024fddad85a4d7c15336aefe9da80b7d42cda

                                      SHA256

                                      050e59f261304198054be1e0205f2570c07f4e51e87e2c6109e660ef3120fde9

                                      SHA512

                                      59b0bd85d438a8372b05824d86521f882d2c22fd4946a9bf58c9630925714f671f45a1d0aee2f8497a1480f93c9afaa8b1d14de29f9c03e9ecc82923146496df

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                      Filesize

                                      471B

                                      MD5

                                      5f2459962e06db56120ef2cd42b4de48

                                      SHA1

                                      e26adbf4927b99e67ecf188c981c30e6431def3d

                                      SHA256

                                      8bf7dc6bcc7ef2c1efb57891252b66e3e1614a5fabdbcb13da9d42bce772d53d

                                      SHA512

                                      86a20c02710d9d79ed59e479a9bbfb5d7dc42765a2446a30bf29535f11447168713144d20b7571078332032b8c157f51037e8aae549760436d93b5eee863ff92

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

                                      Filesize

                                      400B

                                      MD5

                                      8e13702405f6b3b99ac5c208dd79742a

                                      SHA1

                                      67907226e6588ad633ac22c6637bceef01bca026

                                      SHA256

                                      8524b6881851b3beedbbe06cbde3a5e336a9055deb6ba91ee86c15d157a849a0

                                      SHA512

                                      2eb0d32020257ef1d793ead32bdc74e373a46e8fe3f05f3fb091af0c295db2a60fc533f99fa20e60786d2b63eecd35097fbe6ff3214a8b50daff856c3d42a6b1

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0F90096E7DCB862ED66CE39084FC7811

                                      Filesize

                                      412B

                                      MD5

                                      2c6e1437bc47631936846e313a9d183c

                                      SHA1

                                      9ca8aa4b01e4e970674fbd139cfac044c402f73d

                                      SHA256

                                      e2f885aaab984abe530bd1fe8b92a51172835c617c1368682f2bbe268d567f15

                                      SHA512

                                      f6bee19e1aba5ef2a1168d07353fd0b8da6bec2269433605c1c5998ee5ba4ec43535f49b638fe3ccae5ce4528098f9f5c62659aa7908a2204630aed1faab7224

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                      Filesize

                                      400B

                                      MD5

                                      c5736a7f3d86973e0189685427196d68

                                      SHA1

                                      21382512fe6aded0f4f44cfcc90d1591d26e6b5e

                                      SHA256

                                      62f7598e7f56a350088835f176cb9381c0cecf77f7755b4e78a1422c0d34e2e1

                                      SHA512

                                      77cb5f8bd01e4aac10e5772283b006dde39aca98f8bcdfc4be8206a034f470e3bf546cf57ca13442b3239ac339ec6f8bc43e321a9d33ae54fa234d1438b691c9

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

                                      Filesize

                                      412B

                                      MD5

                                      9e9cbf8c42d966c56dd4067b5dbae286

                                      SHA1

                                      de0e8a756bdaa3b23323f6dec60925d013f3aa23

                                      SHA256

                                      e4bb4534ce1f057e6fef71e7fcbb77248cc818217caf0c99be57520739cd7ccf

                                      SHA512

                                      dbbe0288b9a411d479db92952730169b0e427e2f8b21cd6d41de26bd2ca4991f5045deb7eaf540820f2a556d2e93ee738d805987701490f0ba85f3484feceef6

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                      Filesize

                                      412B

                                      MD5

                                      3d6e7c9a662cb0a6a67794027343e4c8

                                      SHA1

                                      9a403f3e91fd5889f6a3a9122927c6faf020d87f

                                      SHA256

                                      f910b3322c8d866838398bee4f721430f07442dc03756348015e7ec0093f2b37

                                      SHA512

                                      1beda8d9cfffdb7b5b34d4e1a5a70475dbc539ec8f5e3a4dba34c9744c215566e5c65a25c9a5b1db1b2ed81632b7ee0849996925cb43e964a4b16893f6b6f3fe

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10a422de-22ff-43cc-b706-9585218e99e3.tmp

                                      Filesize

                                      11KB

                                      MD5

                                      277e5013fc654370226dd1bea8bf7344

                                      SHA1

                                      3a0322b9eb82b559f492be5345ad14972214ed4b

                                      SHA256

                                      93d298aa0be23ac7b73be0e8f03ffb89d3d51d6f206e9d2a7fd120e062d184cb

                                      SHA512

                                      1df0463cf5126336184284a23d64151284fe14d240f360d8159e48e1019394e4767cbf26ed901f7a8dfffac8f3404fd2af22fc2e06fcbf9ac1174fb8658a573a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      a0486d6f8406d852dd805b66ff467692

                                      SHA1

                                      77ba1f63142e86b21c951b808f4bc5d8ed89b571

                                      SHA256

                                      c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

                                      SHA512

                                      065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      dc058ebc0f8181946a312f0be99ed79c

                                      SHA1

                                      0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

                                      SHA256

                                      378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

                                      SHA512

                                      36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      192B

                                      MD5

                                      7ab3796f2ba9648a0f5c8fe20c729b2f

                                      SHA1

                                      d7af5bb5568ebcec112a020a453df6ffa86336bb

                                      SHA256

                                      2e00e4f422f4ebca2aa1db878eaef9790f0743b8ff8e4c42a5ba23101d13e9d8

                                      SHA512

                                      2a2e273f211a0896c219ed3b2908b91644e6c4f9fb9bf1c72c0f8c32d7df16a126161b3bd174c49b3f4d7d52963b313371579fc90fb4a5314e810b934716d3be

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      39c535c2c68ab9dcfa05f37100139a0b

                                      SHA1

                                      3a43b99d1029c6e59ee244c42a2a0b40bda5bfbc

                                      SHA256

                                      dd1a6971452df16e7a4247947b877dc3a3cc3c5204ef4183761ab73741a033c7

                                      SHA512

                                      49779416ec1beff561cdc978406da9c731b8e21af76e0625e5fcc9e473c4712e466321516bf1677808adc85a803f35b0636dffb7faa82d11199ad6196e6ca0ce

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      d01982d278bc1473451966d424ee7813

                                      SHA1

                                      ac24c30a3e6bcf4be73cad6899a05a3ba381cab6

                                      SHA256

                                      95d1485898eae6b823970a4a64d16c37993c82bdced75b4efa4396a16111febc

                                      SHA512

                                      a9d558a3eff805975c19dae921efef5d6b8eefbdbfaa30ceb30626d18750feb0813c0cc122b184754776573748a7e06c3983ee65e9199f55645f132331948f9b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      1434e536115abfacf15484d139f6cef5

                                      SHA1

                                      5066f07fa4310c4d9595dd7d726143615091315d

                                      SHA256

                                      4841893873a1af17ae13394855d3ad923e370a07630f59ac5ef4b6aee545cda7

                                      SHA512

                                      d1afd2426b9f6fd5435e69ba9b18fbc1c4b687f720a02de8b6d081987f0b222ec0498a89d5b322d5b66b99b50d82649235d99b0348c55fef7d9992348c942ef2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                      Filesize

                                      72B

                                      MD5

                                      6a74fef4e6304a43cbb2f832c2b29d49

                                      SHA1

                                      8b5fb7bb0d328d8ff89eec3920144e24c5e4c49e

                                      SHA256

                                      bc4eea65fed9b0e137a88a9485c32666da952b303f3ac7f3ab73da264e0f63bf

                                      SHA512

                                      19782ccf7e3d950a257dc93d1b7aca4b94fdc509d4077253eb2c1a1ce2f2a502af07274e379c8d5a78f14416ecd40e448c1e8f796302d08619af440692f44f26

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ea41.TMP

                                      Filesize

                                      48B

                                      MD5

                                      1d82566bea3cf0182a5611b6002b3b52

                                      SHA1

                                      4df93b7a8067c0a1001f82be46c3a478e61a6eb8

                                      SHA256

                                      b656c5c63825e5d3d5badb2fb0f6d0d05783721d32a0cb14c42f8e4e6bd7bfda

                                      SHA512

                                      63f9e4d90c2355cf710b241c6d443fe1d095a90ea1455516d3d0151d62530003063b909dca095a31dcc0965bdbe59a6deec9e1faaec3324ef7a42c7ba18038be

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      78e6f9c54f44ee462dac39829b28c4a9

                                      SHA1

                                      1b06c359b33f965b15075f89566426a5ce60bad8

                                      SHA256

                                      e27b78034594a0a94ea5533f18c80cb90cb9bc5936db772d169da08762fff8dc

                                      SHA512

                                      9522724e800bc72e9722556b3da437d4589f2b990cc500e3ec6cd7c3e0cb1173ff8dcad93a5fd6480b00ad6775df5e9b62c62e73cbe7253be860bcd6ca0927d3

                                    • C:\Users\Admin\AppData\Local\Temp\7zS06F5AE67\setup.exe

                                      Filesize

                                      5.1MB

                                      MD5

                                      c3ad19d69141fa707540087edc297679

                                      SHA1

                                      0bba92b6e3371770989ef3597a9192d16b4feae2

                                      SHA256

                                      ff7ac32388dbd9ad3ef945b0e71518c2d869b9d9cc8fbbd14d3b0665850b0933

                                      SHA512

                                      28648a5c8c44def983cbdc4f6b48dc97d5fbda2a2f8ac3d93f85476f3492bc18986be97a5954e27fff1206779736b0ed90df1a04c35f30e1c182b6435cf33f2f

                                    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2410280200519891124.dll

                                      Filesize

                                      4.6MB

                                      MD5

                                      af4d7038964957d0316e5cc585dcc65b

                                      SHA1

                                      5adf3de24387ba6aa548787586cca5c6186fddfa

                                      SHA256

                                      bac6f2f2f872837ceecf54e7ab04e620e5e0a951029e93920977bac0a2b0fe03

                                      SHA512

                                      b76b889e3ef159a363a85b0db84a67d478a04b1737b14582877622dc07fd12fb5dd20171d0f178bad1c7d9b77aebe76edee59ca9e5b8c75d983384e6dab33fa4

                                    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                      Filesize

                                      40B

                                      MD5

                                      91f20233c4a2d30e3df9c8b8197fe1e3

                                      SHA1

                                      98eb15912a41007747f93487f99aa702c487e82f

                                      SHA256

                                      3b21fd8412480f338511ab27e54b52e79b79d7274018baac2d33ab829379f38c

                                      SHA512

                                      f16492220ebaa31d91e7e4da88ca89d9631322baca6a1885e6da7c4e4080fc8c5a9418457930f3ab6d3e3492166ce9df2056d30afb88581b2411f9df8d3f60c0

                                    • \??\pipe\LOCAL\crashpad_3348_QDSMHVRXGPRVZXCH

                                      MD5

                                      d41d8cd98f00b204e9800998ecf8427e

                                      SHA1

                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                      SHA256

                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                      SHA512

                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e