Analysis

  • max time kernel
    1794s
  • max time network
    1799s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 20:01

General

  • Target

    Solara New Bootstrapper_10282148.exe

  • Size

    5.7MB

  • MD5

    15d1c495ff66bf7cea8a6d14bfdf0a20

  • SHA1

    942814521fa406a225522f208ac67f90dbde0ae7

  • SHA256

    61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42

  • SHA512

    063169f22108ac97a3ccb6f8e97380b1e48eef7a07b8fb20870b9bd5f03d7279d3fb10a69c09868beb4a1672ebe826198ae2d0ea81df4d29f9a288ea4f2b98d8

  • SSDEEP

    98304:+j8ab67Ht6RL8xpH4Tv7wPV6osBsBpPj7cZ+KCojTeEL78rqNkIi+bn:+j8aatLPV6oPrk38rqNj

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 16 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 33 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • NTFS ADS 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solara New Bootstrapper_10282148.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara New Bootstrapper_10282148.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Users\Admin\AppData\Local\OperaGX.exe
      C:\Users\Admin\AppData\Local\OperaGX.exe --silent --allusers=0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3728
      • C:\Users\Admin\AppData\Local\Temp\7zS09EA9F48\setup.exe
        C:\Users\Admin\AppData\Local\Temp\7zS09EA9F48\setup.exe --silent --allusers=0 --server-tracking-blob=ZjkwMWM2M2Y2MmRlOTE5YmI3ZDA5NzQ5ZWM1ZjhiZTc5ZGFiMzk4NDM1MzQ0YzJiYmJjZWQ1NTViOTAyODNlODp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD1iNzQxMmEzYjg0MTQ0Y2IzOTQ0NzhkYTkzM2FjYTRkNCZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInRpbWVzdGFtcCI6IjE3MzExODI1NTIuMzQ3MSIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdPVzY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfMzU3NSIsImNvbnRlbnQiOiIzNTc1X0ZpbGVETSIsImlkIjoiYjc0MTJhM2I4NDE0NGNiMzk0NDc4ZGE5MzNhY2E0ZDQiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI2MDJiZmNmNS02OWM3LTRkNjEtYjJlZS1kNGY5MmM4ZjM0ZDgifQ==
        3⤵
        • Enumerates connected drives
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:1136
        • C:\Users\Admin\AppData\Local\Temp\7zS09EA9F48\setup.exe
          C:\Users\Admin\AppData\Local\Temp\7zS09EA9F48\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x32c,0x330,0x334,0x328,0x338,0x713d8c5c,0x713d8c68,0x713d8c74
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2096
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1636
        • C:\Users\Admin\AppData\Local\Temp\7zS09EA9F48\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS09EA9F48\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1136 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241109200235" --session-guid=b635baa6-06a8-46c5-9fe1-080432fbfd29 --server-tracking-blob=ZjM3NWFlYTA2NWJkY2JhMTYxOGEzNjM4YjJmOTRmOWFlMDVhNzkxYmFkYzQyYzU0NzVkMWNmYmU5ZTRlYjUyZTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV8zNTc1JnV0bV9pZD1iNzQxMmEzYjg0MTQ0Y2IzOTQ0NzhkYTkzM2FjYTRkNCZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMTE4MjU1Mi4zNDcxIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1BCNV8zNTc1IiwiY29udGVudCI6IjM1NzVfRmlsZURNIiwiaWQiOiJiNzQxMmEzYjg0MTQ0Y2IzOTQ0NzhkYTkzM2FjYTRkNCIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6IjYwMmJmY2Y1LTY5YzctNGQ2MS1iMmVlLWQ0ZjkyYzhmMzRkOCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=D405000000000000
          4⤵
          • Enumerates connected drives
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2660
          • C:\Users\Admin\AppData\Local\Temp\7zS09EA9F48\setup.exe
            C:\Users\Admin\AppData\Local\Temp\7zS09EA9F48\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x31c,0x320,0x324,0x2f8,0x328,0x705b8c5c,0x705b8c68,0x705b8c74
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2024
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411092002351\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411092002351\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4696
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411092002351\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411092002351\assistant\assistant_installer.exe" --version
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4968
          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411092002351\assistant\assistant_installer.exe
            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411092002351\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0xec4f48,0xec4f58,0xec4f64
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:620
    • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
      "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2740
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:2904
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd2d746f8,0x7fffd2d74708,0x7fffd2d74718
      2⤵
        PID:232
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
        2⤵
          PID:2600
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1732
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
          2⤵
            PID:3264
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
            2⤵
              PID:2568
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
              2⤵
                PID:2208
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
                2⤵
                  PID:1828
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3468 /prefetch:8
                  2⤵
                    PID:3100
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3468 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3216
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
                    2⤵
                      PID:5064
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4872 /prefetch:8
                      2⤵
                        PID:1896
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
                        2⤵
                          PID:2316
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6012 /prefetch:8
                          2⤵
                            PID:4916
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
                            2⤵
                              PID:3340
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
                              2⤵
                                PID:908
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5164
                              • C:\Users\Admin\Downloads\Bootstrapper 3.exe
                                "C:\Users\Admin\Downloads\Bootstrapper 3.exe"
                                2⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5408
                                • C:\Users\Admin\Downloads\BootstrapperV1.22.exe
                                  "C:\Users\Admin\Downloads\BootstrapperV1.22.exe" --oldBootstrapper "C:\Users\Admin\Downloads\Bootstrapper 3.exe" --isUpdate true
                                  3⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5608
                                  • C:\Windows\SYSTEM32\cmd.exe
                                    "cmd" /c ipconfig /all
                                    4⤵
                                      PID:5704
                                      • C:\Windows\system32\ipconfig.exe
                                        ipconfig /all
                                        5⤵
                                        • Gathers network information
                                        PID:5748
                                    • C:\Windows\SYSTEM32\cmd.exe
                                      "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
                                      4⤵
                                        PID:5788
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
                                          5⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5836
                                      • C:\Windows\System32\msiexec.exe
                                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
                                        4⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:6068
                                      • C:\ProgramData\Solara\Solara.exe
                                        "C:\ProgramData\Solara\Solara.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5444
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7021948123430589574,16792464579792631610,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3196 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2568
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3008
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:1368
                                    • C:\Windows\system32\msiexec.exe
                                      C:\Windows\system32\msiexec.exe /V
                                      1⤵
                                      • Blocklisted process makes network request
                                      • Enumerates connected drives
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • Modifies data under HKEY_USERS
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6104
                                      • C:\Windows\System32\MsiExec.exe
                                        C:\Windows\System32\MsiExec.exe -Embedding 086F7B9EEA4A415F9F56370498CE1E19
                                        2⤵
                                        • Loads dropped DLL
                                        PID:5220
                                      • C:\Windows\syswow64\MsiExec.exe
                                        C:\Windows\syswow64\MsiExec.exe -Embedding 4776281753DCC4D172EB7139B9845C00
                                        2⤵
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        PID:5264
                                      • C:\Windows\syswow64\MsiExec.exe
                                        C:\Windows\syswow64\MsiExec.exe -Embedding 808AEB00AC315D289A8DB1E2D11A819F E Global\MSI0000
                                        2⤵
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        PID:5496
                                        • C:\Windows\SysWOW64\wevtutil.exe
                                          "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5408
                                          • C:\Windows\System32\wevtutil.exe
                                            "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
                                            4⤵
                                              PID:5756

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Config.Msi\e59e539.rbs

                                        Filesize

                                        1.0MB

                                        MD5

                                        54c9b2e5d41a796ba7f5889689c81ecb

                                        SHA1

                                        5a2ce6a9bb4ca459cb2681cbb2b4a4819a36f2fe

                                        SHA256

                                        84557b3351aa65057b5f30542ff3d6629300c1b78e4ac87eedfa14e21563c8fa

                                        SHA512

                                        64cb75961b9530e195058f33a310572d2d8c279087991ca6b184f96f80700edc1fb96b8af28577fcd02f62e571568c12fed7496c443c35daa292bb902143deac

                                      • C:\Program Files\nodejs\node_etw_provider.man

                                        Filesize

                                        10KB

                                        MD5

                                        1d51e18a7247f47245b0751f16119498

                                        SHA1

                                        78f5d95dd07c0fcee43c6d4feab12d802d194d95

                                        SHA256

                                        1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

                                        SHA512

                                        1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

                                        Filesize

                                        818B

                                        MD5

                                        2916d8b51a5cc0a350d64389bc07aef6

                                        SHA1

                                        c9d5ac416c1dd7945651bee712dbed4d158d09e1

                                        SHA256

                                        733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

                                        SHA512

                                        508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

                                        Filesize

                                        1KB

                                        MD5

                                        5ad87d95c13094fa67f25442ff521efd

                                        SHA1

                                        01f1438a98e1b796e05a74131e6bb9d66c9e8542

                                        SHA256

                                        67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

                                        SHA512

                                        7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

                                        Filesize

                                        754B

                                        MD5

                                        d2cf52aa43e18fdc87562d4c1303f46a

                                        SHA1

                                        58fb4a65fffb438630351e7cafd322579817e5e1

                                        SHA256

                                        45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

                                        SHA512

                                        54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

                                        Filesize

                                        771B

                                        MD5

                                        e9dc66f98e5f7ff720bf603fff36ebc5

                                        SHA1

                                        f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

                                        SHA256

                                        b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

                                        SHA512

                                        8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

                                        Filesize

                                        730B

                                        MD5

                                        072ac9ab0c4667f8f876becedfe10ee0

                                        SHA1

                                        0227492dcdc7fb8de1d14f9d3421c333230cf8fe

                                        SHA256

                                        2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

                                        SHA512

                                        f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

                                        Filesize

                                        1KB

                                        MD5

                                        d116a360376e31950428ed26eae9ffd4

                                        SHA1

                                        192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

                                        SHA256

                                        c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

                                        SHA512

                                        5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

                                        Filesize

                                        802B

                                        MD5

                                        d7c8fab641cd22d2cd30d2999cc77040

                                        SHA1

                                        d293601583b1454ad5415260e4378217d569538e

                                        SHA256

                                        04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

                                        SHA512

                                        278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

                                        Filesize

                                        16KB

                                        MD5

                                        bc0c0eeede037aa152345ab1f9774e92

                                        SHA1

                                        56e0f71900f0ef8294e46757ec14c0c11ed31d4e

                                        SHA256

                                        7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

                                        SHA512

                                        5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

                                        Filesize

                                        780B

                                        MD5

                                        b020de8f88eacc104c21d6e6cacc636d

                                        SHA1

                                        20b35e641e3a5ea25f012e13d69fab37e3d68d6b

                                        SHA256

                                        3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

                                        SHA512

                                        4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

                                        Filesize

                                        763B

                                        MD5

                                        7428aa9f83c500c4a434f8848ee23851

                                        SHA1

                                        166b3e1c1b7d7cb7b070108876492529f546219f

                                        SHA256

                                        1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

                                        SHA512

                                        c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

                                        Filesize

                                        4KB

                                        MD5

                                        f0bd53316e08991d94586331f9c11d97

                                        SHA1

                                        f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

                                        SHA256

                                        dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

                                        SHA512

                                        fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

                                      • C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

                                        Filesize

                                        771B

                                        MD5

                                        1d7c74bcd1904d125f6aff37749dc069

                                        SHA1

                                        21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

                                        SHA256

                                        24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

                                        SHA512

                                        b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

                                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

                                        Filesize

                                        168B

                                        MD5

                                        db7dbbc86e432573e54dedbcc02cb4a1

                                        SHA1

                                        cff9cfb98cff2d86b35dc680b405e8036bbbda47

                                        SHA256

                                        7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

                                        SHA512

                                        8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

                                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

                                        Filesize

                                        133B

                                        MD5

                                        35b86e177ab52108bd9fed7425a9e34a

                                        SHA1

                                        76a1f47a10e3ab829f676838147875d75022c70c

                                        SHA256

                                        afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

                                        SHA512

                                        3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

                                      • C:\ProgramData\Solara\Solara.exe

                                        Filesize

                                        133KB

                                        MD5

                                        c6f770cbb24248537558c1f06f7ff855

                                        SHA1

                                        fdc2aaae292c32a58ea4d9974a31ece26628fdd7

                                        SHA256

                                        d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

                                        SHA512

                                        cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                                        Filesize

                                        1KB

                                        MD5

                                        67e486b2f148a3fca863728242b6273e

                                        SHA1

                                        452a84c183d7ea5b7c015b597e94af8eef66d44a

                                        SHA256

                                        facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

                                        SHA512

                                        d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

                                        Filesize

                                        436B

                                        MD5

                                        971c514f84bba0785f80aa1c23edfd79

                                        SHA1

                                        732acea710a87530c6b08ecdf32a110d254a54c8

                                        SHA256

                                        f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

                                        SHA512

                                        43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                                        Filesize

                                        174B

                                        MD5

                                        fefc8b62f5841fa701d8a5bac02bd24f

                                        SHA1

                                        869e58183253c880f3914f6fe70d09e8005d95fa

                                        SHA256

                                        5ba13ff32438c9e9184d8e1053a7d90b21f0083edceb037e9f8b6cd6d15405ec

                                        SHA512

                                        e62620351094f0059d4abae6ef00b6295acce47a05b74a2a2ce0fa2642681c7ad21c4d6a955a58e66d7827e350e327dd7e4241da41e5a9e8989a370dcb9937a9

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

                                        Filesize

                                        170B

                                        MD5

                                        631a2d49e7e57766dac68e92d8571ce6

                                        SHA1

                                        f2f875d2f53c5e3bdd6f33d4071fff7025b35850

                                        SHA256

                                        125bded8980f866ecdb2c823b71c8c85466c79de8455215c2ce0572a38aabe27

                                        SHA512

                                        93c48a4e7f066b407c37afb7a92a0fe2a22a650d5e187a6f873ef9529a0147d1f33c567ee05c8f64e397d4396577d45aa4b2b4bc291bdef7786a694ce0161ee0

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        ba6ef346187b40694d493da98d5da979

                                        SHA1

                                        643c15bec043f8673943885199bb06cd1652ee37

                                        SHA256

                                        d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

                                        SHA512

                                        2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        75a61078e84c43c317244a81bc088082

                                        SHA1

                                        0084513adf072ab9d45a3ce57e0abae705d5a08e

                                        SHA256

                                        d91605fb12c2533197c96b05e323f9666e7a91825d2ed8b8a4a2afcdb3141f17

                                        SHA512

                                        7ee73e5eaff5323879b688262c61927189a1614bd5a6ec91e576f36f47505e7a4038c99bd26e1ede6b4e95bea99216fef876b7a08a59d0412c755ad34a9a8291

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        462cc206582bfe15b5a549c4e70818ee

                                        SHA1

                                        397718dc76263ab3047b9259dbafdb876ae29258

                                        SHA256

                                        452c1d1d95933a33bb417a3eeabc405dee1e22dd3b8ad4d24a7ad72d2d3ce181

                                        SHA512

                                        14c47a2ab04ede4c855a2b09acd09d2eabc2a54979e6b20d05b8ffc8e02ee0b91cc2f53a8bad17a2263d47f075518870719113846e86414578576c692524844c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        b4ed17fda10d580ca5679b760ccd74aa

                                        SHA1

                                        49b9f8cbe3a073166e5f79450dc3c04ad25179c2

                                        SHA256

                                        a34d39aa2e8a990ceb5e0b263f5bb064daeeb961ec7381724b847297d55c5a84

                                        SHA512

                                        455368fee08f3e3ae6f2d5c3da621c0399e033bd2d13a9e38640697aa1c62db6155dd10ce1d3e9e92e18d6740f7281965e0c67a8550c6e4a635ecf8741203f7e

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        6752a1d65b201c13b62ea44016eb221f

                                        SHA1

                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                        SHA256

                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                        SHA512

                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        10KB

                                        MD5

                                        60090a7d0cef313011d91681320fd38a

                                        SHA1

                                        62370480d27aa50802859219962bda8fccf9202c

                                        SHA256

                                        4a4cfb2326e11392a8e74460dc2244055e7a1853f8d722c719b34808be07ca62

                                        SHA512

                                        91935a874f91da9e112b092a7054ec0ac48a0a22ae294d8644ee850672602b7023ffe6d597212a1d59678ab9bdf03f51659afcf36fc66e0e7ae2337f6f228ddf

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        10KB

                                        MD5

                                        a5937ea244752afcf69cdf2be98d60c1

                                        SHA1

                                        830c8c0205895b760d17abb20775ce5994761ad7

                                        SHA256

                                        dc3ef4743c49a23d0469d633bd9fda95729af799b43c00aefaeb146358514542

                                        SHA512

                                        7c723ca2f23dc354d97dca672f58d550223123b034b844c8148caa95caae68ebba2cdb6810e48b4f1e2bf056432d61545bb86b2c87c2482afb909f95b7e9788a

                                      • C:\Users\Admin\AppData\Local\OperaGX.exe

                                        Filesize

                                        3.2MB

                                        MD5

                                        84b130d4dec269270a0ccfa13ad65884

                                        SHA1

                                        cf743db303d27eed0a67a2a67d893a533e030aab

                                        SHA256

                                        7284a283ececcbf32aa0dc078d521a55299c63fe2c2b851bc4ce7b921f8ddb7b

                                        SHA512

                                        4195789eefbc3f5a631c80f0cfc3c43629122f0d8ec99cf6581c97300fb5a0b9b72daa5e1fc5605e39690960d14408f50fc81c400cf8055cbd70b124516c259e

                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411092002351\additional_file0.tmp

                                        Filesize

                                        1.4MB

                                        MD5

                                        e9a2209b61f4be34f25069a6e54affea

                                        SHA1

                                        6368b0a81608c701b06b97aeff194ce88fd0e3c0

                                        SHA256

                                        e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

                                        SHA512

                                        59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411092002351\assistant\assistant_installer.exe

                                        Filesize

                                        1.8MB

                                        MD5

                                        4c8fbed0044da34ad25f781c3d117a66

                                        SHA1

                                        8dd93340e3d09de993c3bc12db82680a8e69d653

                                        SHA256

                                        afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

                                        SHA512

                                        a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

                                      • C:\Users\Admin\AppData\Local\Temp\7zS09EA9F48\setup.exe

                                        Filesize

                                        6.5MB

                                        MD5

                                        dcc0d15e77a7872758e65deb0bfc6745

                                        SHA1

                                        1efb89e143bf5edd34d46ae8370ecc13d4c3339f

                                        SHA256

                                        87a168a04a254b1cf1adfe732e8b7b08d5c3e76ddca4e8b7fb4e58ebef85fe64

                                        SHA512

                                        9cb972bcd99fd03a924bbff79e8989a040d1202a77c9d8f62ea862cc6b1d258778410ad9a4de5f2aab43062f5e9fe17d7ab9baa000de98d22a47f1471d1de778

                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2411092002337731136.dll

                                        Filesize

                                        6.0MB

                                        MD5

                                        1b07ce60bc1c77f0cadf13c2e62b1383

                                        SHA1

                                        ca70d0ef99ae5d1ebf85880ee669ad1145e4d79d

                                        SHA256

                                        e48eb19ca0210f9063f4e77c2f14293ee940eeaef2ecb9efceac7f6336cc203f

                                        SHA512

                                        94c358b6dfef0fcb0012a3a43235292b18ebf897043baef0c110570e91cc73721b12f1f771df6d000b4097f3c0cc22dcc65330a9153c7a9643787d24da6108f0

                                      • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe

                                        Filesize

                                        3.8MB

                                        MD5

                                        bf6eed6cdc17a0130189a33a55ef5209

                                        SHA1

                                        e337f5a0931f69c464f162385f1330b4d27b372f

                                        SHA256

                                        ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168

                                        SHA512

                                        90d23fd84007343e85f9fc003cf826b112fd930216a24d8c1488468443ae2a4b0c3cc2426b91c81a8228e125050e922fce05672e010e65247709fc4a7b856f1d

                                      • C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

                                        Filesize

                                        30.1MB

                                        MD5

                                        0e4e9aa41d24221b29b19ba96c1a64d0

                                        SHA1

                                        231ade3d5a586c0eb4441c8dbfe9007dc26b2872

                                        SHA256

                                        5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

                                        SHA512

                                        e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

                                      • C:\Users\Admin\AppData\Local\link.txt

                                        Filesize

                                        57B

                                        MD5

                                        0ed76d0a948f021916b8c255fb16ba99

                                        SHA1

                                        1f3af610b441cb151f89009d4d1343be66c875cd

                                        SHA256

                                        eca0a517e62a864b0e05633b9bf1a14b401e350d3788a17569569b8076ddba99

                                        SHA512

                                        a0259b538e8931ca4505224e5070b30ee202d6529d41a032b2921a26be8868eeb4403d9da582bae9478b53ed7a5e8b4325f681d03a5726b981686b0ffaa46b25

                                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

                                        Filesize

                                        40B

                                        MD5

                                        b5e6960b4c58c16c7d5abbfa4a0538ba

                                        SHA1

                                        39c2c6ff8b664795038920e39a486f78f6efb406

                                        SHA256

                                        35997e2466f2a8e7aced8d44752324c1482b0aaba0a71edca90b2f549b9bfc7a

                                        SHA512

                                        887e3740554ad4ad32a52104ea8306b3b0e8d00ee0c45d2d77cd56c9b97e20e9c74f64728056f3dc98f6edafe0a1ad9bc1bff2da0ab7d36f3f811f6248c3dd1c

                                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

                                        Filesize

                                        40B

                                        MD5

                                        081073dd3fc964d74b38c0559ea599d1

                                        SHA1

                                        ed8651273586238aea372705e8cde3f5016d7402

                                        SHA256

                                        24fad8916291231d644ef1d1002f7be653bbacf4675f196b7a39fd123ac7b6c3

                                        SHA512

                                        721d4409e12629cd80a2381c9298915ac337360b36ca3ecb6781b72c3059c8abfc5fa62683bd5404be55ff1ba35f615cf8cfac60a378f2584bd77b9446194580

                                      • C:\Users\Admin\Downloads\Bootstrapper 3.exe

                                        Filesize

                                        796KB

                                        MD5

                                        4b94b989b0fe7bec6311153b309dfe81

                                        SHA1

                                        bb50a4bb8a66f0105c5b74f32cd114c672010b22

                                        SHA256

                                        7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

                                        SHA512

                                        fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

                                      • C:\Users\Admin\Downloads\BootstrapperV1.22.exe

                                        Filesize

                                        800KB

                                        MD5

                                        2a4dcf20b82896be94eb538260c5fb93

                                        SHA1

                                        21f232c2fd8132f8677e53258562ad98b455e679

                                        SHA256

                                        ebbcb489171abfcfce56554dbaeacd22a15838391cbc7c756db02995129def5a

                                        SHA512

                                        4f1164b2312fb94b7030d6eb6aa9f3502912ffa33505f156443570fc964bfd3bb21ded3cf84092054e07346d2dce83a0907ba33f4ba39ad3fe7a78e836efe288

                                      • C:\Users\Admin\Downloads\DISCORD

                                        Filesize

                                        103B

                                        MD5

                                        b016dafca051f817c6ba098c096cb450

                                        SHA1

                                        4cc74827c4b2ed534613c7764e6121ceb041b459

                                        SHA256

                                        b03c8c2d2429e9dbc7920113dedf6fc09095ab39421ee0cc8819ad412e5d67b9

                                        SHA512

                                        d69663e1e81ec33654b87f2dfaddd5383681c8ebf029a559b201d65eb12fa2989fa66c25fa98d58066eab7b897f0eef6b7a68fa1a9558482a17dfed7b6076aca

                                      • C:\Windows\Installer\MSIEA56.tmp

                                        Filesize

                                        122KB

                                        MD5

                                        9fe9b0ecaea0324ad99036a91db03ebb

                                        SHA1

                                        144068c64ec06fc08eadfcca0a014a44b95bb908

                                        SHA256

                                        e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

                                        SHA512

                                        906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

                                      • C:\Windows\Installer\MSIEB43.tmp

                                        Filesize

                                        211KB

                                        MD5

                                        a3ae5d86ecf38db9427359ea37a5f646

                                        SHA1

                                        eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                        SHA256

                                        c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                        SHA512

                                        96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                      • C:\Windows\Installer\MSIF111.tmp

                                        Filesize

                                        297KB

                                        MD5

                                        7a86ce1a899262dd3c1df656bff3fb2c

                                        SHA1

                                        33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

                                        SHA256

                                        b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

                                        SHA512

                                        421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

                                      • memory/5408-249-0x000001C9AE780000-0x000001C9AE84E000-memory.dmp

                                        Filesize

                                        824KB

                                      • memory/5408-254-0x000001C9AECB0000-0x000001C9AECD2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/5444-3073-0x0000022667C60000-0x0000022667C84000-memory.dmp

                                        Filesize

                                        144KB

                                      • memory/5444-3074-0x000002266A870000-0x000002266ADAC000-memory.dmp

                                        Filesize

                                        5.2MB

                                      • memory/5444-3076-0x000002266A420000-0x000002266A4DA000-memory.dmp

                                        Filesize

                                        744KB

                                      • memory/5444-3077-0x000002266A4E0000-0x000002266A592000-memory.dmp

                                        Filesize

                                        712KB

                                      • memory/5608-267-0x0000022740A30000-0x0000022740AFE000-memory.dmp

                                        Filesize

                                        824KB

                                      • memory/5608-2657-0x000002275B050000-0x000002275B05A000-memory.dmp

                                        Filesize

                                        40KB

                                      • memory/5608-2659-0x000002275B0D0000-0x000002275B0E2000-memory.dmp

                                        Filesize

                                        72KB