Resubmissions

12/11/2024, 16:30

241112-tz4d7swhlc 7

12/11/2024, 16:28

241112-ty3fhswgpr 3

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/11/2024, 16:30

General

  • Target

    Luna Exploit_42878198.exe

  • Size

    5.7MB

  • MD5

    15d1c495ff66bf7cea8a6d14bfdf0a20

  • SHA1

    942814521fa406a225522f208ac67f90dbde0ae7

  • SHA256

    61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42

  • SHA512

    063169f22108ac97a3ccb6f8e97380b1e48eef7a07b8fb20870b9bd5f03d7279d3fb10a69c09868beb4a1672ebe826198ae2d0ea81df4d29f9a288ea4f2b98d8

  • SSDEEP

    98304:+j8ab67Ht6RL8xpH4Tv7wPV6osBsBpPj7cZ+KCojTeEL78rqNkIi+bn:+j8aatLPV6oPrk38rqNj

Malware Config

Signatures

  • A potential corporate email address has been identified in the URL: [email protected]
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Luna Exploit_42878198.exe
    "C:\Users\Admin\AppData\Local\Temp\Luna Exploit_42878198.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Users\Admin\AppData\Local\OperaGX.exe
      C:\Users\Admin\AppData\Local\OperaGX.exe --silent --allusers=0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5020
      • C:\Users\Admin\AppData\Local\Temp\7zSC93144E7\setup.exe
        C:\Users\Admin\AppData\Local\Temp\7zSC93144E7\setup.exe --silent --allusers=0 --server-tracking-blob=ZTJjN2MwNzg1ZDM1NDBkOTYwZjRmYjYzMjJhMWYyNmNiYzc2MDY1YmNhMDY2YThkOTY2YTA2NDliNThkMzFhYTp7ImNvdW50cnkiOiJOTCIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX05MX1BCNV8zNTc1JnV0bV9pZD01YjE2YjcwODJjMDk0NTk3YTFiYjcyMjJlMjZkZDVmOCZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInRpbWVzdGFtcCI6IjE3MzE0MjkwNjAuNTc0OCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdPVzY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9OTF9QQjVfMzU3NSIsImNvbnRlbnQiOiIzNTc1X0ZpbGVETSIsImlkIjoiNWIxNmI3MDgyYzA5NDU5N2ExYmI3MjIyZTI2ZGQ1ZjgiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJlYjY1ODQ2My0wOWVhLTQ1ODUtYWRmOC03N2QwY2FiZWYzZWIifQ==
        3⤵
        • Enumerates connected drives
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:540
        • C:\Users\Admin\AppData\Local\Temp\7zSC93144E7\setup.exe
          C:\Users\Admin\AppData\Local\Temp\7zSC93144E7\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x338,0x33c,0x340,0x318,0x344,0x71518c5c,0x71518c68,0x71518c74
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:872
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4644
        • C:\Users\Admin\AppData\Local\Temp\7zSC93144E7\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSC93144E7\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=540 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241112163102" --session-guid=48baac75-04ff-457d-b899-2355cfe8b40f --server-tracking-blob=NmVhNWE0MDJjNjEzYmUyOGM1NmI1YjFlNGJjOTZhNzIwYTMzMzFiYWY3ZmU5MjYyNzAxYzcyMWY1ODFkZTg0Mjp7ImNvdW50cnkiOiJOTCIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX05MX1BCNV8zNTc1JnV0bV9pZD01YjE2YjcwODJjMDk0NTk3YTFiYjcyMjJlMjZkZDVmOCZ1dG1fY29udGVudD0zNTc1X0ZpbGVETSIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMTQyOTA2MC41NzQ4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX05MX1BCNV8zNTc1IiwiY29udGVudCI6IjM1NzVfRmlsZURNIiwiaWQiOiI1YjE2YjcwODJjMDk0NTk3YTFiYjcyMjJlMjZkZDVmOCIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImViNjU4NDYzLTA5ZWEtNDU4NS1hZGY4LTc3ZDBjYWJlZjNlYiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=4C06000000000000
          4⤵
          • Enumerates connected drives
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2044
          • C:\Users\Admin\AppData\Local\Temp\7zSC93144E7\setup.exe
            C:\Users\Admin\AppData\Local\Temp\7zSC93144E7\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x328,0x32c,0x330,0x304,0x334,0x705d8c5c,0x705d8c68,0x705d8c74
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:3148
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411121631021\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411121631021\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1340
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411121631021\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411121631021\assistant\assistant_installer.exe" --version
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3796
          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411121631021\assistant\assistant_installer.exe
            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411121631021\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x8c4f48,0x8c4f58,0x8c4f64
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1644
    • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
      "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3636
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:2508
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8005a3cb8,0x7ff8005a3cc8,0x7ff8005a3cd8
      2⤵
        PID:2760
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
        2⤵
          PID:3560
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3736
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:8
          2⤵
            PID:1796
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
            2⤵
              PID:4712
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
              2⤵
                PID:2492
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
                2⤵
                  PID:564
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
                  2⤵
                    PID:3060
                  • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3488
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3960
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                    2⤵
                      PID:1420
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
                      2⤵
                        PID:532
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
                        2⤵
                          PID:700
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:1
                          2⤵
                            PID:2144
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
                            2⤵
                              PID:4784
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
                              2⤵
                                PID:4368
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
                                2⤵
                                  PID:764
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:8
                                  2⤵
                                    PID:1752
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                                    2⤵
                                      PID:3756
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
                                      2⤵
                                        PID:4412
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                                        2⤵
                                          PID:5032
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                                          2⤵
                                            PID:2720
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,17181930747494027486,14558320462028501833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
                                            2⤵
                                              PID:4720
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:4188
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:1420
                                              • C:\Windows\System32\rundll32.exe
                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                1⤵
                                                  PID:1432
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Solara\Application.bat" "
                                                  1⤵
                                                    PID:4828
                                                    • C:\Users\Admin\Downloads\Solara\lua.exe
                                                      lua.exe cache.txt
                                                      2⤵
                                                      • Drops file in Windows directory
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4664
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /create /sc daily /st 11:13 /f /tn WindowsErrorRecovery_ODA3 /tr ""C:\Users\Admin\AppData\Local\ODA3\ODA3.exe" "C:\Users\Admin\AppData\Local\ODA3\cache.txt""
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:4944
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /create /sc daily /st 11:13 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:752
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Solara\Application.bat" "
                                                    1⤵
                                                      PID:3220
                                                      • C:\Users\Admin\Downloads\Solara\lua.exe
                                                        lua.exe cache.txt
                                                        2⤵
                                                          PID:4716
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Solara\Application.bat" "
                                                        1⤵
                                                          PID:1004
                                                          • C:\Users\Admin\Downloads\Solara\lua.exe
                                                            lua.exe cache.txt
                                                            2⤵
                                                              PID:4884
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Solara\Application.bat"
                                                            1⤵
                                                              PID:2020
                                                              • C:\Users\Admin\Downloads\Solara\lua.exe
                                                                lua.exe cache.txt
                                                                2⤵
                                                                  PID:2240
                                                              • C:\Users\Admin\Downloads\Solara\lua.exe
                                                                "C:\Users\Admin\Downloads\Solara\lua.exe"
                                                                1⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3936
                                                              • C:\Users\Admin\Downloads\Solara\lua.exe
                                                                "C:\Users\Admin\Downloads\Solara\lua.exe"
                                                                1⤵
                                                                  PID:476
                                                                • C:\Users\Admin\Downloads\Solara\lua.exe
                                                                  "C:\Users\Admin\Downloads\Solara\lua.exe"
                                                                  1⤵
                                                                    PID:5084
                                                                  • C:\Users\Admin\Downloads\Solara\lua.exe
                                                                    "C:\Users\Admin\Downloads\Solara\lua.exe"
                                                                    1⤵
                                                                      PID:5064
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Solara\Application.bat" "
                                                                      1⤵
                                                                        PID:1432
                                                                        • C:\Users\Admin\Downloads\Solara\lua.exe
                                                                          lua.exe cache.txt
                                                                          2⤵
                                                                            PID:4324

                                                                        Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

                                                                                Filesize

                                                                                854B

                                                                                MD5

                                                                                e935bc5762068caf3e24a2683b1b8a88

                                                                                SHA1

                                                                                82b70eb774c0756837fe8d7acbfeec05ecbf5463

                                                                                SHA256

                                                                                a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

                                                                                SHA512

                                                                                bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                67e486b2f148a3fca863728242b6273e

                                                                                SHA1

                                                                                452a84c183d7ea5b7c015b597e94af8eef66d44a

                                                                                SHA256

                                                                                facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

                                                                                SHA512

                                                                                d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

                                                                                Filesize

                                                                                436B

                                                                                MD5

                                                                                971c514f84bba0785f80aa1c23edfd79

                                                                                SHA1

                                                                                732acea710a87530c6b08ecdf32a110d254a54c8

                                                                                SHA256

                                                                                f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

                                                                                SHA512

                                                                                43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                                Filesize

                                                                                471B

                                                                                MD5

                                                                                786a2a29cc128960a3be691b9ff76c98

                                                                                SHA1

                                                                                5ce2fe1387cabf1c001401b8f7596259cd9299cc

                                                                                SHA256

                                                                                16e9283a10f631bdc1cb1a5acfc348691520bbf3a03a6098c088f5aa0874c84c

                                                                                SHA512

                                                                                e2ebe6737eaef3805c31b0a638c64855c6aaafe1506a616c43697103365bc975ae3d3d5cdc8e1b4ee4de1f4252aaf8074225698656a3c22839bfc2d44adb57de

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

                                                                                Filesize

                                                                                170B

                                                                                MD5

                                                                                d3b5587eef9a555e6dbf0b6def0d1d83

                                                                                SHA1

                                                                                cb6586d9f5945cc4b834c3ecc6c6fe8b8a1ce4c1

                                                                                SHA256

                                                                                1168f56d9432f44ab7bbc870e2f9f94ac7bfb545bdac2a7de99779c84b0c08af

                                                                                SHA512

                                                                                bf11a93a9f1e4342003f0eba6a46a7646b50a5927f5f0b7e8f359100cfc5566d7125f27d20afd496cb8ef09be49e281bbb7a234638761bc03c3dd660f3134e23

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                                                                                Filesize

                                                                                174B

                                                                                MD5

                                                                                4021ab035fb7f8a95c0b897c032583d0

                                                                                SHA1

                                                                                e2cac16922455250f721a33078359a5cd100ef6b

                                                                                SHA256

                                                                                d273f6c6479d8a2e44aacc0183e51b946752c0d9a8ec5511c720f6c0b19c3f94

                                                                                SHA512

                                                                                ff5fc7f55369ea93e585a70204e4c896a613f268c562a099b62b76ee7757ceaeccc4b50da4bb0b00b7c6f84cfd861a97f9524a1ffb1041606885b272baf51665

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

                                                                                Filesize

                                                                                170B

                                                                                MD5

                                                                                4006712b9d168b75d177aa15c45bd221

                                                                                SHA1

                                                                                7482e6ac9fe9c24370aa3261bcf4abd55d191bc7

                                                                                SHA256

                                                                                717841a5a367ae2c4e550054414da0cc8f1f087c7bfd5cd76c6191150e1d9310

                                                                                SHA512

                                                                                c87044db02f9db57f7ec75ba56e4d05a150f6c9592add6d29728296a8e8dec9e77bcede0f686cb398f1b8da1ad999774d6c020f9012ec48fa2df664be1987f84

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                                Filesize

                                                                                412B

                                                                                MD5

                                                                                38cc4e47fb5baf3e0ec81caad919a214

                                                                                SHA1

                                                                                7863f89ddd6b6ac6fea6a55c24687977e1b2be2a

                                                                                SHA256

                                                                                51a97d22354c673f11d5d63590b5ebee2af474f5363f0c756fe9a59caf1d9244

                                                                                SHA512

                                                                                9aa3370fd9aaa54d2f15047a1505d5aa765a310971174fcfe0fd6d69750d32fa7c902d35d4147656eec1f68569ca780db32906690d89061200102e762bc478e8

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                Filesize

                                                                                152B

                                                                                MD5

                                                                                d91478312beae099b8ed57e547611ba2

                                                                                SHA1

                                                                                4b927559aedbde267a6193e3e480fb18e75c43d7

                                                                                SHA256

                                                                                df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

                                                                                SHA512

                                                                                4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                Filesize

                                                                                152B

                                                                                MD5

                                                                                d7145ec3fa29a4f2df900d1418974538

                                                                                SHA1

                                                                                1368d579635ba1a53d7af0ed89bf0b001f149f9d

                                                                                SHA256

                                                                                efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

                                                                                SHA512

                                                                                5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                c22087253081d9beda84ca67c3150568

                                                                                SHA1

                                                                                f9b39c750bf88b6bafbd3cc71d4fe12b155fd2c4

                                                                                SHA256

                                                                                13a4fcd165a316426abcc31ead6413379fd11f40af80faeb45d74cf4adde0b2f

                                                                                SHA512

                                                                                7980fb4d888eedc1c620bf564f7583ad9a1d0f35b25d5309b31080fdc6f5948850a4405744c4d8c61a2fb1745101990b98d29f622c4db9c4982d37e86270b92f

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                e5d6358584c6cfbcc73015c99671b3a1

                                                                                SHA1

                                                                                25798a42946acf2c328a6fd9352d11c19a4c562e

                                                                                SHA256

                                                                                c7d183a43d6f80a7ec24686235c2b383ec9d119fd74b1d18f9260f4ba507a207

                                                                                SHA512

                                                                                73435dcffd99cfbd6d1bfaf5b778fa2c58db6b88c58ec7d95f2d8162363e4bfd5fc5f84c9077bbfceb2942695c80257c705e50080ce428a53b099ee540d30341

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                4b4acf0eb3228f91ff79101e2ec94abc

                                                                                SHA1

                                                                                4b383d681770f8a849a8c5024b2489f7c2f8f32e

                                                                                SHA256

                                                                                1d6a74563f5656596e5b08c32e9f8046b1e32f7a3583d7ae9c107d2cf9e7e8ef

                                                                                SHA512

                                                                                bc27f788bff86d347b07430b4d408c81171f0ffd60d6d41b128e1f02162032fb5025be309a2c8d0186bd5c887df4052437ca9412a41f448358d9f9eb62959780

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                5KB

                                                                                MD5

                                                                                6309b57ab87cdad23693d8197ee7c149

                                                                                SHA1

                                                                                c05d285a3e408ec0b44a851c52ad5fb62b3e1418

                                                                                SHA256

                                                                                5258f91a697bdf2f512fd47cb2690aea12024d245583e856886d0c1a7519432b

                                                                                SHA512

                                                                                6427bc7778a52fbea166e4a9096c60a1853024af77294a709bfa5efbcc9f2c6b074173abcb266b0b114ff573ecf73f864c7019b972873931a3a0e97d3a308415

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                5KB

                                                                                MD5

                                                                                7353d95265545fed9e47d556433d47eb

                                                                                SHA1

                                                                                8b7cf47f322ba93cafe35e69bf5768f7724a7f1e

                                                                                SHA256

                                                                                b4ac539137721cb308bf3cc6dbad5345f69e335dbde5321610eace9c1552f792

                                                                                SHA512

                                                                                a99ffb7244edb9bbc169b0ab9764e373139af1ee8fdc98cbb3df66a090fa3b905eb4c75622a2840783a94159e6845e7a0e08aad27679d2a2a31ad371e1d9cad7

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                6c974ecae028cf9ce2502bf9083fc362

                                                                                SHA1

                                                                                27df1a2cd916e86d64ebad120ea2040258b6ce5b

                                                                                SHA256

                                                                                762a3a9c7a9d4a732bcacbfe1669fa8c9a7861fb42b4d5d09439efbac90ce419

                                                                                SHA512

                                                                                58a961b97cbf5abc24935e8501fe0e3ed5a8b40195ee4f5d25d870dc236b7d7df49f2a1ef6cc14db84dd136a64784a6bbe382319c7e2a03289de92dd5e6cd98e

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                c593d424e16e1a40a0a8a74abe859bc6

                                                                                SHA1

                                                                                a6ee8ef4649328601781e365d311d0dfc07fdf3c

                                                                                SHA256

                                                                                ab4359319c838bc1e8d7ef8661cb1b41cdcef45bd6df7b77d3c4d1670ac66244

                                                                                SHA512

                                                                                124af47d207601816e83cd5d0bba9deb21a1274ef1d4feefd88ff8c24330cd5e59cee0bd3f5f0b7b821a90a8e2b751d4bc0ab02e431fb481acc9d1e0cccc31cd

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                Filesize

                                                                                873B

                                                                                MD5

                                                                                843abbd0e643bf8bd6009550daae5648

                                                                                SHA1

                                                                                fb6e5cb83c1be8de913e1da7668fd15ada29d8f7

                                                                                SHA256

                                                                                0ddcd2caeee9428a8139199ab2bfbff84eec2d2d8a6f8c44c3faed84b68f45d3

                                                                                SHA512

                                                                                fe23a0e8657a30b475df884e92afa8fef6c167dbde6c881fae96e2593da00c9b0a56beb017afb0e330f9d415dcaf38c0568ef146f0f41c180f1297ba8e8cd97d

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d925.TMP

                                                                                Filesize

                                                                                538B

                                                                                MD5

                                                                                0dedb27b8bbf8c889bb698b7df1f2c1e

                                                                                SHA1

                                                                                44c1e0d0fe266339c8da5e91579c73c1952cd9be

                                                                                SHA256

                                                                                3b965cd768c861a9998832d3208803688a0b2bfcef7cdcde9dea9038b84e72d3

                                                                                SHA512

                                                                                38e29756cf1e303ec61f5a947abea8d4555db374484870e04d3f287b95ed3ddf53246ff8005e96ebb1ee49815cdda59866e00267fa80918f7037f053bcba5154

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                Filesize

                                                                                16B

                                                                                MD5

                                                                                46295cac801e5d4857d09837238a6394

                                                                                SHA1

                                                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                SHA256

                                                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                SHA512

                                                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                Filesize

                                                                                16B

                                                                                MD5

                                                                                206702161f94c5cd39fadd03f4014d98

                                                                                SHA1

                                                                                bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                SHA256

                                                                                1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                SHA512

                                                                                0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                4c96736fa88606f2f30882c551cb68fc

                                                                                SHA1

                                                                                c435cf16880991aaec76bf95f6d3bb96098d60f3

                                                                                SHA256

                                                                                397ce1dc2cbebc68180963f3f5f339cc65f523ef44f8f13258fdbadf7b374548

                                                                                SHA512

                                                                                8d64ab6cc263cadcefb9293a559b2a2327621c3e2af5f781c0b01c6c8baaa5813a1f2d01363881d87b01325c6c6c2cb2ecc6ef85f2aca269b90d68f5bf58cd67

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                Filesize

                                                                                10KB

                                                                                MD5

                                                                                c8e2b94a338f9397c65e9a742a0fa477

                                                                                SHA1

                                                                                f541dd3c6005035c55824fd09c3bb027a77c17e7

                                                                                SHA256

                                                                                9a168aee96ceec5a059c2c96aea6e8fc3c6c6dbad0c0911401c07ee2730d67f5

                                                                                SHA512

                                                                                ccddd2cbffbf7e526aeb6a55b09daddb9081fc75055f200059ab966612baaf573744683e0dfbab59911b12296ee38da1413533d4422c197538797dd7b39aaa4a

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9ED10DTS\json[1].json

                                                                                Filesize

                                                                                306B

                                                                                MD5

                                                                                02b3ab672ff8414f937ff51e0f04dc33

                                                                                SHA1

                                                                                389c25910c6a0c34759f518c72b8ea0326bc035e

                                                                                SHA256

                                                                                f8116b98ab53ce8ec6048d864dd53a77399e5d812edc7ac18770bff5742342c7

                                                                                SHA512

                                                                                f8d95459d788e6af7b10c22240b643c3f811bbfffc4ded24cbb4062d3537d3300cd57b5f541ece93428374c4febec00f66b784de23aa39770dfd2f79980afb2f

                                                                              • C:\Users\Admin\AppData\Local\OperaGX.exe

                                                                                Filesize

                                                                                3.2MB

                                                                                MD5

                                                                                db7e7acc37891f8c85aa6a4686747a75

                                                                                SHA1

                                                                                62c03e4c52e44e319767f08b2806194daa85bcab

                                                                                SHA256

                                                                                44d75cf7b71338fb2866e87454c3db39a088fd17b48080a397402eedb779c1c1

                                                                                SHA512

                                                                                ec738e2704537fa3cbd0cda12338b5606b945c0ad8f9a4231624f2287eba90020c5e3c6431fe3b388a989020e68b8dd4f40c058c541be145f0ada02c91407f40

                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411121631021\additional_file0.tmp

                                                                                Filesize

                                                                                1.4MB

                                                                                MD5

                                                                                e9a2209b61f4be34f25069a6e54affea

                                                                                SHA1

                                                                                6368b0a81608c701b06b97aeff194ce88fd0e3c0

                                                                                SHA256

                                                                                e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

                                                                                SHA512

                                                                                59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411121631021\assistant\assistant_installer.exe

                                                                                Filesize

                                                                                1.8MB

                                                                                MD5

                                                                                4c8fbed0044da34ad25f781c3d117a66

                                                                                SHA1

                                                                                8dd93340e3d09de993c3bc12db82680a8e69d653

                                                                                SHA256

                                                                                afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

                                                                                SHA512

                                                                                a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC93144E7\setup.exe

                                                                                Filesize

                                                                                6.5MB

                                                                                MD5

                                                                                dcc0d15e77a7872758e65deb0bfc6745

                                                                                SHA1

                                                                                1efb89e143bf5edd34d46ae8370ecc13d4c3339f

                                                                                SHA256

                                                                                87a168a04a254b1cf1adfe732e8b7b08d5c3e76ddca4e8b7fb4e58ebef85fe64

                                                                                SHA512

                                                                                9cb972bcd99fd03a924bbff79e8989a040d1202a77c9d8f62ea862cc6b1d258778410ad9a4de5f2aab43062f5e9fe17d7ab9baa000de98d22a47f1471d1de778

                                                                              • C:\Users\Admin\AppData\Local\Temp\Opera_installer_241112163101246540.dll

                                                                                Filesize

                                                                                6.0MB

                                                                                MD5

                                                                                1b07ce60bc1c77f0cadf13c2e62b1383

                                                                                SHA1

                                                                                ca70d0ef99ae5d1ebf85880ee669ad1145e4d79d

                                                                                SHA256

                                                                                e48eb19ca0210f9063f4e77c2f14293ee940eeaef2ecb9efceac7f6336cc203f

                                                                                SHA512

                                                                                94c358b6dfef0fcb0012a3a43235292b18ebf897043baef0c110570e91cc73721b12f1f771df6d000b4097f3c0cc22dcc65330a9153c7a9643787d24da6108f0

                                                                              • C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe

                                                                                Filesize

                                                                                3.8MB

                                                                                MD5

                                                                                bf6eed6cdc17a0130189a33a55ef5209

                                                                                SHA1

                                                                                e337f5a0931f69c464f162385f1330b4d27b372f

                                                                                SHA256

                                                                                ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168

                                                                                SHA512

                                                                                90d23fd84007343e85f9fc003cf826b112fd930216a24d8c1488468443ae2a4b0c3cc2426b91c81a8228e125050e922fce05672e010e65247709fc4a7b856f1d

                                                                              • C:\Users\Admin\AppData\Local\link.txt

                                                                                Filesize

                                                                                1B

                                                                                MD5

                                                                                68b329da9893e34099c7d8ad5cb9c940

                                                                                SHA1

                                                                                adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

                                                                                SHA256

                                                                                01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

                                                                                SHA512

                                                                                be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

                                                                              • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

                                                                                Filesize

                                                                                40B

                                                                                MD5

                                                                                cbd0ea565393fed844bb50eb4333a351

                                                                                SHA1

                                                                                655ef8cab888a40e56772c088b7918197d094e1e

                                                                                SHA256

                                                                                28cecc8bf892bf34a4158e9455fd614d02d4c670945a5bb26c6c7149294fb5fb

                                                                                SHA512

                                                                                2ca592d7f649eb4ab151466f351dc61ad4414a4774ae72b248565f5d830b489430a0be96137b421f81b1c226415e5723e553214c0997a010cf93b09a327347d0

                                                                              • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

                                                                                Filesize

                                                                                40B

                                                                                MD5

                                                                                efe6825760cd7936cdc6386c5d2c2d87

                                                                                SHA1

                                                                                2e63e0d7bc372a942ac1ad59eeba0611fd3d9f7e

                                                                                SHA256

                                                                                6094cd767609ae4ba7718ef898f258c72b20010bec1ddff426bcce8a1b32c97a

                                                                                SHA512

                                                                                23febb78de969d6b1e4e896df507a6b8f6b914e1fa52b7fcad7dc66db8a16b521cd351d6f79bf22f1438f6869cc164dc3db0d706323a1c419bf205fbbd40bd0a

                                                                              • C:\Users\Admin\Downloads\Solara.zip

                                                                                Filesize

                                                                                411KB

                                                                                MD5

                                                                                2eb41b95f55cedda9d33f429c4b4d293

                                                                                SHA1

                                                                                7faeb44c4c501a7cb801b0939058af4a4539705a

                                                                                SHA256

                                                                                85852663982c4048086d26e264b9ffc9fc73abea026cfb4c1be5721747f5e259

                                                                                SHA512

                                                                                309b4d741086783ea4c2bf33e1586589faef97b584a674bda748acee347f604736ec078a9ec674ff6956516fb9ad18fa64bb8810aef450a22ac2aa79962c7ea7

                                                                              • memory/4664-591-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-570-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-560-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-555-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-537-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-599-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-598-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-597-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-596-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-595-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-594-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-593-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-592-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-578-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-589-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-588-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-587-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-586-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-585-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-584-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-583-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-582-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-581-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-580-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-579-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-576-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-575-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-574-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-573-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-572-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-571-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-577-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-569-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-568-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-567-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-566-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-565-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-564-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-563-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-562-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-561-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-559-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-558-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-557-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-556-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-554-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-553-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-552-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-551-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-550-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-549-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-548-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-547-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-546-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-545-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-544-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-543-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-542-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-541-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-540-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-539-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-538-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-590-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4664-536-0x000000007F860000-0x000000007F870000-memory.dmp

                                                                                Filesize

                                                                                64KB