Analysis

  • max time kernel
    162s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 21:37

Errors

Reason
Machine shutdown

General

  • Target

    antA_bump.jpg

  • Size

    318KB

  • MD5

    18a72001b9043aa1dcd0471e1c3f79f0

  • SHA1

    8614f3ff60027912dbf4a3c8775b6504a381342f

  • SHA256

    af4fc7a1f4d6ebea7eeb15f584e84af31b5c0b15c53dafacf1d069731963b1c4

  • SHA512

    1d3a27305533bd5f5fe401f380936475055128a24c5e09d7a87320c4858a3c424b0f6f2dc9555598ebf1dee8ff1d351c9720e39c93440f2dd508fbdc963e0679

  • SSDEEP

    6144:ze4jYM6hiZE9xguZYcvTvgvXFdGVTfqEdh4ifCywWPP74VW04iy+CLp0FMeZrkBr:zjYMkZxguZvv8vfGVTfqEUGCyXcPFmpN

Malware Config

Signatures

  • Downloads MZ/PE file
  • A potential corporate email address has been identified in the URL: [email protected]
  • A potential corporate email address has been identified in the URL: [email protected]
  • A potential corporate email address has been identified in the URL: [email protected]
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\antA_bump.jpg
    1⤵
      PID:3124
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3840
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe64d846f8,0x7ffe64d84708,0x7ffe64d84718
        2⤵
          PID:988
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10383249821745054191,4565428037082247930,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
          2⤵
            PID:4372
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,10383249821745054191,4565428037082247930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2932
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
          1⤵
          • Enumerates system info in registry
          • Modifies registry class
          • NTFS ADS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4824
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe64d846f8,0x7ffe64d84708,0x7ffe64d84718
            2⤵
              PID:4940
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
              2⤵
                PID:2368
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2540
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
                2⤵
                  PID:3640
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
                  2⤵
                    PID:2320
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
                    2⤵
                      PID:2960
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
                      2⤵
                        PID:1044
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
                        2⤵
                          PID:788
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
                          2⤵
                            PID:2072
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 /prefetch:8
                            2⤵
                              PID:1292
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2036
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
                              2⤵
                                PID:4372
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
                                2⤵
                                  PID:5448
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
                                  2⤵
                                    PID:5564
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
                                    2⤵
                                      PID:5688
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
                                      2⤵
                                        PID:5992
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
                                        2⤵
                                          PID:5280
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
                                          2⤵
                                            PID:5372
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
                                            2⤵
                                              PID:5904
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
                                              2⤵
                                                PID:5584
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
                                                2⤵
                                                  PID:5604
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
                                                  2⤵
                                                    PID:5612
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
                                                    2⤵
                                                      PID:5188
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
                                                      2⤵
                                                        PID:1608
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
                                                        2⤵
                                                          PID:2428
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
                                                          2⤵
                                                            PID:5616
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
                                                            2⤵
                                                              PID:6140
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
                                                              2⤵
                                                                PID:5924
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1
                                                                2⤵
                                                                  PID:5852
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
                                                                  2⤵
                                                                    PID:5788
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6880 /prefetch:8
                                                                    2⤵
                                                                      PID:6028
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7252 /prefetch:8
                                                                      2⤵
                                                                        PID:5604
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7504 /prefetch:1
                                                                        2⤵
                                                                          PID:4212
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7436 /prefetch:1
                                                                          2⤵
                                                                            PID:4360
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6412 /prefetch:8
                                                                            2⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:4320
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5828 /prefetch:8
                                                                            2⤵
                                                                              PID:1536
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7472 /prefetch:8
                                                                              2⤵
                                                                                PID:4408
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7988 /prefetch:1
                                                                                2⤵
                                                                                  PID:5864
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=8104 /prefetch:8
                                                                                  2⤵
                                                                                    PID:5792
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1056 /prefetch:8
                                                                                    2⤵
                                                                                      PID:3116
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7824 /prefetch:8
                                                                                      2⤵
                                                                                        PID:2284
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1820 /prefetch:8
                                                                                        2⤵
                                                                                          PID:1512
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
                                                                                          2⤵
                                                                                            PID:2616
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7804 /prefetch:8
                                                                                            2⤵
                                                                                              PID:552
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6556 /prefetch:2
                                                                                              2⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:1716
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,5116189779680923017,8756628067402995587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
                                                                                              2⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:116
                                                                                            • C:\Users\Admin\Downloads\ExLoader_Installer (1).exe
                                                                                              "C:\Users\Admin\Downloads\ExLoader_Installer (1).exe"
                                                                                              2⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              PID:5128
                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Drops file in Program Files directory
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:2016
                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -command "$WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"c:\users\admin\desktop\ExLoader.lnk\") $Shortcut.TargetPath = \"C:\Program Files\ExLoader\ExLoader.exe\" $Shortcut.Save()"
                                                                                                  4⤵
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:408
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:660
                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                              1⤵
                                                                                                PID:3400
                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                1⤵
                                                                                                  PID:5660
                                                                                                • C:\Users\Admin\Downloads\OperaGXSetup.exe
                                                                                                  "C:\Users\Admin\Downloads\OperaGXSetup.exe"
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5432
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS835E1EE8\setup.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS835E1EE8\setup.exe --server-tracking-blob=ZmU0MGU2MmY3NzQ3NGY0NzQzZmIxMzFkNWQ1NzIxMDI4ZWM4ODM3NGRiYjllYjQ4MTRhOTgwZTI0OGI5MWVjODp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9TVlJfT09NJmVkaXRpb249c3RkLTImdXRtX2lkPTAyZDg5NDhhY2I3NTRlZTk4MzM5N2IxMmEyYjE3ZDQ3Jmh0dHBfcmVmZXJyZXI9bWlzc2luZyZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRiZ1dG1faWQ9MDJkODk0OGFjYjc1NGVlOTgzMzk3YjEyYTJiMTdkNDcmZGxfdG9rZW49Njc0MjM2OTYiLCJ0aW1lc3RhbXAiOiIxNzMxNTMzOTExLjUzNzIiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBTYWZhcmkvNTM3LjM2IEVkZy85Mi4wLjkwMi42NyIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9TVlJfT09NIiwiaWQiOiIwMmQ4OTQ4YWNiNzU0ZWU5ODMzOTdiMTJhMmIxN2Q0NyIsImxhc3RwYWdlIjoib3BlcmEuY29tLyIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI5ODdmOTIzYi1kM2NiLTQ1MmQtYmFlZC1hN2M3YWQ4Zjg3YzQifQ==
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    • Enumerates connected drives
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Modifies system certificate store
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:1616
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS835E1EE8\setup.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS835E1EE8\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x330,0x334,0x338,0x308,0x33c,0x74e08c5c,0x74e08c68,0x74e08c74
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3512
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:5500
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS835E1EE8\setup.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS835E1EE8\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1616 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241113213852" --session-guid=80cc1822-dcd4-4b3d-be5f-dd2b73b22ff8 --server-tracking-blob=MmUyYWY1YzU5MmE3NWY5NmJlODVmNDIwZmY4ZTNiNDNkM2QwMzljYmNmNjM2NTVlYjkzOWU0ZDYxMmJhZGE3Mjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9TVlJfT09NJmVkaXRpb249c3RkLTImdXRtX2lkPTAyZDg5NDhhY2I3NTRlZTk4MzM5N2IxMmEyYjE3ZDQ3Jmh0dHBfcmVmZXJyZXI9bWlzc2luZyZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRiZ1dG1faWQ9MDJkODk0OGFjYjc1NGVlOTgzMzk3YjEyYTJiMTdkNDcmZGxfdG9rZW49Njc0MjM2OTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MzE1MzM5MTEuNTM3MiIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Mi4wLjQ1MTUuMTMxIFNhZmFyaS81MzcuMzYgRWRnLzkyLjAuOTAyLjY3IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1NWUl9PT00iLCJpZCI6IjAyZDg5NDhhY2I3NTRlZTk4MzM5N2IxMmEyYjE3ZDQ3IiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vIiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6Ijk4N2Y5MjNiLWQzY2ItNDUyZC1iYWVkLWE3YzdhZDhmODdjNCJ9 --desktopshortcut=1 --wait-for-package --initial-proc-handle=2009000000000000
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:4368
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS835E1EE8\setup.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS835E1EE8\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x320,0x324,0x328,0x2fc,0x32c,0x72658c5c,0x72658c68,0x72658c74
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4540
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411132138521\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411132138521\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1928
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411132138521\assistant\assistant_installer.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411132138521\assistant\assistant_installer.exe" --version
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:2984
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411132138521\assistant\assistant_installer.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411132138521\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x1064f48,0x1064f58,0x1064f64
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3284
                                                                                                • C:\Users\Admin\Downloads\OperaGXSetup.exe
                                                                                                  "C:\Users\Admin\Downloads\OperaGXSetup.exe"
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2524
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCD99C088\setup.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCD99C088\setup.exe --server-tracking-blob=ZmU0MGU2MmY3NzQ3NGY0NzQzZmIxMzFkNWQ1NzIxMDI4ZWM4ODM3NGRiYjllYjQ4MTRhOTgwZTI0OGI5MWVjODp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9TVlJfT09NJmVkaXRpb249c3RkLTImdXRtX2lkPTAyZDg5NDhhY2I3NTRlZTk4MzM5N2IxMmEyYjE3ZDQ3Jmh0dHBfcmVmZXJyZXI9bWlzc2luZyZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRiZ1dG1faWQ9MDJkODk0OGFjYjc1NGVlOTgzMzk3YjEyYTJiMTdkNDcmZGxfdG9rZW49Njc0MjM2OTYiLCJ0aW1lc3RhbXAiOiIxNzMxNTMzOTExLjUzNzIiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBTYWZhcmkvNTM3LjM2IEVkZy85Mi4wLjkwMi42NyIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9TVlJfT09NIiwiaWQiOiIwMmQ4OTQ4YWNiNzU0ZWU5ODMzOTdiMTJhMmIxN2Q0NyIsImxhc3RwYWdlIjoib3BlcmEuY29tLyIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI5ODdmOTIzYi1kM2NiLTQ1MmQtYmFlZC1hN2M3YWQ4Zjg3YzQifQ==
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    • Enumerates connected drives
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5124
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCD99C088\setup.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCD99C088\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x72658c5c,0x72658c68,0x72658c74
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:5772
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3108
                                                                                                • C:\Windows\system32\LogonUI.exe
                                                                                                  "LogonUI.exe" /flags:0x4 /state0:0xa38a1055 /state1:0x41c64e6d
                                                                                                  1⤵
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:3008

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\Program Files\ExLoader\ExLoader.zip

                                                                                                  Filesize

                                                                                                  45.2MB

                                                                                                  MD5

                                                                                                  f8f5d8a48f0c2cab57db0ce48c44b320

                                                                                                  SHA1

                                                                                                  cc82c726e916a5f2a6dcdbeecef3fa4a0319ee42

                                                                                                  SHA256

                                                                                                  d8cc2d4e4e84e42f0724e0c5e63ec38381a2c40b87b699e2c55648a56e61588f

                                                                                                  SHA512

                                                                                                  b412014a279ae9e61a70bf07c63789f2c90129fe7f75cb967cf7400a9d81c91ee75a4e91c1fd18972d6d1dcea7a9fe7544c7f5a105fcaac0d132b1c7a29eb316

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  99afa4934d1e3c56bbce114b356e8a99

                                                                                                  SHA1

                                                                                                  3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                                                                                                  SHA256

                                                                                                  08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                                                                                                  SHA512

                                                                                                  76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  443a627d539ca4eab732bad0cbe7332b

                                                                                                  SHA1

                                                                                                  86b18b906a1acd2a22f4b2c78ac3564c394a9569

                                                                                                  SHA256

                                                                                                  1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                                                                                                  SHA512

                                                                                                  923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

                                                                                                  Filesize

                                                                                                  89KB

                                                                                                  MD5

                                                                                                  445d7ca13d334a0838cff9d6905c1790

                                                                                                  SHA1

                                                                                                  5747ad731326797179dac0f4770e09c36a8aa248

                                                                                                  SHA256

                                                                                                  ac47705cb831ecb13f1c94a76fe667e40af99a5ff58ab9e50a1846ec84ec3b37

                                                                                                  SHA512

                                                                                                  096f26d1d0cfaca0faeb975c62fd0b820215905a01194f96853d3f050b0c33b1b30c96a006e3eeb2924acf939d8713df98e1a3c0e1d1d9a9a9096a0be421bb6b

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  d9bf4df95663e90f73b095fac0c9b331

                                                                                                  SHA1

                                                                                                  d9ee9f0038a3e6c84ae462f70f0e765ab766fdf3

                                                                                                  SHA256

                                                                                                  33eee7f6e0ef2807fd2ec3155230d116e768e0b2aff5ef56553eb56bf52772ee

                                                                                                  SHA512

                                                                                                  ba0469672b442106a086da7541e31b0ada7401c391c596ff494737a131ea6ff590222842e5c9a9d3d71f11b20e337e10a9e556a691fdb3757c4390d1d25dd5f2

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

                                                                                                  Filesize

                                                                                                  41B

                                                                                                  MD5

                                                                                                  5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                  SHA1

                                                                                                  d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                  SHA256

                                                                                                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                  SHA512

                                                                                                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                  Filesize

                                                                                                  5KB

                                                                                                  MD5

                                                                                                  9cea608f939898677e79e208e452d9fa

                                                                                                  SHA1

                                                                                                  1d4114a77f0fbb4862184d2633458bb9d32bd85f

                                                                                                  SHA256

                                                                                                  3019991a1f8850c597d5f8c532ecb5c6a9133742055829eb71486ae7db503467

                                                                                                  SHA512

                                                                                                  ca4a34db9a950ab9e8b6c3af8ad655c5713a0943c6e30da06ac029a2cfbf81510418b2511451822ca9ced324193735d0567e3d56fc9d6863f081b50057d4bca5

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  441bccf5fbdeaf9dc9105362c0dd327e

                                                                                                  SHA1

                                                                                                  12a147df3a6277187aa3e85f3af054f147babd28

                                                                                                  SHA256

                                                                                                  ccc903f1c7809a2f39f8c37ef4889e218494497823114fa97f051e84178d19fb

                                                                                                  SHA512

                                                                                                  7dcf67503f63d52cc53eb26d0ea77e0f24d68c3d43740d7e063939d862392b5744193ba9ef1deabc14a2017f731fad57be7a09ab3c1c486975c525f7f1080913

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  84b74254dda53df94d0a3719f9e1190f

                                                                                                  SHA1

                                                                                                  6fc63ef48956f375f641b463266f528261c7dc50

                                                                                                  SHA256

                                                                                                  995022c91f9348e725f68a390aebaa8667654fba7124cdf77fa8bb75a783d838

                                                                                                  SHA512

                                                                                                  da49070cc166c37127f95cc58943117988c2dfc4dcb98b5b7bd5225fa41b7f47e42d6951e4b2ca93d6a37c153aee475b5c3361c29858afd599332ed8e43b1278

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  de4d45f97adf7b3e8d6710d01f91948e

                                                                                                  SHA1

                                                                                                  ddc36a3ca77f772a448e974b29f8da92aa88c47b

                                                                                                  SHA256

                                                                                                  ad34a783243366bc1b65d0b36e5824e20068f4b03b8cd7c9dfad7c4c8888ca1c

                                                                                                  SHA512

                                                                                                  d93bdcd728aaaaa73a0a79b3750b781d34abc04daa87c0f33fcae7c6dc8b9669947140d5a6b092e6331f7ff51308a83648b3b97e0eb1b46791885052a51dc046

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  eee5b5828c1df29994994b58836fb00d

                                                                                                  SHA1

                                                                                                  8f3fc39f669b2a22c90b40e449dc3024f61651f2

                                                                                                  SHA256

                                                                                                  b9459f2804548bf844743029f6661636b826a4427bc896e2f72be47d8a59b25b

                                                                                                  SHA512

                                                                                                  39bf15537d9866f32869263ef05622f91de8964e79fd26d0dd3b65bb275fc38a3b8b7d5881d4b42ce841f508e813ff5ba2835c932d151722c7aab512d259d91a

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  f8ea5812f4828bc587915216eb884a8b

                                                                                                  SHA1

                                                                                                  e98a7d2c089db3546e3cb057e8cd17b7733778db

                                                                                                  SHA256

                                                                                                  8d3e1026f856df8ab1cdfa4d8e692f0fdc7553f01f2a0b9f6e7971b350e1313e

                                                                                                  SHA512

                                                                                                  15caa089977ab2a267fcc1e00bcf5bf2b8fb7c300cdfd172d41fa2fae0cf61e0aaf2f247f84d1d35d14ba91e85d0f31bde9fe218a2010ca1a932f22e2b8d11db

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  ba7a587c06d0505f15ceb87ed32b1b8e

                                                                                                  SHA1

                                                                                                  d58c0cd24c0e06b798882c8934dab7407d1b4905

                                                                                                  SHA256

                                                                                                  e79036a8b7fa41ab992748c5d72c35176615ea9efa6593c83d56b004e6bdb12e

                                                                                                  SHA512

                                                                                                  44bff63f1d90edf3953783f91c50d5c420a8298bd624379871ee16585daabf06bf5637d893e7d5ccaf96b84d3ed51d62866e35979da8b235c29937000fea9c82

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  5KB

                                                                                                  MD5

                                                                                                  6973ecc72fc575efe7cedaab60e0a5de

                                                                                                  SHA1

                                                                                                  49b15b644fdbdb86990627fd972e6635fb42e8a7

                                                                                                  SHA256

                                                                                                  b6a0012874c83a02f5cfbd504bda1a192735599c232c3ab74a9f844c6bb69f7b

                                                                                                  SHA512

                                                                                                  7a1ccc973a843123230dd468957ab25c0ffb67e485760ef3048f9ce1d997b6488f0cf1d072138ac99c683f98b5c1099c132be2d7e399a355494b62083f0d5eda

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  5c9905d0f39002e88e71a769c80f9c73

                                                                                                  SHA1

                                                                                                  260b0428d37fc8a34d23f36cbe107ec87bf80c34

                                                                                                  SHA256

                                                                                                  736256ef5ffae22451173efe8929d9d60226794e7497df1ba536dfaa21fcd0a6

                                                                                                  SHA512

                                                                                                  0aa7a41d224eda2af1dee53a5f4f9cee5822cec834711edf7ed3750e6ca5c8b5c5e48acbff28308dfe4fefe6476fe86528d40bb50c29cc80925e81a8d5ba524d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                  Filesize

                                                                                                  72B

                                                                                                  MD5

                                                                                                  76585502c8b64174885c5bbb2d680b2b

                                                                                                  SHA1

                                                                                                  cba10c35a6b62c0b69b84b1e7ce629a95243caa4

                                                                                                  SHA256

                                                                                                  5c3dca738bed6df6c8a76859be825a73e691f90ecbf715c3b18d5e7eac869dd7

                                                                                                  SHA512

                                                                                                  ecc421fdd3ea9ec4505dbc0b9f851be9cb0362ac71e340c4664c9b1bfc4d7182b44fc90b0c69cfef68e86a097ae38bc77e53f5adb11f3c3ce05624ee551edad4

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b205.TMP

                                                                                                  Filesize

                                                                                                  48B

                                                                                                  MD5

                                                                                                  cf27122d7ff879150468d79b43acb4c6

                                                                                                  SHA1

                                                                                                  56c0135a1b83fe7bcda73bc5ab5fad262af850c9

                                                                                                  SHA256

                                                                                                  8aceaee83179addd2b36564b90c9587dae4c3000cdd8c9ace427378d3d1a8244

                                                                                                  SHA512

                                                                                                  b6be06869cf00bea8b4464ece7a952e52bb4085c3101e6851e70722d1ed6eb887652d95498a40f6c6682809253dcbd7ef387a196201cd8e38914ddb6eabebd68

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  a4ca5b1259fd4358eddc789fcf367ec5

                                                                                                  SHA1

                                                                                                  4eded91db977a30649a1ca4bcae400c030bbfd53

                                                                                                  SHA256

                                                                                                  437ff7add143fd78792fcabadf938cc96b01c38b68d64fadd4c8c52973c04982

                                                                                                  SHA512

                                                                                                  7b43d857ff157b061ec6880d3d18ea4cec075e39eaf81a2450883662b2aa6cd499bf0400520108985d5f9950d12b48020caf67a8ac745a2558b7bd9626eafcbf

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  afbca65c5a3edec0352c7eb59a42b193

                                                                                                  SHA1

                                                                                                  83147bd37303f55cbea3657afbaa4bfd8702c0a0

                                                                                                  SHA256

                                                                                                  45e839881cd5753524ce1ddcc359099d90cf1953b8aeb6b3a03598077dad66e3

                                                                                                  SHA512

                                                                                                  b939c4709389f56ba5e80e59669c43db95e3c6b263e75c0082a437280cae4d426456a71c27302b11acd8a4de2333dec13e2bbd9444233203666833bf20ce4077

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  20563f2da4cb145028f39d604ab08632

                                                                                                  SHA1

                                                                                                  581a66a09c0c6c5dec06637f98940edcf657746b

                                                                                                  SHA256

                                                                                                  4e529e9e06ced7a5dbe4cc03db6dfd73cc349a5371afda6c4aff72ed6f10f836

                                                                                                  SHA512

                                                                                                  bd4c8f18e5b03643c7bd4d9331039144f914343ad41adda4f1776444e2e07d41367d19e909192a8386d1eaa12c740a429ed4af1522a9e2d973a38c13f3549200

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  fbd706c6f1f66829c4cac9fe65aa3c77

                                                                                                  SHA1

                                                                                                  23d2f6b7364d994de223fcfb0882c4f5f4bd109a

                                                                                                  SHA256

                                                                                                  e79b0977793ac8750063857fa9b8bda18c87c921a551beb53b6d38f396390971

                                                                                                  SHA512

                                                                                                  e93de58bdf71a8bb0a5c163f28252c6d2c4c30553e0f8cefd558131961e6ea133920fd3afccd9a72835a23ef0c3afe681033a71f07a68316cfd91fb08f512c32

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586c23.TMP

                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  c6702b6a82aee5b6c02112220e8db13d

                                                                                                  SHA1

                                                                                                  a4a6d02c66c4264d84d1fa1e04b23472769e5fed

                                                                                                  SHA256

                                                                                                  08a24b5871c6dccf9ec6e590e730a8289cd753faf1c62b9bb5814e79ad3f37fe

                                                                                                  SHA512

                                                                                                  fd1981a00e0cedd869b68b007ff3f7929657a12c258188e6b10c6f3ef79262bf13129b8fca6176790c8d117d8d550fe88514e214ca1c3fe7f89223e63a734a87

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  206702161f94c5cd39fadd03f4014d98

                                                                                                  SHA1

                                                                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                  SHA256

                                                                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                  SHA512

                                                                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                  SHA1

                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                  SHA256

                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                  SHA512

                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  c07bb1b20d4bc7736c5bf68470245903

                                                                                                  SHA1

                                                                                                  97365f21264b9ef9f9814a177b4fc85d88a9d71d

                                                                                                  SHA256

                                                                                                  68e6954a6b5da867230048d129eccb76b675e9a6ee9f908e4a3b9e64614365ff

                                                                                                  SHA512

                                                                                                  5b5c11d117ac7e3dfbc23a3694adbe01835ed3c3e40656f57eaf8efa283f7349913ca4e6bdf24305bd3b38504dad5b4fed7c67ce9da5e9939087776ebab54f17

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  1020f410dae98ab94b1d69fa525bbb32

                                                                                                  SHA1

                                                                                                  b3dd90a9fd18aa6953425129692ac3e28153b03e

                                                                                                  SHA256

                                                                                                  9b23d85592a666f139318891c2cde5a7b34944a10407f74a22b6f019384641eb

                                                                                                  SHA512

                                                                                                  3a50dbe6b31ea08dc70102ffe539557c581025dd3ebc3e22a92a63ffd1db757ae6d360f6f36f812a6c2a0d9a25e6ba5245f3e839ecfa3520a17ad5548df49e7f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  64064ea9af17ca1cb23017c5fe544521

                                                                                                  SHA1

                                                                                                  29740b3e5ce86b2559fd9d12a5c36c19ecfdd9f9

                                                                                                  SHA256

                                                                                                  23afa095c086e28662b28b50600d26d51f6d76de4dd993e39eb93aa898fa8ba5

                                                                                                  SHA512

                                                                                                  080b5c350af6a998227aa66d0d97900d2d6bf202ecf27ab279ab4f118c2a62c7b8bd54d22547e5d469ea784bc452e4045424f5e8c98746b04fae603ed1645fb3

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  4609f7187af657f4e13b333b88b19afd

                                                                                                  SHA1

                                                                                                  45f821d8a0802f990c07857b40000057ed25ce9d

                                                                                                  SHA256

                                                                                                  1767a1a0b4230bf6f71c6ed2e037e3f4b93ddd096c3d0984f6d39a24196c414b

                                                                                                  SHA512

                                                                                                  fe07ba87744533458f126736276350bb1ce4c8c9b3f513b9ce0ddfc85e539ab572cdea4f6ba2d79134f887744f2d65432ba430e0d95faa560607b446fd307051

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  c689304ec17ad623c66ea8f80052ac99

                                                                                                  SHA1

                                                                                                  852d713f1cf819bf98e975e853e9193b805448bb

                                                                                                  SHA256

                                                                                                  6aa9b0c780682a6af58182d9abd149cf437a96e3f8fec209093eeed6f5d9b8c3

                                                                                                  SHA512

                                                                                                  5526c9073e5f9926293b17fd178ea2d1e3d61a4a8a6ffcf3a417daaf9a87a66abdcdc3f5afc6dc83fa53eb63f386d9eb8e89f5f4b25d3582c9370600b236fdec

                                                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411132138521\additional_file0.tmp

                                                                                                  Filesize

                                                                                                  1.4MB

                                                                                                  MD5

                                                                                                  e9a2209b61f4be34f25069a6e54affea

                                                                                                  SHA1

                                                                                                  6368b0a81608c701b06b97aeff194ce88fd0e3c0

                                                                                                  SHA256

                                                                                                  e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

                                                                                                  SHA512

                                                                                                  59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS835E1EE8\setup.exe

                                                                                                  Filesize

                                                                                                  6.5MB

                                                                                                  MD5

                                                                                                  dcc0d15e77a7872758e65deb0bfc6745

                                                                                                  SHA1

                                                                                                  1efb89e143bf5edd34d46ae8370ecc13d4c3339f

                                                                                                  SHA256

                                                                                                  87a168a04a254b1cf1adfe732e8b7b08d5c3e76ddca4e8b7fb4e58ebef85fe64

                                                                                                  SHA512

                                                                                                  9cb972bcd99fd03a924bbff79e8989a040d1202a77c9d8f62ea862cc6b1d258778410ad9a4de5f2aab43062f5e9fe17d7ab9baa000de98d22a47f1471d1de778

                                                                                                • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2411132138497941616.dll

                                                                                                  Filesize

                                                                                                  6.0MB

                                                                                                  MD5

                                                                                                  1b07ce60bc1c77f0cadf13c2e62b1383

                                                                                                  SHA1

                                                                                                  ca70d0ef99ae5d1ebf85880ee669ad1145e4d79d

                                                                                                  SHA256

                                                                                                  e48eb19ca0210f9063f4e77c2f14293ee940eeaef2ecb9efceac7f6336cc203f

                                                                                                  SHA512

                                                                                                  94c358b6dfef0fcb0012a3a43235292b18ebf897043baef0c110570e91cc73721b12f1f771df6d000b4097f3c0cc22dcc65330a9153c7a9643787d24da6108f0

                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe

                                                                                                  Filesize

                                                                                                  183KB

                                                                                                  MD5

                                                                                                  b51f61c70894e92875d5530d0f553067

                                                                                                  SHA1

                                                                                                  6cfe241ad503445443463faa5f869e0ec9cf0cb5

                                                                                                  SHA256

                                                                                                  0cb547550924bc73727d60885a82df098ead1eddb37f39b32dd46eac8e83db27

                                                                                                  SHA512

                                                                                                  e8ed6fa9f10dbad7cd7e420aecf655079cb04d59229b8c014eec2cdae545de16566f8c784786dbb98e2c12f3f3bcdbba2d78445fed14807ec154bea0ce653ccc

                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b3kbsa0e.3pt.ps1

                                                                                                  Filesize

                                                                                                  60B

                                                                                                  MD5

                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                  SHA1

                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                  SHA256

                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                  SHA512

                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                • C:\Users\Admin\AppData\Local\Temp\opera_installer_ui.lck

                                                                                                  Filesize

                                                                                                  4B

                                                                                                  MD5

                                                                                                  c6894ed154a0b8e852ad30ee4ee840bf

                                                                                                  SHA1

                                                                                                  19e2b2269bb99cd29495a07274c427eb93dcbc86

                                                                                                  SHA256

                                                                                                  62a270b29e926adc39f0daaa2f168b6efc02fe42ffc145f60aaf71fa2507aa86

                                                                                                  SHA512

                                                                                                  3c3548874ce26856b2808557fb0517a36b837446fca1991322f569ecafc2f0a914ee6b45c6060494731217fb672dbffc74882aa751874ecba9c57b74c128a0d9

                                                                                                • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

                                                                                                  Filesize

                                                                                                  40B

                                                                                                  MD5

                                                                                                  3de5e6e447dff35a8f249e5c1ba8f4a3

                                                                                                  SHA1

                                                                                                  284d10e268fb6ceb20967e27fccc337905c21479

                                                                                                  SHA256

                                                                                                  fd1cea1d6152ecd0d543bbb7310a22adae70dfa5b5a1e487afe9862e6e71cc97

                                                                                                  SHA512

                                                                                                  2a5750f1ae0cfc2f75d8d18b69cfbeeea05abceb0932283ef6abbf267d6170bc02af1aae7b090b06a10cc4bbecae47c9e97716288f938d98adcf5051ae334c96

                                                                                                • C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json

                                                                                                  Filesize

                                                                                                  269B

                                                                                                  MD5

                                                                                                  90de94dac203930a5b78859624c846fd

                                                                                                  SHA1

                                                                                                  ecd72888fa9a686994a06b44640900247966a0c1

                                                                                                  SHA256

                                                                                                  965a9cffa869bf0531cc12b7e3c453d0211d18996347676114271d0c2e9a1833

                                                                                                  SHA512

                                                                                                  abfa3adf18c573136d1fb51d70acdd0cdf09becb018f8f42fe2f3e260720a7c61774129191293a0d98a8ee3580cb64f947f0130b9d0b6b664662fa6b3735757e

                                                                                                • C:\Users\Admin\Downloads\OperaGXSetup.exe

                                                                                                  Filesize

                                                                                                  3.2MB

                                                                                                  MD5

                                                                                                  ddbf01732ce62e17891142dedbfded8d

                                                                                                  SHA1

                                                                                                  7f2a890bd24ec02b163901c6d58f971e435aa646

                                                                                                  SHA256

                                                                                                  e9d345b551117260b59e9a654ae5dcef6d9807316ee61d7eb517178b1664d17d

                                                                                                  SHA512

                                                                                                  84ffe6a26024b53f41a56c74de950f77a81dbe2e0246b9e02d25cc2eb5c267dbda7b015a5a9945af16f26c8a5761dd023edce39cd46decdeee5b359f13ef33b2

                                                                                                • C:\Users\Admin\Downloads\Unconfirmed 505989.crdownload

                                                                                                  Filesize

                                                                                                  25.4MB

                                                                                                  MD5

                                                                                                  51d5e87ae7bc99d3acc39daa20b03431

                                                                                                  SHA1

                                                                                                  7320a8cd779bd18f572422aa53b241fadeae6a34

                                                                                                  SHA256

                                                                                                  07f61f7c87bdeacfe34388001489136c563f55891d1a7e4481048b0e26e888a4

                                                                                                  SHA512

                                                                                                  273eb5f5c93df9885ce2bcdc35df234a1f99e13af7b904d7e9a257b5e75a9a38b95f2ee4bc27a4cb069718cde57804aea45cc79223b34aa211a3a5604189c7b4

                                                                                                • \??\pipe\LOCAL\crashpad_4824_HAZBIXAFRPHXTMRI

                                                                                                  MD5

                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                  SHA1

                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                  SHA256

                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                  SHA512

                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                • memory/408-1876-0x0000022B6D400000-0x0000022B6D422000-memory.dmp

                                                                                                  Filesize

                                                                                                  136KB

                                                                                                • memory/2016-1538-0x000001835A2F0000-0x000001835B081000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.6MB

                                                                                                • memory/2016-1537-0x000001835A2F0000-0x000001835B081000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.6MB

                                                                                                • memory/2016-1539-0x000001835A2F0000-0x000001835B081000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.6MB

                                                                                                • memory/2016-1540-0x000001835A220000-0x000001835A221000-memory.dmp

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                • memory/2016-1536-0x000001835A210000-0x000001835A211000-memory.dmp

                                                                                                  Filesize

                                                                                                  4KB