0e94c714635ba84785d53b474eca360a321f60742e268447363d6d3d06dfe3bc

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e94c714635ba84785d53b474eca360a321f60742e268447363d6d3d06dfe3bc.exe
Size

3.1MB
MD5

d39a39c8a74a146d6094c2d63df5a7bd
SHA1

a5df59891f6d74266bf398979f8fa676426c1773
SHA256

0e94c714635ba84785d53b474eca360a321f60742e268447363d6d3d06dfe3bc
SHA512

546291d0c1119d75d84620763697eb117afaf0199c8a04038138694b82375273eefc7005116068c4f6ecca8cc45f5841d60b17c77a7424bf79e5cc70a8ae4ac2
SSDEEP

98304:qAJbF/eB26JB6+hafAQ2NFSrsf9qgMsIZ/JUFmRT2H:jGpafS0U9q0IFYz

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
2300	setup.exe
1760	setup.exe
2860	setup.exe
940	setup.exe
3136	setup.exe

Loads dropped DLL 5 IoCs

pid	Process
2300	setup.exe
1760	setup.exe
2860	setup.exe
940	setup.exe
3136	setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e94c714635ba84785d53b474eca360a321f60742e268447363d6d3d06dfe3bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 619144.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
2500	msedge.exe
2500	msedge.exe
4876	identity_helper.exe
4876	identity_helper.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2300	setup.exe
2300	setup.exe
2300	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 2300	4516	0e94c714635ba84785d53b474eca360a321f60742e268447363d6d3d06dfe3bc.exe	81
PID 4516 wrote to memory of 2300	4516	0e94c714635ba84785d53b474eca360a321f60742e268447363d6d3d06dfe3bc.exe	81
PID 4516 wrote to memory of 2300	4516	0e94c714635ba84785d53b474eca360a321f60742e268447363d6d3d06dfe3bc.exe	81
PID 2300 wrote to memory of 1760	2300	setup.exe	82
PID 2300 wrote to memory of 1760	2300	setup.exe	82
PID 2300 wrote to memory of 1760	2300	setup.exe	82
PID 2300 wrote to memory of 2860	2300	setup.exe	83
PID 2300 wrote to memory of 2860	2300	setup.exe	83
PID 2300 wrote to memory of 2860	2300	setup.exe	83
PID 2300 wrote to memory of 940	2300	setup.exe	88
PID 2300 wrote to memory of 940	2300	setup.exe	88
PID 2300 wrote to memory of 940	2300	setup.exe	88
PID 940 wrote to memory of 3136	940	setup.exe	90
PID 940 wrote to memory of 3136	940	setup.exe	90
PID 940 wrote to memory of 3136	940	setup.exe	90
PID 2300 wrote to memory of 2500	2300	setup.exe	93
PID 2300 wrote to memory of 2500	2300	setup.exe	93
PID 2500 wrote to memory of 1892	2500	msedge.exe	95
PID 2500 wrote to memory of 1892	2500	msedge.exe	95
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 1820	2500	msedge.exe	96
PID 2500 wrote to memory of 3832	2500	msedge.exe	97
PID 2500 wrote to memory of 3832	2500	msedge.exe	97
PID 2500 wrote to memory of 1020	2500	msedge.exe	98
PID 2500 wrote to memory of 1020	2500	msedge.exe	98
PID 2500 wrote to memory of 1020	2500	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\0e94c714635ba84785d53b474eca360a321f60742e268447363d6d3d06dfe3bc.exe
"C:\Users\Admin\AppData\Local\Temp\0e94c714635ba84785d53b474eca360a321f60742e268447363d6d3d06dfe3bc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\7zS4A1F6487\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7zS4A1F6487\setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\7zS4A1F6487\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7zS4A1F6487\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=113.0.5230.75 --initial-client-data=0x314,0x310,0x300,0x318,0x338,0x74b71864,0x74b71870,0x74b7187c
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\7zS4A1F6487\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4A1F6487\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2300 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241121101404" --session-guid=097def1b-16ac-4a71-94f4-cbbe2b162b0b --server-tracking-blob=MWY0ZjA2N2JjNjVjNTRlMGZlYmU0YjExMjhlYTA1NDIzMjczMWUzNzQ3MmQ2Mjc3NTkzZjM2OTQ5MTAxYmI4OTp7InByb2R1Y3QiOnsibmFtZSI6Ik9wZXJhIEdYIn0sInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fX0= --desktopshortcut=1 --wait-for-package --initial-proc-handle=1C09000000000000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Users\Admin\AppData\Local\Temp\7zS4A1F6487\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS4A1F6487\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=113.0.5230.75 --initial-client-data=0x32c,0x330,0x334,0x2fc,0x338,0x71fe1864,0x71fe1870,0x71fe187c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
    3⤵
    - Enumerates system info in registry
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc76c246f8,0x7ffc76c24708,0x7ffc76c24718
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3544 /prefetch:8
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4836 /prefetch:8
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
      4⤵
      PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
      4⤵
      PID:512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7876311618245016905,14711807309642753776,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
636d24ca5006f3f32739bc8191fb9c74

SHA1
119aa921ad39d573fc20426a9ab2b69119898e91

SHA256
4c54361c924f6367ec3f033de977085d0d10e75cc0f572fc58161203b6b4cab8

SHA512
f1bc01f87d92022a061f341eca07d1f6b34019e14d0213ee2662ac344424da8f86587da778c30f028940af45a764351901b23c894de786c31727dafb9acebb41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
2aaf11132879d8c2b42f57465f854abf

SHA1
cba36bc4067f4c8a6cc14b50a24b51142432c5e1

SHA256
18bbafb9e2a6ad48027495efa487c47c179933cc2cd92c923c191207bd101172

SHA512
1d370c979d7513aac4abb79ecd2650da180e07335547b997c0a26a3f4a8bfa9851710f82c7e1b3b16baaa01433422151d0af940e4ae0e08ff65e888c5ef5cc93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
4e521dfc0336974917b61da5241736fe

SHA1
155f6c0127be8f9c172f0165823fd46ce91fb6de

SHA256
4f7b1329c5be4ff3674cbc29668424385af0777e96783c8d472656d3491c722d

SHA512
69484234dc4d7d82f5d22ef732399e6b41e18b3f6563c32d0ff061106680073dc60b2dc2f24c830867f4618614bcdbe1f785bcfe859f8dd5b1d9e08e0f09f82d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
7ef5143fd3c1c6c181f5cef71b5b363d

SHA1
989275e070b65a74030926bcf6e1419c09f80ce2

SHA256
f1db6cb29f97ecde4bd2b55c8b41413880f1f1466a945b2e4d4346fd4a2af34c

SHA512
0f8aaa11f3c5da09d993ed38d3c803ee87dec5d6198958ec5357d1bab39f325d66434ea97d7fe84987cc231b919be40ecaf053ebdce02eccb64dc48a70646e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
7788380555352c9b66c23031a68f02e4

SHA1
50aa09c9713693193f4968e163e98bd0d462d8ce

SHA256
fb0f1f4cac7f8684f4b3ccea047e16c861fbae7844d94303315bd39abf368c8d

SHA512
906ed5a5e0ca8bc5ffa2893cd78ea06098fa46c0d8d3f47d42bd46bf7e39152d40e17aae9394f3a2f67787dc55f589068cefc2b325a93aaba6fecea86ed5d3ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
042869867cabd133483a277f4f788d46

SHA1
18358f62b3345fbdf8d21da4d5b1716246551d77

SHA256
48a3a233bdfa6398dd1c09fcdd745bec12ff32e31e01c6beee31604617c8e6fd

SHA512
261583812527b2a6a8027400316f381b2bd073c820a2b6ee84d34fdc5cd1c800bc57d60c1f362c973ea2278760d90021b6a8cb580f54f05eb4563f28597c0110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0c00a32e3971407c7b37e994e43333d1

SHA1
c180e4edd323215ee618d2bfe5ed18e55db8d7dc

SHA256
beeeab94c6c961762c583370e4060a4a337bb7f3924fb04ca3aa409f74778690

SHA512
844a28d95ca941691b08d747e5c21e59e29ee0bf7fa1335893c06b7055adea926707a52c9f11c2b8064b23c48f545fc122875fd40816c06cb4a43e1b8f53454f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
71bc1fc6c4c247e426baff67449fd031

SHA1
df8bc97d89c77b699fa96d62e91af5a1afc0c14d

SHA256
79272f5875855525d5106b9af9a9aebe34fa4874ee80d70d8eb44b83e65bd9fc

SHA512
053ca9f9d320cc54389043f434a90300e351730e30b24047e8f5f4e4ff3405ec65f4498fc44b63000267eba5752e0d8ca903e9c42ee30535a9b22680f8c24b04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
7461ad3ca966e32cb7a4a693d094936b

SHA1
444252f851893dbc07c1fe1df91fcbb4fda84587

SHA256
f63e96dbc1ca8c4c76615e24a4e5bb9075a352d0989d8b705f21d7693f1c8bf3

SHA512
a3353c776e4b060fb65872ab41c6b1d2969853f5cf1b4f55834ca0e88e79c3a74c3eaa1b16c94970712ea7580bdbaed381809265df0da1ac05c60aa640e87ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5850ea.TMP

Filesize
48B

MD5
9979e9d00f2b810e26129e447e4ee2f0

SHA1
cac038350ffb97dc8774b7930d7d322f7a86e552

SHA256
827c4b0db1ef22fd50e20c5ba5be08889d5f0071b2b955bc90ae27fd03e84850

SHA512
105630ddbcbbcb2822fbd917450217bc035a56d507270b008ce411adf0a0d2f74772e14271623e03336f173e4e5f8ffd1c822eabbee02f2be03dafb19967b564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b90140ebf1a7d0160c319a8d665d6e21

SHA1
4f46c77f4a42c0278dbb56e73391099fd77b8696

SHA256
fd7a9ebfa6b79b59b6d30dee11d825acc2aeb47ef77c1b8d32ca7d0dbc3f11de

SHA512
9b7982f8206041187049c5c76c23293990ddfaf7b1f45538026ad6a0421d5704882a9f8175594db69f349a5683491e05c5ce5714dac504ebb16d07c85b8b4750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
24e8101e2ea92c74c9c7b0e0cb40f811

SHA1
67e8cdf51c177a817809f10794ec650a942c8ee3

SHA256
5edee5f1fee35c9342c1f06acbdedac78662b829171d4961022a5187af065a9f

SHA512
8083c6da0aa91de7542cdc603fc9e97aa8c48a26bbf2b6df702186e200146add79b5981a531df7d8e9e9e808eb66c1e81b3d0acc881f19f2f18ef71393d7cc7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4A1F6487\setup.exe

Filesize
6.3MB

MD5
eb798e91d503b97614756193e195a7b1

SHA1
06367f70a0b4c6de9e208c419beb84fa10c0eeef

SHA256
406b5edbd94bc38ce345d3c0f34b6b5fcd0405bd290a2ad0fd55c08b0695eed8

SHA512
5738431f355f599e88ec8b603f692a23a779ef41183ee1ebad3f7c81a9296a3df626d852cca1256791cc665d912f8f73c4ac00a15e4f96259c253290a40ba020

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2411211014033412300.dll

Filesize
5.8MB

MD5
d9566efedb5ea286e12826594a40e623

SHA1
eba69b688be145e73103ec9587db22e072ee9fb5

SHA256
d09af4042577f9c1c72863df791b0114d25086cbf9fa3012b765157ddcbbdf33

SHA512
daa4adc5f254088d3b8d22d27b5af3d3663630017903f64377579cba46c0b8e4ffa427b7e51ccdc214e70ed835e2ff9ec2baf4a28a194a1c22dd2ee2abf653bb

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

Filesize
40B

MD5
83521873ba10b0ad8dbde02bae78fd7e

SHA1
84a43e76e3ad4830368d3ac535d54dbb41b0381d

SHA256
768825547bd88b4493f49536490c79c455ce6497a6b0b1d9d9d0dd1fc518d00c

SHA512
ddf2c37164d28440a93f3ed76d97a3f24c307dba894e3438502ed233c3857d5b01a48c057037c7764306d9c7a166730fc5bd2a9dabfa83bc49b75c27692d058a

Download Submit