Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    180s
  • max time network
    183s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18/01/2025, 03:29

General

  • Target

    OperaGXSetup.exe

  • Size

    3.8MB

  • MD5

    b7ae71c3434b37da6d4ded743256092e

  • SHA1

    64bd14bbcae4d7645a576d387ecc5f654ff98fea

  • SHA256

    7bbf75a95c1ce0e6d57acfb4c7b2becf73932545f7ae6cb5da36266de128210a

  • SHA512

    27f7abad8d7e9edc492e14171554d741d2317d4b05d7f24beb8b73cdd4113a4d55cf540483203bd0f2585f4f320cfb2d7bd414b966045b7675cabadb3a64a718

  • SSDEEP

    98304:fAU8bcWhTQvY8XYKGEAq/xFRAutU+6s3yEoivcdIrmIX+dFZdM:LCh98XYK3Aq/zmcfoiv18/dM

Malware Config

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

  • Dharma family
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Renames multiple (573) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Downloads MZ/PE file
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Drops startup file 5 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:992
    • C:\Users\Admin\AppData\Local\Temp\7zS0E3A47A7\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS0E3A47A7\setup.exe --server-tracking-blob=ZmE0Mjc0ZTY2YzM3YjEzMDZhMmUzZGEyMTIyNDExZGZlOWY3ZDNlZDc2ODBiZWQ4MWNlMTZmNGRlY2IzMTUwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT1QV05nYW1lcyZ1dG1fbWVkaXVtPXBhJnV0bV9jYW1wYWlnbj1QV05fVVNfTVZSX0REXzI2OCZlZGl0aW9uPXN0ZC0yJnV0bV9jb250ZW50PTI2OF8yMjIyMiZ1dG1faWQ9ZTQxMmUxMjg2NDNlNGI3NWE5MTZjZjMxZDcwMTZmNjImaHR0cF9yZWZlcnJlcj1odHRwcyUzQSUyRiUyRnd3dy5vcGVyYS5jb20lMkZnZXQlMkZvcGVyYS1neCUzRnV0bV9jb250ZW50JTNEMjY4XzIyMjIyJTI2dXRtX3NvdXJjZSUzRFBXTmdhbWVzJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX1VTX01WUl9ERF8yNjglMjZ1dG1faWQlM0RlNDEyZTEyODY0M2U0Yjc1YTkxNmNmMzFkNzAxNmY2MiUyNmVkaXRpb24lM0RzdGQtMiZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRiZkbF90b2tlbj02NzMwMDYxNCIsInRpbWVzdGFtcCI6IjE3MzQ3NTMxNDAuMTc0NyIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzEuMC4wLjAgU2FmYXJpLzUzNy4zNiBFZGcvMTMxLjAuMC4wIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX1VTX01WUl9ERF8yNjgiLCJjb250ZW50IjoiMjY4XzIyMjIyIiwiaWQiOiJlNDEyZTEyODY0M2U0Yjc1YTkxNmNmMzFkNzAxNmY2MiIsImxhc3RwYWdlIjoib3BlcmEuY29tLyIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJkNmVhZTJjNi0xMGQ1LTQyY2EtODdiMi02MWY4YTJjNTBjNjgifQ==
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Users\Admin\AppData\Local\Temp\7zS0E3A47A7\setup.exe
        C:\Users\Admin\AppData\Local\Temp\7zS0E3A47A7\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=115.0.5322.113 --initial-client-data=0x338,0x33c,0x340,0x30c,0x344,0x74362d4c,0x74362d58,0x74362d64
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4720
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2044
      • C:\Users\Admin\AppData\Local\Temp\7zS0E3A47A7\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS0E3A47A7\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --vought_browser=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1096 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20250118032949" --session-guid=5cfc0c20-5de2-4c98-8c61-c650315e6d8a --server-tracking-blob=YmIzN2Q4MzhmNmEyOTc3MjM5YjNjNGJjYTcxY2Q2NTMyM2FkNzEwYWZmNjcwM2I4ZTQ3NzAxMmQ0NGFmYTEyMTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT1QV05nYW1lcyZ1dG1fbWVkaXVtPXBhJnV0bV9jYW1wYWlnbj1QV05fVVNfTVZSX0REXzI2OCZlZGl0aW9uPXN0ZC0yJnV0bV9jb250ZW50PTI2OF8yMjIyMiZ1dG1faWQ9ZTQxMmUxMjg2NDNlNGI3NWE5MTZjZjMxZDcwMTZmNjImaHR0cF9yZWZlcnJlcj1odHRwcyUzQSUyRiUyRnd3dy5vcGVyYS5jb20lMkZnZXQlMkZvcGVyYS1neCUzRnV0bV9jb250ZW50JTNEMjY4XzIyMjIyJTI2dXRtX3NvdXJjZSUzRFBXTmdhbWVzJTI2dXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX1VTX01WUl9ERF8yNjglMjZ1dG1faWQlM0RlNDEyZTEyODY0M2U0Yjc1YTkxNmNmMzFkNzAxNmY2MiUyNmVkaXRpb24lM0RzdGQtMiZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRiZkbF90b2tlbj02NzMwMDYxNCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczNDc1MzE0MC4xNzQ3IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzMS4wLjAuMCBTYWZhcmkvNTM3LjM2IEVkZy8xMzEuMC4wLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfTVZSX0REXzI2OCIsImNvbnRlbnQiOiIyNjhfMjIyMjIiLCJpZCI6ImU0MTJlMTI4NjQzZTRiNzVhOTE2Y2YzMWQ3MDE2ZjYyIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vIiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImQ2ZWFlMmM2LTEwZDUtNDJjYS04N2IyLTYxZjhhMmM1MGM2OCJ9 --desktopshortcut=1 --wait-for-package --initial-proc-handle=8C09000000000000
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3108
        • C:\Users\Admin\AppData\Local\Temp\7zS0E3A47A7\setup.exe
          C:\Users\Admin\AppData\Local\Temp\7zS0E3A47A7\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=115.0.5322.113 --initial-client-data=0x328,0x32c,0x330,0x304,0x334,0x71bf2d4c,0x71bf2d58,0x71bf2d64
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2036
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501180329491\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501180329491\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2512
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501180329491\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501180329491\assistant\assistant_installer.exe" --version
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5080
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501180329491\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501180329491\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x804f48,0x804f58,0x804f64
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4828
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e8ab3cb8,0x7ff9e8ab3cc8,0x7ff9e8ab3cd8
      2⤵
        PID:1576
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1968 /prefetch:2
        2⤵
          PID:2172
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1408
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
          2⤵
            PID:2040
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
            2⤵
              PID:1100
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
              2⤵
                PID:1860
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
                2⤵
                  PID:3248
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
                  2⤵
                    PID:2696
                  • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4572
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
                    2⤵
                      PID:3556
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1112
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
                      2⤵
                        PID:5084
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
                        2⤵
                          PID:4952
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                          2⤵
                            PID:1860
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
                            2⤵
                              PID:668
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
                              2⤵
                                PID:3556
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
                                2⤵
                                  PID:4028
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
                                  2⤵
                                    PID:1428
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
                                    2⤵
                                      PID:860
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
                                      2⤵
                                        PID:2800
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:1
                                        2⤵
                                          PID:4904
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
                                          2⤵
                                            PID:1764
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
                                            2⤵
                                              PID:2408
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
                                              2⤵
                                                PID:2536
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
                                                2⤵
                                                  PID:4960
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6700 /prefetch:8
                                                  2⤵
                                                    PID:3992
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1932,9152687261376310524,15297630927051035216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6844 /prefetch:8
                                                    2⤵
                                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                    • NTFS ADS
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:228
                                                  • C:\Users\Admin\Downloads\CoronaVirus.exe
                                                    "C:\Users\Admin\Downloads\CoronaVirus.exe"
                                                    2⤵
                                                    • Drops startup file
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Drops desktop.ini file(s)
                                                    • Drops file in System32 directory
                                                    • Drops file in Program Files directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: RenamesItself
                                                    PID:4792
                                                    • C:\Windows\system32\cmd.exe
                                                      "C:\Windows\system32\cmd.exe"
                                                      3⤵
                                                        PID:3096
                                                        • C:\Windows\system32\mode.com
                                                          mode con cp select=1251
                                                          4⤵
                                                            PID:33232
                                                          • C:\Windows\system32\vssadmin.exe
                                                            vssadmin delete shadows /all /quiet
                                                            4⤵
                                                            • Interacts with shadow copies
                                                            PID:27012
                                                        • C:\Windows\system32\cmd.exe
                                                          "C:\Windows\system32\cmd.exe"
                                                          3⤵
                                                            PID:32648
                                                            • C:\Windows\system32\mode.com
                                                              mode con cp select=1251
                                                              4⤵
                                                                PID:27004
                                                              • C:\Windows\system32\vssadmin.exe
                                                                vssadmin delete shadows /all /quiet
                                                                4⤵
                                                                • Interacts with shadow copies
                                                                PID:25680
                                                            • C:\Windows\System32\mshta.exe
                                                              "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                              3⤵
                                                                PID:8564
                                                              • C:\Windows\System32\mshta.exe
                                                                "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                                3⤵
                                                                  PID:8076
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:656
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:4952
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                  1⤵
                                                                    PID:3168
                                                                  • C:\Windows\system32\vssvc.exe
                                                                    C:\Windows\system32\vssvc.exe
                                                                    1⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:46192
                                                                  • C:\Windows\system32\werfault.exe
                                                                    werfault.exe /h /shared Global\230290213b37427aaf5607bef824a214 /t 8236 /p 8564
                                                                    1⤵
                                                                      PID:45540
                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                      1⤵
                                                                      • Modifies registry class
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:46680

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-17403E5E.[[email protected]].ncov

                                                                      Filesize

                                                                      2.7MB

                                                                      MD5

                                                                      23bcfda0f267d3beba46d9c99d5d8f4a

                                                                      SHA1

                                                                      dd91b5f2c8acaa7cdf6cfa694c475e9a5b48c1bb

                                                                      SHA256

                                                                      5937a5960d0816f6d94ccc6e02b2df0f3ba34c757e04551730171cc5f4540e64

                                                                      SHA512

                                                                      4b0adf0c50ed3a05201a3b803fadb07b777362aae62244cc89675e270c98597abd2a05621ac661f7fc4c11d72dc24562edfa9cac3ab083fcecd6db94a1f2e9dc

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                      Filesize

                                                                      471B

                                                                      MD5

                                                                      9c523d545bbda63b1bf2e3fea1b43024

                                                                      SHA1

                                                                      dda71186e4057aa8ece9f06639e0387e8b247c16

                                                                      SHA256

                                                                      3ee41e4dadf8100a51d48b6eecb2f72bbf4564a2514dc7aa24547159b3b55ba2

                                                                      SHA512

                                                                      308064f1fe403b39cd33c9318d88c7d4a173ccba974dabafb7b21995c0a947745b41ece781982978729d9836036f92aed3220eb7d0ec5453706533670ae1e656

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                      Filesize

                                                                      412B

                                                                      MD5

                                                                      63b51fa5e8d2142c00fef81cae7b819b

                                                                      SHA1

                                                                      a4aa8f803f789d77f931ce8a89cc0e30ec079e94

                                                                      SHA256

                                                                      3b91f2862903c2d5edb66f7fdadee6d57ab03a0bc70e7844f6c24e54bc7911eb

                                                                      SHA512

                                                                      e88585bc69fba0c0e3465726108c042e85aa5bcbc6efd1f9cfbcb1a0f0c8a232b0a2412abe6594586ad56be59155c453c6626d7620646bf6da4076508fa82964

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      a28bb0d36049e72d00393056dce10a26

                                                                      SHA1

                                                                      c753387b64cc15c0efc80084da393acdb4fc01d0

                                                                      SHA256

                                                                      684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

                                                                      SHA512

                                                                      20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      554d6d27186fa7d6762d95dde7a17584

                                                                      SHA1

                                                                      93ea7b20b8fae384cf0be0d65e4295097112fdca

                                                                      SHA256

                                                                      2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

                                                                      SHA512

                                                                      57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                      Filesize

                                                                      47KB

                                                                      MD5

                                                                      0d89f546ebdd5c3eaa275ff1f898174a

                                                                      SHA1

                                                                      339ab928a1a5699b3b0c74087baa3ea08ecd59f5

                                                                      SHA256

                                                                      939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

                                                                      SHA512

                                                                      26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                                      Filesize

                                                                      64KB

                                                                      MD5

                                                                      d6b36c7d4b06f140f860ddc91a4c659c

                                                                      SHA1

                                                                      ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                                      SHA256

                                                                      34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                                      SHA512

                                                                      2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                                      Filesize

                                                                      67KB

                                                                      MD5

                                                                      69df804d05f8b29a88278b7d582dd279

                                                                      SHA1

                                                                      d9560905612cf656d5dd0e741172fb4cd9c60688

                                                                      SHA256

                                                                      b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

                                                                      SHA512

                                                                      0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                                                      Filesize

                                                                      63KB

                                                                      MD5

                                                                      226541550a51911c375216f718493f65

                                                                      SHA1

                                                                      f6e608468401f9384cabdef45ca19e2afacc84bd

                                                                      SHA256

                                                                      caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

                                                                      SHA512

                                                                      2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                                      Filesize

                                                                      19KB

                                                                      MD5

                                                                      1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

                                                                      SHA1

                                                                      6dd8803e59949c985d6a9df2f26c833041a5178c

                                                                      SHA256

                                                                      af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

                                                                      SHA512

                                                                      b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      968e69dd10d6a686591a539f41d60a34

                                                                      SHA1

                                                                      adf888028b5fcb1c239077946f50f99b10e995b1

                                                                      SHA256

                                                                      29079c03b837b5c6f4eccc3810ee7e6b6efbc65f9a9baac83cf66069711fc6b0

                                                                      SHA512

                                                                      b99a750269d9b79c1e427703ccd7d541ce440f53e6edc8ac0b4c5e6650991c4f0ed932b38752af9e447192daa48ab621cb14cef5cef8dde9c86e94bbad2f9f9d

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                      Filesize

                                                                      926B

                                                                      MD5

                                                                      df6ff37d21001d2c2c5a86d811e0e307

                                                                      SHA1

                                                                      a8e1181a5e83ed44ed21bb2aee2dca9062c0ba7e

                                                                      SHA256

                                                                      8062451db1779c3b1aed31fe3a728d977cb2d084c8270f3410b6a0efe03f06eb

                                                                      SHA512

                                                                      ebb28ab127c9b6944d7f2ffd26dd0dc0e09aa6430324fa79d485c99d0e8231fc4df354c0a89379c29712ffa8df03320b6f4fc54b7508ee74e589324ad77fb9c8

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      5KB

                                                                      MD5

                                                                      6b7ac9178b7e7173032e858df6ab1f11

                                                                      SHA1

                                                                      5abe65c0e23e431e6eec22f538902464159acaef

                                                                      SHA256

                                                                      246f4bb17fcfff87821e34349aa7719489241d3d4d47b796732e08e91cf814a1

                                                                      SHA512

                                                                      b2472e8af17ac1584fc1bc2d2ed815a7562beb39e761f4061e568f84e33c4c2afa8b406f5fae161592e3d66817e78d61850f231f3a680951ae1587410c275569

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      7KB

                                                                      MD5

                                                                      7a32e5492bdfe33dbd961a280cb9d94c

                                                                      SHA1

                                                                      e8bde8e70b433776e1bc2b8728711f94d3d44280

                                                                      SHA256

                                                                      2bdd647d33205cf42643c4fa054fea2e3e803ba31dac2ac3ed34df88dcd54df0

                                                                      SHA512

                                                                      5d340e5ec426da8913889fc19bef3b706a09bc52dad2e4f2beb8c3560590e9ae2edb7e978f75a96d7c465d9d8274c6fc982952d12bd4f95b2ea544260bd4e035

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      f768f90193f24614ff5813d67af11313

                                                                      SHA1

                                                                      dbe7e21fa1e46204aec2bd386fbffcb717bcc7a7

                                                                      SHA256

                                                                      a2acf417dd2099dd022a5a3b5165b4c3101f5daea85326d4afe328e6dfcf1675

                                                                      SHA512

                                                                      02d618d258df07c3c80c465594b55a759d038841fe8dae91659d8354f4e558fe1073cfb8d82820f6436cac885b75039d4790cd7f94a6926527ec28e5f05d6db5

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      67a0340d37db0efff8a80255dcb694b9

                                                                      SHA1

                                                                      12bbd78196f82f3f493c87b822c4bc412b2e59f3

                                                                      SHA256

                                                                      493e34dbbeb14625c65045202e3792deb7f7c5a0d9e057e1226bb9450e026795

                                                                      SHA512

                                                                      90cdb31e1170a18ba71d4d80231e5f094143e1cc8a7a8944db982e2ae022610c4aaf066638ea0c63a4a7dd056a1d35452901a7decd102588981358e5e1a49691

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      0e62ddb325e3ea21d7fedfb24532dda4

                                                                      SHA1

                                                                      eb340bfda3343f3a9c51c7f33fd8bb8fa38289fc

                                                                      SHA256

                                                                      8c678a80d685ebda4221bc6ba2113d21c114304eb06d0a450fceb7c013d6a451

                                                                      SHA512

                                                                      6fd6672d6e2fe0286a18cf182b8ab8e00f7e63df9fec42e0e9b3fd28ecf6e0e3fb05ac5326238fa46e4f497617d61dff71f416cb35a1b6b3f717fc2879a57739

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      5KB

                                                                      MD5

                                                                      9ab3c53b7694a546431c6daba1412683

                                                                      SHA1

                                                                      b0b457ed69a29fc8fe6dae271d10561b49e2b14b

                                                                      SHA256

                                                                      6e5070c5e03c6d3b90003e04a101983a6963d8b35064695b9242ead5492c630e

                                                                      SHA512

                                                                      edb0ff103933584d3a2f9000fbcbd8f99465bd6c7972a620b863b5c6c165ce6e273125c586ddd8850640882bd09d537a8a028d0ca65338901707bacc4dfe2e62

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      163959953f57759c7baf21dcf6923526

                                                                      SHA1

                                                                      d41a942da6b27e39b02b85e09064e50341069d08

                                                                      SHA256

                                                                      b69e4e0a15d39fbb35d3a6c256d7d4f71603d9fd4334dabea46eedffa3e5105c

                                                                      SHA512

                                                                      4cbd3d0f1faa7910511557260567d6560ae50132b0806244cccda0968d428e7341a00e085dcb7637cef25e36e6aa4b4ef7fe3f838a7231bdf21eabcbc6cf5d36

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      74a981f4a5ff2a5fc6106b03a278475d

                                                                      SHA1

                                                                      54ec1971a7c200358a2cfb153dd24b7fd4bab4e5

                                                                      SHA256

                                                                      edb2e1604bcc3eb0638da76cdd24df8bde208ea336609db68da2a449dcf8633e

                                                                      SHA512

                                                                      16c57efe9bc49e461af86dd17d77d8e22e7f1e77582b84334ae8045eb6d3d6075c71e7732f3080c8a7c9ef814dea797d1f58dc284edb3a6c1b0dc0b193430dae

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                      Filesize

                                                                      534B

                                                                      MD5

                                                                      4f21c3242d069aa8661f6fc74fd41443

                                                                      SHA1

                                                                      1c2de11a15aa333ef66ec9c4ec86ff8e656ccd5d

                                                                      SHA256

                                                                      d99698e52fb451ca19bbcc345031c339cb9dd248c1770757e70f54f910f704d2

                                                                      SHA512

                                                                      b6cfbf7fe8837a3397ca7997f01c198b602d772c51f76760bd64a3c031308ce422164e1b7fe0f74996a0cbe04bff900edc00babe599bb86c1409af5dc32a742d

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      0e18cdbb83cdcad32fc12ae971d68900

                                                                      SHA1

                                                                      08b177c82ec43edf86298e60c4a7be942d8b257d

                                                                      SHA256

                                                                      509827bda16388ba8f1bbc500a9a3668544a0f3ead41d16327ae61fde1415f66

                                                                      SHA512

                                                                      9bad6e58c667b4b4ddb299edab158201330ebb7faae4b4d39ee0fc6fe919b70d33f28ffa750de7f8d481a5838ee88f5dbfb6a5430f3cd99c4a3bf6b20f8d0a09

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      ef75b39822d85b167a585b67bdddebaa

                                                                      SHA1

                                                                      3cbbcda81317ed6c03036ac51b9be607393ad1ba

                                                                      SHA256

                                                                      00de97448eb442d8ce3dfca5a4658ab79c612d1e0137913ac567baba779a5309

                                                                      SHA512

                                                                      dd2e6987f0b3d4b0083b3d1c849d53a81a5b68b3c9d5786961ae46f0a4311bb9d8a647d359cb9060844df1b5c5da9d9375d34606b4bec90a58b260d7e62b069a

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58cabd.TMP

                                                                      Filesize

                                                                      534B

                                                                      MD5

                                                                      039ef705609087b34020ef8a57d11294

                                                                      SHA1

                                                                      6fb09f1abb4d49946d73b11f45a7cf73f898086e

                                                                      SHA256

                                                                      0fd2a607c463a03befc7958c1c8c5dec59c3a298b04f3ce05c526cb27178d04b

                                                                      SHA512

                                                                      0ac8c84283ce942714876a8a2e1a585b74cde95ea0a3a4c7a42378eb66d31b647bf3bb2453b360edebe0775b6743f6aea9344172eec65e9d28ec2b78c05efbc7

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                      Filesize

                                                                      16B

                                                                      MD5

                                                                      46295cac801e5d4857d09837238a6394

                                                                      SHA1

                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                      SHA256

                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                      SHA512

                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                      Filesize

                                                                      16B

                                                                      MD5

                                                                      206702161f94c5cd39fadd03f4014d98

                                                                      SHA1

                                                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                      SHA256

                                                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                      SHA512

                                                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

                                                                      Filesize

                                                                      16KB

                                                                      MD5

                                                                      9a8e0fb6cf4941534771c38bb54a76be

                                                                      SHA1

                                                                      92d45ac2cc921f6733e68b454dc171426ec43c1c

                                                                      SHA256

                                                                      9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be

                                                                      SHA512

                                                                      12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\previews_opt_out.db

                                                                      Filesize

                                                                      16KB

                                                                      MD5

                                                                      d926f072b41774f50da6b28384e0fed1

                                                                      SHA1

                                                                      237dfa5fa72af61f8c38a1e46618a4de59bd6f10

                                                                      SHA256

                                                                      4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249

                                                                      SHA512

                                                                      a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                      Filesize

                                                                      11KB

                                                                      MD5

                                                                      7b9d8e559cce969e7d4e618bffa96db1

                                                                      SHA1

                                                                      16cb7c2c4862454062885a07c0ac8c3843a7b7b0

                                                                      SHA256

                                                                      6e344421127e9584402176cc65a21bf69cd1a3b9839c992ec86737e2468807c3

                                                                      SHA512

                                                                      b658cd7643d9cbfc746514a65415cb254dc2a857267df3bc59e69bf47886e113c02b047a7424038e52661db1407baee33afda7a0eb7bde0ba8ba414d67112fad

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      df7a200fa6f115b05b6e7891892e13aa

                                                                      SHA1

                                                                      79d80d5c500bff342b9e37e025af9cde973d0f59

                                                                      SHA256

                                                                      3a61cee54676b4bcdd2db1de7c27a65100d16a0b106279220a41cef1f491d472

                                                                      SHA512

                                                                      303d5ae1431aa926254f64266aab2805625960db35f2e89cc2f3a559abfa056856551e5c83827188b7c3cd32d3650ed93ef8477973189cb21e31736b734254c9

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                      Filesize

                                                                      11KB

                                                                      MD5

                                                                      84f327e287f861fcaec3e431705363ae

                                                                      SHA1

                                                                      0d2d31553f3bbd613cf58d4c0f8c54121c378eab

                                                                      SHA256

                                                                      f7af8343058ba6d898c3fe168204e8a018635bbaedccd004e19bddbdafd3b015

                                                                      SHA512

                                                                      185ab34670f95d5aed86d0c01af132ba033cfdad35353581793ea174cd1e4d71a165d47540e1cfc2b3532880c52f2e04d27a166f957337ee06d8c4063f50e872

                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

                                                                      Filesize

                                                                      10KB

                                                                      MD5

                                                                      ad7a569bafd3a938fe348f531b8ef332

                                                                      SHA1

                                                                      7fdd2f52d07640047bb62e0f3d3c946ddd85c227

                                                                      SHA256

                                                                      f0e06109256d5577e9f62db2c398974c5002bd6d08892f20517760601b705309

                                                                      SHA512

                                                                      b762bae338690082d817b3008144926498a1bd2d6d99be33e513c43515808f9a3184bd10254e5c6a1ff90a9211653f066050249030ad9fe0460ec88335b3d423

                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt

                                                                      Filesize

                                                                      846KB

                                                                      MD5

                                                                      766f5efd9efca73b6dfd0fb3d648639f

                                                                      SHA1

                                                                      71928a29c3affb9715d92542ef4cf3472e7931fe

                                                                      SHA256

                                                                      9111e9a5093f97e15510bf3d3dc36fd4a736981215f79540454ce86893993fdc

                                                                      SHA512

                                                                      1d4bb423d9cc9037f6974a389ff304e5b9fbd4bfd013a09d4ceeff3fd2a87ad81fe84b2ee880023984978391daf11540f353d391f35a4236b241ccced13a3434

                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501180329491\additional_file0.tmp

                                                                      Filesize

                                                                      1.4MB

                                                                      MD5

                                                                      e9a2209b61f4be34f25069a6e54affea

                                                                      SHA1

                                                                      6368b0a81608c701b06b97aeff194ce88fd0e3c0

                                                                      SHA256

                                                                      e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

                                                                      SHA512

                                                                      59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202501180329491\assistant\assistant_installer.exe

                                                                      Filesize

                                                                      1.8MB

                                                                      MD5

                                                                      4c8fbed0044da34ad25f781c3d117a66

                                                                      SHA1

                                                                      8dd93340e3d09de993c3bc12db82680a8e69d653

                                                                      SHA256

                                                                      afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

                                                                      SHA512

                                                                      a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0E3A47A7\setup.exe

                                                                      Filesize

                                                                      7.3MB

                                                                      MD5

                                                                      5de6d68dc2da990b0b0e8ede5efbcd4c

                                                                      SHA1

                                                                      f2f348737bc87041b76bf86db7f90b11e3332f9a

                                                                      SHA256

                                                                      afe8e65386fce7385b8c2229b6dfe3da4d021606bfe7c19e982737c95adf68ff

                                                                      SHA512

                                                                      21a53d3d8695acceadf13de30b2ef7c9bc8946162ab5c672aa7eb06b432c52eed657448d74c28b842e98ea6215d4715c4baf01efa1a4ec9b1491df956880f96e

                                                                    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2501180329470771096.dll

                                                                      Filesize

                                                                      6.8MB

                                                                      MD5

                                                                      4b4419a92f8f84d9a5930ca78d06c0f7

                                                                      SHA1

                                                                      c6904afd256c36f3c63e61a5874f1e6a6def28e1

                                                                      SHA256

                                                                      5bd375c597ab5d88202ff01e9528bb72c0b17a171510a1839708a790828123de

                                                                      SHA512

                                                                      7ffefb73a0141a0b1636db96ddcb1d2522005364d1d1e445ebad619c0364bea0c66e2d86c95c5ec9b0599a5cb6cdfeb216b65e346d80918076a436f687b608c0

                                                                    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

                                                                      Filesize

                                                                      40B

                                                                      MD5

                                                                      d48a9b8639c19838b88c0b1be5ce45de

                                                                      SHA1

                                                                      62636928cee6626a9b6840f7e2ce53d1ea14d5d3

                                                                      SHA256

                                                                      fcca79e1f57d2757fb2f6a048f4f6770e7c63829d41f9da08da6b0fcc2e4a38e

                                                                      SHA512

                                                                      dace636f5ad62158373077075e5adb9faf0cdb8db3a1a7dd357df4e50efda9636316c6782f71b82c3c36c8eefeb188ce338aaa7f174f2add7dfde6a1f6b427c8

                                                                    • C:\Users\Admin\Downloads\Unconfirmed 768788.crdownload

                                                                      Filesize

                                                                      1.0MB

                                                                      MD5

                                                                      055d1462f66a350d9886542d4d79bc2b

                                                                      SHA1

                                                                      f1086d2f667d807dbb1aa362a7a809ea119f2565

                                                                      SHA256

                                                                      dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

                                                                      SHA512

                                                                      2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

                                                                    • memory/4792-863-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                    • memory/4792-882-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                    • memory/4792-4878-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                      Filesize

                                                                      1.4MB