46dda74095b229c3724b4ef7e5f4c05b0b0e15426ca76e9ac947475f21459d19

Analysis

max time kernel
185s
max time network
421s
platform
windows7_x64
resource
win7-en-20211208
submitted
14-01-2022 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpyHunter-5.11-5-26253-Installer.exe
Size

7.4MB
MD5

911736872bcb9f85b9181c7d785ee032
SHA1

806691ea5f3cf3cd335b00e436c51c9cb85bc9a4
SHA256

46dda74095b229c3724b4ef7e5f4c05b0b0e15426ca76e9ac947475f21459d19
SHA512

016c73a7e8ecad84ba73e220a37869bdf8465411a2085133112ba1215b92553c3ff7194e425b94b13b43f0152a0c1194376c87c5ffbd2441df0f3236d2b8fda6

Score

10^/10

discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

ShKernel.exe

description ioc process

File created C:\Windows\system32\Drivers\EnigmaFileMonDriver.sys ShKernel.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\EnigmaFileMonDriver.sys	ShKernel.exe

Executes dropped EXE 9 IoCs

Processes:

opera_setup.exeopera_setup.exeopera_setup.exeopera_setup.exeShKernel.exeopera_setup.exeShMonitor.exeSpyHunter5.exe

pid	process
1632	opera_setup.exe
908	opera_setup.exe
1684	opera_setup.exe
2016	opera_setup.exe
468
700	ShKernel.exe
1812	opera_setup.exe
2080	ShMonitor.exe
2160	SpyHunter5.exe

Patched UPX-packed file 3 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

Processes:

resource	yara_rule
C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe	patched_upx
\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe	patched_upx
C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe	patched_upx

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\opera_setup.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe	upx
\Users\Admin\AppData\Local\Temp\opera_setup.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe	upx
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_setup.exe	upx
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_setup.exe	upx
\Users\Admin\AppData\Local\Temp\opera_setup.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe	upx
\Users\Admin\AppData\Local\Temp\opera_setup.exe	upx
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe	upx

Loads dropped DLL 22 IoCs

Processes:

SpyHunter-5.11-5-26253-Installer.exeopera_setup.exeopera_setup.exeopera_setup.exeregsvr32.exeopera_setup.exeopera_setup.exeShKernel.exe

pid	process
1460	SpyHunter-5.11-5-26253-Installer.exe
1460	SpyHunter-5.11-5-26253-Installer.exe
1460	SpyHunter-5.11-5-26253-Installer.exe
1424
1424
1424
1424
1460	SpyHunter-5.11-5-26253-Installer.exe
1632	opera_setup.exe
1632	opera_setup.exe
908	opera_setup.exe
1632	opera_setup.exe
1684	opera_setup.exe
880	regsvr32.exe
1632	opera_setup.exe
2016	opera_setup.exe
2016	opera_setup.exe
1812	opera_setup.exe
468
700	ShKernel.exe
700	ShKernel.exe
1424

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

ShKernel.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ShKernel.exe
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

opera_setup.exeopera_setup.exe

description ioc process

File opened (read-only) \??\D: opera_setup.exe
File opened (read-only) \??\D: opera_setup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ShKernel.exe

description	ioc	process
File opened (read-only)	\??\D:	opera_setup.exe
File opened (read-only)	\??\D:	opera_setup.exe

Drops file in System32 directory 7 IoCs

Processes:

ShKernel.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76	ShKernel.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76	ShKernel.exe
File opened for modification	C:\Windows\system32\sh5native.exe	ShKernel.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD	ShKernel.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD	ShKernel.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B8CC409ACDBF2A2FE04C56F2875B1FD6	ShKernel.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B8CC409ACDBF2A2FE04C56F2875B1FD6	ShKernel.exe

Drops file in Program Files directory 64 IoCs

Processes:

SpyHunter-5.11-5-26253-Installer.exeShKernel.exeShMonitor.exe

description	ioc	process
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Finnish.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Indonesian.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Polish.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Portuguese (Brazil).lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Ukrainian.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Traditional).lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Traditional).lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Finnish.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\French.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Norwegian.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Swedish.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\license.txt	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Dutch.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Norwegian.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Defs\full.def	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\ShShellExt.dll	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Data\ScanHistory.dat-journal	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Lithuanian.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Romanian.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Croatian.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Hungarian.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Portuguese (Portugal).lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Romanian.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Russian.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Russian.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Defs\full.def	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Slovene.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\English.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Albanian.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Czech.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Indonesian.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Korean.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Lithuanian.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Turkish.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\ShShellExt.dll	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Danish.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Hungarian.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Korean.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Serbian.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Spanish.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\license.txt	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Czech.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Dutch.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Italian.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Native.exe	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Croatian.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\German.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Serbian.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Ukrainian.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Logs\ShMonitor.log	ShMonitor.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Native.exe	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Bulgarian.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Simplified).lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\French.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Italian.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Polish.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Greek.lng	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Greek.lng	SpyHunter-5.11-5-26253-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Logs\20220114_160656.krn.log	ShKernel.exe

Drops file in Windows directory 2 IoCs

Processes:

SpyHunter-5.11-5-26253-Installer.exe

description	ioc	process
File created	C:\Windows\Tasks\EsgInstallerTask76.job	SpyHunter-5.11-5-26253-Installer.exe
File opened for modification	C:\Windows\Tasks\EsgInstallerTask76.job	SpyHunter-5.11-5-26253-Installer.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SpyHunter5.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SpyHunter5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SpyHunter5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SpyHunter5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	SpyHunter5.exe

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FCF692E1-7553-11EC-BA6C-CA93D16BBF84} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

ShKernel.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ShKernel.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ShKernel.exe

Modifies registry class 18 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}\InprocServer32\ = "C:\\Program Files\\EnigmaSoft\\SpyHunter\\ShShellExt.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{026941B7-ABD1-4F16-ADB7-E811B8BAC354}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{026941B7-ABD1-4F16-ADB7-E811B8BAC354}\1.0\ = "SH ShellExt Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{026941B7-ABD1-4F16-ADB7-E811B8BAC354}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{026941B7-ABD1-4F16-ADB7-E811B8BAC354}\1.0\0\win64\ = "C:\\Program Files\\EnigmaSoft\\SpyHunter\\ShShellExt.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{026941B7-ABD1-4F16-ADB7-E811B8BAC354}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{026941B7-ABD1-4F16-ADB7-E811B8BAC354}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{026941B7-ABD1-4F16-ADB7-E811B8BAC354}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{026941B7-ABD1-4F16-ADB7-E811B8BAC354}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{026941B7-ABD1-4F16-ADB7-E811B8BAC354}\1.0\HELPDIR\ = "C:\\Program Files\\EnigmaSoft\\SpyHunter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}\ = "SHContextMenuExt Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}\ = "SH5 Shell Extension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{026941B7-ABD1-4F16-ADB7-E811B8BAC354}\1.0\0	regsvr32.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

opera_setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	opera_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	opera_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	opera_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	opera_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	opera_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	opera_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	opera_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	opera_setup.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

SpyHunter-5.11-5-26253-Installer.exeShKernel.exe

pid	process
1460	SpyHunter-5.11-5-26253-Installer.exe
1460	SpyHunter-5.11-5-26253-Installer.exe
1460	SpyHunter-5.11-5-26253-Installer.exe
1460	SpyHunter-5.11-5-26253-Installer.exe
1460	SpyHunter-5.11-5-26253-Installer.exe
700	ShKernel.exe
700	ShKernel.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

ShKernel.exe

pid process

700 ShKernel.exe

pid	process
700	ShKernel.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

SpyHunter-5.11-5-26253-Installer.exeShKernel.exe

description	pid	process
Token: SeShutdownPrivilege	1460	SpyHunter-5.11-5-26253-Installer.exe
Token: SeBackupPrivilege	1460	SpyHunter-5.11-5-26253-Installer.exe
Token: SeRestorePrivilege	1460	SpyHunter-5.11-5-26253-Installer.exe
Token: SeDebugPrivilege	1460	SpyHunter-5.11-5-26253-Installer.exe
Token: SeTakeOwnershipPrivilege	1460	SpyHunter-5.11-5-26253-Installer.exe
Token: SeBackupPrivilege	700	ShKernel.exe
Token: SeRestorePrivilege	700	ShKernel.exe
Token: SeSecurityPrivilege	700	ShKernel.exe
Token: SeTakeOwnershipPrivilege	700	ShKernel.exe
Token: SeLoadDriverPrivilege	700	ShKernel.exe
Token: SeBackupPrivilege	700	ShKernel.exe
Token: SeBackupPrivilege	700	ShKernel.exe
Token: SeSecurityPrivilege	700	ShKernel.exe
Token: SeSecurityPrivilege	700	ShKernel.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

SpyHunter-5.11-5-26253-Installer.exeiexplore.exeSpyHunter5.exe

pid process

1460 SpyHunter-5.11-5-26253-Installer.exe
1540 iexplore.exe
2160 SpyHunter5.exe
2160 SpyHunter5.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

SpyHunter5.exe

pid process

2160 SpyHunter5.exe
2160 SpyHunter5.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1540 iexplore.exe
1540 iexplore.exe
1756 IEXPLORE.EXE
1756 IEXPLORE.EXE

pid	process
2160	SpyHunter5.exe
2160	SpyHunter5.exe

pid	process
1540	iexplore.exe
1540	iexplore.exe
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SpyHunter-5.11-5-26253-Installer.exetaskeng.exerundll32.exeiexplore.exeopera_setup.exe

description	pid	process	target process
PID 1460 wrote to memory of 1256	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 1256	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 1256	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 1256	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 1892	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 1892	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 1892	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 1892	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 916	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 916	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 916	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 916	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 1012	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 1012	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 1012	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 1012	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1676 wrote to memory of 1844	1676	taskeng.exe	rundll32.exe
PID 1676 wrote to memory of 1844	1676	taskeng.exe	rundll32.exe
PID 1676 wrote to memory of 1844	1676	taskeng.exe	rundll32.exe
PID 1844 wrote to memory of 1540	1844	rundll32.exe	iexplore.exe
PID 1844 wrote to memory of 1540	1844	rundll32.exe	iexplore.exe
PID 1844 wrote to memory of 1540	1844	rundll32.exe	iexplore.exe
PID 1540 wrote to memory of 1756	1540	iexplore.exe	IEXPLORE.EXE
PID 1540 wrote to memory of 1756	1540	iexplore.exe	IEXPLORE.EXE
PID 1540 wrote to memory of 1756	1540	iexplore.exe	IEXPLORE.EXE
PID 1540 wrote to memory of 1756	1540	iexplore.exe	IEXPLORE.EXE
PID 1460 wrote to memory of 1632	1460	SpyHunter-5.11-5-26253-Installer.exe	opera_setup.exe
PID 1460 wrote to memory of 1632	1460	SpyHunter-5.11-5-26253-Installer.exe	opera_setup.exe
PID 1460 wrote to memory of 1632	1460	SpyHunter-5.11-5-26253-Installer.exe	opera_setup.exe
PID 1460 wrote to memory of 1632	1460	SpyHunter-5.11-5-26253-Installer.exe	opera_setup.exe
PID 1460 wrote to memory of 1632	1460	SpyHunter-5.11-5-26253-Installer.exe	opera_setup.exe
PID 1460 wrote to memory of 1632	1460	SpyHunter-5.11-5-26253-Installer.exe	opera_setup.exe
PID 1460 wrote to memory of 1632	1460	SpyHunter-5.11-5-26253-Installer.exe	opera_setup.exe
PID 1460 wrote to memory of 676	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 676	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 676	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 676	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1632 wrote to memory of 908	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 908	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 908	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 908	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 908	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 908	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 908	1632	opera_setup.exe	opera_setup.exe
PID 1460 wrote to memory of 776	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 776	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 776	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1460 wrote to memory of 776	1460	SpyHunter-5.11-5-26253-Installer.exe	sc.exe
PID 1632 wrote to memory of 1684	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 1684	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 1684	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 1684	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 1684	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 1684	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 1684	1632	opera_setup.exe	opera_setup.exe
PID 1460 wrote to memory of 880	1460	SpyHunter-5.11-5-26253-Installer.exe	regsvr32.exe
PID 1460 wrote to memory of 880	1460	SpyHunter-5.11-5-26253-Installer.exe	regsvr32.exe
PID 1460 wrote to memory of 880	1460	SpyHunter-5.11-5-26253-Installer.exe	regsvr32.exe
PID 1460 wrote to memory of 880	1460	SpyHunter-5.11-5-26253-Installer.exe	regsvr32.exe
PID 1460 wrote to memory of 880	1460	SpyHunter-5.11-5-26253-Installer.exe	regsvr32.exe
PID 1460 wrote to memory of 880	1460	SpyHunter-5.11-5-26253-Installer.exe	regsvr32.exe
PID 1460 wrote to memory of 880	1460	SpyHunter-5.11-5-26253-Installer.exe	regsvr32.exe
PID 1632 wrote to memory of 2016	1632	opera_setup.exe	opera_setup.exe
PID 1632 wrote to memory of 2016	1632	opera_setup.exe	opera_setup.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

ShKernel.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ShKernel.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ShKernel.exe

C:\Users\Admin\AppData\Local\Temp\SpyHunter-5.11-5-26253-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\SpyHunter-5.11-5-26253-Installer.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe create EsgShKernel start= demand binPath= "\"C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe\"" DisplayName= "SpyHunter 5 Kernel"
2⤵
PID:1256

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe description EsgShKernel "SpyHunter 5 Kernel"
2⤵
PID:1892

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe create ShMonitor start= demand binPath= "\"C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe\"" DisplayName= "SpyHunter 5 Kernel Monitor"
2⤵
PID:916

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe description ShMonitor "SpyHunter 5 Kernel Monitor"
2⤵
PID:1012

C:\Users\Admin\AppData\Local\Temp\opera_setup.exe
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe --silent --allusers=0
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\opera_setup.exe
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=82.0.4227.58 --initial-client-data=0x190,0x194,0x198,0x164,0x19c,0x7409a558,0x7409a568,0x7409a574
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_setup.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_setup.exe" --version
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684

C:\Users\Admin\AppData\Local\Temp\opera_setup.exe
"C:\Users\Admin\AppData\Local\Temp\opera_setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --server-tracking-data=server_tracking_data --initial-pid=1632 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20220114160656" --session-guid=15e7abb4-11cd-446c-a700-359e841f84a4 --server-tracking-blob=ODRjNGVhNzA4YWQ0ZDM4MWIwNmEyZTE1NjdiMjVmYzY3ZjE5NzAxMzE5MzFlYTgyM2NmYzU4MDRlMDhlMmEzYjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJZeCAwMyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImZWRpdGlvbj1ZeCswMyZ1dG1fc291cmNlPW1rdCZ1dG1fY2FtcGFpZ249NzQ5IiwidGltZXN0YW1wIjoiMTY0MjE3NjMwMy42MDc5IiwidXNlcmFnZW50IjoiSW5zdGFsbGVyLzMuMC43NzMuNDQ5MiIsInV0bSI6eyJjYW1wYWlnbiI6Ijc0OSIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiN2Y1NTkwZTItNWQ0NS00YzlmLThiZWEtMDI1NDcxOTU0M2E1In0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0403000000000000
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:2016

C:\Users\Admin\AppData\Local\Temp\opera_setup.exe
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=82.0.4227.58 --initial-client-data=0x19c,0x1a0,0x1a4,0x164,0x1a8,0x713da558,0x713da568,0x713da574
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812

C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\installer.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\installer.exe" --backend --initial-pid=1632 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202201141606561" --session-guid=15e7abb4-11cd-446c-a700-359e841f84a4 --server-tracking-blob=ODRjNGVhNzA4YWQ0ZDM4MWIwNmEyZTE1NjdiMjVmYzY3ZjE5NzAxMzE5MzFlYTgyM2NmYzU4MDRlMDhlMmEzYjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJZeCAwMyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImZWRpdGlvbj1ZeCswMyZ1dG1fc291cmNlPW1rdCZ1dG1fY2FtcGFpZ249NzQ5IiwidGltZXN0YW1wIjoiMTY0MjE3NjMwMy42MDc5IiwidXNlcmFnZW50IjoiSW5zdGFsbGVyLzMuMC43NzMuNDQ5MiIsInV0bSI6eyJjYW1wYWlnbiI6Ijc0OSIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiN2Y1NTkwZTItNWQ0NS00YzlmLThiZWEtMDI1NDcxOTU0M2E1In0= --silent --desktopshortcut=1 --install-subfolder=82.0.4227.58
4⤵
PID:3016

C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\installer.exe
C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=82.0.4227.58 --initial-client-data=0x17c,0x180,0x184,0x150,0x188,0x7fef5a8cb48,0x7fef5a8cb58,0x7fef5a8cb68
5⤵
PID:3036

C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" --start-maximized
5⤵
PID:2312

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher
6⤵
PID:2384

C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_crashreporter.exe
C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=82.0.4227.58 --initial-client-data=0x14c,0x150,0x154,0x120,0x158,0x7feee5764e0,0x7feee5764f0,0x7feee576500
7⤵
PID:2564

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --field-trial-handle=980,3175730154463906122,9512276045624595105,131072 --start-stack-profiler --with-feature:adblock-snippets=on --with-feature:aliexpress-modal=off --with-feature:booking-modal=off --with-feature:bookmarks-trash-cleaner=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:enhanced-address-bar-ref=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:partner-inline-autocompletion=on --with-feature:pinboard-local=on --with-feature:premium-valve-in=on --with-feature:reader-mode=on --with-feature:rollout-dna=on --with-feature:sd-suggestions-external=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:trending-pages-suggestion-provider=off --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --with-feature:installer-opera-exe-in-root=on --ab_tests=DNA-88496-us-ref:DNA-88496-us --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=988 /prefetch:2
7⤵
PID:2148

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=980,3175730154463906122,9512276045624595105,131072 --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:adblock-snippets=on --with-feature:aliexpress-modal=off --with-feature:booking-modal=off --with-feature:bookmarks-trash-cleaner=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:enhanced-address-bar-ref=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:partner-inline-autocompletion=on --with-feature:pinboard-local=on --with-feature:premium-valve-in=on --with-feature:reader-mode=on --with-feature:rollout-dna=on --with-feature:sd-suggestions-external=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:trending-pages-suggestion-provider=off --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --with-feature:installer-opera-exe-in-root=on --ab_tests=DNA-88496-us-ref:DNA-88496-us --mojo-platform-channel-handle=1280 /prefetch:8
7⤵
PID:2924

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202201141606561\assistant\_sfx.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202201141606561\assistant\_sfx.exe"
3⤵
PID:2824

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202201141606561\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202201141606561\assistant\assistant_installer.exe" --version
3⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202201141606561\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202201141606561\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=80.0.4170.40 --initial-client-data=0x12c,0x130,0x134,0x100,0x138,0x1157c90,0x1157ca0,0x1157cac
4⤵
PID:2884

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe config ShMonitor start= auto
2⤵
PID:676

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe config EsgShKernel start= auto
2⤵
PID:776

C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /s "C:\Program Files\EnigmaSoft\SpyHunter\ShShellExt.dll"
2⤵
- Loads dropped DLL
- Modifies registry class
PID:880

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe start EsgShKernel -tt_on
2⤵
PID:1772

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe start ShMonitor
2⤵
PID:1844

C:\Windows\system32\taskeng.exe
taskeng.exe {C0CC39BF-4D7C-4939-8C56-F8439820593D} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe url.dll,FileProtocolHandler https://www.enigmasoftware.com/congratulations-spyhunter-installed/?hwx=f41cc9dd014ea5029ddb49276fc44dc2&lang=EN&sid=enigmasoftware%2Ecom
2⤵
- Suspicious use of WriteProcessMemory
PID:1844

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.enigmasoftware.com/congratulations-spyhunter-installed/?hwx=f41cc9dd014ea5029ddb49276fc44dc2&lang=EN&sid=enigmasoftware%2Ecom
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1540 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1756

C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --autoupdaterequesttype=start --autoupdateoperaversion=82.0.4227.58
2⤵
PID:2680

C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\72A8C838D015\installer.exe" --version
3⤵
PID:2144

C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe
"C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:700

C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe
"C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe" /hide
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2160

C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" -noautoupdate -- "https://get.adobe.com/uk/reader/"
3⤵
PID:2788

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" -noautoupdate --ran-launcher -- https://get.adobe.com/uk/reader/
4⤵
PID:2292

C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_crashreporter.exe
C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=82.0.4227.58 --initial-client-data=0x14c,0x150,0x154,0x120,0x158,0x7feee5764e0,0x7feee5764f0,0x7feee576500
5⤵
PID:2660

C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe" -noautoupdate -- "https://www.videolan.org/vlc/"
3⤵
PID:476

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" -noautoupdate --ran-launcher -- https://www.videolan.org/vlc/
4⤵
PID:2408

C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_crashreporter.exe
C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=82.0.4227.58 --initial-client-data=0x14c,0x150,0x154,0x120,0x158,0x7feee5764e0,0x7feee5764f0,0x7feee576500
5⤵
PID:1960

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --field-trial-handle=824,14735255961902372571,16444544439640893702,131072 --start-stack-profiler --with-feature:adblock-snippets=on --with-feature:aliexpress-modal=off --with-feature:booking-modal=off --with-feature:bookmarks-trash-cleaner=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:enhanced-address-bar-ref=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:partner-inline-autocompletion=on --with-feature:pinboard-local=on --with-feature:premium-valve-in=on --with-feature:reader-mode=on --with-feature:rollout-dna=on --with-feature:sd-suggestions-external=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --with-feature:installer-opera-exe-in-root=on --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=836 /prefetch:2
5⤵
PID:1144

C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe
"C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2080

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --start-maximized --ran-launcher --flag-switches-begin --flag-switches-end --enable-quic --lowered-browser
1⤵
PID:3008

C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_crashreporter.exe
C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_crashreporter.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=82.0.4227.58 --initial-client-data=0x14c,0x150,0x154,0x120,0x158,0x7feee5764e0,0x7feee5764f0,0x7feee576500
2⤵
PID:3024

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --field-trial-handle=936,17529679287282161227,2504959513421950668,131072 --start-stack-profiler --with-feature:adblock-snippets=on --with-feature:aliexpress-modal=off --with-feature:booking-modal=off --with-feature:bookmarks-trash-cleaner=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:enhanced-address-bar-ref=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:partner-inline-autocompletion=on --with-feature:pinboard-local=on --with-feature:premium-valve-in=on --with-feature:reader-mode=on --with-feature:rollout-dna=on --with-feature:sd-suggestions-external=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --with-feature:installer-opera-exe-in-root=on --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=984 /prefetch:2
2⤵
PID:2328

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=936,17529679287282161227,2504959513421950668,131072 --lang=en-US --service-sandbox-type=utility --enable-quic --with-feature:adblock-snippets=on --with-feature:aliexpress-modal=off --with-feature:booking-modal=off --with-feature:bookmarks-trash-cleaner=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:enhanced-address-bar-ref=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:partner-inline-autocompletion=on --with-feature:pinboard-local=on --with-feature:premium-valve-in=on --with-feature:reader-mode=on --with-feature:rollout-dna=on --with-feature:sd-suggestions-external=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --with-feature:installer-opera-exe-in-root=on --mojo-platform-channel-handle=1424 /prefetch:8
2⤵
PID:2892

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=936,17529679287282161227,2504959513421950668,131072 --lang=en-US --service-sandbox-type=none --enable-quic --start-stack-profiler --with-feature:adblock-snippets=on --with-feature:aliexpress-modal=off --with-feature:booking-modal=off --with-feature:bookmarks-trash-cleaner=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:enhanced-address-bar-ref=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:partner-inline-autocompletion=on --with-feature:pinboard-local=on --with-feature:premium-valve-in=on --with-feature:reader-mode=on --with-feature:rollout-dna=on --with-feature:sd-suggestions-external=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --with-feature:installer-opera-exe-in-root=on --mojo-platform-channel-handle=1288 /prefetch:8
2⤵
PID:1716

C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --display-capture-permissions-policy-allowed --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 OPR/82.0.4227.58 (Edition Yx 03)" --with-feature:adblock-snippets=on --with-feature:aliexpress-modal=off --with-feature:booking-modal=off --with-feature:bookmarks-trash-cleaner=on --with-feature:continue-on-booking=on --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:enhanced-address-bar-ref=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:partner-inline-autocompletion=on --with-feature:pinboard-local=on --with-feature:premium-valve-in=on --with-feature:reader-mode=on --with-feature:rollout-dna=on --with-feature:sd-suggestions-external=on --with-feature:startpage-sync-banner=on --with-feature:yandex-zen-leads-for-nonsdusers=off --with-feature:yandex-zen-lift-up=off --with-feature:yandex-zen-news-next=on --with-feature:yat-emoji-addresses=on --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --with-feature:installer-opera-exe-in-root=on --field-trial-handle=936,17529679287282161227,2504959513421950668,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=1724 /prefetch:1
2⤵
PID:1592

C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_autoupdate.exe
"C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_autoupdate.exe" --host=https://autoupdate.geo.opera.com/ --pipeid --version=82.0.4227.58 --edition="Yx 03" --lang=en-US --producttype --requesttype=start --operadir="C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58" --installdir="C:\Users\Admin\AppData\Local\Programs\Opera" --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --installationdatadir="C:\Users\Admin\AppData\Local\Programs\Opera" --firstrunver=82.0.4227.58 --consent-info=eyJzdGF0aXN0aWNzX2NvbGxlY3Rpb25fZW5hYmxlZCI6dHJ1ZSwidXNlcl9leHBlcmllbmNlX21ldHJpY3NfcmVwb3J0aW5nX2VuYWJsZWQiOnRydWV9 --firstrunts=1642176468
2⤵
PID:2620

C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_autoupdate.exe
C:\Users\Admin\AppData\Local\Programs\Opera\82.0.4227.58\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=82.0.4227.58 --initial-client-data=0x140,0x144,0x148,0x114,0x14c,0x13f533430,0x13f533440,0x13f533450
3⤵
PID:2692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\EnigmaSoft\SpyHunter\Defs\full.def

MD5
060230fa162baa98cb3121f9efb78f31

SHA1
72caef5b78e439c547f25420f8ab492efd6d3dd5

SHA256
b0efd260b77dda72e0184868cf2381e78b36b8c3c8594a90ad814f9cda27aed3

SHA512
c49965b49789189612b8a913821db475ecf992df7e8b5f5c9c714d3394e93d5f1b69780b342f00b1cd9b3e0e2fb65640e4d6bc180efc8a6f83c68dd7bfa4c884

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Albanian.lng

MD5
d8447a0dc54c21654664e14210949f07

SHA1
9cd83e610b856d6e0888ea18ff95f84774d909d9

SHA256
73fb04683249aaf221c07765355e2c2be122282a3a03e8e0888eae2d722added

SHA512
070f000c64bdc1c27eb894892fb7db5ef6cd3c7f82f822a69a4875310b552e9e9f3e2583f6fbde754fa60df124dda7685cdaa2206c63ee6f5cf2960f92c59fe1

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Bulgarian.lng

MD5
9937f2604aa713ea534cabd76a9a0675

SHA1
6dc2f003f4b997b77576bf1a9a50ccab24542851

SHA256
9e15f68c6765d09ff8ce41253557d86f52d1d9089d2de820a4e9daa110e48c3a

SHA512
387f00afa88f6438870d01674cf535815b187a3f04e2903540f855a83a04ee9d49de7b5543c76c580a4f387f9b15b0743c29aa6fb712b1dfb126fe20bf1e78aa

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Simplified).lng

MD5
ff3424368d2df30d2865de7d8161ccfb

SHA1
541905577870be2928255d742fb412a27702ba99

SHA256
4d9cbe9ce8d62580c7987a7b425771a2a94b96eef8984cc1e20685b7f84c4e02

SHA512
7753f33340bd037361c39d6c4f1e980a330c88fba32c5b30b3cb227445ac78d117983381a1329c5a76486e5c5097bb08abd4b1aaccfbfc359a744d8f1e6e1d1f

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Traditional).lng

MD5
d53f0a2ee26953169a329a2226a0ab0e

SHA1
b901e736c5bfc78e23d4751af5742055673a83e4

SHA256
219b6d0c8aa04a52879ffbda00791d26ef869ca24988519599a252f9b5b4df14

SHA512
ac8149a45060cb81139eb3bfe4079def80b2995bbbdcd19eb050a6ac785f9ce2dd4e89a8e6953611228f05f10886add9430398740d868f23e22fe253ecdfec0f

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Croatian.lng

MD5
5284544df69a51c00663f5b6260c34ac

SHA1
e92536b839ef5576a8ccc647c23d760695fc93b5

SHA256
5532b409df07b027854d53dc64be4ecf913698ff674655782be6e77ae30a2763

SHA512
ef0603375303a403f0da0c8a0310a529b6a4221d819d73efaf9c7f0630c885d684ea86c57e68846a7f500ed2de23b35d32ea1524ced6422fb63bc42d89a9da99

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Czech.lng

MD5
dad859e5309c56f4446e16b05e161484

SHA1
16b0c5acebcfc6ac979b4301f6fbe2bbad4f140d

SHA256
711481cdc1b6b94e88b8206c197308e15141cec8aaae9ed94ddb42dc2800de5f

SHA512
47a2b5c4a73a91faf79c479b65fabed66039e827c5f33358425600f203b88a0e2da246e15aec6c4b4f268513510c13a41ab988dbdb0a11c57cfd8b919132dcd4

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Danish.lng

MD5
a00f015a6a7a8f77674dff361ca664dc

SHA1
705f822975c83aad1815efafd059fe2aff3049ff

SHA256
3f09db6a794d945c4e7b537c3cfecc61be8f3034e7b25fbb760076a4f1a941d5

SHA512
1a7f1d2ffe6a1335f98b5951757a117e18c69fd89cc37112fba6ee6221aec4c6f1576300b42bc47838d34fd0a09c4055b558a656c6631accca8c648ccbc7fd8b

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Dutch.lng

MD5
3ed711aa8d2eeebee5d21a4d3ae785aa

SHA1
ba280c8dca03efda2df18570e49326aabafa8782

SHA256
a33da43599c8d5eed373f71165d986489f8f3b5eb7419cc5127d5074f63e460f

SHA512
bb7a6b4e47226c053d462be9bf5e3eb806b6a70fe92da0e7cc89eabf39f4a42993be68b4c3c938b57ec51e16d1cd4ec49516db6b51e4406cecc028fbaa0a4816

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\English.lng

MD5
f2f435851292b0e3b79bf65fa23a7244

SHA1
7cd1db08660680f7a04a5e620f4a91eec9630059

SHA256
702aeae7861b6c3653b78d135a21fa13c97dbdd1620ee6dbea8543fcd323c3b3

SHA512
0532bedcdb030e0a1f5981a6a439a058805a46e52c8c6fba21291f5c3938f1a6c8b7074880c6a34e76d6e648084304da4c6f701713911aa56a3ca638af863bde

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Finnish.lng

MD5
3e7c004b5cc0d2fbc31f57e049c3d539

SHA1
3f6177790cc5a1408d390cd4cce226f994e3bbc4

SHA256
913c3ffea314723d250967497eb4784ccedaefbaf97572a53107b16e59c1a6bf

SHA512
1ef033c64777fc5cafea071c2bc89050a551800a80ced7cb411c1b3b95f1fb4596457d0fe5ea8350c53bfb29b7d568deca418fb2a0571aa26414059b2f37f457

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\French.lng

MD5
48a5674e803c89e91d6a93ddce427441

SHA1
b2a09ad1b68e650a5ba42102cd5bbef994a1fb3a

SHA256
a6427122d029244a83144d7d3f67b785c3607b165c74b0967fd37f539ad55043

SHA512
41f5ebd641b72525d3ec07004717940e4d1dc066519b8e78fc90ab66cd64b47c13bd552fbd5b3d35f3e99905fa7f1ffb5fffc933effe6502b05058b43145b7ef

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\German.lng

MD5
7ed21b9277ff76005f4ddf8e016f7635

SHA1
456cb884ed2aa2a967765b0e5f29ba8ba6256ed5

SHA256
392f7fa8adc001a819ef9c0992ac27553f6d09a1caade497a9b7d0c56318089f

SHA512
ff3102cb240e23f8a589f1e54f1874f58023d00d05a0cc51f88e2ee1940f033f09c4904e75a731f53dcdc5202283331749b18160767a52b365dad03099fa71ae

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Greek.lng

MD5
907f633b1755e605bf8860bb153f4962

SHA1
70a8adabc744468ad197dd1cdfc56a430a5134ad

SHA256
7ccefb494176997be8accb9bfc50275a8fb05fee0ea099c541751fb3aa69e721

SHA512
1dde0b233632f8d978d1b1e505cb12d0fccb47012b2427f0bd22e3e1387fa6eb411d47e14af9e0b88e93179ee53b1ef59f34e81cf67c111de65d4cd82a05870c

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Hungarian.lng

MD5
0204e41e2484ad60ca30a7e8e6c89e8d

SHA1
4a980ff170dca8b4dffd22d1240588ac0df6d94f

SHA256
8408afb86556be954ce0c13fd06cac5c9d0009b770ae9e1163d859368941b255

SHA512
b66004cc5e7cdee69dd7db5cb14c44f5d729c1c2ff0989ccc0fa8ecde36a659ca346de535dab0af506d6e009907d792046a8873d71146067aea692ae2cf33ac2

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Indonesian.lng

MD5
fdba12c56d0aa892b7817c6e7bb11c6c

SHA1
19a5577af2458cdc130c3252d33f1f98a0c1bb47

SHA256
707e64ae4258fb3c6d6fb32c3c25c9ce2253a5303cf36f8950a4520ff8f53c3e

SHA512
abdbfe5f08b750f2aef8ed4e607261f3245faeccd0b552f49a60f1d531c78a6d8c57fc56c3631d72d482326ed56437ffc7be1cb932585d27620eb6e2329015e3

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Italian.lng

MD5
f8c0159d41db4fdeb9cee5c121d92ae7

SHA1
4f7acf936465062a0d4b488d15609ecf6cd29220

SHA256
b09010f72ce6f2bdea2a8e56fac7da692e86b898859563edc63b569960d083c9

SHA512
7bbcae10c9a0e6d3903a5610de0117ccca431313e65d701d64a82fc9efc02c90120c7736f91a05278b49f3a8611dcc0824b203adfc7bac0c7a4fce67016aa516

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Japanese.lng

MD5
bd819b61b3cc4e0bd8b6a3f5313f2387

SHA1
4bac37d950defa5d140fa329fb68fdcafa180ddd

SHA256
de3e69fa0e3318b3fa48d889538be4ad08ed29d186c3d7236e383ec217802803

SHA512
6556d11c867a0043fc84c4e833ebce2890f969ae2e5a4d791b3a99b4dcbc3254033e2291b5ba107e1cd1a19434dbe3db77bb7dd4804d004e095d9fb24286c762

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Korean.lng

MD5
e8ffe2cd2bdf9f46670b50b4d2799b2e

SHA1
5fec20cbd1e653d3720e1cdf03d3299b2674b796

SHA256
fc74132bef00e43d92f9127c7e925bf518496dee03a62c219cc751f1d9fec9d4

SHA512
96642979f07277e8fc236e96c3a25adb14156f118f0fa428d751f4a3317cc3b6594b1f9d50ae34f8e1b04862aff356a149770a5e3bc96e60621c2281469d6a2a

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Lithuanian.lng

MD5
53d4fa9bd31fda3e83c29ff9b153d467

SHA1
ccce87519ab331ef42d71c680ec06b5f5e82abf8

SHA256
46e76313360e304dd625a8001fc5b46254b1b3265689fb9bbdc2bc8d1c608fa6

SHA512
37e2b9806fd5269e808fd43056e9faa96a95d460b0354df085b3de3742405b379246c2e49091ba40e590f4b075fe9b39c485a875dc41c5fa4dad3bf9bef521be

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Norwegian.lng

MD5
7204f68e62cfb7e288291d6f193cfe6c

SHA1
23c65b31df1da8ef0bbfa940609f105ce64b5053

SHA256
4a06a099a2bec22c1435de0e2a63bba8a879a64cd06c54150af26b9ca1f286a6

SHA512
5009495514992fc9201e03ed051603a770c673efebe7423e7ffaf767f5ed91244549576c668631f2bacd85d4b3772ef1819c4a51c1d9670cfc30a045ddf1f53a

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Polish.lng

MD5
976372b32dfb12e83de0010964831490

SHA1
86c29e5fe046b49ca69dd9d96139115687cc8fd5

SHA256
5e07ba79ffd496bd861c34a670048a82a182ac7995815f078e9884c2e7963d70

SHA512
54550622380750997d78e903a4b57adf062d41ddc98a36302ad6b5e05746fdd659253325628d35d2ee6aa1898cfb501ee4f90190afc2f1e723cdb21c2ec43210

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Portuguese (Brazil).lng

MD5
1e462ae27f5d4777a6e23f1706201472

SHA1
979629e596108e9a9db92fc9ad06cb8bb9262985

SHA256
53b15a4f0975a43d14922b2dfd6680786a353e44a1f159a7ebffb87ee33c85b9

SHA512
1bcf208ce78d61555729f2aa9f10ff460674c9f12ea52cef27cead31623a69baaa78c2e549df584f78aa5c36045082f0580482485180fad59be064c635d8fa9e

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Portuguese (Portugal).lng

MD5
a2966345b265d8a0b833a7cb7ec370ce

SHA1
aeb5b8e627a24c531b799de7075972ae2c3ee427

SHA256
f1294514cf774b740e82450afb06f07954b15d5ce8d11063fbea8b58467f4ef7

SHA512
e14543a7356fefa97c162c43ee68519d69aaf7418eeb37e6c8da6ae0e74747895037e9d892e6854ce0faa24accb90f3779ef42150c9c1ef7e493389d568d330b

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Romanian.lng

MD5
9c19b3255cbcbf31a8fabd2cc485a0b2

SHA1
9cbe4a40c6561182f1168e0904b47c47607a61f6

SHA256
dffd6cd85a6820f3dc174aa39f4193842860c1fbc15fc3aee6e50b4f083e4802

SHA512
5632ab8f78742fc71081384bd24b0d2daf55a6975826d60e82a54ce90e2d232c050629ffe66ede301207401279f723b78b9b052679f95126f2383d97285971be

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Russian.lng

MD5
f6115f3a46ba37f1c1740d82934e2aaf

SHA1
d3911b111a0f177b4cf68dbaab1d09799d7044ad

SHA256
4e109f4c1190b9f378b76ee1119e7c6bbe55c11846a5bfeb4e17490155ec9005

SHA512
a1f7d1d00dab0fb453d5b2b48456dd4bafc446732eac39ea5332fb460caa7b84f23eb8232f0b71d447a7ab27157aa228fdc91cd61acb589d2df34bfb8af4761a

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Serbian.lng

MD5
c781f18ed6a6a55d87fab5aa940e3d63

SHA1
13fa8224161e74699d1af80b7009af13660baf71

SHA256
a8ecb523c652cedb3ad202c4c4dfbd2ce982d21f2707cd2ce2ca5ba256013102

SHA512
8122e7b482d001a2618ed1bfe141d6916247081cc9b68f86bf017a9a9cde25d0af5e68d17c0fdd0833529279128e502f4cdb01a4495ae876a32355d00fcfb736

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Slovene.lng

MD5
02b42a3580f0dfd0cdd82ea534dae999

SHA1
1cf1266278ccfaf03728730f9baf8f2a06f6cf01

SHA256
68587f4e2a0b2f23fdfc894f5bcf5d37abd9c100bfe1fedb715990e047e10180

SHA512
b39a07410b427f3086e5fdc5cc8e7f7b322fd715d7a020f8b872417cb69ab711497c08229da18d85284c8cd3508821013d8d000f28313e1ef153ff4fb0689a53

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe

MD5
d2b6d8e7095539e4a5bb6511d3b2e196

SHA1
b708c118bbaa0161ad54893c741568118c37969b

SHA256
39dfb1ff03cdccac184f56d4448666d701da80d22c3c553f2cf0b0018e316b9b

SHA512
3fa27d6f3aa3756a7d18f0d4130aa4995e0aeaa8eccd38b93c49100c0ff34461d0bf70891e1a026c1ae3d73f06705b6a30c0a4bf7bb8be80136aa0ec5da333d2

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe

MD5
d2b6d8e7095539e4a5bb6511d3b2e196

SHA1
b708c118bbaa0161ad54893c741568118c37969b

SHA256
39dfb1ff03cdccac184f56d4448666d701da80d22c3c553f2cf0b0018e316b9b

SHA512
3fa27d6f3aa3756a7d18f0d4130aa4995e0aeaa8eccd38b93c49100c0ff34461d0bf70891e1a026c1ae3d73f06705b6a30c0a4bf7bb8be80136aa0ec5da333d2

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe

MD5
09059ab9bfd966912ea4f3dc99eff5d6

SHA1
f57fd6bf77b51974ae2044affdfddbe1ed0059fe

SHA256
443a9a6656944464adc765820643aa59dc9626e6a1f7a189cb0cb957572c20df

SHA512
3fd57521a91f8f9bd954ca1e60387e43a2116dd080ea28aa732ea6ac4664e378827495776dfee5fd0bed4b5a149ba44c3caff6fc154e35f7839b668d5e649085

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\ShShellExt.dll

MD5
46692b73818db2642869dc1b500b7b1b

SHA1
68afc4aacddc4f4f0ba7417a40b543205cdcfdbb

SHA256
ff7a20729a2758d4aa023139684b15de2125759cf562b9deb540b182e510418b

SHA512
d120c655417af3d1d199d05e59fcd06f617fc4eb35f057d670031a24c7e46365cdafd3ac9409cba9d3747bdceb403adaf1b16193f77a813d8aa790dc38480ead

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe

MD5
206c858cf3aa3c0afd5c933a97dec6d7

SHA1
b0dfa4e1df47ed5dd178a834f4e53589d36ab36b

SHA256
ff15c2da15de20a93ad5d870d118c9515529dce67c6852e8d878ee3050a0f264

SHA512
9f08ff0172535d8478831b854db3d9bcb5ca8d70c34d2f5ad386f3907216117e8850ee39db4a8a9703b86d37b1f6eb6763b09e8894f376683676f3648ad01e6f

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe

MD5
206c858cf3aa3c0afd5c933a97dec6d7

SHA1
b0dfa4e1df47ed5dd178a834f4e53589d36ab36b

SHA256
ff15c2da15de20a93ad5d870d118c9515529dce67c6852e8d878ee3050a0f264

SHA512
9f08ff0172535d8478831b854db3d9bcb5ca8d70c34d2f5ad386f3907216117e8850ee39db4a8a9703b86d37b1f6eb6763b09e8894f376683676f3648ad01e6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_setup.exe

MD5
9177990bab2b530cae06779a28ca0153

SHA1
4e1305e15be2c2b17e34f8e482641e622ecea694

SHA256
e676d5f77b10438236cd2d50bdaebe084ce5a92f2cdd6e25d6a853d4ac23813a

SHA512
b8610e47fc7283123f510e23a4339145d0bb6515b755e972466e78b65fb4738bb026916727bb24c86144cad6d6569dddf0e053c1f3a796817fa62f4d0498e074

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe

MD5
9177990bab2b530cae06779a28ca0153

SHA1
4e1305e15be2c2b17e34f8e482641e622ecea694

SHA256
e676d5f77b10438236cd2d50bdaebe084ce5a92f2cdd6e25d6a853d4ac23813a

SHA512
b8610e47fc7283123f510e23a4339145d0bb6515b755e972466e78b65fb4738bb026916727bb24c86144cad6d6569dddf0e053c1f3a796817fa62f4d0498e074

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe

MD5
9177990bab2b530cae06779a28ca0153

SHA1
4e1305e15be2c2b17e34f8e482641e622ecea694

SHA256
e676d5f77b10438236cd2d50bdaebe084ce5a92f2cdd6e25d6a853d4ac23813a

SHA512
b8610e47fc7283123f510e23a4339145d0bb6515b755e972466e78b65fb4738bb026916727bb24c86144cad6d6569dddf0e053c1f3a796817fa62f4d0498e074

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe

MD5
9177990bab2b530cae06779a28ca0153

SHA1
4e1305e15be2c2b17e34f8e482641e622ecea694

SHA256
e676d5f77b10438236cd2d50bdaebe084ce5a92f2cdd6e25d6a853d4ac23813a

SHA512
b8610e47fc7283123f510e23a4339145d0bb6515b755e972466e78b65fb4738bb026916727bb24c86144cad6d6569dddf0e053c1f3a796817fa62f4d0498e074

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe

MD5
9177990bab2b530cae06779a28ca0153

SHA1
4e1305e15be2c2b17e34f8e482641e622ecea694

SHA256
e676d5f77b10438236cd2d50bdaebe084ce5a92f2cdd6e25d6a853d4ac23813a

SHA512
b8610e47fc7283123f510e23a4339145d0bb6515b755e972466e78b65fb4738bb026916727bb24c86144cad6d6569dddf0e053c1f3a796817fa62f4d0498e074

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera_setup.exe

MD5
9177990bab2b530cae06779a28ca0153

SHA1
4e1305e15be2c2b17e34f8e482641e622ecea694

SHA256
e676d5f77b10438236cd2d50bdaebe084ce5a92f2cdd6e25d6a853d4ac23813a

SHA512
b8610e47fc7283123f510e23a4339145d0bb6515b755e972466e78b65fb4738bb026916727bb24c86144cad6d6569dddf0e053c1f3a796817fa62f4d0498e074

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

MD5
3bfa958ad2443777884571d4bdd5c573

SHA1
a35edf66b4ad2c35a8982a741c08fbe1c8b07dfd

SHA256
c7fb089d9772990e05941f2ea132ae3739100b974efa8f8de2cd4f8fd8d96500

SHA512
cd85bc074606dc65b8b4dcb643620e725f0ade9789b050313d7a3c4d4e7da6a3f266c754709757425959a90061c5ecca783a0e2cd1a1f7acb6e863104c7d07d8

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

MD5
3bfa958ad2443777884571d4bdd5c573

SHA1
a35edf66b4ad2c35a8982a741c08fbe1c8b07dfd

SHA256
c7fb089d9772990e05941f2ea132ae3739100b974efa8f8de2cd4f8fd8d96500

SHA512
cd85bc074606dc65b8b4dcb643620e725f0ade9789b050313d7a3c4d4e7da6a3f266c754709757425959a90061c5ecca783a0e2cd1a1f7acb6e863104c7d07d8

Download Submit
\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe

MD5
d2b6d8e7095539e4a5bb6511d3b2e196

SHA1
b708c118bbaa0161ad54893c741568118c37969b

SHA256
39dfb1ff03cdccac184f56d4448666d701da80d22c3c553f2cf0b0018e316b9b

SHA512
3fa27d6f3aa3756a7d18f0d4130aa4995e0aeaa8eccd38b93c49100c0ff34461d0bf70891e1a026c1ae3d73f06705b6a30c0a4bf7bb8be80136aa0ec5da333d2

Download Submit
\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe

MD5
09059ab9bfd966912ea4f3dc99eff5d6

SHA1
f57fd6bf77b51974ae2044affdfddbe1ed0059fe

SHA256
443a9a6656944464adc765820643aa59dc9626e6a1f7a189cb0cb957572c20df

SHA512
3fd57521a91f8f9bd954ca1e60387e43a2116dd080ea28aa732ea6ac4664e378827495776dfee5fd0bed4b5a149ba44c3caff6fc154e35f7839b668d5e649085

Download Submit
\Program Files\EnigmaSoft\SpyHunter\ShShellExt.dll

MD5
46692b73818db2642869dc1b500b7b1b

SHA1
68afc4aacddc4f4f0ba7417a40b543205cdcfdbb

SHA256
ff7a20729a2758d4aa023139684b15de2125759cf562b9deb540b182e510418b

SHA512
d120c655417af3d1d199d05e59fcd06f617fc4eb35f057d670031a24c7e46365cdafd3ac9409cba9d3747bdceb403adaf1b16193f77a813d8aa790dc38480ead

Download Submit
\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe

MD5
206c858cf3aa3c0afd5c933a97dec6d7

SHA1
b0dfa4e1df47ed5dd178a834f4e53589d36ab36b

SHA256
ff15c2da15de20a93ad5d870d118c9515529dce67c6852e8d878ee3050a0f264

SHA512
9f08ff0172535d8478831b854db3d9bcb5ca8d70c34d2f5ad386f3907216117e8850ee39db4a8a9703b86d37b1f6eb6763b09e8894f376683676f3648ad01e6f

Download Submit
\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe

MD5
206c858cf3aa3c0afd5c933a97dec6d7

SHA1
b0dfa4e1df47ed5dd178a834f4e53589d36ab36b

SHA256
ff15c2da15de20a93ad5d870d118c9515529dce67c6852e8d878ee3050a0f264

SHA512
9f08ff0172535d8478831b854db3d9bcb5ca8d70c34d2f5ad386f3907216117e8850ee39db4a8a9703b86d37b1f6eb6763b09e8894f376683676f3648ad01e6f

Download Submit
\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe

MD5
206c858cf3aa3c0afd5c933a97dec6d7

SHA1
b0dfa4e1df47ed5dd178a834f4e53589d36ab36b

SHA256
ff15c2da15de20a93ad5d870d118c9515529dce67c6852e8d878ee3050a0f264

SHA512
9f08ff0172535d8478831b854db3d9bcb5ca8d70c34d2f5ad386f3907216117e8850ee39db4a8a9703b86d37b1f6eb6763b09e8894f376683676f3648ad01e6f

Download Submit
\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe

MD5
206c858cf3aa3c0afd5c933a97dec6d7

SHA1
b0dfa4e1df47ed5dd178a834f4e53589d36ab36b

SHA256
ff15c2da15de20a93ad5d870d118c9515529dce67c6852e8d878ee3050a0f264

SHA512
9f08ff0172535d8478831b854db3d9bcb5ca8d70c34d2f5ad386f3907216117e8850ee39db4a8a9703b86d37b1f6eb6763b09e8894f376683676f3648ad01e6f

Download Submit
\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe

MD5
206c858cf3aa3c0afd5c933a97dec6d7

SHA1
b0dfa4e1df47ed5dd178a834f4e53589d36ab36b

SHA256
ff15c2da15de20a93ad5d870d118c9515529dce67c6852e8d878ee3050a0f264

SHA512
9f08ff0172535d8478831b854db3d9bcb5ca8d70c34d2f5ad386f3907216117e8850ee39db4a8a9703b86d37b1f6eb6763b09e8894f376683676f3648ad01e6f

Download Submit
\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe

MD5
206c858cf3aa3c0afd5c933a97dec6d7

SHA1
b0dfa4e1df47ed5dd178a834f4e53589d36ab36b

SHA256
ff15c2da15de20a93ad5d870d118c9515529dce67c6852e8d878ee3050a0f264

SHA512
9f08ff0172535d8478831b854db3d9bcb5ca8d70c34d2f5ad386f3907216117e8850ee39db4a8a9703b86d37b1f6eb6763b09e8894f376683676f3648ad01e6f

Download Submit
\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe

MD5
206c858cf3aa3c0afd5c933a97dec6d7

SHA1
b0dfa4e1df47ed5dd178a834f4e53589d36ab36b

SHA256
ff15c2da15de20a93ad5d870d118c9515529dce67c6852e8d878ee3050a0f264

SHA512
9f08ff0172535d8478831b854db3d9bcb5ca8d70c34d2f5ad386f3907216117e8850ee39db4a8a9703b86d37b1f6eb6763b09e8894f376683676f3648ad01e6f

Download Submit
\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe

MD5
206c858cf3aa3c0afd5c933a97dec6d7

SHA1
b0dfa4e1df47ed5dd178a834f4e53589d36ab36b

SHA256
ff15c2da15de20a93ad5d870d118c9515529dce67c6852e8d878ee3050a0f264

SHA512
9f08ff0172535d8478831b854db3d9bcb5ca8d70c34d2f5ad386f3907216117e8850ee39db4a8a9703b86d37b1f6eb6763b09e8894f376683676f3648ad01e6f

Download Submit
\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe

MD5
206c858cf3aa3c0afd5c933a97dec6d7

SHA1
b0dfa4e1df47ed5dd178a834f4e53589d36ab36b

SHA256
ff15c2da15de20a93ad5d870d118c9515529dce67c6852e8d878ee3050a0f264

SHA512
9f08ff0172535d8478831b854db3d9bcb5ca8d70c34d2f5ad386f3907216117e8850ee39db4a8a9703b86d37b1f6eb6763b09e8894f376683676f3648ad01e6f

Download Submit
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_setup.exe

MD5
9177990bab2b530cae06779a28ca0153

SHA1
4e1305e15be2c2b17e34f8e482641e622ecea694

SHA256
e676d5f77b10438236cd2d50bdaebe084ce5a92f2cdd6e25d6a853d4ac23813a

SHA512
b8610e47fc7283123f510e23a4339145d0bb6515b755e972466e78b65fb4738bb026916727bb24c86144cad6d6569dddf0e053c1f3a796817fa62f4d0498e074

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2201141606546041632.dll

MD5
58bbb243ab1cda37a33b34d0d688515f

SHA1
1a880a4b95aee7a0bf4798ac20d5b321e257a62e

SHA256
3d0d34ff74b7b5db05e864ef8e99613b70f419f4976351937923a1925d92636b

SHA512
f23f80defa75a6183f00804c6ce74cd6cb4032e70cf6114047d1f3d880cff02444361473ff5153375e26228d741b38f654c6a4feb4e1be869308b8d4630c5a04

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_220114160655072908.dll

MD5
58bbb243ab1cda37a33b34d0d688515f

SHA1
1a880a4b95aee7a0bf4798ac20d5b321e257a62e

SHA256
3d0d34ff74b7b5db05e864ef8e99613b70f419f4976351937923a1925d92636b

SHA512
f23f80defa75a6183f00804c6ce74cd6cb4032e70cf6114047d1f3d880cff02444361473ff5153375e26228d741b38f654c6a4feb4e1be869308b8d4630c5a04

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2201141606562571684.dll

MD5
58bbb243ab1cda37a33b34d0d688515f

SHA1
1a880a4b95aee7a0bf4798ac20d5b321e257a62e

SHA256
3d0d34ff74b7b5db05e864ef8e99613b70f419f4976351937923a1925d92636b

SHA512
f23f80defa75a6183f00804c6ce74cd6cb4032e70cf6114047d1f3d880cff02444361473ff5153375e26228d741b38f654c6a4feb4e1be869308b8d4630c5a04

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2201141606566942016.dll

MD5
58bbb243ab1cda37a33b34d0d688515f

SHA1
1a880a4b95aee7a0bf4798ac20d5b321e257a62e

SHA256
3d0d34ff74b7b5db05e864ef8e99613b70f419f4976351937923a1925d92636b

SHA512
f23f80defa75a6183f00804c6ce74cd6cb4032e70cf6114047d1f3d880cff02444361473ff5153375e26228d741b38f654c6a4feb4e1be869308b8d4630c5a04

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2201141606569751812.dll

MD5
58bbb243ab1cda37a33b34d0d688515f

SHA1
1a880a4b95aee7a0bf4798ac20d5b321e257a62e

SHA256
3d0d34ff74b7b5db05e864ef8e99613b70f419f4976351937923a1925d92636b

SHA512
f23f80defa75a6183f00804c6ce74cd6cb4032e70cf6114047d1f3d880cff02444361473ff5153375e26228d741b38f654c6a4feb4e1be869308b8d4630c5a04

Download Submit
\Users\Admin\AppData\Local\Temp\opera_setup.exe

MD5
9177990bab2b530cae06779a28ca0153

SHA1
4e1305e15be2c2b17e34f8e482641e622ecea694

SHA256
e676d5f77b10438236cd2d50bdaebe084ce5a92f2cdd6e25d6a853d4ac23813a

SHA512
b8610e47fc7283123f510e23a4339145d0bb6515b755e972466e78b65fb4738bb026916727bb24c86144cad6d6569dddf0e053c1f3a796817fa62f4d0498e074

Download Submit
\Users\Admin\AppData\Local\Temp\opera_setup.exe

MD5
9177990bab2b530cae06779a28ca0153

SHA1
4e1305e15be2c2b17e34f8e482641e622ecea694

SHA256
e676d5f77b10438236cd2d50bdaebe084ce5a92f2cdd6e25d6a853d4ac23813a

SHA512
b8610e47fc7283123f510e23a4339145d0bb6515b755e972466e78b65fb4738bb026916727bb24c86144cad6d6569dddf0e053c1f3a796817fa62f4d0498e074

Download Submit
\Users\Admin\AppData\Local\Temp\opera_setup.exe

MD5
9177990bab2b530cae06779a28ca0153

SHA1
4e1305e15be2c2b17e34f8e482641e622ecea694

SHA256
e676d5f77b10438236cd2d50bdaebe084ce5a92f2cdd6e25d6a853d4ac23813a

SHA512
b8610e47fc7283123f510e23a4339145d0bb6515b755e972466e78b65fb4738bb026916727bb24c86144cad6d6569dddf0e053c1f3a796817fa62f4d0498e074

Download Submit
\Users\Admin\AppData\Local\Temp\opera_setup.exe

MD5
9177990bab2b530cae06779a28ca0153

SHA1
4e1305e15be2c2b17e34f8e482641e622ecea694

SHA256
e676d5f77b10438236cd2d50bdaebe084ce5a92f2cdd6e25d6a853d4ac23813a

SHA512
b8610e47fc7283123f510e23a4339145d0bb6515b755e972466e78b65fb4738bb026916727bb24c86144cad6d6569dddf0e053c1f3a796817fa62f4d0498e074

Download Submit
memory/476-264-0x0000000000000000-mapping.dmp

Download
memory/676-74-0x0000000000000000-mapping.dmp

Download
memory/776-81-0x0000000000000000-mapping.dmp

Download
memory/880-88-0x0000000000000000-mapping.dmp

Download
memory/908-79-0x0000000000000000-mapping.dmp

Download
memory/916-65-0x0000000000000000-mapping.dmp

Download
memory/1012-66-0x0000000000000000-mapping.dmp

Download
memory/1256-63-0x0000000000000000-mapping.dmp

Download
memory/1460-55-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1460-54-0x0000000075431000-0x0000000075433000-memory.dmp

Filesize
8KB

Download
memory/1540-69-0x0000000000000000-mapping.dmp

Download
memory/1632-72-0x0000000000000000-mapping.dmp

Download
memory/1684-86-0x0000000000000000-mapping.dmp

Download
memory/1716-209-0x0000000000000000-mapping.dmp

Download
memory/1756-70-0x0000000000000000-mapping.dmp

Download
memory/1772-97-0x0000000000000000-mapping.dmp

Download
memory/1812-103-0x0000000000000000-mapping.dmp

Download
memory/1844-68-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Filesize
8KB

Download
memory/1844-67-0x0000000000000000-mapping.dmp

Download
memory/1844-108-0x0000000000000000-mapping.dmp

Download
memory/1892-64-0x0000000000000000-mapping.dmp

Download
memory/1960-267-0x0000000000000000-mapping.dmp

Download
memory/2016-95-0x0000000000000000-mapping.dmp

Download
memory/2144-261-0x0000000000000000-mapping.dmp

Download
memory/2148-181-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-168-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-183-0x0000000000000000-mapping.dmp

Download
memory/2148-182-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-179-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-180-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-178-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-162-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2148-165-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-166-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-167-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-185-0x00000000772F0000-0x00000000772F1000-memory.dmp

Filesize
4KB

Download
memory/2148-169-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-170-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-171-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-172-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-174-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-173-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-175-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-177-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2148-176-0x0000000000076000-0x0000000000077000-memory.dmp

Filesize
4KB

Download
memory/2160-146-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2160-147-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/2160-116-0x0000000000000000-mapping.dmp

Download
memory/2292-265-0x0000000000000000-mapping.dmp

Download
memory/2312-158-0x0000000000000000-mapping.dmp

Download
memory/2328-203-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-201-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-204-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-202-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-190-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-194-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-195-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-196-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-193-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-192-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-191-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-197-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-198-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-199-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-200-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-208-0x0000000000000000-mapping.dmp

Download
memory/2328-207-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-206-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2328-205-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2384-160-0x0000000000000000-mapping.dmp

Download
memory/2408-266-0x0000000000000000-mapping.dmp

Download
memory/2564-161-0x0000000000000000-mapping.dmp

Download
memory/2620-256-0x0000000000000000-mapping.dmp

Download
memory/2660-268-0x0000000000000000-mapping.dmp

Download
memory/2680-260-0x0000000000000000-mapping.dmp

Download
memory/2692-258-0x0000000000000000-mapping.dmp

Download
memory/2788-263-0x0000000000000000-mapping.dmp

Download
memory/2824-148-0x0000000000000000-mapping.dmp

Download
memory/2864-150-0x0000000000000000-mapping.dmp

Download
memory/2884-152-0x0000000000000000-mapping.dmp

Download
memory/2892-232-0x0000000000000000-mapping.dmp

Download
memory/2924-184-0x0000000000000000-mapping.dmp

Download
memory/3008-241-0x0000000005BD0000-0x0000000005BD1000-memory.dmp

Filesize
4KB

Download
memory/3016-154-0x0000000000000000-mapping.dmp

Download
memory/3024-186-0x0000000000000000-mapping.dmp

Download
memory/3036-156-0x0000000000000000-mapping.dmp

Download