e132be19bc7ae8a96d3d620710fa26b614e022abecccc161ad733eff732afcd6

Resubmissions

02-05-2023 16:27

230502-tx8adade4w 10

Analysis

max time kernel
146s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2023 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher-2.879-Installer-1.1.1.exe
Size

22.6MB
MD5

c4ceda8c435298d23cc40a842f426d61
SHA1

c7337094f09852b00a815950e96f3292295e9e15
SHA256

e132be19bc7ae8a96d3d620710fa26b614e022abecccc161ad733eff732afcd6
SHA512

25e74422d3b7adeb0cc805bbe41298d4e0fcf984b038c63a3a4faeea16e10a18f113c9a7d946e16f377ad9e3a5ca0a6425d7650b62c1e5db9ee2299e9921f52b
SSDEEP

393216:LXfgqusAgbGPfs/dQETVlOBbpFEjdGphRqV56Hpkf+V4scTKAjENq3:LvtDpsHExi73qqHpg+Vvc+Amc

Score

8^/10

discovery spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	TLauncher-2.879-Installer-1.1.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	irsetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	BrowserInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	irsetup.exe

Executes dropped EXE 11 IoCs

pid	Process
3164	irsetup.exe
4868	BrowserInstaller.exe
3776	irsetup.exe
1132	opera-installer-bro.exe
4932	opera-installer-bro.exe
3392	opera-installer-bro.exe
2320	opera-installer-bro.exe
4852	opera-installer-bro.exe
4736	Assistant_98.0.4759.6_Setup.exe_sfx.exe
1456	assistant_installer.exe
1732	assistant_installer.exe

Loads dropped DLL 13 IoCs

pid	Process
3164	irsetup.exe
3164	irsetup.exe
3164	irsetup.exe
3776	irsetup.exe
1132	opera-installer-bro.exe
4932	opera-installer-bro.exe
3392	opera-installer-bro.exe
2320	opera-installer-bro.exe
4852	opera-installer-bro.exe
1456	assistant_installer.exe
1456	assistant_installer.exe
1732	assistant_installer.exe
1732	assistant_installer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023181-138.dat	upx
behavioral2/files/0x0008000000023181-143.dat	upx
behavioral2/files/0x0008000000023181-144.dat	upx
behavioral2/memory/3164-147-0x0000000000630000-0x0000000000A18000-memory.dmp	upx
behavioral2/memory/3164-461-0x0000000000630000-0x0000000000A18000-memory.dmp	upx
behavioral2/memory/3164-463-0x0000000000630000-0x0000000000A18000-memory.dmp	upx
behavioral2/memory/3164-477-0x0000000000630000-0x0000000000A18000-memory.dmp	upx
behavioral2/files/0x00060000000232a3-518.dat	upx
behavioral2/files/0x00060000000232a3-523.dat	upx
behavioral2/files/0x00060000000232a3-524.dat	upx
behavioral2/memory/3776-532-0x0000000000B30000-0x0000000000F18000-memory.dmp	upx
behavioral2/memory/3164-557-0x0000000000630000-0x0000000000A18000-memory.dmp	upx
behavioral2/files/0x00060000000232ac-565.dat	upx
behavioral2/files/0x00060000000232ac-583.dat	upx
behavioral2/files/0x00060000000232ac-582.dat	upx
behavioral2/files/0x00060000000232ac-592.dat	upx
behavioral2/files/0x00060000000232fc-603.dat	upx
behavioral2/files/0x00060000000232fc-602.dat	upx
behavioral2/memory/1132-609-0x0000000000F20000-0x000000000142E000-memory.dmp	upx
behavioral2/memory/3392-612-0x0000000000500000-0x0000000000A0E000-memory.dmp	upx
behavioral2/memory/4932-617-0x0000000000F20000-0x000000000142E000-memory.dmp	upx
behavioral2/files/0x00060000000232ac-618.dat	upx
behavioral2/files/0x00060000000232ac-623.dat	upx
behavioral2/memory/3164-649-0x0000000000630000-0x0000000000A18000-memory.dmp	upx
behavioral2/memory/3776-651-0x0000000000B30000-0x0000000000F18000-memory.dmp	upx
behavioral2/memory/2320-654-0x0000000000F20000-0x000000000142E000-memory.dmp	upx
behavioral2/memory/4852-658-0x0000000000F20000-0x000000000142E000-memory.dmp	upx
behavioral2/memory/3164-1610-0x0000000000630000-0x0000000000A18000-memory.dmp	upx
behavioral2/memory/3164-1665-0x0000000000630000-0x0000000000A18000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	opera-installer-bro.exe
File opened (read-only)	\??\D:	opera-installer-bro.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	opera-installer-bro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	opera-installer-bro.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
3164	irsetup.exe
3164	irsetup.exe
3164	irsetup.exe
3164	irsetup.exe
3164	irsetup.exe
3164	irsetup.exe
3164	irsetup.exe
4868	BrowserInstaller.exe
3776	irsetup.exe
3776	irsetup.exe
3776	irsetup.exe
1132	opera-installer-bro.exe
4932	opera-installer-bro.exe
3392	opera-installer-bro.exe
2320	opera-installer-bro.exe
4852	opera-installer-bro.exe
4736	Assistant_98.0.4759.6_Setup.exe_sfx.exe
1456	assistant_installer.exe
1732	assistant_installer.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 3164	1628	TLauncher-2.879-Installer-1.1.1.exe	83
PID 1628 wrote to memory of 3164	1628	TLauncher-2.879-Installer-1.1.1.exe	83
PID 1628 wrote to memory of 3164	1628	TLauncher-2.879-Installer-1.1.1.exe	83
PID 3164 wrote to memory of 4868	3164	irsetup.exe	93
PID 3164 wrote to memory of 4868	3164	irsetup.exe	93
PID 3164 wrote to memory of 4868	3164	irsetup.exe	93
PID 4868 wrote to memory of 3776	4868	BrowserInstaller.exe	94
PID 4868 wrote to memory of 3776	4868	BrowserInstaller.exe	94
PID 4868 wrote to memory of 3776	4868	BrowserInstaller.exe	94
PID 3776 wrote to memory of 1132	3776	irsetup.exe	95
PID 3776 wrote to memory of 1132	3776	irsetup.exe	95
PID 3776 wrote to memory of 1132	3776	irsetup.exe	95
PID 1132 wrote to memory of 4932	1132	opera-installer-bro.exe	96
PID 1132 wrote to memory of 4932	1132	opera-installer-bro.exe	96
PID 1132 wrote to memory of 4932	1132	opera-installer-bro.exe	96
PID 1132 wrote to memory of 3392	1132	opera-installer-bro.exe	97
PID 1132 wrote to memory of 3392	1132	opera-installer-bro.exe	97
PID 1132 wrote to memory of 3392	1132	opera-installer-bro.exe	97
PID 1132 wrote to memory of 2320	1132	opera-installer-bro.exe	98
PID 1132 wrote to memory of 2320	1132	opera-installer-bro.exe	98
PID 1132 wrote to memory of 2320	1132	opera-installer-bro.exe	98
PID 2320 wrote to memory of 4852	2320	opera-installer-bro.exe	99
PID 2320 wrote to memory of 4852	2320	opera-installer-bro.exe	99
PID 2320 wrote to memory of 4852	2320	opera-installer-bro.exe	99
PID 1132 wrote to memory of 4736	1132	opera-installer-bro.exe	101
PID 1132 wrote to memory of 4736	1132	opera-installer-bro.exe	101
PID 1132 wrote to memory of 4736	1132	opera-installer-bro.exe	101
PID 1132 wrote to memory of 1456	1132	opera-installer-bro.exe	102
PID 1132 wrote to memory of 1456	1132	opera-installer-bro.exe	102
PID 1132 wrote to memory of 1456	1132	opera-installer-bro.exe	102
PID 1456 wrote to memory of 1732	1456	assistant_installer.exe	103
PID 1456 wrote to memory of 1732	1456	assistant_installer.exe	103
PID 1456 wrote to memory of 1732	1456	assistant_installer.exe	103

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.1.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.1.exe" "__IRCT:3" "__IRTSS:23652314" "__IRSID:S-1-5-21-2805025096-2326403612-4231045514-1000"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-2805025096-2326403612-4231045514-1000"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Modifies system certificate store
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=98.0.4759.15 --initial-client-data=0x340,0x344,0x348,0x31c,0x34c,0x6efec398,0x6efec3a8,0x6efec3b4
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1132 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230502182828" --session-guid=8ef01a23-d48c-47ac-9080-32bdf1f7d02e --server-tracking-blob="MzBkMDIzNWUyOTFiOTI2MTYwYjliNjYyMmYyMTA1MmQwN2M2ZDI5ZWIxOTc0M2RiMTkxNmZkMGViZmE3Yjk0Yzp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY4MzA0NDkwNy44NTU4IiwidXNlcmFnZW50IjoiU2V0dXAgRmFjdG9yeSA5LjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYURlc2t0b3AiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJNU1RMIn0sInV1aWQiOiI5MzY3ZjllZi0wZDcyLTRmYmYtYjRhNC1jNGIxYjE1NTgxNjcifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=AC05000000000000
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
        
        C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=98.0.4759.15 --initial-client-data=0x34c,0x350,0x354,0x31c,0x358,0x6e52c398,0x6e52c3a8,0x6e52c3b4
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\Assistant_98.0.4759.6_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\Assistant_98.0.4759.6_Setup.exe_sfx.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\assistant_installer.exe" --version
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=98.0.4759.6 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2b8,0x2fc,0xef9b08,0xef9b18,0xef9b24
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
471B

MD5
36dfdb286b0c70b070b50a5975b9c0b0

SHA1
07d0ebc1bfd992586d25ff2ed3d9393314010d3b

SHA256
258e35882c097847327776af90c8a2db35b93e335952e24171c202529937896c

SHA512
4f7311644b5de6f3df9b1469c395b17c833f67be1d9db6aa38057756086c3b2e97b0270a3ece04c7c590acc33838cc7da0d5cc6364b54c08223e423b94ad061f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Filesize
434B

MD5
906c7a2ca6a33269a5f9a60234a3b2a5

SHA1
73c4d57c8f3d8a363ce5e26be46f868a97e37ec0

SHA256
2e0b06b1d446ed0bef2ddd5ad865effab8945c3933ad4c6f144da82d7c4c3146

SHA512
f92c335d967c5819e5152053a3cc53f4115502310e52ef9297967b7c02d9aeefabb6289326ab330f3d03d99167c84844dbb12b1c5ef2183125dd68b9118eafa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

Filesize
2.6MB

MD5
91bdcaeb60d9c464a85305525e7ab671

SHA1
e2d08cab12a603383449116e504ba9e094f00ae3

SHA256
7adcc9c13ffbee6eac3e0f39759c92051111b5ffe765108ccb6eef67e2571759

SHA512
daceb59486737be5aa7fcbca6f30af690c9d9399e57c7ae7d507d857dfa8035ffc257510c9f100048fd1f6505e2beb7a45ced6f6de47f628f5ef2072ff5bc801

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe

Filesize
2.6MB

MD5
91bdcaeb60d9c464a85305525e7ab671

SHA1
e2d08cab12a603383449116e504ba9e094f00ae3

SHA256
7adcc9c13ffbee6eac3e0f39759c92051111b5ffe765108ccb6eef67e2571759

SHA512
daceb59486737be5aa7fcbca6f30af690c9d9399e57c7ae7d507d857dfa8035ffc257510c9f100048fd1f6505e2beb7a45ced6f6de47f628f5ef2072ff5bc801

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\additional_file0.tmp

Filesize
2.4MB

MD5
090de281df0aff70c6bab2e004321dbb

SHA1
25746cf9a368636c35d552b0c08f74b455c7c44b

SHA256
9b829a0ac23000a77a4455c46b49f23e27e99251d56c99edf9a5b3163d0a5be1

SHA512
263945666f7a077368ad20025eb71098b604a3a7af04d08ee5fcad81e12be3fe39d9dd415cf26d194cf645c534d3056e8385824889dceea82657993e6c47d61b

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\Assistant_98.0.4759.6_Setup.exe_sfx.exe

Filesize
2.4MB

MD5
090de281df0aff70c6bab2e004321dbb

SHA1
25746cf9a368636c35d552b0c08f74b455c7c44b

SHA256
9b829a0ac23000a77a4455c46b49f23e27e99251d56c99edf9a5b3163d0a5be1

SHA512
263945666f7a077368ad20025eb71098b604a3a7af04d08ee5fcad81e12be3fe39d9dd415cf26d194cf645c534d3056e8385824889dceea82657993e6c47d61b

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\Assistant_98.0.4759.6_Setup.exe_sfx.exe

Filesize
2.4MB

MD5
090de281df0aff70c6bab2e004321dbb

SHA1
25746cf9a368636c35d552b0c08f74b455c7c44b

SHA256
9b829a0ac23000a77a4455c46b49f23e27e99251d56c99edf9a5b3163d0a5be1

SHA512
263945666f7a077368ad20025eb71098b604a3a7af04d08ee5fcad81e12be3fe39d9dd415cf26d194cf645c534d3056e8385824889dceea82657993e6c47d61b

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\assistant_installer.exe

Filesize
2.0MB

MD5
3c942ff0d46769c4ebebaf8af7cecd09

SHA1
22edc54535ca0d310f078741e5a384032dff4dda

SHA256
6411b8efde988c3c5e24c1555ee0b910985a5e037b3beb887b38754aceb7f533

SHA512
4138e8d6c21510451d47b7ad7f3d4954eccdf8fa04b2a676082c710e79110da8ff21e96337c93bd5903442740d2cf4b249974248571a05bcc0fd5a25018d8da7

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\assistant_installer.exe

Filesize
2.0MB

MD5
3c942ff0d46769c4ebebaf8af7cecd09

SHA1
22edc54535ca0d310f078741e5a384032dff4dda

SHA256
6411b8efde988c3c5e24c1555ee0b910985a5e037b3beb887b38754aceb7f533

SHA512
4138e8d6c21510451d47b7ad7f3d4954eccdf8fa04b2a676082c710e79110da8ff21e96337c93bd5903442740d2cf4b249974248571a05bcc0fd5a25018d8da7

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\assistant_installer.exe

Filesize
2.0MB

MD5
3c942ff0d46769c4ebebaf8af7cecd09

SHA1
22edc54535ca0d310f078741e5a384032dff4dda

SHA256
6411b8efde988c3c5e24c1555ee0b910985a5e037b3beb887b38754aceb7f533

SHA512
4138e8d6c21510451d47b7ad7f3d4954eccdf8fa04b2a676082c710e79110da8ff21e96337c93bd5903442740d2cf4b249974248571a05bcc0fd5a25018d8da7

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\dbgcore.DLL

Filesize
166KB

MD5
8e7190bf9a51e2951b140642511c00fe

SHA1
8ac4ad95c91cca1f5a048a97f63619b2babd7348

SHA256
775c3e3c76780e8a61db42a4520b81a663eac224e7ec33dc252a1276e47613b5

SHA512
d5dc33882b2a211a997cb178aefdda7013f30efd626722dc56cbbb1b85855a5eb7b77c70bf7fe6b605e93658498ae086f590b1b53346df01891fa0071c5cf4e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\dbgcore.dll

Filesize
166KB

MD5
8e7190bf9a51e2951b140642511c00fe

SHA1
8ac4ad95c91cca1f5a048a97f63619b2babd7348

SHA256
775c3e3c76780e8a61db42a4520b81a663eac224e7ec33dc252a1276e47613b5

SHA512
d5dc33882b2a211a997cb178aefdda7013f30efd626722dc56cbbb1b85855a5eb7b77c70bf7fe6b605e93658498ae086f590b1b53346df01891fa0071c5cf4e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\dbgcore.dll

Filesize
166KB

MD5
8e7190bf9a51e2951b140642511c00fe

SHA1
8ac4ad95c91cca1f5a048a97f63619b2babd7348

SHA256
775c3e3c76780e8a61db42a4520b81a663eac224e7ec33dc252a1276e47613b5

SHA512
d5dc33882b2a211a997cb178aefdda7013f30efd626722dc56cbbb1b85855a5eb7b77c70bf7fe6b605e93658498ae086f590b1b53346df01891fa0071c5cf4e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\dbghelp.dll

Filesize
1.7MB

MD5
bcc596c2460244066b3c40a6559b88d9

SHA1
6ee955c1efd65eba6eb6020467bc4d26aaa82793

SHA256
e7ba778244de4144318b6946e2f9aa382ee6c8e93849f49ed54bbb9a9625f34f

SHA512
016468a0188239a5e9eb93dd3842eed5bde60b1e5fc69ea822099ebc2a7d2094d307ce4abfe98a222fa684d3538cd3df1b63bbf5dd694d020020543f41f328be

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\dbghelp.dll

Filesize
1.7MB

MD5
bcc596c2460244066b3c40a6559b88d9

SHA1
6ee955c1efd65eba6eb6020467bc4d26aaa82793

SHA256
e7ba778244de4144318b6946e2f9aa382ee6c8e93849f49ed54bbb9a9625f34f

SHA512
016468a0188239a5e9eb93dd3842eed5bde60b1e5fc69ea822099ebc2a7d2094d307ce4abfe98a222fa684d3538cd3df1b63bbf5dd694d020020543f41f328be

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\assistant\dbghelp.dll

Filesize
1.7MB

MD5
bcc596c2460244066b3c40a6559b88d9

SHA1
6ee955c1efd65eba6eb6020467bc4d26aaa82793

SHA256
e7ba778244de4144318b6946e2f9aa382ee6c8e93849f49ed54bbb9a9625f34f

SHA512
016468a0188239a5e9eb93dd3842eed5bde60b1e5fc69ea822099ebc2a7d2094d307ce4abfe98a222fa684d3538cd3df1b63bbf5dd694d020020543f41f328be

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202305021828281\opera_package

Filesize
90.2MB

MD5
3ce6bb9794ce05f50f253600e2ca63e1

SHA1
5cead37e99d2c1060bd75f9a61ac3e77ad1aedcb

SHA256
85896658a743ecf1f32b0141fdb0be56cd6e44ecea0398ef9f85dc8319262fce

SHA512
8721a13da9fad220429fca32ac96d372d5913c2d5815bb4a583f4d7ba6f8717e17641ef207698c26aef31f875909418ce41f7c69ad820bce30314266bbca2507

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2305021828271971132.dll

Filesize
4.4MB

MD5
8037ea118e22eb387adf20c36375e367

SHA1
ae646806a29ec7745840da4c699a6d9f7ceba1f4

SHA256
d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

SHA512
f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2305021828273844932.dll

Filesize
4.4MB

MD5
8037ea118e22eb387adf20c36375e367

SHA1
ae646806a29ec7745840da4c699a6d9f7ceba1f4

SHA256
d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

SHA512
f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2305021828273844932.dll

Filesize
4.4MB

MD5
8037ea118e22eb387adf20c36375e367

SHA1
ae646806a29ec7745840da4c699a6d9f7ceba1f4

SHA256
d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

SHA512
f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2305021828276193392.dll

Filesize
4.4MB

MD5
8037ea118e22eb387adf20c36375e367

SHA1
ae646806a29ec7745840da4c699a6d9f7ceba1f4

SHA256
d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

SHA512
f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2305021828281342320.dll

Filesize
4.4MB

MD5
8037ea118e22eb387adf20c36375e367

SHA1
ae646806a29ec7745840da4c699a6d9f7ceba1f4

SHA256
d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

SHA512
f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2305021828282914852.dll

Filesize
4.4MB

MD5
8037ea118e22eb387adf20c36375e367

SHA1
ae646806a29ec7745840da4c699a6d9f7ceba1f4

SHA256
d3a1505843d55048bf01686e74aa16ef76e78bdacc62fda20a4266ff0abd7ed8

SHA512
f7adf71035ff3a1208d3dfa1a8828ce5acf5883f45d8722d07be2ec8f78f269a5e607bbcf5199d4ba3e7ee6d976709dd993b7035559abd0dfcbb0e00eb993b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

Filesize
339B

MD5
6beb106fcdb10fdd1af8f408dbfad7c0

SHA1
47e5cc259f9b7f0aacaf61f51a2b8835135925e4

SHA256
adb0b0e1c35dc71b2796d71009d610a086a1b2a46cd78495ca6c1e414e424d52

SHA512
b5ecf7fc5f4d2378c8d069a2e40dad3dab6b1b954257abab41b35f3e460df959d02d9f2bb04d5f66a0c8067021eab4d85507613f641ca7eb7af86c3a9a6d7e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

Filesize
644B

MD5
9756710c8ffbd55efcc8cceb7ae36978

SHA1
1cfa830268061cd6988cd04c69dbd260eff20906

SHA256
0ef03e7257d6d31a1d37adfdbc733ed9fb41259bb0d44c0b3424d1dddfe91646

SHA512
67a8317c199349e9142821bbc204ebc31a5091560f257d8ae8f498bba1c35b3e1f666faae1fc70803e8781903bb3386dfb7b09d796c0a61211ae7df6cfe1eeb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG105.PNG

Filesize
40KB

MD5
ed056469c2f0a7adce3e80404bff316a

SHA1
48e8a5e0dbe66bb8ad044b39f2161583a10cf24e

SHA256
ee5e42eee432320ac80b75b45d4d254d2880c31092579680bd6a585beabddf0e

SHA512
34322e5654902227bb67e43e5a6ffcca5895bb634a2c3f795ea68fd57125b693d656eab4fa412f1d4f64c79aa02e0de8b36b9b04eae5bae7134062a9a5adeed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG108.PNG

Filesize
2KB

MD5
177a9e913e7039e698bea8b073ed46a0

SHA1
6aa8cb4efce1443a604dae67653cbc29727353dc

SHA256
10ece4579c86f299612f85a4dc21a6906cd522bba801d9b357abfbd2b5a21ebb

SHA512
5380f57569a5e44ecd66e6a996cb8949e01f7e2f15337a21133bb9bebd3893fb6a887b69b2bd56edbfc4872aca6f59e37b305ace774ee175955fa911b2a39a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

Filesize
280B

MD5
ac819dc416a9c3d7cd218247a505f4e4

SHA1
65184cf901d16f1f18dd82bd0673250d5422799c

SHA256
a1639ff730514d3ef9d8e5363e6848069462845a9c9c0bc4ca355b60cb9dfca3

SHA512
4ab1351fd036b4187660bf42b19a5f1b5a2ad51369c5e056bbbc765051905e3f1b5716557f113cf2e14678481101897698c3fc746814189da75693d3fec8fab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

Filesize
281B

MD5
179d7efdf2a2909c5cce33a2fa7b29cf

SHA1
e6ee30a67170e74491069edba50c950909bea4dc

SHA256
cc4db69be2bcdf373a7615df5a274a7e08c1dc7c3106fd835272dea973b9e049

SHA512
1ffba7773a15d7b53a4fa7f1b2099b565baf1d550c801a065bd03a613b5a408429c038b51a05293868525ac9cf3976615030b5cb72931a54e1a1045a1c3bdc74

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

Filesize
43KB

MD5
97a2aaca50914badb17e343b6f592171

SHA1
991b22e59ad4482395b288ae5074268ee93a55b3

SHA256
c121b4caefaea329d596596773c39f8a35beb5fcc4bc1a09bdd47d41382364df

SHA512
c8cc5b507a97a6c3ef62a27c7cf1b3f67b81cccf99fdf158948827911d477507d3c4a3326c3bbee4296c1001dc1d745ba1779fd91886dd50d6a89c51879efe8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

Filesize
1KB

MD5
382fa04ae6fdcc6b1713b9ef02e9675a

SHA1
310b638c0bb8ec49b208a1f8982a63f6c34fd6f3

SHA256
8775ed30c651649b1e693cc9bfd8ed3093c91011691fa50bc64dc8058113614f

SHA512
11a91ee803c99a71ae956ede7d8778157456ed53ca0af8d3c72621650cc84ef1df5e3c0fc8c225e22903f0c7a57d867723777655c1f8606242b8369943ff9d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
0913b4c43b4a1c301353197c30e01f4f

SHA1
245c343a7bb339d402ff8e9d442389a4f3dfc3a8

SHA256
238d15cbb1a929fe19f4558c44fbc67d5d6b9a3176fd9d880345ae0174a8d87c

SHA512
9d2da27264af71d7d1b9a3eac36e9b413041836de2559899d384a76b888cd495703a306c384752047bc9e1da3f8ee908da7218a58cfd9af1f81b51be4b27321f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
0913b4c43b4a1c301353197c30e01f4f

SHA1
245c343a7bb339d402ff8e9d442389a4f3dfc3a8

SHA256
238d15cbb1a929fe19f4558c44fbc67d5d6b9a3176fd9d880345ae0174a8d87c

SHA512
9d2da27264af71d7d1b9a3eac36e9b413041836de2559899d384a76b888cd495703a306c384752047bc9e1da3f8ee908da7218a58cfd9af1f81b51be4b27321f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
0913b4c43b4a1c301353197c30e01f4f

SHA1
245c343a7bb339d402ff8e9d442389a4f3dfc3a8

SHA256
238d15cbb1a929fe19f4558c44fbc67d5d6b9a3176fd9d880345ae0174a8d87c

SHA512
9d2da27264af71d7d1b9a3eac36e9b413041836de2559899d384a76b888cd495703a306c384752047bc9e1da3f8ee908da7218a58cfd9af1f81b51be4b27321f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

Filesize
114KB

MD5
bd5626a0237933e0f1dccf10e7c9fbd6

SHA1
10c47d382d4f44d8d44efaa203501749e42c6d50

SHA256
7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762

SHA512
1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.6MB

MD5
91bdcaeb60d9c464a85305525e7ab671

SHA1
e2d08cab12a603383449116e504ba9e094f00ae3

SHA256
7adcc9c13ffbee6eac3e0f39759c92051111b5ffe765108ccb6eef67e2571759

SHA512
daceb59486737be5aa7fcbca6f30af690c9d9399e57c7ae7d507d857dfa8035ffc257510c9f100048fd1f6505e2beb7a45ced6f6de47f628f5ef2072ff5bc801

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.6MB

MD5
91bdcaeb60d9c464a85305525e7ab671

SHA1
e2d08cab12a603383449116e504ba9e094f00ae3

SHA256
7adcc9c13ffbee6eac3e0f39759c92051111b5ffe765108ccb6eef67e2571759

SHA512
daceb59486737be5aa7fcbca6f30af690c9d9399e57c7ae7d507d857dfa8035ffc257510c9f100048fd1f6505e2beb7a45ced6f6de47f628f5ef2072ff5bc801

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.6MB

MD5
91bdcaeb60d9c464a85305525e7ab671

SHA1
e2d08cab12a603383449116e504ba9e094f00ae3

SHA256
7adcc9c13ffbee6eac3e0f39759c92051111b5ffe765108ccb6eef67e2571759

SHA512
daceb59486737be5aa7fcbca6f30af690c9d9399e57c7ae7d507d857dfa8035ffc257510c9f100048fd1f6505e2beb7a45ced6f6de47f628f5ef2072ff5bc801

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.6MB

MD5
91bdcaeb60d9c464a85305525e7ab671

SHA1
e2d08cab12a603383449116e504ba9e094f00ae3

SHA256
7adcc9c13ffbee6eac3e0f39759c92051111b5ffe765108ccb6eef67e2571759

SHA512
daceb59486737be5aa7fcbca6f30af690c9d9399e57c7ae7d507d857dfa8035ffc257510c9f100048fd1f6505e2beb7a45ced6f6de47f628f5ef2072ff5bc801

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.6MB

MD5
91bdcaeb60d9c464a85305525e7ab671

SHA1
e2d08cab12a603383449116e504ba9e094f00ae3

SHA256
7adcc9c13ffbee6eac3e0f39759c92051111b5ffe765108ccb6eef67e2571759

SHA512
daceb59486737be5aa7fcbca6f30af690c9d9399e57c7ae7d507d857dfa8035ffc257510c9f100048fd1f6505e2beb7a45ced6f6de47f628f5ef2072ff5bc801

Download Submit
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

Filesize
2.6MB

MD5
91bdcaeb60d9c464a85305525e7ab671

SHA1
e2d08cab12a603383449116e504ba9e094f00ae3

SHA256
7adcc9c13ffbee6eac3e0f39759c92051111b5ffe765108ccb6eef67e2571759

SHA512
daceb59486737be5aa7fcbca6f30af690c9d9399e57c7ae7d507d857dfa8035ffc257510c9f100048fd1f6505e2beb7a45ced6f6de47f628f5ef2072ff5bc801

Download Submit
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

Filesize
636B

MD5
6f86d782a8a814fbf893835835015d0a

SHA1
252e7ca0cb1f805370b7d2fd73fcaf82cf2bccf9

SHA256
9d811045029cd74a5ee567b261f1cfc6f93b70dd4a4d405774dbb8945e3518ca

SHA512
d161ca11f645aea76cfab39c5ab309b7fa5527480f5cd632253c91ad99ca6238fbd2db8fd3505cdddb28469f3b9695fc8afd0784e06f16dec305cc2ff9fa7433

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

Filesize
451KB

MD5
0b445ace8798426e7185f52b7b7b6d1e

SHA1
7a77b46e0848cc9b32283ccb3f91a18c0934c079

SHA256
2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

SHA512
51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

Filesize
1KB

MD5
1cf6dc4a707fb390470baa010180aa2c

SHA1
573461063ec81b452576c266fabb0e30cb774e89

SHA256
c3fcda4e4b73324d577bccdcc7750507ea59cbab13d58e13dcb5be4f3272923b

SHA512
81b259e4bbe1f0265ce72d2efb92472b23c5a65fb1da6353d007aeb08d5bad56fde5fac0d85328395f2793c8733204384031c13aae9b42b0b17e435249f1789c

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

Filesize
45KB

MD5
f9eec55204e0bd1957aaa009bc1f0aa9

SHA1
3f576b56f97fc8cf1557d054496ac66d82f1569b

SHA256
015062c19f673688f853a0054f62ded39687d3c16cfd58cdd05954f58de76b6f

SHA512
355e36a9f014d841975ae955c6020b941396f595e1cc5e39a6a526481d5344800cbba6be5db83e44e866a9c04465a79354ca4dbd529f6a63518740fba1c1207d

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG

Filesize
457B

MD5
e715517d216e2ea8972321486c64a82e

SHA1
ce56341376871dfb0940da71b8c2b0174eeb9a37

SHA256
9cace032772bfc90b522b17a1a262072df599ad8e9517a4e16d6e0b97d68e8ed

SHA512
008324bdd3cb33bb3d905e789af3648f814ed826db1a38f58426005637aaf8c11fb7cf038d38901f9fdf342a89a1f7f5db298923589fe6801567eb82b0f5f49d

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

Filesize
352B

MD5
f88854422ec72b0b5277a3873d17998a

SHA1
d2e8cbbb9872a1373fa2359a8097dbd338e10e78

SHA256
9c737e6242db287ef5afa117dc938286b9aa05efeb0d6af1f6fe6e83efb3900f

SHA512
d7094b9c457ac5b76eb8a1a2918e5571e7d8c8b57669e046037a3f8ee3749d57c1dadca4b8b0fadd0c5ffc488f036cb70d7f392ed11f74d99592bc7a5e4b7435

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG

Filesize
438B

MD5
677ed3c0ef77f1d3d09d888f82d22089

SHA1
6fdddf5102cba85694b2212a058e7b061fe49fa4

SHA256
87db8c352230acedd0b49189c6cdf8cb168e68cd48548724c2186db978240d05

SHA512
24ea7cce29a2d968f7cce44178d91651fa6f35a17dea23aa00ac1913bc14e6ae2263bd2e93233efd387370abb7c3512fba92635e3bf6631fce2e12221fe6c1d6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG

Filesize
206B

MD5
8afc6a2df8322ac99e9320a0eb07f978

SHA1
1c5134eb8e2d52fb55ad9a5dfddddd82c38897bb

SHA256
e5a9aafbba5c72f541d09f5d6cbedabe1caf0076fc198a6ac2fba7ad7a0df979

SHA512
9f955409fff9a0011a06967040df80675aad83b893ab2d00080d3411aad2844e416641b247ba18bcb9a7753f17e4887ecc18b9fca1389075dc8d1f98bbce694b

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

Filesize
1KB

MD5
b892dcb07f669beaf1f92b08237d712f

SHA1
320d43d5afc38abf5d73d0363f88417b4363dd8b

SHA256
cadbc5331a0cadb9898090f5624decc1e231cc8b1b50d35bee97a8bfae04e6f0

SHA512
d47a0555f0a048e18d9628f50299d1ad5632da9cb620164bf3a684fa22a33d56b3736f64d614566532029d31e92cc2184a85fd6970257a78a11deacca5e79b32

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

Filesize
1KB

MD5
3868db0b80c782a378d17b7133f41a7f

SHA1
0c52b2223be436848c656472db2aaa5fe99422e5

SHA256
b814c7da30e3615e78267290272964bc1cf700a8cab57520f4d7624fcef20b89

SHA512
029d4e6a4a5e6d1644b17d6c3b376f57564b25bc941c810466c39f6fdf5d87915f5ba36e31a64ea73b15c9b2eea9b73089ecf2b3773c6f9be8567ace230d2c33

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

Filesize
41KB

MD5
383d7e5742dade5dc9f24d3b3ea42812

SHA1
650af6fc1ca47619a7298c090d9c1e5ede22a271

SHA256
681a223f76a0c42de09062573219c16988512efc43e056391d71bc9dc3363b4c

SHA512
01f370ec27505f5474e2b6b746d46e37d121906f3c43e4468a1ee78053c75b3249a4dbe1cb813d13363a4575785629925558621d5d660a32a4e7a5ad666c6396

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

Filesize
1KB

MD5
de1b0d4aebc8d24f87c9536c5f2a5ff3

SHA1
9855d577b6827c7e96171584b907e2efe5b803e6

SHA256
ec0653fad51c2068e8b22e17a31907b2cd0c9629781112d6ba27a3f499e83509

SHA512
85dd7a66ec9cc5e782578886349e26956b68ad80fd7d20ea931f6b4ea9cd957248ddb52ebafa9161f9302862ecc72b72bd497068d9b63db467d46e74c71cdffe

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
21KB

MD5
53f273f8e2da4ae72b5e0229470ef9d3

SHA1
4bf71767acac851a90f66888920f0625e7dc6557

SHA256
43978b0ee53ab74bdc6cecdc7823daa6249f6c76e746fd6308a2ef5f1abe352f

SHA512
48c63eee75ba759f8eea35243decfd667a336415dfeec25e3655b6726b46ce68d2cbc7119e09aa0f23bcdeb564e4ef006b0d7dbc5e37bfe33109d9452bf1166e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
8KB

MD5
f4e45d8832233ea23b0c222f4d61bbdf

SHA1
d4eb9107d197a74341c9d7430a0bc66d1e6b9d6b

SHA256
419d7d12bf33eddcd98fe226d2a2c79dc74875ebf36a079772dda90a3d9ffb10

SHA512
4ded0971dd20f2d80384102aa4ea7f1b826039988032bd85b4070d9f1310a99ebf2a3d129dcc071b1adf887f79c2539e4ae8ad32f2fd04d88c51f935e2e411a7

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
779968be311d78d8bc7f8af890cc63d7

SHA1
44bdd813db6a10308ab2ea774819cf320c418ffc

SHA256
4ed58ddd0bc0d0d23e19fa6a44a9912554cc6b9a976ac74efb82bba5f894c1a4

SHA512
b4e6f1f06cde58062c70b1c46509f4ebe25967f3d707e00bcf89b3fe4162a81c313117ea045ebf2fdaff8e94941a279d7452904859afec49f522d87356f122a1

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
779968be311d78d8bc7f8af890cc63d7

SHA1
44bdd813db6a10308ab2ea774819cf320c418ffc

SHA256
4ed58ddd0bc0d0d23e19fa6a44a9912554cc6b9a976ac74efb82bba5f894c1a4

SHA512
b4e6f1f06cde58062c70b1c46509f4ebe25967f3d707e00bcf89b3fe4162a81c313117ea045ebf2fdaff8e94941a279d7452904859afec49f522d87356f122a1

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
779968be311d78d8bc7f8af890cc63d7

SHA1
44bdd813db6a10308ab2ea774819cf320c418ffc

SHA256
4ed58ddd0bc0d0d23e19fa6a44a9912554cc6b9a976ac74efb82bba5f894c1a4

SHA512
b4e6f1f06cde58062c70b1c46509f4ebe25967f3d707e00bcf89b3fe4162a81c313117ea045ebf2fdaff8e94941a279d7452904859afec49f522d87356f122a1

Download Submit
memory/1132-609-0x0000000000F20000-0x000000000142E000-memory.dmp

Filesize
5.1MB

Download
memory/2320-654-0x0000000000F20000-0x000000000142E000-memory.dmp

Filesize
5.1MB

Download
memory/3164-462-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/3164-478-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/3164-1665-0x0000000000630000-0x0000000000A18000-memory.dmp

Filesize
3.9MB

Download
memory/3164-1610-0x0000000000630000-0x0000000000A18000-memory.dmp

Filesize
3.9MB

Download
memory/3164-1611-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/3164-558-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/3164-557-0x0000000000630000-0x0000000000A18000-memory.dmp

Filesize
3.9MB

Download
memory/3164-147-0x0000000000630000-0x0000000000A18000-memory.dmp

Filesize
3.9MB

Download
memory/3164-440-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/3164-441-0x00000000068D0000-0x00000000068D3000-memory.dmp

Filesize
12KB

Download
memory/3164-477-0x0000000000630000-0x0000000000A18000-memory.dmp

Filesize
3.9MB

Download
memory/3164-463-0x0000000000630000-0x0000000000A18000-memory.dmp

Filesize
3.9MB

Download
memory/3164-649-0x0000000000630000-0x0000000000A18000-memory.dmp

Filesize
3.9MB

Download
memory/3164-461-0x0000000000630000-0x0000000000A18000-memory.dmp

Filesize
3.9MB

Download
memory/3392-612-0x0000000000500000-0x0000000000A0E000-memory.dmp

Filesize
5.1MB

Download
memory/3776-651-0x0000000000B30000-0x0000000000F18000-memory.dmp

Filesize
3.9MB

Download
memory/3776-532-0x0000000000B30000-0x0000000000F18000-memory.dmp

Filesize
3.9MB

Download
memory/4852-658-0x0000000000F20000-0x000000000142E000-memory.dmp

Filesize
5.1MB

Download
memory/4932-617-0x0000000000F20000-0x000000000142E000-memory.dmp

Filesize
5.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads