Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

23/05/2024, 14:58

240523-sb9ewafb52 8

23/05/2024, 14:54

240523-r9wq1afa2y 8

23/05/2024, 14:48

240523-r6y2yseg91 8

Analysis

  • max time kernel
    230s
  • max time network
    234s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    23/05/2024, 14:54

General

  • Target

    https://opera.com

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://opera.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff82735ab58,0x7ff82735ab68,0x7ff82735ab78
      2⤵
        PID:3252
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:2
        2⤵
          PID:1740
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
          2⤵
            PID:2924
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2132 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
            2⤵
              PID:1548
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:1
              2⤵
                PID:4708
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:1
                2⤵
                  PID:4432
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4120 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:1
                  2⤵
                    PID:1396
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4480 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
                    2⤵
                      PID:1812
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4468 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
                      2⤵
                        PID:5064
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
                        2⤵
                          PID:4232
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
                          2⤵
                            PID:2044
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
                            2⤵
                            • NTFS ADS
                            PID:924
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5028 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
                            2⤵
                              PID:3040
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5004 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
                              2⤵
                                PID:2620
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3948 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:1
                                2⤵
                                  PID:2024
                                • C:\Users\Admin\Downloads\OperaSetup.exe
                                  "C:\Users\Admin\Downloads\OperaSetup.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Enumerates connected drives
                                  • Modifies system certificate store
                                  • NTFS ADS
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1840
                                  • C:\Users\Admin\Downloads\OperaSetup.exe
                                    C:\Users\Admin\Downloads\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=110.0.5130.35 --initial-client-data=0x2bc,0x2c0,0x2c4,0x2b8,0x2c8,0x74bff308,0x74bff314,0x74bff320
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:244
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:3432
                                  • C:\Users\Admin\Downloads\OperaSetup.exe
                                    "C:\Users\Admin\Downloads\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1840 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240523145432" --session-guid=818aa713-5266-49be-b565-1343cc26477b --server-tracking-blob="ZTM0ZjQ0NDJmMDk3MmEyYzc0Y2U0Njg0NWMyNDEyODk0ZTgyZWVjNmYyMjAwYTE0ZDAxZmY0ZTBmZWY5MzY5Zjp7ImNvdW50cnkiOiJHQiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhIn0sInF1ZXJ5IjoiL29wZXJhL3N0YWJsZS93aW5kb3dzP3V0bV9zb3VyY2U9JTI4ZGlyZWN0JTI5JnV0bV9tZWRpdW09ZG9jJnV0bV9jYW1wYWlnbj0lMjhkaXJlY3QlMjkmaHR0cF9yZWZlcnJlcj1taXNzaW5nJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGJmRsX3Rva2VuPTg4NzEwMTE1Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE2NDc2MDYxLjg4MDciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTEwLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiIoZGlyZWN0KSIsImxhc3RwYWdlIjoib3BlcmEuY29tLyIsIm1lZGl1bSI6ImRvYyIsInNpdGUiOiJvcGVyYV9jb20iLCJzb3VyY2UiOiIoZGlyZWN0KSJ9LCJ1dWlkIjoiMjgzZjkxNGMtYjg2YS00YTBhLWI2NTgtMDZhNDQwMDk4OTQ1In0= " --desktopshortcut=1 --wait-for-package --initial-proc-handle=B408000000000000
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Enumerates connected drives
                                    PID:5108
                                    • C:\Users\Admin\Downloads\OperaSetup.exe
                                      C:\Users\Admin\Downloads\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=110.0.5130.35 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2c8,0x722bf308,0x722bf314,0x722bf320
                                      4⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:2628
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\Assistant_110.0.5130.23_Setup.exe_sfx.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\Assistant_110.0.5130.23_Setup.exe_sfx.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:2124
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\assistant_installer.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\assistant_installer.exe" --version
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:4628
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\assistant_installer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=110.0.5130.23 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x8630e8,0x8630f4,0x863100
                                      4⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:3400
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4460 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:1
                                  2⤵
                                    PID:568
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5924 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:1
                                    2⤵
                                      PID:948
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6036 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
                                      2⤵
                                        PID:1600
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6176 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
                                        2⤵
                                          PID:3608
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6328 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
                                          2⤵
                                            PID:2068
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6480 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:8
                                            2⤵
                                              PID:4684
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6292 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:1
                                              2⤵
                                                PID:1100
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6840 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:1
                                                2⤵
                                                  PID:4576
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4548 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:1
                                                  2⤵
                                                    PID:392
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=1504 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:1
                                                    2⤵
                                                      PID:5004
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=4888 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:1
                                                      2⤵
                                                        PID:2588
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5620 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:2
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4992
                                                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                      1⤵
                                                        PID:4208

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

                                                        Filesize

                                                        471B

                                                        MD5

                                                        14fae84a346bb0bb762bb6b6e05b4ff2

                                                        SHA1

                                                        148d0ecf5bf7f993b70d57dbc4eb856f181e9c51

                                                        SHA256

                                                        47c8853e9a15e7c79bf9341073a4fc5340e3a3876a9be034b598b0fc41ed576e

                                                        SHA512

                                                        f44cb11b6ce96971aa524954b250b6dbf9838fb667ec473e217245d859536b4e2f5bafcd1f7c097f689c422981bcaa63ff7685eac7f274e329003f3cdb1cd0ee

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0F90096E7DCB862ED66CE39084FC7811

                                                        Filesize

                                                        727B

                                                        MD5

                                                        a25241f2e55b3007ef5b628f4b84f8e5

                                                        SHA1

                                                        905c27f34147442eb62d7ec84b5017eb3d4a5b28

                                                        SHA256

                                                        3b53529bcaffd93e4d487971956fa104ac3dc791c43c5c4677a76e12979d863a

                                                        SHA512

                                                        491ce7ad68de902185e20c074a723fdc47bf43420124209e843c40271c872b8197eed55e6eeb0625b44d1f4f74ace3d85801c522071f672fdbfa3bdc795ac7dc

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

                                                        Filesize

                                                        727B

                                                        MD5

                                                        a90ff749a13166b81da25cdcbc82c54d

                                                        SHA1

                                                        a09692688b0a86d9e06b6a3697d2a1793f367961

                                                        SHA256

                                                        4b1553fdbeca127a257bed3bd232cad24df64166cd39a54159893d5c350ac742

                                                        SHA512

                                                        54dfe43bb1c88eac7d29e641171a27f72270bea50d3d989217f3a739943f4a3d751689dab68319ed7e800986cac1c5053305252a5f92fe14f1566f425f7994b6

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

                                                        Filesize

                                                        400B

                                                        MD5

                                                        1ba79e32e632d4a80083bcc94f268a68

                                                        SHA1

                                                        d0fa1a9fed942adfed79e1da6828df16e0b13837

                                                        SHA256

                                                        9ecc4e6fc358f461da540f313f48c9420ace5d2a2ad7b2721ae8c6ae7c708d51

                                                        SHA512

                                                        7f839364195ecdb1d263457fe0bdb8f85bcc61a5ae6c5300fdf0e37b246d7d70408f6166e08c0013449b2993281394ba73b7266f7989d263c182e355b9968baa

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0F90096E7DCB862ED66CE39084FC7811

                                                        Filesize

                                                        412B

                                                        MD5

                                                        b581fba6f5113ddc691f5cf154d788cf

                                                        SHA1

                                                        4437dd2539ef9c2d30c61f89b9811b7c52b55b36

                                                        SHA256

                                                        a9194ed2a53765c94cc46436c9817dca85f7b731c90229fbbf0a9597381fdd07

                                                        SHA512

                                                        f937ce4ad979914c43512bbac5ea9263d9edbc3a53db3277209e237d41190c70195859e7640e820a12c1140e642def0071eadaf95eb8f4ca99ef414d78931198

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

                                                        Filesize

                                                        412B

                                                        MD5

                                                        505b4dd8793ffe7e80dd57d6ce400e5d

                                                        SHA1

                                                        e5e98f144ce6512790772c0ca2a498778e5fb102

                                                        SHA256

                                                        2744e6b73cf4c1200632e966203d5c65a694d0b1265b2144c3547d7d1f12c5ff

                                                        SHA512

                                                        c7c9f89353c72923d98fd0c9bbf1891d85f968921b37a541c5ca954ca0817c8132eed62d02b2a0b385477072ff26f4901c91f4a98e556811860770df830e32e9

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        552B

                                                        MD5

                                                        024ea70e8bbd4dfc74b73f0c79d90e00

                                                        SHA1

                                                        e5f121c2b2c082619cddc47c35a2b4abb4f24911

                                                        SHA256

                                                        13ef9e9e0b65d6a9e01a9363157c9843aa6165952917cdcb67ca351d560c9c4a

                                                        SHA512

                                                        1ea85fc60291f0e50c12cfc4c7a7268ba06af587f12fef080cf78865db3d242d6d3da9528433a46a7b64dd2d783f4aaf9304c2806c64f3c2a4cd8a4591086a62

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        ff349a4588c267b43a5677264bd6861f

                                                        SHA1

                                                        0c0f8e9c60289c82003502bda337598baecd785f

                                                        SHA256

                                                        dfb9a91e2d7f1216ef8de2e99900dae8e9ad6e316814297e5199c15f653891cf

                                                        SHA512

                                                        1a7c9ef53923675e9150c4a2bf44ef193385befeeac6f0a56fcee74fde036014bd2945be76d55d075314ac42de08e7a59272bce306e3ef81793ce47bbe5579a5

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        5f55b5c1353b29cac1bbbe08f45acbb0

                                                        SHA1

                                                        315469f860ec6aa512082ca45b6a6b2c4277f6f1

                                                        SHA256

                                                        6fd0b4d0fc3269007f03ff1f0b5e7f8dbc334b2a4c70f6e547fd4a650da48127

                                                        SHA512

                                                        f22401837abd8692cc8ba4668d0e6d0160e15cfc77dac571c08b9a66c9a1414cb261710fef79f42cfddb9d915bc20a84a3bfa1b4128a6a83246b79a7b34f4606

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                        Filesize

                                                        5KB

                                                        MD5

                                                        ddffbe98cb8c93eb51d1881b9d4a75f0

                                                        SHA1

                                                        32c345f8205038d40123767b9c35b5bdfed90043

                                                        SHA256

                                                        7bd01a55dc7ee087cae9973cd4e888575e0d049bffec8b198b6e20c57acac02b

                                                        SHA512

                                                        b1f970bba869e1a687ca60d62f2487bac16f8eaa13aef5b42557958e58f94c9547cca5cc266fdddb0d3c79e61643fdc0f968c4f419349e672ce1ea900a275250

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                        Filesize

                                                        2B

                                                        MD5

                                                        d751713988987e9331980363e24189ce

                                                        SHA1

                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                        SHA256

                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                        SHA512

                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        8c0e0039bfe4904d2eb75972898bbd30

                                                        SHA1

                                                        b0f8791d5889867d50dd035d6078ca87aa6aa80f

                                                        SHA256

                                                        6a3d2283a9ebc2ec142c2ea8e1a7dd43c622d7299e3a811b668abd806a0d8c1a

                                                        SHA512

                                                        9239687a75f128e705357332620efce4c6282ee59eafe2eb9134eb7b017a8f9c18cfffc450b15687f123415ba15833ef7c9dc60c9d1db5233a6b7caba042768f

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        06ea524ecc7c7aa8553625f1b5334400

                                                        SHA1

                                                        0758e8ddd47c0b6d611f571aa96dd89820c064a9

                                                        SHA256

                                                        e73c9892bea36ce6025c8639025ad35e461fe37e7ae9507a7fa836f9f8ffce33

                                                        SHA512

                                                        8a97cbf67e151d99b54147ac1bd22f6bc5d6594e64cf474c7faf0eb5662d35bd5dc2a3ccf47645e19646938cc083b3ad36ed22b17ae561665307f489ca5b70dc

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        27e2447115654bd520e357ee36121b68

                                                        SHA1

                                                        dee291fd85fd28fd046764dc54a62b108bebca04

                                                        SHA256

                                                        9e14cb3a1eac484ece33b8eea9bff912d8de68057a1fe2200e3da800309d613d

                                                        SHA512

                                                        6d969bc210aae3fc1edf88c8f5f16b88f1ed5f8bc28869a48ac4d7d2712182a945a0ddad1f610202e8025679d002fb6a767b20e3af14d94d5f5a3d09faa163d7

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        10c52445bee02235d20b9138c581d454

                                                        SHA1

                                                        4cf901be2e4643da8666f7c044b134c2f0854078

                                                        SHA256

                                                        055cf49c6b80da83fe5165287d3beee1fc16b46a862a40bd356218eaf925d3ad

                                                        SHA512

                                                        91f62224fcaf3223505e30a697ce37d0a0181b373b724dc6be1f0271e7f096e3e919ab7a6a2f5dbe3f0f40ab0b954fd508f7c5bdf5c6a7321130f3494845497f

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        3473b074dbe540b516a03eaccea94915

                                                        SHA1

                                                        5ec968812e655aacb06f8cda19d93f0cf5b1b4a4

                                                        SHA256

                                                        c77d4b252f03d64a072ff02940f3537d14ddce42726b82a6e5e05ca2e886812d

                                                        SHA512

                                                        53528a54c559a90dbbd0ae8e6f48ed13cce2af2760e4de388d19662927ecebfd9c55102cca9b3ccb46540c8196be9d241a79c8b08b6577c4abc56bb462ed8a75

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        ed8fb653f39df21e04100258779b2b9c

                                                        SHA1

                                                        811fe08d355fcf67adee4f754b0e3ee431abe0b5

                                                        SHA256

                                                        7bb952532227631f4b1cae7c9ee996c76b8fdfb31bf3d056b86de4b9248b6cc7

                                                        SHA512

                                                        efeaa33c18e6936b82da849b07328c0f517338784479e5732f4eafafb65d2ca0d14f38b71b811bca4c89e37f29c21adbb3bd9a6d654d8a69b494e721405fac91

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        130KB

                                                        MD5

                                                        0286d4a1b9522c230f22399e2f35693f

                                                        SHA1

                                                        3e03efaff4b5775f55de64b03a320f7b2a1fbbf7

                                                        SHA256

                                                        ba862c6a0ec6337c7d6c1a6d95d4d8310ed3a848970c166e28a32c42650485a3

                                                        SHA512

                                                        a215f397876339bf69ccac1403c62f0f9a24db9c725a6d19826108094d2599afc741701166144025d868a3a399ff8e130728f49658f76a582866106f7bb05278

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        130KB

                                                        MD5

                                                        7bfb4b1aad64da47db9d94c655d5149c

                                                        SHA1

                                                        fc2a9497dbcd5f159097b6903dab87ec27251f36

                                                        SHA256

                                                        df347a7b0ede79e5e2ba10a2c6b6aacd85105ca46c6b4dfcd9b826969ca10a8f

                                                        SHA512

                                                        f35e4d484909d613f287c749334e7418e43ef837ab6b91bc7e4602445299852a180ad77107165357d64b0a2314c7fd5d5853d009d949b3b44564d2ae94c3a43d

                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\additional_file0.tmp

                                                        Filesize

                                                        2.5MB

                                                        MD5

                                                        028fb19ee2cea3e611b4a85ac48fafbc

                                                        SHA1

                                                        d1a802b5df649282e896289b4ec5df8d512b53dd

                                                        SHA256

                                                        e8fa79e22926ae07a998b5d2bb1be9309d0a15772ac72b88f4eed66052f33117

                                                        SHA512

                                                        99959d7765c1e6636dee1841f214cb2d0c7684d7128381b0387fa9c7ef4a92ef62bb094087bdcb343e44196b5a333df3a2104ced9f49671197a06fafa27aff51

                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\assistant_installer.exe

                                                        Filesize

                                                        1.9MB

                                                        MD5

                                                        b6789061eb88781add48ec7095ff78e5

                                                        SHA1

                                                        c2cdf5723a94b3b5a69ad78a5e869347444abe0b

                                                        SHA256

                                                        c39c7199fa2221783ea61f085f484668e3c452706069b046cb0f4a9d4cb4c0a3

                                                        SHA512

                                                        7c9a61c7f8d45fb7a2591c0c57c22bca0b527e3b6b4a3bdde5fbdcca25abc1e0c56a244a39d4b65a91316eb8f19fb8232569f5781eedefbc0898646d4df10f9c

                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\dbgcore.dll

                                                        Filesize

                                                        166KB

                                                        MD5

                                                        a4ed3b36776e0155fd24ffa609ffc2f4

                                                        SHA1

                                                        3d6496f21e0f04b6789365d06e71fe7de284b1c0

                                                        SHA256

                                                        b69387b9284dc36d377e4066c4cf361dc65efc6c784af0f8666d9684fabd2d29

                                                        SHA512

                                                        ae5d052fdcc7e7d3e593a1fb2dd5e64fcd75c7381ff4e4c5f4302d8d3c058a48c943c66d04c02d44d45c2bda36b3d3df096dfea26fc35d3c682bdd5221225e76

                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\dbghelp.dll

                                                        Filesize

                                                        1.7MB

                                                        MD5

                                                        fa64324149160877768551fd96c360dc

                                                        SHA1

                                                        dd76ebe617271465ae5820f49152f8a89703ae1a

                                                        SHA256

                                                        7f4a2cff90524b769781b763077be198d74834c6b576ef9f27132a415cbbaca8

                                                        SHA512

                                                        72161c1b0449f546e2a3560369f5cebbe71c5f098efb4037a9ec229310082b0fab2de10b8a0f94b0213d5119cd9ff66daeaa73ca2163ba0224b5cd8526f7bbea

                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2405231454321011840.dll

                                                        Filesize

                                                        4.7MB

                                                        MD5

                                                        5044c8d830417b5e7d8a05c69ba678e1

                                                        SHA1

                                                        45fde84a35f58cc830935997f47eaccb076b4ad5

                                                        SHA256

                                                        0f28ae30d4572875e1f23ea38dbd25b1f19007f46987833c164f5fab83d21cad

                                                        SHA512

                                                        3fa339c773526b94f4c0b8c844563f4547b94c768fe3d139999f9577394cccc04e236964286bea34e9631e70f71581ed3edd2cde6aa6b3ff351034172e9774de

                                                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                        Filesize

                                                        40B

                                                        MD5

                                                        80cd150af4a84379dd95fe43193a3562

                                                        SHA1

                                                        f531bb0b65cd4df30d8df31b032b9418380a33bf

                                                        SHA256

                                                        f95aea041e6a8b7c93cae2161ccb69d8e38e27bc31cee024c3e0adccb06fc84f

                                                        SHA512

                                                        1a753b83fba8d16de0b2d2cde6f0c64d32a5bceb9ba00908df6c66b93893da08f66f383f9b81e4e75a2474688d76bb9963c61b756c111fa7b7c42aa47faf3c25

                                                      • C:\Users\Admin\Downloads\OperaSetup.exe

                                                        Filesize

                                                        5.2MB

                                                        MD5

                                                        945249d0289b32f0c6564ec8348fe968

                                                        SHA1

                                                        16ca20675508b16c851e104c04d8e4386a279958

                                                        SHA256

                                                        97ab14f898d5c79f4c9552558350cf02f7272b460fcbf4b9dfaa3fc05c767b1f

                                                        SHA512

                                                        b80a5597b06e84d688f6304c734513ee01f34e283da713543696308d182cfbe9fad7bc838238a546bc4f7d9597b3aeac5e8ac887da6ccc18362bca21758f280f

                                                      • C:\Users\Admin\Downloads\OperaSetup.exe:Zone.Identifier

                                                        Filesize

                                                        26B

                                                        MD5

                                                        fbccf14d504b7b2dbcb5a5bda75bd93b

                                                        SHA1

                                                        d59fc84cdd5217c6cf74785703655f78da6b582b

                                                        SHA256

                                                        eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                        SHA512

                                                        aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98