Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
23/05/2024, 14:58
240523-sb9ewafb52 823/05/2024, 14:54
240523-r9wq1afa2y 823/05/2024, 14:48
240523-r6y2yseg91 8Analysis
-
max time kernel
230s -
max time network
234s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
23/05/2024, 14:54
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
pid Process 1840 OperaSetup.exe 244 OperaSetup.exe 3432 OperaSetup.exe 5108 OperaSetup.exe 2628 OperaSetup.exe 2124 Assistant_110.0.5130.23_Setup.exe_sfx.exe 4628 assistant_installer.exe 3400 assistant_installer.exe -
Loads dropped DLL 9 IoCs
pid Process 1840 OperaSetup.exe 244 OperaSetup.exe 3432 OperaSetup.exe 5108 OperaSetup.exe 2628 OperaSetup.exe 4628 assistant_installer.exe 4628 assistant_installer.exe 3400 assistant_installer.exe 3400 assistant_installer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: OperaSetup.exe File opened (read-only) \??\F: OperaSetup.exe File opened (read-only) \??\D: OperaSetup.exe File opened (read-only) \??\F: OperaSetup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609496642274276" chrome.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e OperaSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e OperaSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 OperaSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 OperaSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 OperaSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 OperaSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e OperaSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e OperaSetup.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\OperaSetup.exe:Zone.Identifier chrome.exe File created C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe\:Zone.Identifier:$DATA OperaSetup.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1264 chrome.exe 1264 chrome.exe 4992 chrome.exe 4992 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1840 OperaSetup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1264 wrote to memory of 3252 1264 chrome.exe 79 PID 1264 wrote to memory of 3252 1264 chrome.exe 79 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 1740 1264 chrome.exe 80 PID 1264 wrote to memory of 2924 1264 chrome.exe 81 PID 1264 wrote to memory of 2924 1264 chrome.exe 81 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82 PID 1264 wrote to memory of 1548 1264 chrome.exe 82
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://opera.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff82735ab58,0x7ff82735ab68,0x7ff82735ab782⤵PID:3252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:22⤵PID:1740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2132 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:12⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:12⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4120 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:12⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4480 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4468 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:2044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵
- NTFS ADS
PID:924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5028 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:3040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5004 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3948 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:12⤵PID:2024
-
-
C:\Users\Admin\Downloads\OperaSetup.exe"C:\Users\Admin\Downloads\OperaSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1840 -
C:\Users\Admin\Downloads\OperaSetup.exeC:\Users\Admin\Downloads\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=110.0.5130.35 --initial-client-data=0x2bc,0x2c0,0x2c4,0x2b8,0x2c8,0x74bff308,0x74bff314,0x74bff3203⤵
- Executes dropped EXE
- Loads dropped DLL
PID:244
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3432
-
-
C:\Users\Admin\Downloads\OperaSetup.exe"C:\Users\Admin\Downloads\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1840 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240523145432" --session-guid=818aa713-5266-49be-b565-1343cc26477b --server-tracking-blob="ZTM0ZjQ0NDJmMDk3MmEyYzc0Y2U0Njg0NWMyNDEyODk0ZTgyZWVjNmYyMjAwYTE0ZDAxZmY0ZTBmZWY5MzY5Zjp7ImNvdW50cnkiOiJHQiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhIn0sInF1ZXJ5IjoiL29wZXJhL3N0YWJsZS93aW5kb3dzP3V0bV9zb3VyY2U9JTI4ZGlyZWN0JTI5JnV0bV9tZWRpdW09ZG9jJnV0bV9jYW1wYWlnbj0lMjhkaXJlY3QlMjkmaHR0cF9yZWZlcnJlcj1taXNzaW5nJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGJmRsX3Rva2VuPTg4NzEwMTE1Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE2NDc2MDYxLjg4MDciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTEwLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiIoZGlyZWN0KSIsImxhc3RwYWdlIjoib3BlcmEuY29tLyIsIm1lZGl1bSI6ImRvYyIsInNpdGUiOiJvcGVyYV9jb20iLCJzb3VyY2UiOiIoZGlyZWN0KSJ9LCJ1dWlkIjoiMjgzZjkxNGMtYjg2YS00YTBhLWI2NTgtMDZhNDQwMDk4OTQ1In0= " --desktopshortcut=1 --wait-for-package --initial-proc-handle=B4080000000000003⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:5108 -
C:\Users\Admin\Downloads\OperaSetup.exeC:\Users\Admin\Downloads\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=110.0.5130.35 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2c8,0x722bf308,0x722bf314,0x722bf3204⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\Assistant_110.0.5130.23_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\Assistant_110.0.5130.23_Setup.exe_sfx.exe"3⤵
- Executes dropped EXE
PID:2124
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\assistant_installer.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=110.0.5130.23 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x8630e8,0x8630f4,0x8631004⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3400
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4460 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:12⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5924 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:12⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6036 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6176 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:3608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6328 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6480 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:82⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6292 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:12⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6840 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:12⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4548 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:12⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=1504 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:12⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=4888 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:12⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5620 --field-trial-handle=1820,i,9558636304431498780,13727293832143147435,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD514fae84a346bb0bb762bb6b6e05b4ff2
SHA1148d0ecf5bf7f993b70d57dbc4eb856f181e9c51
SHA25647c8853e9a15e7c79bf9341073a4fc5340e3a3876a9be034b598b0fc41ed576e
SHA512f44cb11b6ce96971aa524954b250b6dbf9838fb667ec473e217245d859536b4e2f5bafcd1f7c097f689c422981bcaa63ff7685eac7f274e329003f3cdb1cd0ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0F90096E7DCB862ED66CE39084FC7811
Filesize727B
MD5a25241f2e55b3007ef5b628f4b84f8e5
SHA1905c27f34147442eb62d7ec84b5017eb3d4a5b28
SHA2563b53529bcaffd93e4d487971956fa104ac3dc791c43c5c4677a76e12979d863a
SHA512491ce7ad68de902185e20c074a723fdc47bf43420124209e843c40271c872b8197eed55e6eeb0625b44d1f4f74ace3d85801c522071f672fdbfa3bdc795ac7dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD5a90ff749a13166b81da25cdcbc82c54d
SHA1a09692688b0a86d9e06b6a3697d2a1793f367961
SHA2564b1553fdbeca127a257bed3bd232cad24df64166cd39a54159893d5c350ac742
SHA51254dfe43bb1c88eac7d29e641171a27f72270bea50d3d989217f3a739943f4a3d751689dab68319ed7e800986cac1c5053305252a5f92fe14f1566f425f7994b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD51ba79e32e632d4a80083bcc94f268a68
SHA1d0fa1a9fed942adfed79e1da6828df16e0b13837
SHA2569ecc4e6fc358f461da540f313f48c9420ace5d2a2ad7b2721ae8c6ae7c708d51
SHA5127f839364195ecdb1d263457fe0bdb8f85bcc61a5ae6c5300fdf0e37b246d7d70408f6166e08c0013449b2993281394ba73b7266f7989d263c182e355b9968baa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0F90096E7DCB862ED66CE39084FC7811
Filesize412B
MD5b581fba6f5113ddc691f5cf154d788cf
SHA14437dd2539ef9c2d30c61f89b9811b7c52b55b36
SHA256a9194ed2a53765c94cc46436c9817dca85f7b731c90229fbbf0a9597381fdd07
SHA512f937ce4ad979914c43512bbac5ea9263d9edbc3a53db3277209e237d41190c70195859e7640e820a12c1140e642def0071eadaf95eb8f4ca99ef414d78931198
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD5505b4dd8793ffe7e80dd57d6ce400e5d
SHA1e5e98f144ce6512790772c0ca2a498778e5fb102
SHA2562744e6b73cf4c1200632e966203d5c65a694d0b1265b2144c3547d7d1f12c5ff
SHA512c7c9f89353c72923d98fd0c9bbf1891d85f968921b37a541c5ca954ca0817c8132eed62d02b2a0b385477072ff26f4901c91f4a98e556811860770df830e32e9
-
Filesize
552B
MD5024ea70e8bbd4dfc74b73f0c79d90e00
SHA1e5f121c2b2c082619cddc47c35a2b4abb4f24911
SHA25613ef9e9e0b65d6a9e01a9363157c9843aa6165952917cdcb67ca351d560c9c4a
SHA5121ea85fc60291f0e50c12cfc4c7a7268ba06af587f12fef080cf78865db3d242d6d3da9528433a46a7b64dd2d783f4aaf9304c2806c64f3c2a4cd8a4591086a62
-
Filesize
1KB
MD5ff349a4588c267b43a5677264bd6861f
SHA10c0f8e9c60289c82003502bda337598baecd785f
SHA256dfb9a91e2d7f1216ef8de2e99900dae8e9ad6e316814297e5199c15f653891cf
SHA5121a7c9ef53923675e9150c4a2bf44ef193385befeeac6f0a56fcee74fde036014bd2945be76d55d075314ac42de08e7a59272bce306e3ef81793ce47bbe5579a5
-
Filesize
6KB
MD55f55b5c1353b29cac1bbbe08f45acbb0
SHA1315469f860ec6aa512082ca45b6a6b2c4277f6f1
SHA2566fd0b4d0fc3269007f03ff1f0b5e7f8dbc334b2a4c70f6e547fd4a650da48127
SHA512f22401837abd8692cc8ba4668d0e6d0160e15cfc77dac571c08b9a66c9a1414cb261710fef79f42cfddb9d915bc20a84a3bfa1b4128a6a83246b79a7b34f4606
-
Filesize
5KB
MD5ddffbe98cb8c93eb51d1881b9d4a75f0
SHA132c345f8205038d40123767b9c35b5bdfed90043
SHA2567bd01a55dc7ee087cae9973cd4e888575e0d049bffec8b198b6e20c57acac02b
SHA512b1f970bba869e1a687ca60d62f2487bac16f8eaa13aef5b42557958e58f94c9547cca5cc266fdddb0d3c79e61643fdc0f968c4f419349e672ce1ea900a275250
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
2KB
MD58c0e0039bfe4904d2eb75972898bbd30
SHA1b0f8791d5889867d50dd035d6078ca87aa6aa80f
SHA2566a3d2283a9ebc2ec142c2ea8e1a7dd43c622d7299e3a811b668abd806a0d8c1a
SHA5129239687a75f128e705357332620efce4c6282ee59eafe2eb9134eb7b017a8f9c18cfffc450b15687f123415ba15833ef7c9dc60c9d1db5233a6b7caba042768f
-
Filesize
1KB
MD506ea524ecc7c7aa8553625f1b5334400
SHA10758e8ddd47c0b6d611f571aa96dd89820c064a9
SHA256e73c9892bea36ce6025c8639025ad35e461fe37e7ae9507a7fa836f9f8ffce33
SHA5128a97cbf67e151d99b54147ac1bd22f6bc5d6594e64cf474c7faf0eb5662d35bd5dc2a3ccf47645e19646938cc083b3ad36ed22b17ae561665307f489ca5b70dc
-
Filesize
1KB
MD527e2447115654bd520e357ee36121b68
SHA1dee291fd85fd28fd046764dc54a62b108bebca04
SHA2569e14cb3a1eac484ece33b8eea9bff912d8de68057a1fe2200e3da800309d613d
SHA5126d969bc210aae3fc1edf88c8f5f16b88f1ed5f8bc28869a48ac4d7d2712182a945a0ddad1f610202e8025679d002fb6a767b20e3af14d94d5f5a3d09faa163d7
-
Filesize
7KB
MD510c52445bee02235d20b9138c581d454
SHA14cf901be2e4643da8666f7c044b134c2f0854078
SHA256055cf49c6b80da83fe5165287d3beee1fc16b46a862a40bd356218eaf925d3ad
SHA51291f62224fcaf3223505e30a697ce37d0a0181b373b724dc6be1f0271e7f096e3e919ab7a6a2f5dbe3f0f40ab0b954fd508f7c5bdf5c6a7321130f3494845497f
-
Filesize
7KB
MD53473b074dbe540b516a03eaccea94915
SHA15ec968812e655aacb06f8cda19d93f0cf5b1b4a4
SHA256c77d4b252f03d64a072ff02940f3537d14ddce42726b82a6e5e05ca2e886812d
SHA51253528a54c559a90dbbd0ae8e6f48ed13cce2af2760e4de388d19662927ecebfd9c55102cca9b3ccb46540c8196be9d241a79c8b08b6577c4abc56bb462ed8a75
-
Filesize
7KB
MD5ed8fb653f39df21e04100258779b2b9c
SHA1811fe08d355fcf67adee4f754b0e3ee431abe0b5
SHA2567bb952532227631f4b1cae7c9ee996c76b8fdfb31bf3d056b86de4b9248b6cc7
SHA512efeaa33c18e6936b82da849b07328c0f517338784479e5732f4eafafb65d2ca0d14f38b71b811bca4c89e37f29c21adbb3bd9a6d654d8a69b494e721405fac91
-
Filesize
130KB
MD50286d4a1b9522c230f22399e2f35693f
SHA13e03efaff4b5775f55de64b03a320f7b2a1fbbf7
SHA256ba862c6a0ec6337c7d6c1a6d95d4d8310ed3a848970c166e28a32c42650485a3
SHA512a215f397876339bf69ccac1403c62f0f9a24db9c725a6d19826108094d2599afc741701166144025d868a3a399ff8e130728f49658f76a582866106f7bb05278
-
Filesize
130KB
MD57bfb4b1aad64da47db9d94c655d5149c
SHA1fc2a9497dbcd5f159097b6903dab87ec27251f36
SHA256df347a7b0ede79e5e2ba10a2c6b6aacd85105ca46c6b4dfcd9b826969ca10a8f
SHA512f35e4d484909d613f287c749334e7418e43ef837ab6b91bc7e4602445299852a180ad77107165357d64b0a2314c7fd5d5853d009d949b3b44564d2ae94c3a43d
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\additional_file0.tmp
Filesize2.5MB
MD5028fb19ee2cea3e611b4a85ac48fafbc
SHA1d1a802b5df649282e896289b4ec5df8d512b53dd
SHA256e8fa79e22926ae07a998b5d2bb1be9309d0a15772ac72b88f4eed66052f33117
SHA51299959d7765c1e6636dee1841f214cb2d0c7684d7128381b0387fa9c7ef4a92ef62bb094087bdcb343e44196b5a333df3a2104ced9f49671197a06fafa27aff51
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\assistant_installer.exe
Filesize1.9MB
MD5b6789061eb88781add48ec7095ff78e5
SHA1c2cdf5723a94b3b5a69ad78a5e869347444abe0b
SHA256c39c7199fa2221783ea61f085f484668e3c452706069b046cb0f4a9d4cb4c0a3
SHA5127c9a61c7f8d45fb7a2591c0c57c22bca0b527e3b6b4a3bdde5fbdcca25abc1e0c56a244a39d4b65a91316eb8f19fb8232569f5781eedefbc0898646d4df10f9c
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\dbgcore.dll
Filesize166KB
MD5a4ed3b36776e0155fd24ffa609ffc2f4
SHA13d6496f21e0f04b6789365d06e71fe7de284b1c0
SHA256b69387b9284dc36d377e4066c4cf361dc65efc6c784af0f8666d9684fabd2d29
SHA512ae5d052fdcc7e7d3e593a1fb2dd5e64fcd75c7381ff4e4c5f4302d8d3c058a48c943c66d04c02d44d45c2bda36b3d3df096dfea26fc35d3c682bdd5221225e76
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405231454321\assistant\dbghelp.dll
Filesize1.7MB
MD5fa64324149160877768551fd96c360dc
SHA1dd76ebe617271465ae5820f49152f8a89703ae1a
SHA2567f4a2cff90524b769781b763077be198d74834c6b576ef9f27132a415cbbaca8
SHA51272161c1b0449f546e2a3560369f5cebbe71c5f098efb4037a9ec229310082b0fab2de10b8a0f94b0213d5119cd9ff66daeaa73ca2163ba0224b5cd8526f7bbea
-
Filesize
4.7MB
MD55044c8d830417b5e7d8a05c69ba678e1
SHA145fde84a35f58cc830935997f47eaccb076b4ad5
SHA2560f28ae30d4572875e1f23ea38dbd25b1f19007f46987833c164f5fab83d21cad
SHA5123fa339c773526b94f4c0b8c844563f4547b94c768fe3d139999f9577394cccc04e236964286bea34e9631e70f71581ed3edd2cde6aa6b3ff351034172e9774de
-
Filesize
40B
MD580cd150af4a84379dd95fe43193a3562
SHA1f531bb0b65cd4df30d8df31b032b9418380a33bf
SHA256f95aea041e6a8b7c93cae2161ccb69d8e38e27bc31cee024c3e0adccb06fc84f
SHA5121a753b83fba8d16de0b2d2cde6f0c64d32a5bceb9ba00908df6c66b93893da08f66f383f9b81e4e75a2474688d76bb9963c61b756c111fa7b7c42aa47faf3c25
-
Filesize
5.2MB
MD5945249d0289b32f0c6564ec8348fe968
SHA116ca20675508b16c851e104c04d8e4386a279958
SHA25697ab14f898d5c79f4c9552558350cf02f7272b460fcbf4b9dfaa3fc05c767b1f
SHA512b80a5597b06e84d688f6304c734513ee01f34e283da713543696308d182cfbe9fad7bc838238a546bc4f7d9597b3aeac5e8ac887da6ccc18362bca21758f280f
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98