408c7aeb8f4f7aa34cf388917969d3cae4fc1293b67070109ac5a0170eedb051

Analysis

max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaGXSetup.exe
Size 3.2MB
Sample241108-1lqphssrep
SHA256 408c7aeb8f4f7aa34cf388917969d3cae4fc1293b67070109ac5a0170eedb051
MD5 7f22c7e8763072efdc85b8d2a6aaca32
SHA1 c896267ee7ea4cb9811710b0bb890dc41548b6b3
SHA512 fbadfff30914065d1f01af6f80f3ac201e1d9d24cf4be9824f52b06d02ce8dc06c650dd3ed0988e195573f0100ed5570fa56abfd134d4fe29be0af2a6eab39ea
SSDEEP 49152:iVAbwEw9pn+uTEa3XAqBfpd9pZBsQggCcL+oVmYRg1+Awf+UW7isjQmwLWrMItvA:mA4+uTEvqBhezcXdG7j7wLW4Iq
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 22 IoCs

pid	Process
3648	setup.exe
2204	setup.exe
4144	setup.exe
5000	setup.exe
720	setup.exe
2392	Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
2312	assistant_installer.exe
2472	assistant_installer.exe
5880	Opera_114.0.5282.154_Setup_x64.exe
5468	Opera_114.0.5282.154_Setup_x64.exe
5992	Opera_114.0.5282.154_Setup_x64.exe
6016	Opera_114.0.5282.154_Setup_x64.exe
6140	Opera_114.0.5282.154_Setup_x64.exe
1608	Opera_114.0.5282.154_Setup_x64.exe
4528	Opera_114.0.5282.154_Setup_x64.exe
3496	Opera_114.0.5282.154_Setup_x64.exe
5616	Opera_114.0.5282.154_Setup_x64.exe
3624	assistant_package_sfx.exe
5460	assistant_installer.exe
5500	assistant_installer.exe
6028	Opera_114.0.5282.154_Setup_x64.exe
6096	Opera_114.0.5282.154_Setup_x64.exe

Loads dropped DLL 20 IoCs

pid	Process
3648	setup.exe
2204	setup.exe
4144	setup.exe
5000	setup.exe
720	setup.exe
5880	Opera_114.0.5282.154_Setup_x64.exe
5468	Opera_114.0.5282.154_Setup_x64.exe
5992	Opera_114.0.5282.154_Setup_x64.exe
6016	Opera_114.0.5282.154_Setup_x64.exe
1608	Opera_114.0.5282.154_Setup_x64.exe
6140	Opera_114.0.5282.154_Setup_x64.exe
4528	Opera_114.0.5282.154_Setup_x64.exe
3496	Opera_114.0.5282.154_Setup_x64.exe
5616	Opera_114.0.5282.154_Setup_x64.exe
5460	assistant_installer.exe
5460	assistant_installer.exe
5500	assistant_installer.exe
5500	assistant_installer.exe
6028	Opera_114.0.5282.154_Setup_x64.exe
6096	Opera_114.0.5282.154_Setup_x64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 12 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\F:	Opera_114.0.5282.154_Setup_x64.exe
File opened (read-only)	\??\F:	Opera_114.0.5282.154_Setup_x64.exe
File opened (read-only)	\??\D:	Opera_114.0.5282.154_Setup_x64.exe
File opened (read-only)	\??\F:	Opera_114.0.5282.154_Setup_x64.exe
File opened (read-only)	\??\D:	Opera_114.0.5282.154_Setup_x64.exe
File opened (read-only)	\??\F:	Opera_114.0.5282.154_Setup_x64.exe
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\D:	Opera_114.0.5282.154_Setup_x64.exe
File opened (read-only)	\??\D:	Opera_114.0.5282.154_Setup_x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_package_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 221768.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\Opera_114.0.5282.154_Setup_x64.exe\:SmartScreen:$DATA	Opera_114.0.5282.154_Setup_x64.exe
File created	C:\Users\Admin\Downloads\.opera\Opera Installer Temp\Opera_114.0.5282.154_Setup_x64.exe\:SmartScreen:$DATA	Opera_114.0.5282.154_Setup_x64.exe
File created	C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\Opera_114.0.5282.154_Setup_x64.exe\:SmartScreen:$DATA	Opera_114.0.5282.154_Setup_x64.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
856	msedge.exe
856	msedge.exe
4720	identity_helper.exe
4720	identity_helper.exe
5688	msedge.exe
5688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3648	setup.exe
3648	setup.exe
3648	setup.exe
5880	Opera_114.0.5282.154_Setup_x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 3648	2596	OperaGXSetup.exe	88
PID 2596 wrote to memory of 3648	2596	OperaGXSetup.exe	88
PID 2596 wrote to memory of 3648	2596	OperaGXSetup.exe	88
PID 3648 wrote to memory of 2204	3648	setup.exe	89
PID 3648 wrote to memory of 2204	3648	setup.exe	89
PID 3648 wrote to memory of 2204	3648	setup.exe	89
PID 3648 wrote to memory of 4144	3648	setup.exe	90
PID 3648 wrote to memory of 4144	3648	setup.exe	90
PID 3648 wrote to memory of 4144	3648	setup.exe	90
PID 3648 wrote to memory of 5000	3648	setup.exe	95
PID 3648 wrote to memory of 5000	3648	setup.exe	95
PID 3648 wrote to memory of 5000	3648	setup.exe	95
PID 5000 wrote to memory of 720	5000	setup.exe	97
PID 5000 wrote to memory of 720	5000	setup.exe	97
PID 5000 wrote to memory of 720	5000	setup.exe	97
PID 3648 wrote to memory of 856	3648	setup.exe	98
PID 3648 wrote to memory of 856	3648	setup.exe	98
PID 856 wrote to memory of 2384	856	msedge.exe	100
PID 856 wrote to memory of 2384	856	msedge.exe	100
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 4384	856	msedge.exe	101
PID 856 wrote to memory of 880	856	msedge.exe	102
PID 856 wrote to memory of 880	856	msedge.exe	102
PID 856 wrote to memory of 3364	856	msedge.exe	104
PID 856 wrote to memory of 3364	856	msedge.exe	104
PID 856 wrote to memory of 3364	856	msedge.exe	104

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\7zS42A7E1B7\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7zS42A7E1B7\setup.exe --server-tracking-blob=Mzk3ZDA2MjU5NjQwZjc5NWJiM2IwZDQyNTRjODM3ZTU5ODRkNWMwODFiMGNhN2E4YTdmN2M3OTVjMjU3MThlNzp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9VU19IVlJfUE1fMjgzMSZlZGl0aW9uPXN0ZC0yJnV0bV9jb250ZW50PTI4MzFfJnV0bV9pZD00YjZhNzdlMzZhMzc0ZDlkOGRmYjc3ZjRhZDM2OTU4MSZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3LmF5ZXRzdHVkaW9zLmNvbSUyRiZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRiZ1dG1faWQ9NGI2YTc3ZTM2YTM3NGQ5ZDhkZmI3N2Y0YWQzNjk1ODEmZGxfdG9rZW49Mzk4MjE1MDciLCJ0aW1lc3RhbXAiOiIxNzMxMTAyMjU0Ljk0MjciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTMwLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfSFZSX1BNXzI4MzEiLCJjb250ZW50IjoiMjgzMV8iLCJpZCI6IjRiNmE3N2UzNmEzNzRkOWQ4ZGZiNzdmNGFkMzY5NTgxIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vIiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6Ijg4MjZhMjEyLTYxOWEtNGYxZS04NTQwLTU1NjBiMzMzODBmYSJ9
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Users\Admin\AppData\Local\Temp\7zS42A7E1B7\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7zS42A7E1B7\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x32c,0x330,0x334,0x304,0x338,0x749e8c5c,0x749e8c68,0x749e8c74
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\7zS42A7E1B7\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS42A7E1B7\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3648 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241108214445" --session-guid=cb9c9519-979d-4e26-bdbf-4eb59891ba56 --server-tracking-blob=YTZkY2RhZDY3NzBiNjE0Y2MzNjY2MzE4NjczY2JjYmYwNWQzMjU4NjMyMTA5MzM1MmUzYTVjMzQ1ZWM3NTJmMjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9VU19IVlJfUE1fMjgzMSZlZGl0aW9uPXN0ZC0yJnV0bV9jb250ZW50PTI4MzFfJnV0bV9pZD00YjZhNzdlMzZhMzc0ZDlkOGRmYjc3ZjRhZDM2OTU4MSZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3LmF5ZXRzdHVkaW9zLmNvbSUyRiZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRiZ1dG1faWQ9NGI2YTc3ZTM2YTM3NGQ5ZDhkZmI3N2Y0YWQzNjk1ODEmZGxfdG9rZW49Mzk4MjE1MDciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MzExMDIyNTQuOTQyNyIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzAuMC4wLjAgU2FmYXJpLzUzNy4zNiIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9VU19IVlJfUE1fMjgzMSIsImNvbnRlbnQiOiIyODMxXyIsImlkIjoiNGI2YTc3ZTM2YTM3NGQ5ZDhkZmI3N2Y0YWQzNjk1ODEiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS8iLCJtZWRpdW0iOiJwYSIsInNpdGUiOiJvcGVyYV9jb20iLCJzb3VyY2UiOiJQV05nYW1lcyJ9LCJ1dWlkIjoiODgyNmEyMTItNjE5YS00ZjFlLTg1NDAtNTU2MGIzMzM4MGZhIn0= --desktopshortcut=1 --wait-for-package --initial-proc-handle=3808000000000000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\7zS42A7E1B7\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS42A7E1B7\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x320,0x324,0x328,0x2fc,0x338,0x72238c5c,0x72238c68,0x72238c74
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
    3⤵
    - Enumerates system info in registry
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff150446f8,0x7fff15044708,0x7fff15044718
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5572 /prefetch:8
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6108 /prefetch:8
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6252 /prefetch:8
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
      4⤵
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5688
  - - C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe
      "C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      PID:5880
    - - C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe
        
        C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=114.0.5282.154 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7fff11a92bb0,0x7fff11a92bbc,0x7fff11a92bc8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\Opera_114.0.5282.154_Setup_x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\Opera_114.0.5282.154_Setup_x64.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202411082145581\assistant\assistant_package_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202411082145581\assistant\assistant_package_sfx.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202411082145581\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202411082145581\assistant\assistant_installer.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202411082145581\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202411082145581\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=114.0.5282.154 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff73fb674c8,0x7ff73fb674d4,0x7ff73fb674e0
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5500
    - - C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe
        
        "C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5880 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20241108214558" --session-guid=c6c6c03b-bb57-4989-bed2-d27ef1a51e1e --server-tracking-blob="NjFkODk4ZWJjMmNmNGQ1YjllMzkyYmJlMjJiYmQ5MDY3ZjdhY2U0Y2Y1NWMzYTQwM2Q2Zjk0N2YzZTU1NDA1Yzp7InByb2R1Y3QiOnsibmFtZSI6Ik9wZXJhIn0sInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fX0= " --desktopshortcut=1 --wait-for-package --initial-proc-handle=3409000000000000
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        
        PID:6028
      - C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe
        
        C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=114.0.5282.154 --initial-client-data=0x290,0x294,0x298,0x258,0x29c,0x7fff10eb2bb0,0x7fff10eb2bbc,0x7fff10eb2bc8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6096
  - - C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe
      "C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      NTFS ADS
      PID:5992
    - - C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe
        
        C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=114.0.5282.154 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7fff10eb2bb0,0x7fff10eb2bbc,0x7fff10eb2bc8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6016
    - - C:\Users\Admin\Downloads\.opera\Opera Installer Temp\Opera_114.0.5282.154_Setup_x64.exe
        
        "C:\Users\Admin\Downloads\.opera\Opera Installer Temp\Opera_114.0.5282.154_Setup_x64.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
      4⤵
      PID:960
  - - C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe
      "C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      NTFS ADS
      PID:1608
    - - C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe
        
        C:\Users\Admin\Downloads\Opera_114.0.5282.154_Setup_x64.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=114.0.5282.154 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7fff102d2bb0,0x7fff102d2bbc,0x7fff102d2bc8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\Opera_114.0.5282.154_Setup_x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\Opera_114.0.5282.154_Setup_x64.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14254755113744526988,15552782037285085673,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1792 /prefetch:1
      4⤵
      PID:5416
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411082144451\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411082144451\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411082144451\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411082144451\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411082144451\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411082144451\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0xf44f48,0xf44f58,0xf44f64
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 6ad47d714f3dd55b2fe9072e829542851d2ecf60cb88254002c60449e8aca736
MD5 7795df33fc7dd3aa62e0bc052f9dfbad
SHA1 ea227ec994561b5bce01c5228f9c337286fbec9c
SHA512 de11027f0ca32119ebbb17976ecbe6582ab6af8caa7ce522d75c4185da722550f1f981064db9be6074eb1c6c096c933c2de7ee42b1f31b4fedc9982f87157f9d
MD5 SHA1 SHA512

Submit Download

6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Size 1KB
SHA256 9090028dfc081a6391a535ada1848ea73f115df2a1e40921fe231150a3896a89
MD5 30d2844046ab547e7e4eeabd12808f44
SHA1 8666b5768b18a3034ecdd370414664e2938091fe
SHA512 924bdb692ab78c6abab6eb1fcb4444dcf5a1fb19be46bb9d4f53089f52dec6482a9c15252e97381676df127bb17145aed8da9fe7f6b39d94ed6f708e42e607cc
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 47bf8749c1ac54c6586d625c99219f03c6a073f3b3f5689444985aae85a3e5b1
MD5 f0339c0506fe0b51215f7227b14e656f
SHA1 cf937eeed1483e23e81244baa03d5e8f112c56d5
SHA512 afb55465411bce78b7453e17aca382e0add24a1b0dd7f116cb077a2641abcbde8684e076d69ca6a3a61a3e47d156f85c80621082ab1a80f4a5b3b1b75f20d5bc
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 471B
SHA256 886321648f37f0511ec90a6c31e6d284b7cb3b44bb3fb0a5120085322bdbe64f
MD5 40066543a0957bc9d1fd490a400bfdfd
SHA1 486507b14eadc39540527e64049de64e0d24bf6e
SHA512 93b80e0c1e4b876056f984cac5cb67781136d46609794e6a9cc5431e5a8d0a9232fd92bc0e1c17d161b6e60be077c3df6c7a319714a2ac74427faaec77ae2f4e
MD5 SHA1 SHA512

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 d46058a23dd39ae94ed2161cd6e36c093340da9e1966bac51426f237295f5fd9
MD5 8196c1ce2c46c8863ca345a04c5eaa9b
SHA1 d0b5a97d6bdde2176ce8542ad6941d4aa06d6713
SHA512 68e4bf879c61a7eecacb26845ba853f2d85373a5ea38bf389fd2278d74e1fef53c1c09099712ac679ca2d9a76f2ad57fc32c134aa4886f0949114c122b28f043
MD5 SHA1 SHA512

Submit Download

6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Size 408B
SHA256 ed294aaac52a1de5fece32cb54203d4860e9eebd216af6ee766cc075cb45e3c2
MD5 cbf6c59d6d3139a6faf8550d03da848f
SHA1 1b1c66d69c340b03baabd91f9acc13f45818197d
SHA512 acef489dae7b3b153060e7cfc4d2ffff23f855b531182b40ad9ef418f049418d7f62fc56422c2b1c7e08a15d53f1fd66da616841f4943b25e4edfcb787644020
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 0619013c993fd5e882704d7ef648105cb53c94656d50ed8ed974c7733f048da0
MD5 7906e602f6daf4918c942369b049bd2a
SHA1 41e857c80c2ec2db6776a65c876aa4f1b6d78979
SHA512 d014818905124681eb7045b6545069b762270e591b651dc943f5b1c2630ad861dff1861480554e8454f7dca2b2ffa6a6ef229e9ffece87f9e3bc6ed0e6f8d015
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 26ba0ba18eda573a4fefad806ffdaf099bf5018e979240d09fe1ac0f3b7c814e
MD5 6346e58d3eb48c73d41e31700c5c7e4b
SHA1 ffde778b0b6e25b5fa3b38bcc5b1a45ae227bfc6
SHA512 ffb460ef533e2e134988823fb56549977eaa0773bfc59df34a1a4634b5bed2c148187c7379b329b4472b29178a2e6c35709a61a5e80d04010c5a767e85370ac9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
MD5 a0486d6f8406d852dd805b66ff467692
SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
MD5 dc058ebc0f8181946a312f0be99ed79c
SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 9e5e1606e62aeb9acfe67274851d54afc18ed31674161aa66201063a6c523faf
MD5 b640349528c4318b0a7b9ece6ac05571
SHA1 50916828272b44442771d3dae88acfbcb17f8367
SHA512 c2bf4340c8c30c3c32f80042d0be33cd0b0d10944ee4517021e2c48f269313dab11c35e37f9eb675ec68e8351f37592752190c48b4940f008a8ded80643fe359
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 d004f3e876291e1da69cea5a5f6e48f3fa4a34f1e120d8482a7f021d88ffc7c9
MD5 d6088c3c3d3e9bb56c6be694b429eb6a
SHA1 cc11ee4b646ae12f255b3527e4f8ed2765e36ac6
SHA512 c96c1e6cbe8a30c72e52c1d476e251408b784cad6d69756746d344d253573d0da66b0c749ef3f94e5e0aba92d184a1692d0a776b7ae552d2c619137e21e8eed0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 99c52a10f735062b9912af804ca91b672d51b25d4352fbd45440eaa597f15b3b
MD5 f4f2afd0381181b56755e78c0f0f4443
SHA1 d24e05b1a671d2e22c27cf0deead5e073afc8b5b
SHA512 df2740eb6e9b3b117a9f8da73bc3f6c2be22b2c1307d5df9a255c6db9d906cdeb36b3a93207bf484bd4f2b5d751c341d1988be11ab9bd0efe91c5e55e25a2b2f
SSDEEP 192:nZktaYGWMM2wD8f/xYyk2nv4VJsWq8OQ+2brg:nZqaVWBXzVDC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6f2e1d1fafdc846691b0195d9e5eb9d7de9af077ee3b1f27ff7c43d0c6fbb70f
MD5 011a17e5904ec1a61bda6af76832379e
SHA1 e4df66b16005961c43cd391f2e560f2818f4b467
SHA512 85bdc728f787e1cbe15bbab3feb51a8123a866e87973b23bf5f7d3537e46b35fba29617b6996924b176302096077e0498f0d75e087c433896f021ba823459b0d
SSDEEP 96:nZkJA1+R9wpvWMoiVmdeH5eEUWQyV+VD7AiEwb:nZkea9GWMXRrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 acc410ead85cadfb69a90efcd3b75bd6006939550751ccd98a1736776c76b26e
MD5 d7f565e4f4c0f41cad229a587434cdad
SHA1 dac55e8d4236258781b100be782a99a8c1d0cb53
SHA512 30521ee611104f1e81d80b05e6bbcaeee77126cda6742a8fc9443ceadecedf17449ee63ac5e6bff8549086520f4429ba068a2cc8f9b03c01ba41a8c1bb50cea5
SSDEEP 96:nZk2A1+R9wpvWMoiVmdeH5eEUWQyV+VDCziEwb:nZkPK9GWMXRro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 acb600753d9a1a6bd23abcf09ab29e320eb0b69098fdb5c885ca9917d1039cb0
MD5 f34db5b1c44e9cec01fdff1aa12d734c
SHA1 619a49de458e584dd77d32890c718ad6aff35cb2
SHA512 777eaa129afc030264f5682b11b907bf58dd7cc1b04ecbd5d85ffe0e4b8eb9869c5a01cc3c867dcdd63e2ef536d751e2588dd693a54f7be2aa1a1d437d7b3be6
SSDEEP 96:nZkswXsQOA1+RYwpvWMoiVmde8HuTS1/yIb2gGhoGQq5sEUWQyV+VD7AiEwb:nZkPZaYGWMMHuW1yk2vOqHrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 813e031532c388a2842c2222e133d63c0082f6e24cbcbfcf04da22551dfa4737
MD5 7f0cd2dcbe4c4adac770d1557c8cc5c1
SHA1 14ba87b70f52807c78efd97f5f1cc0d4256d433a
SHA512 b1bdd4da21a7867d043b8d3a351fb39606c28025e1491610a3f434d814c9a69e3943d9caa1da33f263f94ebca1719c6d71e594a371ade520e9bcabe768a48f01
SSDEEP 96:nZkssQOA1+RYwpvWMoiVmde82wDjByIb2emgGh4VJCfWq8GQQ+25xxUWQyV+VD7l:nZkSaYGWMM2wDtyk2nv4VJsWqiQ+2drg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6fdd77ba9052cf76393aa06d9b0dfd56c5a4de99f6a662137a44334b6aa1f495
MD5 15cdf09c3b77f3e32ab2b4d486f55973
SHA1 322588a8b69a94975d826b271dea2a67bb82461c
SHA512 2fa4fdd83678e29aaabbbe461e006dc726e8276bc12df215d1ca141ffc999eda662ba8164a1bdfaf194724a59788a24a444424c952ac242805da39423cdae8e4
SSDEEP 96:nZks4A1+RNwpvWMoiVmde8HuTS1j5sEUWQyV+VD7AiEwb:nZk0aNGWMMHuWhHrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0ce8d4a86d5d45045aa5f8c955d8cff581f0da2a1ad962194ef88a2098eada06
MD5 218aa865eb6f3b1255d7668c6b1c47b2
SHA1 37a3ba5f8294c098b8817a694581fa112c323c1b
SHA512 6e0ef93815fc4939d6e55097fd4f7729db56de54548e9f0da69a6becfddf3d49c5beb4e468f361fb548c9965db28ece01e7da62e3643627e4115cf61e743eeb9
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58629d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58629d.TMP
Size 48B
SHA256 e6ce65606f8d8817b0e9754565e339fc4d1fba9b995e34b1ee7b6abd7050d9e7
MD5 f7bc78a8d68039f2ae23b5fe58444235
SHA1 a889f6c9dca93997862ca13cb5e8361de1d873e4
SHA512 dc136662ac4dcba67b676e01c13859dd494adf01fe90892375cf6ab7360cbadef7e9d821e5db2141d235f5d945ff93ceaeec0d8b315fa484c3be105c26906df3
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 a484a90995c11efcf016f26c70bdb83f2c9b0ab66a1f1b8727f43c6e29fcbd8f
MD5 42e51b65a7fcd24b5d188ca3505cfb14
SHA1 0fbc0efc1b2e11c2d80eeec284442c8f03cdc67b
SHA512 c3cfea46a5928f2b7e0e5e9b1d1e0bd2bf50d3dd21c8932357a3314f4272775b57f490bcb898f3ebf258ae1287bdc0c9c469d45bc46bc216d6397fa17c85cb0d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 5f06012954ab29556e936d298859eb36d2c0d387122374e66d8bb53579bd6529
MD5 e6d3200317563fda8de04cb904dfdb85
SHA1 84acb43a7bb16e9ffba97497a3baefc0e75c36d2
SHA512 e6ebcfaa983f7e83efa1b3fc3b09f8314106092b6ad4fee2d74bae9c3fb3fb68b4b2f11ac19aabd6a3ef2ed00467953612df9d5b4219d88c98337eb228af41e3
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe583b10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583b10.TMP
Size 537B
SHA256 4a15b565a4bdeebc3191c30e0614f3706299e324929356e403e4cafba38abbe8
MD5 ebd5a763df962f0da9e3722c6484586d
SHA1 52a3dc5e0edae4d59ee9aa8b1b17e5f3ead931e8
SHA512 5454183809df012c261346adb13697bc0e4c1982f1b4a8089e330c0a38132e90ff8bfaee59083f8e26a320c3b93f10bb416146314944a55a2e24e5679175b901
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 0401e39702e962b23f5f3448db10c74db578ad428580646890325f77e3f2b167
MD5 abc3d34a08085dd78d395c440b5db8c5
SHA1 fa573060fa085785f718509281a63e60e7a5f48d
SHA512 0d5eba1595b4fa2f66993f2a082eb9a1a49e5b5ed1668712e207e1eceea9ea832fbecb649fcd1df4c221cbc770dafb39be562365b7f1053259348d2151880d23
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup2e2RUMLkyo7HqRUx3GPOxb:A9iIxuERzA83h09RZxYY562SFGmx8oiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 96255198377fb782ca6f20b126084e3022280a006e42c2ca92d2bb3907d93da8
MD5 d2ea6b9e4ebceb0811ca9051a6fd6122
SHA1 974bd0c885c591d66af88943ea068ac3dc3a8337
SHA512 05d96860713a3c898949c00c4f7435cbbc2ab50bd5a58857d44b29aba09da202adfee67c37df7f1824949f1cec3ea1cd1866413d1f03158b4549a609c3bd343c
SSDEEP 192:tFoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSe2RUMmcvkyovbHqRUx3R:T9iIxuERzA83h09RZxYshv6OSFGmx8oD
MD5 SHA1 SHA512 SSDEEP

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411082144451\additional_file0.tmp
Size 1.4MB
SHA256 e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f
MD5 e9a2209b61f4be34f25069a6e54affea
SHA1 6368b0a81608c701b06b97aeff194ce88fd0e3c0
SHA512 59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5
SSDEEP 24576:4ACKcQz8HkfJ8dQnd4GrbwsgY+UfLBCQdI5f3cjCRgCPPWCUZry8k/GUrbN:5pT8HkfJ5eGrbmR0afsXCBrG
MD5 SHA1 SHA512 SSDEEP

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411082144451\assistant\assistant_installer.exe
Size 1.8MB
SHA256 afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a
MD5 4c8fbed0044da34ad25f781c3d117a66
SHA1 8dd93340e3d09de993c3bc12db82680a8e69d653
SHA512 a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481
SSDEEP 24576:K9A2yB7Nxu6wdWob6zD0fnBa2M9SmWqRYv9XTQdg7VHUw9MqNTLTM7DbXTWs4HU+:cAF/wvfnJ1zRH/2qNvsD3W3HUTX4Ean
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS42A7E1B7\setup.exe
Size 6.5MB
SHA256 87a168a04a254b1cf1adfe732e8b7b08d5c3e76ddca4e8b7fb4e58ebef85fe64
MD5 dcc0d15e77a7872758e65deb0bfc6745
SHA1 1efb89e143bf5edd34d46ae8370ecc13d4c3339f
SHA512 9cb972bcd99fd03a924bbff79e8989a040d1202a77c9d8f62ea862cc6b1d258778410ad9a4de5f2aab43062f5e9fe17d7ab9baa000de98d22a47f1471d1de778
SSDEEP 98304:j+hx5R6666666666666666666666666666666x666666666666666fwwwwwwwwww:lSJmoDdtVFsg5uwx1jh6Uo3s2CRDw8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2411082144448503648.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2411082144448503648.dll
Size 6.0MB
SHA256 e48eb19ca0210f9063f4e77c2f14293ee940eeaef2ecb9efceac7f6336cc203f
MD5 1b07ce60bc1c77f0cadf13c2e62b1383
SHA1 ca70d0ef99ae5d1ebf85880ee669ad1145e4d79d
SHA512 94c358b6dfef0fcb0012a3a43235292b18ebf897043baef0c110570e91cc73721b12f1f771df6d000b4097f3c0cc22dcc65330a9153c7a9643787d24da6108f0
SSDEEP 98304:66666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww2:BSJmoDdtVFsg5uwx1jh6Uo3s2CRDw8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2411082145560165880.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2411082145560165880.dll
Size 5.8MB
SHA256 0d7c50ba10a7c83d0aae8836363b3ee0c51064207499e03dd2864e9581037e33
MD5 ec406fac0ee7d7fdcb95d50cf8aadcb0
SHA1 7ebf152e12a1ed87c49d2cb38b165c0de845263a
SHA512 abe0b79543df08ebe3e6c70f3cca7bf7f23f34a7ee5f3d774af7af2e3b111912a9e504a8856d11777870c470d028d0b361bec9ebb42465e0d7316709e9f0729b
SSDEEP 49152:iKwkhjltrnpfHM2BCLg6uebssbAbZ6Sl0dyJ06mSvRvEJYftClpXckbo/b1VuxYO:nBTpwbfq06qJstCre1V6hW9Lq
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 b75f7d02a141a4ead48b5afb3a6e103cedd7354346474a59b26d477d4a4acbc2
MD5 8fd4ea3e9cc942557c06d91d693fb124
SHA1 349bb64850042961aee4c674cbabb356aa1733ee
SHA512 f1b4201e1dc1da17a096e1b3dc5f162616876079b55e37d47b679dcd944fd5c4fd287b207ac21186fca1a45ad021c621bdfdfdf85fb5703db82109b250f46f9e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 d04a04c34c3f4502f993e23b397b0f7c2bf7de5742d523541fca7ac68886c60d
MD5 85f36656572a1d4e805cf5130b9873b2
SHA1 66c1f3c9abc2536503f27bd005fd56b7f78c73aa
SHA512 ce72aa2f2482815901d3b12dfec6f956e4f6da7907ef2b5aa61b10568df5a8576680d2648d6f62f0dd29adbe9cb035cb8b17d6bbea6dd95e3e7ead6df87c0856
MD5 SHA1 SHA512

Submit Download