hxxps://sakpot[.]com/new-windows-nezur-executor-v1-byfron-bypassing-roblox/

Resubmissions

12/11/2024, 22:38

241112-2kkyba1ra18

12/11/2024, 22:35

241112-2hs6xawkgr8

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
12/11/2024, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sakpot.com/new-windows-nezur-executor-v1-byfron-bypassing-roblox/
Sample241112-2hs6xawkgr

Score

8^/10

defense_evasion discovery phishing spyware stealer

Malware Config

Signatures

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 9 IoCs

pid	Process
3736	OperaGXSetup.exe
2932	setup.exe
4648	setup.exe
4476	setup.exe
1340	setup.exe
760	setup.exe
5564	Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
5640	assistant_installer.exe
5668	assistant_installer.exe

Loads dropped DLL 5 IoCs

pid	Process
2932	setup.exe
4648	setup.exe
4476	setup.exe
1340	setup.exe
760	setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	msedge.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 991253.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
5036	msedge.exe
5036	msedge.exe
3224	msedge.exe
3224	msedge.exe
1132	identity_helper.exe
1132	identity_helper.exe
2468	msedge.exe
2468	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2932	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1780	5036	msedge.exe	79
PID 5036 wrote to memory of 1780	5036	msedge.exe	79
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 828	5036	msedge.exe	80
PID 5036 wrote to memory of 3656	5036	msedge.exe	81
PID 5036 wrote to memory of 3656	5036	msedge.exe	81
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82
PID 5036 wrote to memory of 728	5036	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://sakpot.com/new-windows-nezur-executor-v1-byfron-bypassing-roblox/
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff82c083cb8,0x7ff82c083cc8,0x7ff82c083cd8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7356 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7420 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,7482585713687959944,15541374024782105007,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000494 0x00000000000004E4
1⤵
PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2324

C:\Users\Admin\Downloads\OperaGXSetup.exe
"C:\Users\Admin\Downloads\OperaGXSetup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3736
- C:\Users\Admin\AppData\Local\Temp\7zS89E34D98\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7zS89E34D98\setup.exe --server-tracking-blob=Yzk1N2RmZTNhOTQ1NGVmMjE5NzEwMTQ3YzAzMDZiYjRkM2FmZDMwNjliY2JmYzU2OGU4ZDI3YTkxYWUwOTY4Yzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9TVlJfT09NJmVkaXRpb249c3RkLTImdXRtX2lkPTMxNDhiZTk4MzVjNTQ1ZjQ4ZjY1ODY5N2VlNGU0NmUwJmh0dHBfcmVmZXJyZXI9bWlzc2luZyZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRiZ1dG1faWQ9MzE0OGJlOTgzNWM1NDVmNDhmNjU4Njk3ZWU0ZTQ2ZTAmZGxfdG9rZW49ODUwOTIwNTgiLCJ0aW1lc3RhbXAiOiIxNzMxNDUwOTY0LjQ4NTQiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTAuMC40NDMwLjIxMiBTYWZhcmkvNTM3LjM2IEVkZy85MC4wLjgxOC42NiIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9TVlJfT09NIiwiaWQiOiIzMTQ4YmU5ODM1YzU0NWY0OGY2NTg2OTdlZTRlNDZlMCIsImxhc3RwYWdlIjoib3BlcmEuY29tLyIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJmOWNjZTI1Ny0zYmFkLTQzMzAtYWJhZC1kZjViZTU4MGMwYmIifQ==
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  PID:2932
- - C:\Users\Admin\AppData\Local\Temp\7zS89E34D98\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7zS89E34D98\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x33c,0x340,0x344,0x2f4,0x348,0x74458c5c,0x74458c68,0x74458c74
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4648
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\7zS89E34D98\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS89E34D98\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2932 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241112223621" --session-guid=99ff0070-9e6b-4e53-a9c6-a89bf7a9b901 --server-tracking-blob=MzM5NzQ2ZjNlYTg5NGJiZGQ3Y2I3MzM1ODVhOGIzNDMzNGJhZjVlMmFmMGI0YTBhYzdjOWI0YWFlYmFmMzYxNjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmFfZ3gifSwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9TVlJfT09NJmVkaXRpb249c3RkLTImdXRtX2lkPTMxNDhiZTk4MzVjNTQ1ZjQ4ZjY1ODY5N2VlNGU0NmUwJmh0dHBfcmVmZXJyZXI9bWlzc2luZyZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRiZ1dG1faWQ9MzE0OGJlOTgzNWM1NDVmNDhmNjU4Njk3ZWU0ZTQ2ZTAmZGxfdG9rZW49ODUwOTIwNTgiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MzE0NTA5NjQuNDg1NCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85MC4wLjQ0MzAuMjEyIFNhZmFyaS81MzcuMzYgRWRnLzkwLjAuODE4LjY2IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1NWUl9PT00iLCJpZCI6IjMxNDhiZTk4MzVjNTQ1ZjQ4ZjY1ODY5N2VlNGU0NmUwIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vIiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImY5Y2NlMjU3LTNiYWQtNDMzMC1hYmFkLWRmNWJlNTgwYzBiYiJ9 --desktopshortcut=1 --wait-for-package --initial-proc-handle=5809000000000000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\7zS89E34D98\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS89E34D98\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.159 --initial-client-data=0x32c,0x330,0x334,0x308,0x338,0x71e68c5c,0x71e68c68,0x71e68c74
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:760
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411122236211\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411122236211\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5564
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411122236211\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411122236211\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411122236211\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411122236211\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0xba4f48,0xba4f58,0xba4f64
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 b413be294aa14be865f49a949eedbb14614e0aa1808808c7d4c864a744797b9f
MD5 9a991506d06755a35913689b313e2337
SHA1 6bf4ca8b8856b20d25062ec94c930f7bc7e8dc63
SHA512 8466d15754005c8da1571070975406f109ed98a2b319287e2edcea33cc6c7aa2749585859187d96bea1ab7dd215c7403b066dc30bcb1164f8282397a8705543f
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_9A347AC5A42F886F9F966873087C7F2E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_9A347AC5A42F886F9F966873087C7F2E
Size 727B
SHA256 452c1a0e6bc7df29f058b329765b4184d3b0f6e082dcd0db77c18bea51f3c9aa
MD5 1a0fa10e49a4d62fced793e4ef5f1466
SHA1 340971cd8cb67e2d41bfa5b9fb6d3babbf5fc940
SHA512 cb652054ff53256291839ba2508df71657e2ae9e3d33a7a7ef4bff07fd05bafa8e78d50c7a0b7a66ba6eb03e7177b96465b80ea8d8990373ebb4002c8079441a
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 376fd6fec42ba09d21b131410ebd956b6c768597d3bba28d120060ca8f8ca64c
MD5 19818ddcac7e6d84edda2d202a8bd6f5
SHA1 078a354358a3ab745489ec949e64e71b73f800a7
SHA512 646010ea61958a0af74cf6bf53623fdc233291cdb309b7d92dfc1cce33444e57c693c3186b54ac7e082106fe02a48faefc02ff647a5eb09fc2b945f12d0df36b
MD5 SHA1 SHA512

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 e67282a6c260231758851753f8589057139e623586562365e46a48d5742d4784
MD5 b07979662a1d89099b7c13f477aec2a2
SHA1 884e2a6f061dc8ef6beb1e1dd16bcc50a10ed2c8
SHA512 a71cba4d9691d1054f1d4734888d438bbad75b25553e896cca371000adc48b0ad80a45670420ae5cab05ddbde01945550b5e2c0fb1eea76c2e28542c592c673a
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_9A347AC5A42F886F9F966873087C7F2E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_9A347AC5A42F886F9F966873087C7F2E
Size 404B
SHA256 af812d125b5d72d18c589977fe8ba91eb9714a529483a36cef23e7d39383099d
MD5 c655400d832ae61735cc10e37e7e4cf5
SHA1 c23c1ebaa76bf88a61ac9d10d03c7ec54ceab678
SHA512 880c1d0621bcc941a346af2ceb6920fae9e13c7265058b5d968fc61afd20050d092e350d1a4f2e8122b80d091923983526a437773685fd3b96bbdd9dd49f6a66
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 059bd1e8639a04a5eaeff8c130c8ff53457f94084e1a58a6ce88064d84135704
MD5 6e0f253ba10f40edea00b20c067ec316
SHA1 fa1af6321d4d6dc802085210cc7aa6ee609a51bc
SHA512 ef830325a5b5164fd02770a64b040b04da054c71c75560668b1f7a987fcedc89e9ac953ea67dd9d3c0be062b9a86f03493ab1b84561c0dc21b5ca5d4da669cd1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb
MD5 c0a1774f8079fe496e694f35dfdcf8bc
SHA1 da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3
SHA512 60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0
MD5 e11c77d0fa99af6b1b282a22dcb1cf4a
SHA1 2593a41a6a63143d837700d01aa27b1817d17a4d
SHA512 c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ac621afcf670fa0f3f1c595f0c7fe501f4059f01df3d2b1452de2753d2125345
MD5 63cb740957b647c45352b6265f6b3393
SHA1 193f1985d8f50968971ee0b50fe9c61ea4f10788
SHA512 1706e5565d9652706fbfdc5da080226dad7f08f6e2195acce36446bc49baebc691c48e3cde44ec5c794b93b3e26c9fbeb69a6f3d26f94779d41140165d71f79b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 7KB
SHA256 3d4b9f8196b3af518b9d9b56b3c9c3417f6863ba52384959e9bf18e39094339a
MD5 b6cae96809f8472cac099b62efbb5f78
SHA1 bc43decd14859ed38e51f453ca9f29aff43f22ff
SHA512 c9451d48119118ad0d19484f8a88350ca13a6306fba76b6de312bd484df685da2ef4fb555ea5d6162f9105a94dc3846fbc21c717d60c2d6f9a9ac04824a753f5
SSDEEP 192:J6NI6HFBa6rpvCUS96jtS0Uf5C5rF0P6V4lIXJY+e5biPF6neiNyIAqviRSI+BPs:J6NI6HFBa6rpvCUS96jtzUf5C5rFI6VN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 7KB
SHA256 655ed011cc38833cf0bdef927e2ed92b9ab4b2f970b5ca380ec2f6b584b7b02f
MD5 c7a8f1586e5aed9b658773e5bd510bda
SHA1 02a16f8f15b96c12a2b6b141ebec8de7db496037
SHA512 36d009a70d622ab3df7a63602acfcc50d7db228e577da859a998fcf4fedb6a305ccda8a97b839678c3d1523ec5383116d62c30bf2a821f84276d0e9940c2bfc2
SSDEEP 192:J6NIQBa6rpvCUS96jtS0Uf55rF0P6V4abiPF6n6yIAqvmBP0T7PG3lJ4TTTKRb+l:J6NIQBa6rpvCUS96jtzUf55rFI6V4a2B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6334b5c7e04cf9540592b29a6ff7d4c7b31e08dd9b1e44ce2c5b1cd7ee5af128
MD5 1bd5d06751271684a67bba2bfa99b000
SHA1 8d8cbac032642e0bf65f05fa258f25d60a8ef58a
SHA512 84db738b8fdd915486c24020e7e618aceaee4d65d46dcf245bc9659f48aebaca13fb2ea2011d4d36bd175ebc3e682a72e307b1e53654df553bd5dff835fc2b1a
SSDEEP 96:nGk3x9Q0kqqwSv0MoiVmdHISJ10WQyV+VuziX3wI3:nGk3jQ0kqqv0MAI41LM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7cc17aaf8d6b1da6aed04f7666169f80469a96e98600ba76165eabee68cde274
MD5 544468f45be8724d7495018993f1edca
SHA1 897c8ac20f56a5cd793301946a50ced9a02fda60
SHA512 f5088dac16868451a9ac4cdc1d9a67b3223476efcf0a71374a97622a68a7f1b752457abee7d7d5fad3df4bf0d42d8ffa3a8dca2960d8d3222c0153db9edabd00
SSDEEP 192:nGk3JQ0kaqv0MD7uS1uYVxk7xIxRErug8XDc2It1LH93:nGeJ7kJ0U1pfirBt1L93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 99bdcf7b9f2a5d8acf0834af618380609f4bb501cd916ccf7bdbf49d2e1ce61c
MD5 4a455026a61357abb3aa84e6f9170bdd
SHA1 f5780cad96e4171baa52ad1f5cf1ba0335e7f53c
SHA512 293f856bdb964ef98041767c89d0505368edd33948ff14fe0136a06a1b93212c4a63c11c969d55f8156b1df65dfa2842c73a1320aa70ed25a7ec5fda5e404e7d
SSDEEP 192:nGk3qQ0kJqn80MDfw7tuYVxk7xIxRErug8XDc2Iy1Le93:nGeq7kZ0ztpfirBy1C93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 6a5abe220cba626271a9f1043b660b140be03425a502004d9451e913a4e839c5
MD5 60f6fbad1a1e654b661cb2bf81335f58
SHA1 0c4d3a5cc566afbe75a4abc398d1871c60c16296
SHA512 5b53c549d68509f89691b87e453a4c64b6f0d682931e00abc7c44343ba346139939c034b150461ccec88240e8347416031c8f95bae96cb290ddd7f5addae8db6
SSDEEP 192:nGk3EQ0k7qnmC0MdktJfw7ZtkuYVxk0LqIxREruEVog9o0Dc2Iy1Le93:nGeE7ku0E0pNirnVky1C93
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 fdd07788500d20e7b02657ca9b76c457001ad2d69bd725a33ef8b6b4e87a9603
MD5 ccff00c5bbb9d5435ba2fd19228c0fce
SHA1 dfdf41bd50ee4f7540342bdb272ca28b09f92e0c
SHA512 474b4cd380c804c6a5bd25be58ccf76fddf31fc489ccab96badbe706517c018efb1532622ad8c5b8faa2712567a92da7089cd190ef99f19d9d00dbf6dabd6863
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe588018.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588018.TMP
Size 48B
SHA256 b225de1b78f986c8a878bedfc04fe0c2ad9d683870df25bbe4400e12b78c76b2
MD5 f3460b02b4933106fb4ed5c6540e97ab
SHA1 795ae45cb543a967342444ba3468d0c0e57467f1
SHA512 628c502014449efae55ac3ef8b994544ac1ddbd1b1e57ee921ca5d0c360bff837cb372f339fa9365019d4bbb644a5437c55bcc3e318d91443279797888758626
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 4KB
SHA256 03a4a4469e6b06c9f69331ba68414000a4e7339177a04f48e1976a5a27507851
MD5 24ece7e737119a38e1304216c50e1c09
SHA1 91b4427662e0c85258787a21bdd0d0bf7b3c11ff
SHA512 95f259646d1bf64e4cce5a29da979f980518e2119b040719fbd9fd780a264be127094c4523424550b527a7b90b24efc4260542290fdfecef69794c0507d38b1a
SSDEEP 96:tU1UlUAUaZAUnFfIUYUcieUyUdmUWU4UtNUlUfR0UdVwUEKU4cU4U4UdvjUSKU3z:tU1UlUAUaZAUnuUYUsUyUQUWU4UtNUls
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 175c00dcf392183b3d343b9d8f996790975bd259e7e3bd7638348da46d200374
MD5 b1a95e3a537c49fbb385d9102cbe8336
SHA1 a15c4c80483730d9d3bc1d9bd5f357c72dcdf80e
SHA512 d7a6d24d14ffeb4c78cc8a085b5dedc237ee9b2f0176f78dc43142443435172f1b012f5572f3add3a20df2155e4d8512cb8b1ce52803b08c137cb01ae4e45339
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581e9f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581e9f.TMP
Size 3KB
SHA256 ceb236298bdb2ce782bad9fd4626df2d552f224ebe5e647b9fc98bdc26807f7d
MD5 2e29c9106d1cec0bcd1269459972839e
SHA1 8a093e977fd3c7d11f846d2935a6d2719bca49e7
SHA512 9012bef31f78f0cc9fda8bf5fc693721ad0e0fb03a9ff642cf7dabbf39450a339527ddd85606bcc07cd70a38a767265b74015967792d75176cbf1a4c10faebb5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e88cacadfaf63b8383ec04a71593a150184ed30dbbd4f9c3c3d6095a40f17178
MD5 abacc72f08d948e2329a0f05f5f787db
SHA1 a017dac1ce5a1d2b37d0c36ed5561b6c8acde433
SHA512 0362c9fd80a672f7e786657c2da59164d8b39ce94d0aa3b0af7c213d5c1caa88b86e0eab8951460b75372c3b99108d189a10a60e7d55a87020fc443e015f9049
SSDEEP 192:CoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG4Oe2RU19SOymrUYqjUws6wOc:W9iIxuERzA83h09RZxASGPg9EmrUYqz8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 722a2e3a59d79a3204e2da2b8d764a30b7b85894d4c933644fedda6a41d191a2
MD5 98094238b980cc0c3761530f507e8104
SHA1 0a756957eb6954c20a730ba749dd06acda992a49
SHA512 16d9cd2734a86e6b609a981d58980833fadbe852183ad6c987a8c2f3c2342f8ef94ab7dc8df26238a93a2e5e6ce33f693d4f52fa59a415b78a47843d8200ff0e
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG4be2RU19SOsMUYqjUws6wOyB:M9iIxuERzA83h09RZxASGMg9eMUYqzsZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7150abe935aea88bb8ba14c9bb470e9faa58ab581c99bfe4f22f1cad45a56fa6
MD5 8a5f4c34843a07ef19b772c795fc898b
SHA1 924fa1720e26e9cd2675764c842e0e6caebca184
SHA512 d53fc201edec33239b03573a16257b73a24b05cbe7a27e325de8228dfbb2b5575088dbd5e955e515456d6f008dbb01628fc1f2dc11a819f255a7248338be9d16
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3jbe2RU1dR1wUYqjUws6wOyQaZ:M9iIxuERzA83h09RZxA3ngtwUYqzs63c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 15ede2e41a79cfcc284d76e772a908afbfd740508f7470dc03b776665cfc807d
MD5 4beb2447322a64bb463ceadedd279a72
SHA1 618f1dfe4b186735ee95a63da58d2759164d013f
SHA512 c8f474df6d4f52c06448ad90973715a324e69a3a081c4016e081b903bc3bc0b9447b01bcb4978ec3ce3c6b90a146b133664cfb993efe15a72cd3e8a23e2ddbab
SSDEEP 192:xoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG4Oe2RU19SOsrUYqjUws6wOyB:t9iIxuERzA83h09RZxASGPg9erUYqzsZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411122236211\additional_file0.tmp
Size 1.4MB
SHA256 e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f
MD5 e9a2209b61f4be34f25069a6e54affea
SHA1 6368b0a81608c701b06b97aeff194ce88fd0e3c0
SHA512 59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5
SSDEEP 24576:4ACKcQz8HkfJ8dQnd4GrbwsgY+UfLBCQdI5f3cjCRgCPPWCUZry8k/GUrbN:5pT8HkfJ5eGrbmR0afsXCBrG
MD5 SHA1 SHA512 SSDEEP

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202411122236211\assistant\assistant_installer.exe
Size 1.8MB
SHA256 afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a
MD5 4c8fbed0044da34ad25f781c3d117a66
SHA1 8dd93340e3d09de993c3bc12db82680a8e69d653
SHA512 a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481
SSDEEP 24576:K9A2yB7Nxu6wdWob6zD0fnBa2M9SmWqRYv9XTQdg7VHUw9MqNTLTM7DbXTWs4HU+:cAF/wvfnJ1zRH/2qNvsD3W3HUTX4Ean
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS89E34D98\setup.exe
Size 6.5MB
SHA256 87a168a04a254b1cf1adfe732e8b7b08d5c3e76ddca4e8b7fb4e58ebef85fe64
MD5 dcc0d15e77a7872758e65deb0bfc6745
SHA1 1efb89e143bf5edd34d46ae8370ecc13d4c3339f
SHA512 9cb972bcd99fd03a924bbff79e8989a040d1202a77c9d8f62ea862cc6b1d258778410ad9a4de5f2aab43062f5e9fe17d7ab9baa000de98d22a47f1471d1de778
SSDEEP 98304:j+hx5R6666666666666666666666666666666x666666666666666fwwwwwwwwww:lSJmoDdtVFsg5uwx1jh6Uo3s2CRDw8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2411122236192162932.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2411122236192162932.dll
Size 6.0MB
SHA256 e48eb19ca0210f9063f4e77c2f14293ee940eeaef2ecb9efceac7f6336cc203f
MD5 1b07ce60bc1c77f0cadf13c2e62b1383
SHA1 ca70d0ef99ae5d1ebf85880ee669ad1145e4d79d
SHA512 94c358b6dfef0fcb0012a3a43235292b18ebf897043baef0c110570e91cc73721b12f1f771df6d000b4097f3c0cc22dcc65330a9153c7a9643787d24da6108f0
SSDEEP 98304:66666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww2:BSJmoDdtVFsg5uwx1jh6Uo3s2CRDw8O
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 c686cfb80f76482b43b1f53b3009f7cfa3fcff8ce15b48701c663988752c0760
MD5 7d7ab5d33c499b7e6a43e543787d41f7
SHA1 46793891fad31fb34e0e1e614e85b4444f9f9c47
SHA512 8506b002ca2d5bb517e0a82a054ec7c8705da52a1c25fff55fc1580afc535918f0d2ef8616653f457972df51089e88d574716b124a1d891b4be261fbca55f105
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 3e5285c2efd887f09977b7b9942d845d37832496df485a780b89987aea5f07c2
MD5 ce7d67ab8e38c3c316927dc55e98e096
SHA1 27d4ac6efe2927c210495b6832de1ee55afcceb2
SHA512 f39fb4882626cad2643b785194adaa63007fb251f7087f9db596335d1cbe9ad8b6492f62a6dcc8af76372126e41b85c71931b74f50322bbf99a96ad847bb1306
MD5 SHA1 SHA512

Submit Download

OperaGXSetup.exe

Path C:\Users\Admin\Downloads\OperaGXSetup.exe
Size 3.2MB
SHA256 37b8e6dc366934e63b1c522278a849b16b6f768cce1678964135bb5dfc4b1378
MD5 b62564e0c8b1548193cffea0e8750fa1
SHA1 d23ea4dcf009ad5e9e474f6127368f5bbaaa605d
SHA512 e5f9e7c3de970bd16636575a9c34e6a33d095585a35f64b65fa01cadfdb687e93cbfc809b18069b5182703700fd4ef93fcbd044b1941b00f9db6bf5ca5e7f09f
SSDEEP 49152:yVAbwEw9pn+uTEa3XAqBfpd9pZBsQggCcL+oVmYRg1+Awf+UW7isjQmwLWrMItvd:2A4+uTEvqBhezcXdG7j7wLW4IP
MD5 SHA1 SHA512 SSDEEP

Submit Download

OperaGXSetup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download