62067ee0da2b30ce3835c3709e9b8ad149d512d2cecc5d4877595ca2a5c17374

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
112s
max time network
114s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaGXSetup (4).exe
Size 3.9MB
Sample260503-qa9cdacz3r
SHA256 62067ee0da2b30ce3835c3709e9b8ad149d512d2cecc5d4877595ca2a5c17374
MD5 42581ed6b282f7c77218f2e2f2e6d1de
SHA1 c87978def75de7551c67ccab6319f1cbb9d15d85
SHA512 20bf84c7eb5364ad623d8a5a37f55b072b1087d0c6de09f26d67d4de23a344c672bf145b9a79ee4b04f372b2f3833cdf1fe61d7a0c2614fafaf30232930841d2
SSDEEP 98304:qAYE9x9Vef3KZ/x7E3dhqSiBfu3ofErPql4FEll:0E9x9BZ7EHu4yz3
TLSH
T13B1623227B4484B5E5C322320F68F7B9D1FDF6251F6A144F37C40E6E8E70681AA36B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
3940	installer.exe
5388	installer.exe
5348	installer.exe
5936	Opera_GX_assistant_130.0.5847.58_Setup.exe_sfx.exe
5848	assistant_installer.exe
5808	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
5848	assistant_installer.exe
5848	assistant_installer.exe
5808	assistant_installer.exe
5808	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
16	camo.githubusercontent.com

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_130.0.5847.58_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4192	chrome.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222871287498160"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	chrome.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Altify-Developing-Main-main.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe
Token: SeShutdownPrivilege	1320	chrome.exe
Token: SeCreatePagefilePrivilege	1320	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3940	installer.exe
3940	installer.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 3940	3468	OperaGXSetup (4).exe	81
PID 3940 wrote to memory of 5388	3940	installer.exe	82
PID 3940 wrote to memory of 5348	3940	installer.exe	83
PID 3940 wrote to memory of 5936	3940	installer.exe	84
PID 3940 wrote to memory of 5848	3940	installer.exe	85
PID 5848 wrote to memory of 5808	5848	assistant_installer.exe	86
PID 1320 wrote to memory of 5816	1320	chrome.exe	88
PID 1320 wrote to memory of 4844	1320	chrome.exe	89
PID 1320 wrote to memory of 4192	1320	chrome.exe	90
PID 1320 wrote to memory of 4844	1320	chrome.exe	89
PID 1320 wrote to memory of 4444	1320	chrome.exe	92
PID 1320 wrote to memory of 4444	1320	chrome.exe	92
PID 1320 wrote to memory of 2656	1320	chrome.exe	93
PID 1320 wrote to memory of 2656	1320	chrome.exe	93
PID 1320 wrote to memory of 3020	1320	chrome.exe	94
PID 1320 wrote to memory of 3020	1320	chrome.exe	94
PID 1320 wrote to memory of 1312	1320	chrome.exe	95
PID 1320 wrote to memory of 1312	1320	chrome.exe	95
PID 1320 wrote to memory of 2224	1320	chrome.exe	97
PID 1320 wrote to memory of 2224	1320	chrome.exe	97
PID 1320 wrote to memory of 2484	1320	chrome.exe	98
PID 1320 wrote to memory of 5556	1320	chrome.exe	100
PID 1320 wrote to memory of 5556	1320	chrome.exe	100
PID 1320 wrote to memory of 6072	1320	chrome.exe	101
PID 1320 wrote to memory of 6072	1320	chrome.exe	101
PID 1320 wrote to memory of 5224	1320	chrome.exe	102
PID 1320 wrote to memory of 1364	1320	chrome.exe	103
PID 1320 wrote to memory of 3684	1320	chrome.exe	104
PID 1320 wrote to memory of 5452	1320	chrome.exe	105

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup (4).exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup (4).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\7zSC8D14B38\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zSC8D14B38\installer.exe --server-tracking-blob=NzY3OGY2ZWU5MjdiNmFiZTlmYmY5Yjg3NWI2NmY2YWU2YTQxZTJlOTE0MDI5Y2Y1NzkzZTQwYjcwNjA1ZWUwMDp7ImNvdW50cnkiOiJERSIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0RFX1NWUl85NDgxX0REXzU1NDImdXRtX2lkPTlmN2FjMDhhNWQyNTQ4NzFhYTZhMTJkZDQyOTQzY2FkIiwidGltZXN0YW1wIjoiMTc3NzgxMTkxNy41ODY4IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0Ny4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0RFX1NWUl85NDgxX0REXzU1NDIiLCJpZCI6IjlmN2FjMDhhNWQyNTQ4NzFhYTZhMTJkZDQyOTQzY2FkIiwibWVkaXVtIjoicGEiLCJzb3VyY2UiOiJQV05nYW1lcyJ9LCJ1dWlkIjoiY2U4YmExODgtMjczMC00ZTI5LWFmOWYtZTFlYzBmMzM1OGFkIn0=
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Enumerates system info in registry
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Users\Admin\AppData\Local\Temp\7zSC8D14B38\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zSC8D14B38\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.108 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff660fd6718,0x7ff660fd6724,0x7ff660fd6730
    3⤵
    - Executes dropped EXE
    PID:5388
- - C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:5348
- - C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\assistant\Opera_GX_assistant_130.0.5847.58_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\assistant\Opera_GX_assistant_130.0.5847.58_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5936
- - C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x774040,0x77404c,0x774058
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa52ffc728,0x7ffa52ffc734,0x7ffa52ffc740
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,10431805097261608877,16302583847261845038,262144 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,10183472495448350683,17794714466080386416,524288 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2148 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,3825288498953919169,6019276277292870877,524288 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,12580327443706092986,17828787678671101034,2097152 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3348,i,3402325563577484061,5129500436479810965,2097152 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,16359532234958298062,10707100334584139099,2097152 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3728 /prefetch:9
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4632,i,12405625199278706125,115282440051906889,2097152 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,4427634657768216635,12446957721993986833,524288 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5836,i,6255598529069310665,13796936150371704700,2097152 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3488,i,4532290046784597987,15010706455240926808,2097152 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,7129363321631006870,6306414125489888244,524288 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,2518543569378990040,8941009468624873427,524288 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3672 /prefetch:14
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,7928463229660975984,15451631254418651079,524288 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3628,i,13119371796986462404,10394932255850676187,524288 --field-trial-handle=1904,i,6082056898130419666,5604290170747267302,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3220 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b4aded92c7d60fcfe9b3535b748bdd186b4674ca4ec95a55fab98b335cad7ae3
MD5 e24d7be66fc3066c811d94adc965596f
SHA1 c8422e5ff27d575b256314a4eb5d2ff5841e2969
SHA512 b55925a93ed596ee16b642f7f3927044f8f8e985fb6bb8504c11b14259d1d95355ccb696e6d72cde256813cc8598db57c58bdc899c5cda071129cc82111d0151
TLSH
T10EE0EDAEC922AC2B09FD0B2A60908B86EB1003572B41895B3A3C810D8FF027A0196D2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aa9bfdf7c52a2407dd9d757ed20ddd0b2480ed18929cb307b69afc6108c178e1
MD5 50bb1cf76d6f31938e15f0f3a5dc270e
SHA1 7f18256f3f5126bdb3cd9ea9529717715beb0852
SHA512 fa246e5c86c0d289f967522f52b551af5c69359302a08c91421a78a42798f600459e947d7f8aad96190c15554c33acefcc0e166ca42cac243a365a2fbf3167d2
TLSH
T10481B64796854577EB3C68B1BAF07D23743C4577161B1F624E69B678143339B12D04E3
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a8bde30cd0a64f94776142a9c781f8305c479130f9fcec7b0a9bda9f2850196f
MD5 23b6e40777476b352780c9a68a69559f
SHA1 c82880f1878da9df3c9de144283d1599fda0f35e
SHA512 64d7daa86c5d362edebf6bc87fb73026be83fda4fb759aabf037f5601159355cdfeaea2368b7c9bf14afdbc89526914120ed552c563309803eed336f667823b8
SSDEEP 192:DRRcVz0lm4mUqaIa86Bx31pxeVFrNm+OHmLmmmsmDmemzmf:DRRcVz0lm4mUqaIa86Bx31pxeVFrNmHh
TLSH
T1BCE18BF7C3E5852D891156F4EB15AF1ECE2D0A14831C3C6AC8E4AF5B93E2972E21135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4a443111b0e572fae7e9ab9bbd4db8a4e2a6ce2697408ceca9e388dd13f04faa
MD5 6b361a14a92b7009132f788302be04ad
SHA1 bb56b4349e81cee1ec5eaebbba67bcc9fad9deba
SHA512 4467bb39392a65d1067fe6d77de1fb4271f02076780a61940337b12273a58f5cdfc6e1218b9ea299630e690e21a2c64f7ffb7bec41fca9cf87996a177ab551f0
SSDEEP 192:dReQcBz9uBPMWDWv7dhAPRp2CRIC59ZHsb+WNwLIev6I+KI2YzPgAqC5VyIsnAUW:dRbmz9uB3ip8XbHwYZg26ffvV
TLSH
T1D652B62EA9142D7B5CCBC219F991BB1BE7F5102162D41E84EBFCCA1C18E79DD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c064e264136ea83391cbc4c4f2196437d614c94d98c75a50e4a9cbd3b3b32073
MD5 a6b1d5874298ea8a9c04e244caba78f2
SHA1 a5793b2576d34cea102a6ef98e62738b0be9ca63
SHA512 5a7ec8211c69af0b7c3d6ae65e1f5f73bbd4fb65bbeb03f3ecd249ae0f3b1a151131b954a0c059816bc73c2c3a2c6628f71f65960ab0b73058257dd2e01237a2
SSDEEP 192:dReT9uBPMWDWv7dhAPRp2d9ZHsb+WNnIe0PzPgAHC5VyIsnAUgtaJ:dRa9uB3ip8XGHw90L0f8
TLSH
T1C942B62DAA14693B5CCBC319F9527B17D7F5102162952E84EAFCCA2C18E79CD221742F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0ed1c01134027b7b56205f654a0fa66921b11d52db2b5a64a745bbef0e548b2e
MD5 126a95292469a0f7e1cf1846396e79c6
SHA1 d918e99f29c11e87ce9a1c300f71d72ab7d3941d
SHA512 828ac9423c7ed916ae1f10a3d48448b98bfe727c2bdef5493e8c94b1b78290b0c4372f8f04029ea40cd64e6c9298dcc47dbf5ee8264e57e185163b16d407b7a9
SSDEEP 192:dRePcBz9uBPMWDWv7dhAPRp2eU59ZHsb+WNnIe4KI29zPgAHC5VyIsnAUg5oaJ:dRamz9uB3ip8X0Hw962d0f5V
TLSH
T14952A52EBA146D3B5CCBC219F952BB1BD7F5102162942D84EAFCC92C18E79DD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 63a45cdc0ed52b0466867d48237545edd9b9e19d29d78709271eb80f4978c22a
MD5 170884eda16a3ca9756c984a483c6e9e
SHA1 21257a592df213090d638d93f4d607daffbae137
SHA512 1e65f31d582bf134faf4f5ee5599bc4edafb9f4679db5af6e0df93abefa9e80c0bda903fe5b9442cb57fd40a65eb2170d3a7cdb97a5bb838f7736ce751eaaf6e
TLSH
T13AB01212C8025541D04302B01682449831155F208F0E13025BE4A972E8366A1C014190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a524.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a524.TMP
Size 96B
SHA256 edee51486ea33f38705daf2eb554a0c7ee9e353f5e252a88be76db1a2e99831b
MD5 3d7feef872ee9518ac4f92c491fbe7ac
SHA1 8d31a9a9434e25c9957f4c357ae701cc6c536b0c
SHA512 a672447ff3eccd97811778b81391886963ee7f526fc2cd389df88347458588e09e7526dd9d798f8ab8602a70a833cd38b67e50e09b005aa91efa4d5fc6bfd9e7
TLSH
T174B02200C003B2A2C00303F030A880C83020CF28CAC30282CAE00A22CC22230C0280A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 9c290143968b5a1a9e0101698eeec0b8ec4050b61be51e18a30f14533f0d0749
MD5 6e73c8bb66c2fdc93e65e66e8c4a1e42
SHA1 c9e7209d2cc0c166543228ec5a8cc4bca88f229c
SHA512 bee9aab66c19cef3678c0edecfb230fa21152eae514df447f51d6a40991eb59a19f1b209a2ecc7210728c3d930814d854a44b5bea37add2b9f4a456859876d86
TLSH
T14EA002589144D602D44083B47087128232149D70490A0609C696DD45BD606408206510
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 cfcac2f80c2c79379532305e34337e40ccfddb1e5730bff0c0d5889246be0437
MD5 ef51adf49331825b1c063109b3b24a59
SHA1 055b6c0dec68e3d6197bfd69c32e7991ab0bf6a2
SHA512 bd7faaf012b13f5ea3331483302e62ef2083deebd6f9397d66b5150ff6c95059ee2a3e30f6b7c085053a9f77fe6e4b29e4c435b97da4f652225723f8622cbd37
SSDEEP 6144:gYGu+N+0GYmzFJ71o0keSh++JjcMW2VcVLg:g3u+Nc3J7SwSzOMWW
TLSH
T1CE1412E4DD3B2CF51347D762A20E6EBD8DD2DA5D4448606861DB5B8E08BC3E5730BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 ec374860dfe5c6b53824055e459bc527de0ece3763ef0cf9546c860be5628508
MD5 7d3355dcf754cf309d90c2f940c60b2c
SHA1 8014dea2669e02ea68e710598192c54844f4bd06
SHA512 ee26624273b36559809e1babc4da08a235ab0e1d6ef28251491653a7f0776717fbb5f4394e818a2eac47bf41255172d7a3df532a198417490b6a8bb6f4244e1d
SSDEEP 1536:X7P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:D++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T19F9302BD991E7C79536BD696A0079DAC8CD3DCCD111451BC30C76B0E18BA3A3A31B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 1b0391a026d559772e210b41989115e082e3575730f9ea3214807da375b87133
MD5 533585951e910603fc4c790276a410a8
SHA1 96b36f9ffe84d425bdca6bbfd88619692f88ebf5
SHA512 b3fe2c07d4ccf90ecd18d9343789d528f70dac48ed9eb83e2b96f18c069ef60e9afcdd588f1aa6346c31d1b77e5ebae2f094bb5aa473487ce04a7f2c5aaa64ec
SSDEEP 6144:RYGu+N+0GYmzFJ71o0keSh++JjcMW2VcVLg:R3u+Nc3J7SwSzOMWW
TLSH
T1181412E4DD3B2CF51347D762A20E6EBD8DC2DA5D4448606861DB5B8E08BC3E5730BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 c3675dad0fa60032d946ebc5f145ca69a820486d272b6564f72197582edbba8e
MD5 ae9dba54c50121c0913ccd1b542e9941
SHA1 2f1300980f4e9628479049ace70b12ffc12ca5d1
SHA512 f8a376c3e11c6b9eb023a9e027e743998cffa34a711ea088537fa9c67db2a34d255c1bc9f5c551ec5103a46c4f51141b2e1bcc802e34eafc2806b75880a0f7f6
SSDEEP 6144:5Gu+N+0GYmzFJ71o0keSh++JjcMW2VcVLg:Mu+Nc3J7SwSzOMWW
TLSH
T15E1412F4D93B2CF51757D752620A6EB8CDD2EA5B544C646821DB2F8908BC3E5B30BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\additional_file0.tmp
Size 2.8MB
SHA256 1ef33f3f50727d57dda98c03db5f759fc66315965fda144dbcbe41e3d0720265
MD5 de1c092176228feaca13513e4cacb5cb
SHA1 531bd96d030350a78be68c0a3081146cbc476a3f
SHA512 5477886e3223133ba73be724ec27502a51b127b907186a7ec81dd4a7403225bfcffc3329e76d7d5d3c59e3479f51434baa4c604f0c6101bcd553e7e62d3acc9b
SSDEEP 49152:akino0+8oqPQH+rjoBiCajVbGuzS25WxpU320/bkjSxHufYzMYeHdE:akioWIevoBxajVbG0S2aLIgOxOfYzIHu
TLSH
T19ED52322BAD1C479C62317334DE4B7E86ABFB6210AB74ADBB75C1F6D4FB0046460851B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\assistant\assistant_installer.exe
Size 2.5MB
SHA256 39284ef1695bee19a8fa544f64215eb9fa49dc97b05bca3499d0a2781055929c
MD5 864e681fa1b2ef2b3b9ae1ef7ca8e09e
SHA1 a1ca23e83f285fbce9c9a408630ed2d5edbe5790
SHA512 fa0695c9e8a17b2c49c4202300f969fdc582fe550eaeb6029abed451db252f0ab2b7032243f8b29ed566a109df46cf666a0ee0e52ebc80934c011767a252ab71
SSDEEP 49152:j/hcmraCJj/CW8f/N2qiGzRt5EuGPWs6CA2PizcO:jpFraCJj/CW8f/N2q1ttKuG+s6CLPC7
TLSH
T1BDC59D02A86050B5D8573072761DEB3E9E346E1647354DDBDBA0BCC2ABB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_assistant.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\assistant\browser_assistant.exe
Size 5.2MB
SHA256 91455152ee199195352f4f42ef7000c08ac52b4b9149577b8cde0244b1c12c1b
MD5 630a1c075620c90a347cb4a740010951
SHA1 130e9565d751216af1928eac11aed89b4612185e
SHA512 b79959591b404e2a9b32a3b969bb0a446eaadd12ec5443d6672a6203503fc209e00ad77a32f3cb4bfdc06a1570d04d3a4e8284b74a4710db6fc4cf08406abc27
SSDEEP 98304:+6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwq:srRkFaPGzDLWLZt5B6UJdsPk7R0cW
TLSH
T1DE46BF52FE1270B4C82A75B1253C6BBB5D281D23972187DB8ED83CE05B746C3263E75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\assistant\dbgcore.dll
Size 222KB
SHA256 e26ae1b6f5a828c108addee11e0688eab08142b014366d9ab919c8ca41c1cb14
MD5 acf391fbf0be4d34e2dd0ea104344564
SHA1 662884d628142f386263d9c5883b3097745a64dd
SHA512 a5dd96f833e49cef69d90ff7df502de20fe3eb691543b6322445ae2d2c34d63bc209312fe9819bf85fc128b01ae2770adc5c00c3e0fc95074de9f8b4c45e3838
SSDEEP 6144:+ASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96X:1MHZn1n+P96X
TLSH
T12C247C2269401533DCEF12F062AF373A96AEDD90239494C359A05ADCD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\assistant\dbghelp.dll
Size 1.8MB
SHA256 815bf4f300630117dde0c4fb4605550e84bf70a918bc8444f5cb1904f518e32c
MD5 0e7e6d7536166ecd98dac5bef8481541
SHA1 20e9563687232c9b1503150626ca049297c10256
SHA512 977be5fde71ae2f4ac0d88901c77de2afe354fbc2b4cf11d483f426cdfa2d6a3283a51f93040f0f924a9c95ff5a583afd29452a958628f34e7acc263697b41d9
SSDEEP 49152:TEDlXSohR86M5NKBlv/2yOFVnzM9F0KMj:oFhR86MHyl0fD
TLSH
T13B856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Temp\.opera\e3f787de-30c9-4d64-ad88-9b64a9a78afe Opera GX Installer Temp\opera_package_202605031505081\assistant\files_list
Size 72B
SHA256 5b3741e12f14d0ae54d450fff585c5fbfa7b360800c863722472d320c26b4ef4
MD5 7c375531029e3e1e14e204850417eb74
SHA1 086ccee638fbb7dcad3d21627c4f32386490f456
SHA512 8411bf285d334a51b51993487148d0b53f6cf9439a9250b71cce9718250bbb226825e3a1be832443b84ace59e43f3fb77c4f4741f0d376543ca32d9ab40f4a67
TLSH
T169A00204C51E089CAFC53595831146FF67D765145AB89655075F10CC5926027478F776
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC8D14B38\installer.exe
Size 9.0MB
SHA256 c4a265b084cdac06add82a9b7ff6dab1ab62604a73b9da35cbb6d26facc1dba2
MD5 12f51c000793f25198e98f402af4f81a
SHA1 fe3179afaa5795c9af1ab0ae3f702a8ac4d18677
SHA512 1a85b5c94f53e9ee5ec0adadc026a454ec462b0cea9592af7900ce8ea19a11f0b81cec818a52ad9e577c3088ad74256d4f82720f2fd145052b00f3e4ab911de6
SSDEEP 98304:oYPPx/37arhKVU0lpletC0dGHsaD9yIFBI3++wteEm/:rPPxv+hKq0Jk3+Bq/
TLSH
T1F4A68D43F3A601E8D06ECA748B7E562299357C564B34A3EF0A943A251E75FD49F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 3b3c23550047e87fb477239b2d3f24ab621e42633e2981974277d74fe475dcfc
MD5 8b0f05d38ed52a4c95e5b1d187734526
SHA1 15f4a2f8e62541ac198ff700cf250e1293840a4c
SHA512 0da64c5715897b5e2d5da2ce84c1ef23b853fc46c378cdb51066fa94066e6fe04744e6edcaa3cbe48cef35913d492d475dc9fa546c83676c3e691afcfb377797
MD5 SHA1 SHA512

Submit Download

Altify-Developing-Main-main.zip

Path C:\Users\Admin\Downloads\Altify-Developing-Main-main.zip
Size 40.9MB
SHA256 3bc79a57a2d437289e9287d61d3732b4a7cf5f8df8528f212691ccd677aa5204
MD5 fd13f861384340d2c3924a635deae297
SHA1 b295eab6f67b52fa81b9b8365943a831550821ea
SHA512 a889d2e98bafbaf3e6b48a1180118f8681ec370401b2fefb4d3c2c2d1efaf6d8c8e8450eb4ed8adbfbb5b382600d0ce190cd5088fb6637cea971b65b007f7869
SSDEEP 786432:SOXaAdy10z4xIb1BZEIE7yeYfgbGrvUuh+qbR342LfSbbdwlXDpNSGc7ms:jnxrhLXE7yeYfg6LUApbYbMlNS57ms
TLSH
T1DE973331E16C0CD6F3601B3554C64ED1F2249D9335B693F62BE1A5223CBC3E92AA572E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Altify-Developing-Main-main.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Altify-Developing-Main-main.zip:Zone.Identifier
Size 197B
SHA256 338c8323315c6a3ac748170470c35c2fd8982eaa358f3f4b091a088d93e6624b
MD5 12304f09b69d8e493a801874bed37b0d
SHA1 581fe600557a9f4119b5fb6174054b4ddf0a51c0
SHA512 e88f698bf0978f9f6eb20b7d4fbede0b8d1513bb67457da480c1938fe4482a160ba0cfdb7bad8202d71f67dce4709a9a8e9bb84dae5c72c78ef12d151c222a7c
TLSH
T1E4D012B6E00884DC2F1224C990ABEEC6F9F5D0066C60AFC687660552A84805541FF05F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3468-33-0x0000000001150000-0x000000000120B000-memory.dmp

Download

memory/3940-100-0x0000021912C00000-0x0000021912C0C000-memory.dmp

Download

memory/3940-34-0x0000021912C00000-0x0000021912C0C000-memory.dmp

Download

memory/5936-79-0x0000000000CF0000-0x0000000000DAB000-memory.dmp

Download