hxxps://links[.]lootlabs[.]gg/s?o455FiWj

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://links.lootlabs.gg/s?o455FiWj
Sample260528-md6twacy4n

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
431	4052	installer.exe
389	4792	msedge.exe

Executes dropped EXE 19 IoCs

pid	Process
3952	OperaGXSetup.exe
4288	OperaGXSetup.exe
4052	installer.exe
4664	installer.exe
668	installer.exe
4012	installer.exe
4304	installer.exe
5796	installer.exe
1572	OperaGXSetup.exe
1840	OperaGXSetup.exe
3440	installer.exe
5956	installer.exe
176	installer.exe
4436	installer.exe
5740	installer.exe
1800	installer.exe
3580	Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe
3656	assistant_installer.exe
752	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
3656	assistant_installer.exe
3656	assistant_installer.exe
752	assistant_installer.exe
752	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 8 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1300847767\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_525917330\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_525917330\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1586246226\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1586246226\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 13 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244373335101029"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{ADAE457C-7198-4CF0-B35B-5367CAE643C8}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{E8788908-C5BF-44C8-9C0F-9A4E93A034CC}	msedge.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4052	installer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1456	2032	msedge.exe	86
PID 2032 wrote to memory of 4792	2032	msedge.exe	88
PID 2032 wrote to memory of 4408	2032	msedge.exe	89
PID 2032 wrote to memory of 4408	2032	msedge.exe	89
PID 2032 wrote to memory of 4408	2032	msedge.exe	89
PID 2032 wrote to memory of 4188	2032	msedge.exe	90
PID 2032 wrote to memory of 4188	2032	msedge.exe	90
PID 2032 wrote to memory of 1952	2032	msedge.exe	91
PID 2032 wrote to memory of 5032	2032	msedge.exe	92
PID 2032 wrote to memory of 1952	2032	msedge.exe	91
PID 2032 wrote to memory of 1952	2032	msedge.exe	91
PID 2032 wrote to memory of 5032	2032	msedge.exe	92
PID 2032 wrote to memory of 5032	2032	msedge.exe	92
PID 2032 wrote to memory of 1620	2032	msedge.exe	93
PID 2032 wrote to memory of 1092	2032	msedge.exe	94
PID 2032 wrote to memory of 1620	2032	msedge.exe	93
PID 2032 wrote to memory of 1620	2032	msedge.exe	93
PID 2032 wrote to memory of 1092	2032	msedge.exe	94
PID 2032 wrote to memory of 1092	2032	msedge.exe	94
PID 2032 wrote to memory of 4424	2032	msedge.exe	97
PID 2032 wrote to memory of 4424	2032	msedge.exe	97
PID 2032 wrote to memory of 3696	2032	msedge.exe	98
PID 2032 wrote to memory of 3696	2032	msedge.exe	98
PID 2032 wrote to memory of 1184	2032	msedge.exe	100
PID 2032 wrote to memory of 1192	2032	msedge.exe	101
PID 2032 wrote to memory of 1184	2032	msedge.exe	100
PID 2032 wrote to memory of 1192	2032	msedge.exe	101
PID 2032 wrote to memory of 1824	2032	msedge.exe	104
PID 2032 wrote to memory of 4556	2032	msedge.exe	105
PID 2032 wrote to memory of 4556	2032	msedge.exe	105
PID 2032 wrote to memory of 908	2032	msedge.exe	106
PID 2032 wrote to memory of 908	2032	msedge.exe	106
PID 2032 wrote to memory of 4260	2032	msedge.exe	109
PID 2032 wrote to memory of 4260	2032	msedge.exe	109
PID 2032 wrote to memory of 1060	2032	msedge.exe	110
PID 2032 wrote to memory of 1060	2032	msedge.exe	110
PID 2032 wrote to memory of 2496	2032	msedge.exe	111
PID 2032 wrote to memory of 2496	2032	msedge.exe	111
PID 2032 wrote to memory of 2496	2032	msedge.exe	111
PID 2032 wrote to memory of 1932	2032	msedge.exe	112
PID 2032 wrote to memory of 1932	2032	msedge.exe	112
PID 2032 wrote to memory of 4360	2032	msedge.exe	113
PID 2032 wrote to memory of 4360	2032	msedge.exe	113
PID 2032 wrote to memory of 4360	2032	msedge.exe	113
PID 2032 wrote to memory of 4304	2032	msedge.exe	116
PID 2032 wrote to memory of 4304	2032	msedge.exe	116
PID 2032 wrote to memory of 4304	2032	msedge.exe	116
PID 2032 wrote to memory of 220	2032	msedge.exe	117
PID 2032 wrote to memory of 220	2032	msedge.exe	117
PID 2032 wrote to memory of 220	2032	msedge.exe	117
PID 2032 wrote to memory of 4392	2032	msedge.exe	118
PID 2032 wrote to memory of 4392	2032	msedge.exe	118
PID 2032 wrote to memory of 4392	2032	msedge.exe	118
PID 2032 wrote to memory of 4540	2032	msedge.exe	119
PID 2032 wrote to memory of 1524	2032	msedge.exe	120
PID 2032 wrote to memory of 1524	2032	msedge.exe	120
PID 2032 wrote to memory of 3388	2032	msedge.exe	133
PID 2032 wrote to memory of 1720	2032	msedge.exe	134
PID 2032 wrote to memory of 5092	2032	msedge.exe	135
PID 2032 wrote to memory of 5848	2032	msedge.exe	138
PID 2032 wrote to memory of 5848	2032	msedge.exe	138
PID 2032 wrote to memory of 2324	2032	msedge.exe	141
PID 2032 wrote to memory of 2324	2032	msedge.exe	141
PID 2032 wrote to memory of 2324	2032	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://links.lootlabs.gg/s?o455FiWj
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x254,0x7ffe4d63c188,0x7ffe4d63c194,0x7ffe4d63c1a0
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,1987721117729219183,522460975018554246,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,10409837780074532981,15016008257782334756,262144 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,17429914269030124973,3770688665421707720,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,12957995080752591576,17988361567063892035,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,14098361818740564219,4852822688248280001,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,14582796853511607935,33863732183791960,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,6634028848569450933,3187257983781158866,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,5308466809117043370,13995976040508340335,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,6034295609941813502,12164117021195591101,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,9023696025993467517,10080400591649633018,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,7732264402184652350,12397983452097417129,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,15713360927912562719,8352683925495239296,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,15713360927912562719,8352683925495239296,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,10740423449627212864,10921886219917540736,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,4870877907132966330,16423365315006899468,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,15209667233745040331,6652566383189006512,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,6084553738092102041,8208252896253617721,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6616,i,12421595482454165209,18143214543982313568,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,17982883598397828774,9190714647824276934,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6796,i,1232133209249993005,4868137443644070056,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6716,i,16946783366499218157,13710779038127481651,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6292,i,4235417603089442867,12384856541215473106,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6308,i,9760412380067074607,17173800195862564838,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,9521143485359042152,11718423202566376941,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,12178431574510249402,17634830521204141848,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,6416024836578678214,6235813439169053233,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,17864012824610499362,5070250671798194564,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,3679171750493989656,15622335289198263888,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,2829749883677595958,7693686942655836191,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4784,i,12851950256166651987,8704101670362242136,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7128,i,10456054415613096148,2020208903601048271,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,16039122918796426582,15186667469823135500,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6840,i,6089543512519859495,2770597667213461480,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6560,i,16850510734718539088,965728287077845253,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6884,i,141059384674166208,15253512093223756978,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,11534298587074039594,9519866902093650317,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6564,i,9378561142184502901,13695253452206916860,2097152 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,7217006684944292768,2943569651374974443,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:5960
- C:\Users\Admin\Downloads\OperaGXSetup.exe
  "C:\Users\Admin\Downloads\OperaGXSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4288
- - C:\Users\Admin\AppData\Local\Temp\7zS0C0E6FD9\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS0C0E6FD9\installer.exe --server-tracking-blob=YWRhMDI4YTUwYzEwNjMwNTFjNTYyZDM1YzFiZjg0NDc1NWJiMzVjOTE1YmE5OTM5Mjc2MmRlMTllZGVkNzk2NDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9IVlJfOTg1M19XRUJfMjU1MCZlZGl0aW9uPXN0ZC0yJnV0bV9pZD03MGU1ZDEyZWNlNDI0MjMxYjE1ZTQ0NTljMTg0NWZiNCZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX0dCX0hWUl85ODUzX1dFQl8yNTUwJTI2dXRtX2lkJTNENzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9NzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQmZGxfdG9rZW49NzY5MTAzOTUiLCJ0aW1lc3RhbXAiOiIxNzc5OTYzODE3LjA1MTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTM5LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEzOS4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9IVlJfOTg1M19XRUJfMjU1MCIsImlkIjoiNzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJlMzFlMjZmZS04MTFjLTRmODYtOTk1Ni1lMDIwZDdlODBlNDIifQ==
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    PID:668
  - - C:\Users\Admin\AppData\Local\Temp\7zS0C0E6FD9\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS0C0E6FD9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.111 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff6c4f49ed8,0x7ff6c4f49ee4,0x7ff6c4f49ef0
      4⤵
      Executes dropped EXE
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\.opera\aab83bf4-6f47-4a05-bfc7-e64b514c187a Opera GX Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\aab83bf4-6f47-4a05-bfc7-e64b514c187a Opera GX Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:5796
- C:\Users\Admin\Downloads\OperaGXSetup.exe
  "C:\Users\Admin\Downloads\OperaGXSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3952
- - C:\Users\Admin\AppData\Local\Temp\7zS07F179E9\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS07F179E9\installer.exe --server-tracking-blob=YWRhMDI4YTUwYzEwNjMwNTFjNTYyZDM1YzFiZjg0NDc1NWJiMzVjOTE1YmE5OTM5Mjc2MmRlMTllZGVkNzk2NDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9IVlJfOTg1M19XRUJfMjU1MCZlZGl0aW9uPXN0ZC0yJnV0bV9pZD03MGU1ZDEyZWNlNDI0MjMxYjE1ZTQ0NTljMTg0NWZiNCZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX0dCX0hWUl85ODUzX1dFQl8yNTUwJTI2dXRtX2lkJTNENzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9NzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQmZGxfdG9rZW49NzY5MTAzOTUiLCJ0aW1lc3RhbXAiOiIxNzc5OTYzODE3LjA1MTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTM5LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEzOS4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9IVlJfOTg1M19XRUJfMjU1MCIsImlkIjoiNzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJlMzFlMjZmZS04MTFjLTRmODYtOTk1Ni1lMDIwZDdlODBlNDIifQ==
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Modifies system certificate store
    - Suspicious use of SetWindowsHookEx
    PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\7zS07F179E9\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS07F179E9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.111 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff7045e9ed8,0x7ff7045e9ee4,0x7ff7045e9ef0
      4⤵
      Executes dropped EXE
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\.opera\5ac8c629-99d3-49a4-8fb2-a817547f94a3 Opera GX Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\5ac8c629-99d3-49a4-8fb2-a817547f94a3 Opera GX Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\.opera\5ac8c629-99d3-49a4-8fb2-a817547f94a3 Opera GX Installer Temp\opera_package_202605281123481\assistant\Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\5ac8c629-99d3-49a4-8fb2-a817547f94a3 Opera GX Installer Temp\opera_package_202605281123481\assistant\Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\.opera\5ac8c629-99d3-49a4-8fb2-a817547f94a3 Opera GX Installer Temp\opera_package_202605281123481\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\5ac8c629-99d3-49a4-8fb2-a817547f94a3 Opera GX Installer Temp\opera_package_202605281123481\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\.opera\5ac8c629-99d3-49a4-8fb2-a817547f94a3 Opera GX Installer Temp\opera_package_202605281123481\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\5ac8c629-99d3-49a4-8fb2-a817547f94a3 Opera GX Installer Temp\opera_package_202605281123481\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.36 --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x451b80,0x451b8c,0x451b98
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,6931639102509377450,5033807965514344348,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:8
  2⤵
  PID:3388
- C:\Users\Admin\Downloads\OperaGXSetup.exe
  "C:\Users\Admin\Downloads\OperaGXSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1572
- - C:\Users\Admin\AppData\Local\Temp\7zS426547B9\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS426547B9\installer.exe --server-tracking-blob=YWRhMDI4YTUwYzEwNjMwNTFjNTYyZDM1YzFiZjg0NDc1NWJiMzVjOTE1YmE5OTM5Mjc2MmRlMTllZGVkNzk2NDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9IVlJfOTg1M19XRUJfMjU1MCZlZGl0aW9uPXN0ZC0yJnV0bV9pZD03MGU1ZDEyZWNlNDI0MjMxYjE1ZTQ0NTljMTg0NWZiNCZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX0dCX0hWUl85ODUzX1dFQl8yNTUwJTI2dXRtX2lkJTNENzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9NzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQmZGxfdG9rZW49NzY5MTAzOTUiLCJ0aW1lc3RhbXAiOiIxNzc5OTYzODE3LjA1MTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTM5LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEzOS4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9IVlJfOTg1M19XRUJfMjU1MCIsImlkIjoiNzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJlMzFlMjZmZS04MTFjLTRmODYtOTk1Ni1lMDIwZDdlODBlNDIifQ==
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\7zS426547B9\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS426547B9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.111 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff782e69ed8,0x7ff782e69ee4,0x7ff782e69ef0
      4⤵
      Executes dropped EXE
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\.opera\8459cad2-df94-4379-9275-af3d4deaa916 Opera GX Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\8459cad2-df94-4379-9275-af3d4deaa916 Opera GX Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:1800
- C:\Users\Admin\Downloads\OperaGXSetup.exe
  "C:\Users\Admin\Downloads\OperaGXSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1840
- - C:\Users\Admin\AppData\Local\Temp\7zS03741AF9\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS03741AF9\installer.exe --server-tracking-blob=YWRhMDI4YTUwYzEwNjMwNTFjNTYyZDM1YzFiZjg0NDc1NWJiMzVjOTE1YmE5OTM5Mjc2MmRlMTllZGVkNzk2NDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9HQl9IVlJfOTg1M19XRUJfMjU1MCZlZGl0aW9uPXN0ZC0yJnV0bV9pZD03MGU1ZDEyZWNlNDI0MjMxYjE1ZTQ0NTljMTg0NWZiNCZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX0dCX0hWUl85ODUzX1dFQl8yNTUwJTI2dXRtX2lkJTNENzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9NzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQmZGxfdG9rZW49NzY5MTAzOTUiLCJ0aW1lc3RhbXAiOiIxNzc5OTYzODE3LjA1MTciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTM5LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEzOS4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9IVlJfOTg1M19XRUJfMjU1MCIsImlkIjoiNzBlNWQxMmVjZTQyNDIzMWIxNWU0NDU5YzE4NDVmYjQiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJlMzFlMjZmZS04MTFjLTRmODYtOTk1Ni1lMDIwZDdlODBlNDIifQ==
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\7zS03741AF9\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS03741AF9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=131.0.5877.111 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff6965d9ed8,0x7ff6965d9ee4,0x7ff6965d9ef0
      4⤵
      Executes dropped EXE
      PID:176
  - - C:\Users\Admin\AppData\Local\Temp\.opera\5c1871be-c689-4d94-ad00-723aa707e64c Opera GX Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\5c1871be-c689-4d94-ad00-723aa707e64c Opera GX Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6728,i,4763286004900766618,15300626004271914486,262144 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,9351845228130612004,8009621665060725383,524288 --field-trial-handle=2440,i,5392495537374822885,4845681007347988628,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:5276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1300847767\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1586246226\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2032_525917330\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c84b0b96ac63768d057645348446be68c55adab73245de7400c7252788c5dfd
MD5 fbb22b05056938451028373f9ceac730
SHA1 2100181bf2ca147788018c0fc0d8176277267d56
SHA512 442697f514aafad71c10367ec3739b9ccede8ede2df732f17e276001281f5e3b6c20a630f00f705ef192d793575ba29f973ecdd308fa577707145ace09368f31
TLSH
T1B8D022B6AFA29AE1E039353F292543423F9C45320346223B1E6D5C14DCF58CB88D8DCB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 803b074202f3bbaa99aef8ef56dfe22fca6ae89f45945c8ec0f0f5bee87f50d0
MD5 fc8569d07b8d598f052a504d721f7437
SHA1 770a9062dc7807a6d8e7f027188418a412b82819
SHA512 3fe516a3a64f0cdee40f50c7194eb63a0c57390038acb55db19764558abda2648865191f0a8af2b619570b37ec70ae797318c77f9cc7a2446ad00fd8cd2c92cd
SSDEEP 96:cSG6nFWKiNDl86EZVWsVu0YNj4PhN/2FV6IPkr/WSil:TWtZZ0V1dYNjI46TOx
TLSH
T16FB1C52C239C2559EBA171B1EBE10FA773F14CB85D964F075324C83CA493BAFC51A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5d25beb095e6c9f9328ec989bd45e6064ae690b36beb8511e0fd0894f2fafbe4
MD5 57225be4d6f8f3f55430239cd853fb66
SHA1 a823cbec755c27ac7cd0f3e822a5e411cdd7c94f
SHA512 ca1299435e8b7c9a9ee7eca4a9f5ca87c95ca8c472ae8883299ae03bcf0fa195977f824269b9c6f26ac89ed7fc5cfc7bb1c0b4bd316ae7ad10f42820d43f5f03
SSDEEP 48:pWILMjYfWNPTNrEfo0nkXtMb2tqMoifR5Uf0HswH2yVJuVIpcW/ERgyFHVcI:ojxNPTA+tRti8RCzwWyfnEz
TLSH
T1BD814D193354168EE3E2B2B1EBD10F0937B10CA98D9B4F162350DC7C9523B2FC51283A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5938c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5938c9.TMP
Size 3KB
SHA256 7f77fba9d669a136a6c59703eeb1dcbf794cb815a3163ef10836402ba3f51ede
MD5 6b19422c3d60a7b78900ef37c5c24cef
SHA1 3de930998a526c8b915102eafa79d0a19d1de80a
SHA512 fbe6c1793bdc289c29e1f1c04acd0e23f73dcb48258356e935c5c69024f8bc396279fc2c0b5823895ca7a10a7cb735f42141fa93242052621c63c1be2a385896
TLSH
T146715C283298258EE3E1F0B2E7D20F4937B44C894E4B5F161364CC7DAA13B2FC52157A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 c0c6716da19928c874c2ccc7fe83d3a9ef43612e575becfe749c7ca777942c1a
MD5 e3c168dab61bba99b3eca1c5177f5477
SHA1 00286deaeeea2f66d94da0fe1615be2dc471fc6a
SHA512 becbba3a6ccee158966c7953a27470d93c6efced18ecabd766ad22e3e1e9aa0b3bc3cc643f198de86d96a66595fe2c5949df3a2f4a507077c210c365ac89f608
SSDEEP 384:DjPJPY8PTkPoPkPWPfPjPMPbUPD2q7GoG0P6PPISdwYpcLSS+xyLPfIP/GPvPjPS:vhlW2KEnTSWJQNCfW/03TPZtJ1JiPWnS
TLSH
T176826BB7C3E8832DD92256F4A6146F1ECE1E1A24432C3D3AC9E59F4BA7D2471E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 f4c6255aa73ca4eb00c6767a04bfc8356671cf20ad6822fd600748fc24e3f763
MD5 afd0b8a56d0eb9de7106fc45171a2046
SHA1 c862d6c24a37f6e97460dba9ee3b71cebd18782e
SHA512 d69808e8d08068c0003e38f9583095a95bf505453d31c7d07e7d47c5c0e2e7406a6c9ba14e95b74d5a54ba6f304feba3116851a3ef3781525b490ad291a554a3
SSDEEP 192:DjPJPY8PT4JPoPkPWPfPKePMPbUPDveq7GoGAxyLPfIP/GPvPjPnPjFPoWPYj6Vg:DjPJPY8PTkPoPkPWPfPjPMPbUPD2q7Gs
TLSH
T1E0326CF7D3E5831D992192F4AB152F1ECE291A24432C3D36C9E5AF0B97E6870E20165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8a81d83623e229c19cdd01264cce9a1cda153eeb4119d0eeb59d2abbd4254173
MD5 b6c1779aa6b136b20017af040532bc6d
SHA1 3c92c4b14913e064661fff4854d7cd699e8431e7
SHA512 335ee1ec6ec64c8af6f633bd7270460585a866f7254b3433831d5d8f3d98272d434ba2e36b9212166a2d2cda020f92d049f4ff8eba915729b862fadc3eb81e7d
SSDEEP 192:sxZxRfiyM/jK1Ml8Mkx/fCsP+ejuEBQeDIdp9dHW6+WNnNvE/6AIr5E4iIE2Ig4J:sxZxcMx/fCsP+ejRuecrHbn6/ALnc
TLSH
T15952E902AA3859778CDBD219F955BB57D6F9146392900E44AEFCCB0C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b6cde0e957e26341eb5a3eed99cb279899bc74a111dfdb8bfb98cf8cdfb025ae
MD5 f29841099ef8ad29c07f1bb21d8560ad
SHA1 34ad0c4dedaeea58cc51d04be31006b8991f76aa
SHA512 55b81257c33d516d4bc80691383f9c2f72082c19275ce23cf460253a15525a62571ec024baa3a1ebd0b88cbcd9cae45ffdad2851085062ab4c4cb64c3d9104f1
SSDEEP 192:sxZxRfiyM/jK1Ml8MXx/fCsS+ejuEBQeNIdpJ9WNOdHW6+WNnNCmX6AIr5E4hIEL:sxZxcPx/fCsS+ejRueuHJHbnhXA2nw
TLSH
T13E62E903AA3859778CDBD219F954BB57D6F8146792910E44AEFCCB0C04EAAED2107C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ce43c2ae27a8bd5b3be4d1c5cd0c42c02f103a7d95cafbcc149af2a7ad11e88c
MD5 46e008e4c102c5dcacb86539e49ab97e
SHA1 85d4bf7325c09118dc889ecd06e2e91bedfd3245
SHA512 62b71119c1cbed55fd2b1aadbf3ff2ac1f237cfd6db9d7252817ccc391b25608ce160adb853573ced1ba0425bd4168a7c589eeb818f9d44ad555f1c3299f975f
SSDEEP 192:sxZWRfiyM/jK1Ml8MXx/fCsS+HjuEBQeNIdpJ9WNOdHW6+WNubI4NCmX6AIr5E4H:sxZWcPx/fCsS+HjRueuHJHb74hXAUn+
TLSH
T14462E943AA3859B78CDBD219F540BF57D6F9146792910E44AAFCCB0C04EAAED2107C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 f7e45658a9b862641d3ac7f153220f7db0bc97c4dde256a94e7516624d1b7b63
MD5 bf079cdc0a000f6df5e5f341d763b0f1
SHA1 64815c21d9cd15cb3b5ff07b121bc9b9e955d1d5
SHA512 c69daea3747c9e44f54bf68029ecea4c15801a44b9861a573e6335be6687d230d0cfeb8b970bb4622575d5bd983e2e7a2ea34d02cecb2bb08ead2ad28b5739d0
SSDEEP 384:sxZWcq9x/fCsS+HjRueZWJkhbF47Z6on+:sOr9x/fw+HjRvckhbK6T
TLSH
T18382C743A5380AB78DE6D219F511FB6FD3F9146696D14E84AAFCCF0C00E6AED2102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 15a6c4d56414fb125246ef5cd3d7b192103f7c46f5d6b4ff72aae95b1e09e414
MD5 4779ddf56f3b55dbcbf8ae727d0a5306
SHA1 8dcac314ec72821140cf21a21530f1e298b92edf
SHA512 b146a3de90798af04e2dbf00e9803ee46bbef316519f1e749283b37c81d2f8240a5b00ad3f23666a5d07a112b23bf1843d262b7f75ffdf6e4ee0fbfdc5244473
SSDEEP 192:sxZWRfiyM/jK1Ml8M5x/fCsS+HjuEBQeZlIdpL9+i2KDper06eyn9DVuCW6+WN/k:sxZWcBx/fCsS+HjRueZWJkhbF47Z61n+
TLSH
T1F782B743A5381AB78DE6D219F501FB6FD3F9156696D14D84AAFCCF0C00EAAED2102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e064a5d8bd2fb5408b9d3a2761bee54d0b547ea378ae6b6b509a8ca0b6845465
MD5 77c3feeb0b1fe13615583504dd41610e
SHA1 5215d828283d3f090b3e24dac961e484a21f7ef0
SHA512 d7c74f7e533f6d8254d4c8aed20d82c974a353617085c1c1d6c5242398753875cc54f127a114f8f0ad65c60cc11c7aa5e4ffe95887da5676976aa76836413473
SSDEEP 192:sxZWRfiyM/jK1Ml8Mbx/fCsS+HjuEBQe2lIdpL9nKDpl06SDVuCW6+WN/mklbI4F:sxZWcDx/fCsS+HjRue2WJ3hb247ZAHn+
TLSH
T12A72C743A93809B78DE6D219F501FB6FD6F9146696954D44AEFCCF0C04EABED2102C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 dffe023aa4d59c47e52f4c948ff8ab3e45e491daa19e53deb77aabe31ae2f992
MD5 a824bd9d60a967238c18bf1f275ae41c
SHA1 6e8f886187bfdc9602002d2c4109c077e1891727
SHA512 51e9e94969a9f09c49dfd35012fb1c1272a4ad25067e24a98d443b359d71afb062cf99656bed6f9c91e79475041df99a48082f25254daf6396780019155eb08e
SSDEEP 768:8K8iJdQ7pLuLXxNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/rhALl6opdHroN:8K8iJdcEXxNWvx76ru1ja2rhALocdUqS
TLSH
T12EF2FA3B6C0CCB7E4F804E9CEC2A6E9A6DE801CF5A98895447FA841C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 60da8d43c7a8066f89b5c5b1a455b84a380c5c06ca8341a15ff4e5e0937985cb
MD5 049ec3651de0916d717e34dd757fd863
SHA1 25958614ea47e078cfe7ed579c7cc95185fbd602
SHA512 f3135445aa014e5cf78c072a461d41fd4905395956a97faa3476a5235ea25149dc171c9cbdfb28aa6a43b4378b219fc1e02391f70ba86b91db9e63ff5255263c
SSDEEP 48:Kvp8j3pzTxuXesIZvxKM4kJxYBhLWvTSyZII9KwXjIpKsAUfyVRIlKs:KUacKL6SqIKKwXjWKsAm+RqKs
TLSH
T15391560175BF0252387E3509A258A6171F96B267325DB43B3BAC46734D26E203DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7210ce78-b72c-4dd3-9998-09f651e1e9ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7210ce78-b72c-4dd3-9998-09f651e1e9ea.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5b94a23796e6544feb0b75b3198120f120d84612416d22d906f11c3bc1c11d5f
MD5 5e8095e60020e9147fac79a49632cdd4
SHA1 81d310c7f064733dce391c0a0706f80cf9b8a6c7
SHA512 45b70ab91c8eec48dc94cb35f9f5d5c13175a262acbb17a3ca875f0565d8e9a50b22d5fc002b0cff4ae09bb3c1282d12bfefcb7d09f52751cca84047e4acabb2
SSDEEP 384:yjtNnNnb9+sNf16Lpcx7xukWOpT8BSTK3RlUVvDmw:yjZbEab8BST+R2dKw
TLSH
T1CE926C3168792D6B9DA3AE55F04B3B17AFBC516B99C11E91DDEC5B0E00C739C130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e168858dd99d8a8bf4b631b70794c2e23e2f12376eaeab035f6c3f10f64f8981
MD5 fd885473f9f840b385a7823f8d01259b
SHA1 6ed0c6bc23ca2d222f165d7f300c99866e46bf71
SHA512 7e7e036b57603ae6060aa349a4a6ae7858b0bc4a4f11de437badbbc7f1cdde9c4a0ae587dfa33d37aa3620b713ab048b1de1ee40495402300711e9c9c9d0e3c4
SSDEEP 96:ZqONk7QsjpfmUTmDK5ih/cIPURHl8h4otop5A5D05BhPwivh50xy0SFYKDAxvYe9:gONz6kDfQmiUyiuZ903/i+QiR6aU6
TLSH
T11B02F835687C6CBB8EA3AE45F48777275FA8213BEAD12F84D9E81B1C00D725C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1014e3426f39f02f98e2cd8608d1360a182d0ba56a783091160b299f363b2173
MD5 f90e00e0ec66971f96af6c1fe14416b3
SHA1 5ef1fc1d15bee43c9a96ef079f9ec42d3c969873
SHA512 5d1cfb52f46a903306a7db65c2dd86f45c9e824c46210e90fe371f4b59ab03519f836073f0f39f9c9cc09e34fce21730132c81b5e06757fc772ef102c1874922
SSDEEP 384:yjtNnNnb99sNf14Lr97xEkWOpT8BSTK3RlUVvDmw:yjZbbRN8BST+R2dKw
TLSH
T11A926D3168792D7B9DA3AA55F00B3717AFBC516B99C51E91DDEC5B0E00C735C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d090a8d61083a901f736b8c5c193478835652210fec718022d8410c70ab2edff
MD5 dcedf88a2e16edb644604630f62f965e
SHA1 ae5c5f779986ebad2cef67571d483af65f553c2a
SHA512 3bc99bed95d0b10037c097f142c7cd6c71b84260a199f71f3ecb4dae48c531f0d6e21d7f439eca481663f5bbdc8378bbdb654d365fb39c4081ab6721f026ceea
SSDEEP 384:yLtNnNnb99sNf14Lr97xEkWOpT8BSTK3RlUVvDmw:KjZbbRN8BST+R2dKw
TLSH
T152926C3168792D7A9DA3AA55F00B3717AFAC516B99C51E91DDEC5B0E00C739C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 a8bf75fe3fca13faf1cabd0214aebf6bc2ea09f42c97682d0f7d6c5350ef6f7e
MD5 a5e5264a810d5d723cb1ac914d30ef9f
SHA1 3cc9023498f4003135248cf35daf115c5f891c65
SHA512 865f1e518ae22755be7a0fb7b19e61a6c5e6aa38127e6607ef835a989c7f469f7d137d7ee9623f06507c36e3130f5412a57901e86862c4c0c7d6a49c671f3c79
SSDEEP 384:y3iFKtNnNnb93GsN4P8TUNTUlIlELam7xPB0ifVdWOpj78BSTK3RlUVvDmw:/FKjZbQPwgchDH78BST+R2dKw
TLSH
T1E4D2C5F198E79536E8AE4B83A33E7E069EBCD15775841980FBC81D4DCC822BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 d2afac9934aa5df5ac8ab48787c27067fb75f4e837908313d2180ae99d294fd3
MD5 d7fccf1f74886f03b6911a8e3a79b93d
SHA1 f2815475f209ac27057ef25c663fb517d858cbf7
SHA512 0504ae8dacb90ad0bce326d5c0adce4469f7c8315bb8ac5b7c661ba1f785c63ad63c45bc8680b258cd74fdc8c06d34e62b345e59e5e1e846f08468baa6188f3f
SSDEEP 384:y3iFktNnNnb93GsN4P8TUNTUlIlELam7xPB0ifVdWOpj78BSTK3RlUVvDmw:/FkjZbQPwgchDH78BST+R2dKw
TLSH
T182D2C5F198E79536E8AE4B83A33E7E069EBCD15775841980FBC81D4DCC822BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d7a110fda7d5f5b12cd87b3018812c7d89eba3a4f7dfb034ef4e06c9bda76793
MD5 50ae1454dccd5cb6de9051c86f75fa15
SHA1 2f7210e775cea29f3c45990d9f3af37cbb929d00
SHA512 24f16cb962444d49302b7a1cccd3db55def4b44482f8de4d902660061d673e2f2d8a4f81bbb310ca208b1110806b73a86a7261665eaa3999455c4f7b2923c843
SSDEEP 192:gONzE6kSQmiUynu7c903/irbNycRM/ZU6:gONzE6Lp7c9WOpf8U6
TLSH
T1EA12197168BC2C6B9EA3AE52F08777175FA8217BEAC51F81DDE80A1C04C769C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 156227af63aaedd8271e635ead7c0bbc09f45ddaa4cf369bcae7819104605034
MD5 319b2ae33951c60ba18e199dcb3ea751
SHA1 90c0ab4a7afd97e227bd151dcb62f08c3185d1d9
SHA512 7f869fcb49b24cb3da5e80d8607604aa16e091ed42a94b29cd9550b94e7f46426fe0650ee8c522e866a0bb5169120e487d35b70e3e0ab4105c1afa1a299e23cd
SSDEEP 384:y3iF1tNnNnb93wsNfP8TUNTUlIl4LrO7xE0Df0dWOpG8BSTK3RlUVvDmw:/F1jZbeWwgNIK8BST+R2dKw
TLSH
T127D2C6F198E79536E9AE4B83A33E7E069EBCD15775845980FBC81D4DCC822BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b31987f6509e2d099695f5a2c49391bd26afcaedac6d2fdecb1c8448092f7381
MD5 89d51f2162f5d2ead1025a8a4228c4c7
SHA1 8f8f23c57c53bc41b10eed0bd464642bf5cdd27e
SHA512 12830033cd65de0235889922b098b3ed964bd13c56eacefd8ebd85a348feac0fe29020e7796a9fec3ccc2699e166134e8a7c422a3a586b76ea34f6e7834d004a
TLSH
T19CE00263A30051FAC02C033044D757182BE3C07503E343074D2515743C66B541D24EC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d03f347edb23a0fa2a79c0589323c031320c39dcd6a3994d504e97c604e8fb80
MD5 70ec0c80766c34c3f04a2af94b5c1574
SHA1 b80eaeef88aa12e6780c0f913056cc05312fcc6c
SHA512 9d4399a935877142fc5335dfa70a0d6680dd94b367433d1faefe21a6972b05ed2a5d2c428043301ed027f7b610618e702ba27af9647b677157a5a60ffc9244fd
TLSH
T1C6E00963A7405AEAC8280330449B9B282AE3C13502B283464E2999683D67B842E24781
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e30afd39df3d4155d11dce6529f5779d83844cbaa616188144bf9784aac63c97
MD5 44eb2f613657dacf8c68178ce9a797d1
SHA1 b3e74a54a898bf667d95e176fca6990336eb80f4
SHA512 03c4029cecd9539d4adca1dfe3466aa4b8a386d4f1bdeee0cdb946b134319ba73e4fc169facc3b66e8a58856d90b4d865a5c58aaff8001cebd47523a88779ec4
TLSH
T162E00963A7805AEEC838033044979F296BE3C13502B2839A4E3999783D667842E246C5
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 aad7559a08c59f5fbadd73317456b6a7dfa99addf00164a2e3e061ced8afdc97
MD5 e30898edc24b9492d5524019eafa367e
SHA1 39311e27d74bf8a113ec67dbe2d6064eb8a598d2
SHA512 1832447ab4bb030c8b8fdea4feb85bbe5feea31268c8d170e85952e98eeb7eca2ccb6bec51b23743a7242f1ca57802e2dca82a494a07bc86568d0b88b041b067
TLSH
T10AE00253530051B6C01C033044C756042BE1807403F34206491515741C27B501C20F41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58fc8b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58fc8b.TMP
Size 392B
SHA256 64605104c370afe3f4b46ac4fe9b11250450228a499ebd8a7ba5e81d58a546d9
MD5 3741be39286a846ecdd4d6d2ab307e79
SHA1 38fa5b81ee01d29ce53562f6d37cbb3f0842a6fb
SHA512 8eaf312989cc6f83b06c7f7562267e301f196ef08f89a6e37648e681cffe5fc07d53da7a91d6bfc444116c85f327c731911d33e059f2a91029f081565ce67251
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

3589afd6-4270-4986-a109-fae802f00f36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3589afd6-4270-4986-a109-fae802f00f36.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2454b352dee8e46105fd61287cc3d51defef762565cab20af9c0bdabb89ac764
MD5 ca6afe3031d13371a84f9c7f39b0a59d
SHA1 24476935c6c4b33005218e655ab90ef869c040fa
SHA512 e3ead9f376152723957cdbc5338a964ee7ea5ff8ed6523f9c444c761b246e6e4f75b6554d1d92f9c79e17521280b9fc1e29b3601e7f8c25ef89d902b8025e437
TLSH
T175412958B6F91148B3B77E1AABF6A86D487FBC762E07D09D10110E4F4623A00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\5ac8c629-99d3-49a4-8fb2-a817547f94a3 Opera GX Installer Temp\opera_package_202605281123481\additional_file0.tmp
Size 2.8MB
SHA256 aea99ad410a597e74390c1a4c41fd8b9a0847c555e62538f20690bc4f5081073
MD5 1948536db3faccb7e5595773ee92f2ce
SHA1 105b7919aa0443bb2db97f45c14cbab3da936c69
SHA512 e9e14b59861519460ab6c06d0bdee9ad82026f23887a4c63ab0558aa80ddea1b5ce5fd7843f96b6f3acddfc1355cbdceff1f73e3dd4a492c10b35323630559ca
SSDEEP 49152:jkinowz/orNMNO+9HYTFv+n3r45uxOYongWHO7Ixnoc5:jkio2yNY19H2SrbUY5WHmIxo4
TLSH
T1E4D52331F691C8B2D632153248ECE7DD52FE73515FAB6AAB37C80B1FEF615822A15009
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6855f768-75db-47ff-9630-65c1dece3759.tmp

Path C:\Users\Admin\AppData\Local\Temp\6855f768-75db-47ff-9630-65c1dece3759.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS07F179E9\installer.exe
Size 9.1MB
SHA256 0dc3f74b9cabb14adcfed3e6a4f17187a198880ae5d69516cf426ebde712dc2a
MD5 bbcaf65331e7eb4e08025afdb37b06ec
SHA1 8763f5b69cfaef130e2ae68d3a30f5967861649c
SHA512 15c9fcd71f7c3d134d24ab83022930b7be7baea4b28f9e89c081972bdf83753e4ea0e71901bf86e6e1377ce5a7e400912341e87165b6168f0e3bd59079de6ce2
SSDEEP 98304:9aK2JAm3OEz7ypvyQHLBfYnOIZr5+16rkLJYtFBI3++wteEmb:UK2a2Ow2Fhg2JYC3+Bqb
TLSH
T13BA68D53F2E601E8D0AFCA749B3A562299357C464B30A3EF0A9436251E75FD49F3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d691b378-45ee-4234-bc0c-e719237a2155.tmp

Path C:\Users\Admin\AppData\Local\Temp\d691b378-45ee-4234-bc0c-e719237a2155.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

opera_installer_ui.lck

Path C:\Users\Admin\AppData\Local\Temp\opera_installer_ui.lck
Size 4B
SHA256 c79f598959b2fd8939fb8d43869478cadadf8e1ee99c30fd91a51442762136e7
MD5 b9ae02adb2482974ca73ec8094538ccd
SHA1 93f2d8e638de86b4da79cf725de3f6a021d42146
SHA512 28b87f56e30b2789f7736abbbfc74126f41010014a0eef160dd99abe7bb50be91fa561f9885a3fa9eac00a81c9e55952023283ec3e831300ba008cb54329f431
MD5 SHA1 SHA512

Submit Download

6cb536fb-aca9-4666-bed9-c7050c8f7219.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2032_1467818160\6cb536fb-aca9-4666-bed9-c7050c8f7219.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2032_212274179\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 222d29927ecd914b9c27900826c084948710336099077728250d5e7f69b28411
MD5 399416f172f16def6769655e07b7424e
SHA1 e03780003fc0e9b7bcd280f425b5f63469ef76fb
SHA512 308dc30b943173da045f1c9b7bd17c3b8aa1acee2bd48620885872f3525954df36e8a9429e492cab892ed867a6bcde34942b07ce1c675fa469e4950a116c2866
MD5 SHA1 SHA512

Submit Download

OperaGXSetup.exe

Path C:\Users\Admin\Downloads\OperaGXSetup.exe
Size 3.9MB
SHA256 0d7eca25e46e269b8cdbb9960f9f5e1630a0698f2214df2cbb88748cf731523a
MD5 0706d93a370db10e14778304a0c82299
SHA1 f6c61f09a3a239a5966ad348e2495e7d21a0e19b
SHA512 ca58dd7bd8837bc97cdf916686df32deb0294d52dbd14ec023319a643869b0a062769475b71d9926a9add6fdfa110dec97b8180fdafdebdded6dccb0bb2ddb3e
SSDEEP 98304:oANEK2LKHm4MDOGZdB2Fez3wk43Rdcqgu4eMK3kJE:MKRHmjDOGXB2FezAkoRdCu5ME
TLSH
T1E0162310B7858876DAB321324FE9EB58E7BDF5250F234A4727980E1D9F704829F65F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download