20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

Resubmissions

14/07/2026, 17:46

260714-wcjgmacw416

14/07/2026, 17:44

260714-wa4psacw216

Analysis

user interaction
yes
max time kernel
101s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/07/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaInstaller.exe
Size 178KB
Sample260714-wa4psacw21
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
33	5044	chrome.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OperaInstaller.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5044	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285246990743404"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OperaInstaller.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 3600	4968	chrome.exe	81
PID 4968 wrote to memory of 5024	4968	chrome.exe	82
PID 4968 wrote to memory of 5024	4968	chrome.exe	82
PID 4968 wrote to memory of 5044	4968	chrome.exe	83
PID 4968 wrote to memory of 2268	4968	chrome.exe	84
PID 4968 wrote to memory of 2268	4968	chrome.exe	84
PID 4968 wrote to memory of 2632	4968	chrome.exe	85
PID 4968 wrote to memory of 2632	4968	chrome.exe	85
PID 4968 wrote to memory of 3668	4968	chrome.exe	86
PID 4968 wrote to memory of 3668	4968	chrome.exe	86
PID 4968 wrote to memory of 3296	4968	chrome.exe	87
PID 4968 wrote to memory of 3296	4968	chrome.exe	87
PID 4968 wrote to memory of 1856	4968	chrome.exe	90
PID 4968 wrote to memory of 1856	4968	chrome.exe	90
PID 4968 wrote to memory of 1696	4968	chrome.exe	91
PID 4968 wrote to memory of 1696	4968	chrome.exe	91
PID 4968 wrote to memory of 2908	4968	chrome.exe	92
PID 4968 wrote to memory of 2908	4968	chrome.exe	92
PID 4968 wrote to memory of 1968	4968	chrome.exe	93
PID 4968 wrote to memory of 4020	4968	chrome.exe	95
PID 4968 wrote to memory of 4020	4968	chrome.exe	95
PID 4968 wrote to memory of 3916	4968	chrome.exe	96
PID 4968 wrote to memory of 3104	4968	chrome.exe	97
PID 4968 wrote to memory of 3100	4968	chrome.exe	98
PID 4968 wrote to memory of 1996	4968	chrome.exe	99
PID 4968 wrote to memory of 4988	4968	chrome.exe	100
PID 4968 wrote to memory of 4988	4968	chrome.exe	100
PID 4968 wrote to memory of 1696	4968	chrome.exe	101
PID 4968 wrote to memory of 1696	4968	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92f2ec728,0x7ff92f2ec734,0x7ff92f2ec740
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,16601230223400980887,7681226438027791425,262144 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,17170021124197869925,366509294968025821,524288 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,5524297958427205439,3836286773051724141,524288 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,704727793858455446,7890406014313179045,2097152 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,5889361859565552794,4171071155483944707,2097152 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,15994976230264712485,6085742827460007332,2097152 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:9
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,15279683573184247406,6751266288470228042,2097152 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3904,i,8421051485235524712,16160608814861766753,524288 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:14
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,2155816721098996970,3994188894705191030,524288 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,14947501797618041007,18100138749915586736,524288 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5924,i,3162733770129792434,6154012332233333168,2097152 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,6860174441071730116,6461639878282410771,524288 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,1910336806313974360,9931400146882183574,524288 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,2986993927451964439,6824420802987597564,524288 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4328,i,14438065183397963809,7308110552597277617,524288 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,9189909727094201801,585595827104816683,524288 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:14
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=4388,i,14933956229954886297,6870998961997400989,524288 --field-trial-handle=1904,i,17277824585053314814,5197464148005992898,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:14
  2⤵
  PID:1696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 59ac3d066a3cbb51473ac85167dfe2a571e5e29fa004e1658a21d712a37f0a49
MD5 67cf7ff3316f8ca6b36cb27e74ab1171
SHA1 034b4b657f141fb1c829dceac49e3b63c2a220bd
SHA512 988e20415ae474c1eee50b5289bc597fad6a1462b9637db7bedd5e022e5fcec89270e6a33e823ae6033e564e2d2c0e6b769e89146f52fbe549a94ab09a1ac59f
TLSH
T102E02BA9C812DC3B18FD071D60600746F79123676A418A4F3B3C51098F75B37028D96C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fd3837de95bb13a920cb7ac3a9955b93d50126bddabe32198a4d0876b12ea4a9
MD5 80cb3d60df4a05e5e0f8cb110f95b7ec
SHA1 3fa15e4cf35327c1642a1d8c79ba369d7485ebb4
SHA512 a59f8f0fc45b8508a618d28c30b3b918c8be1ea31eaac438efd19936e702810387b3514f1b2adf23643d6ea53d29c7cfdb6214e1cf1b366c78e211094de11145
SSDEEP 384:fRD69a2hv2bVF7xy1CyofZtXmrwEtO26Ee:R69jv2bVF7xy1Cyohwrw4O2M
TLSH
T1D652C82EA900693B9DDBD219F9517B93DBF5102525D42E84E7FC8A2C18EB9CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e16a1908e19606b39c8f20aaf9aeb13b012f4a10717113e56cf9229198aa7a36
MD5 460dbfb1445a92e8f366f201fc709500
SHA1 68a6b07d703b4e1bcc8f0952edc00077f4a9c702
SHA512 18318a221e0aa81199a125f33bff281dbbe4bbcc3e78746de4797bdff47e08e1c0f1a6b8f5d1e34b9871e8d3206f0a272ee6e3fbaeb18e026019aa7248200d5f
SSDEEP 384:fRDO9a2hv2bVF7xy1Cyo6ZJXKrwY0c26K8:RO9jv2bVF7xy1CyoOMrwZc2u
TLSH
T1C442F92EAA10693B5DDBD319F9517B93DBF5102525842E84E7FCCA2C18EB9CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f263dc260cf62dc3495aadc1931b336289bbbdfaf8ae1203f35cabc37600d8ad
MD5 fefdbf50e8247763afc4d9dd9b9fd640
SHA1 44c6405641557ce0fc402edae9cd0c18a7cb78d4
SHA512 42e8139939b3220ba91ec814d23bca2c09a2aa684f03ebeca057b7a37b43d3784ecd88cac767fe9f7ea349672f446ab6593fd4fb6493ec019b9670c48cc0683d
SSDEEP 384:fRDO9a2hv2bVF7xy1CyoiZ8XKrwY0c26K8:RO9rv2bVF7xy1CyoG7rwZc2u
TLSH
T12042E92EAA006D3B5DDBD329F9517B93DBF5102525852E84D7FC8A2C18EB9CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c036fb8e7950df2fbac4a46006850d8639f4d79c1ebb7534af9749cfa4a572b5
MD5 a51d349420dd96a9feda32064d01077f
SHA1 cdde9bc7ee8ae166f70be859d60037dcfc67b06d
SHA512 0cb80648e0d10664f184392999a8a1e19f3f307fed1f34ce061946dbf349fd109950a919f55073169ce15b7304cf0e050e3d76392825c80e8b11f5afa69d71e1
SSDEEP 384:fRDO9a2hv2bVF7xy1CyocZJXKrwY0M26Qe:RO9jv2bVF7xy1CyoMMrwZM2O
TLSH
T1CF42D82EA900693BADDBD219F9517B93DBF5102525852E84E7FCCA1C18EB9CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c41ac08760439a03ab5ec5e060c49882b8f4d15ab3ab00b85cb049c08f15be1a
MD5 6955187a47532fe314a1e1c103045131
SHA1 078d296aa3a6b112637cb6890349af4eafbb904e
SHA512 ac2fa0f26b2e4bb184a5067101f56365478260fb3a1dc1b156420cc3978090b93f213a39d79e53c46bf1c547e8f2ff638a9abe8f0acb0612f362b2d13f77fb93
TLSH
T147B0120084019202C45602F02142548871349F14EB0A1B0183E46922C8261A1801C090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593118.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593118.TMP
Size 96B
SHA256 289ede132c1e0e42f14a89a4a10d8e95c8f071908fccab0c9c7b08c9ca2ea065
MD5 e86bf1548c2eb2ff1c37b588a3c40a9f
SHA1 25b6bfd841829f34b228418adebe347dc22971d3
SHA512 ffcda1bd94fe2d545aaae89ebe68144e7d80ba5f21b4e81fa395a5586e09615f4720607ed87a52ae1bc0c78d41c8bab8d57989d1a8d8230d6c892869ddb7582f
TLSH
T126B022A2C303A302C00203F02088A0CCB030CF20C2032332C2E00A22EC3833B0B28030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 b1af3090af2d05b7b230885d0a54f1d0232dc3d1c67ba248e6a3d55b2f1edf60
MD5 d2d49cadf1d3a5d9d6f62d1176521ac3
SHA1 d866b9b90fd25293bffb544937ce3bb496a3f884
SHA512 461e5ea06e39f12bc620d37e1466317658f23d9f3801218984910970522012906005972a5dd2befe65d7775edb5798c8a4607a085fef3cb03d7f338da5bf5a50
SSDEEP 6144:f1YewRp50GN+3aC0/WpcVi0m7Rkm1tYpBeh2BAoM:f1Hw2S+3z0/WGC9oBGcAoM
TLSH
T1C234232BBDB6EC766D516708B08E1D0F1FB1C5A2D920DD9282D40F0877EA3DE1A46D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 21f114d21bdaf6ebf47400c995f28b736488130f3030f25fec0b6012932dd778
MD5 f7d6275faea564c955c529f23a6b51ee
SHA1 632715a039b594335fa8b1890c5f964f7ef02ca3
SHA512 524358a45f0c8a8019e8bce7d48e16008e28d8e0d6050eeb4025ac4b5b4b27e160160b8969fba746b5468ddfcb922b6a82b3e1aa68bb42abf71e2641c8e1eab4
SSDEEP 6144:i1YewRp50GN+3aC0/WpcVi0m7Rkm1tYpBeh2BAoM:i1Hw2S+3z0/WGC9oBGcAoM
TLSH
T1B334232BBDB6EC765D516708B08E2D0F5FB1C5A2D924DD9282D40F0877EA3CE1A46D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 accb0e2ff754990d5fa88d28bee460eb54870ed3b3b7c386fc7119e4dc575bae
MD5 ac902480cfd177194ed394641179a916
SHA1 1a87c2518645a71bdb4c6be6eec00967e8e1e9b9
SHA512 2fda3f2091f7aa68830b23925df1ffafdfff80e598b35fa71b3ce3634e11a121cb235c25ba40b885695037081b3169932e3cc17fd5dbccdfbbf38310d7966c5b
SSDEEP 3072:nGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:Gm7Rkm1tYpBeh2BAoi
TLSH
T1F0C312375E70E9375979AB0EB48E0B1F2EF149A6C920DE92C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaInstaller.exe.crdownload

Path C:\Users\Admin\Downloads\OperaInstaller.exe.crdownload
Size 178KB
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaInstaller.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\OperaInstaller.exe:Zone.Identifier
Size 68B
SHA256 3c45b6fc55f23d3e43561f260f34b041730f609a56325bde2c7feb52a13e8dbe
MD5 a4987ec69011960353e0b1918e557a88
SHA1 d8c33489c2bf4b78581d4d64f65583c1977d3135
SHA512 466fca6afc8c77c8479fe91efc3fea4bb881eea90f768e9d0729a497ac7ca940730cae778d18752851c3afedf20dbf38a2446f35e19fa0b386c3dbbe4db7b498
TLSH
T10EA0110B000088000A20228020AC800CE02E2A2008828200A8A0008AEA800AC20A000B
MD5 SHA1 SHA512 TLSH

Submit Download