ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684

Analysis

user interaction
yes
max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vega X Windows_48419713.exe
Size 583KB
Sample260429-v677ead141
SHA256 ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684
MD5 7392e839c67ba537093c55353be265ba
SHA1 7c9bce283d6eb9b49dcdcc850e66e0148dc30d71
SHA512 07ccf85180c1d63cc03f9d0ff986d0c704f1ac7719e6f7bec56d32f397eb4400a623a19954914b1d391270ce0b08226ee48f92462c7ec2b6ee29500a36ca0617
SSDEEP 12288:w7yjhihTaVWs+OfaOp0XWgWasfMJo7WLrc7SrnTGf0TRz4hTB2eLsHjlsGk8y:yyjz99asfnyNrnTe0TShhLijlsGJy
TLSH
T132D49E123592C036C5B111B01929EFA690BEBD344F7245DBA7D41B2EDB346F26F31A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
56	5108	Vega X Windows_48419713.exe
52	5108	Vega X Windows_48419713.exe

Executes dropped EXE 9 IoCs

pid	Process
848	OperaGX_48419713.exe
4768	installer.exe
4756	installer.exe
1756	GameBooster.exe
1028	installer.exe
392	GameBooster.exe
4032	installer.exe
4172	installer.exe
3716	GameBooster.exe

Loads dropped DLL 3 IoCs

pid	Process
1756	GameBooster.exe
392	GameBooster.exe
3716	GameBooster.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Booster\hgsdk.dll	Vega X Windows_48419713.exe
File created	C:\Program Files (x86)\Booster\GameBooster.exe	GameBooster.exe
File created	C:\Program Files (x86)\Booster\GameBooster.exe	Vega X Windows_48419713.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vega X Windows_48419713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGX_48419713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameBooster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vega X Windows_48419713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vega X Windows_48419713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vega X Windows_48419713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameBooster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameBooster.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Hgsdk\CurrentVersion	GameBooster.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Hgsdk\CurrentVersion\B1B23168-E827-4FBF-B58D-47ECF602EFD6 = "1"	GameBooster.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Hgsdk\CurrentVersion\B7F0E3FA-E812-4CE3-A5EA-174B209C1C22 = "c36be473-3ec0-4586-9ebb-492b337ad81b"	GameBooster.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Hgsdk\CurrentVersion	GameBooster.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	GameBooster.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Hgsdk	GameBooster.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\OperaGXStable	Vega X Windows_48419713.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Vega X Windows_48419713.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\OperaStable	Vega X Windows_48419713.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Vega X Windows_48419713.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\OperaGXStable	Vega X Windows_48419713.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Vega X Windows_48419713.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Vega X Windows_48419713.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\OperaStable	Vega X Windows_48419713.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\OperaStable	Vega X Windows_48419713.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\OperaGXStable	Vega X Windows_48419713.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Vega X Windows_48419713.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Vega X Windows_48419713.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
392	GameBooster.exe
392	GameBooster.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3716	GameBooster.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3716	GameBooster.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1692	Vega X Windows_48419713.exe
3136	Vega X Windows_48419713.exe
5108	Vega X Windows_48419713.exe
848	OperaGX_48419713.exe
4768	installer.exe
4756	installer.exe
1028	installer.exe
1756	GameBooster.exe
4032	installer.exe
4172	installer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 848	5108	Vega X Windows_48419713.exe	105
PID 848 wrote to memory of 4768	848	OperaGX_48419713.exe	106
PID 4768 wrote to memory of 4756	4768	installer.exe	107
PID 5108 wrote to memory of 1756	5108	Vega X Windows_48419713.exe	108
PID 4768 wrote to memory of 1028	4768	installer.exe	109
PID 4768 wrote to memory of 4032	4768	installer.exe	112
PID 4032 wrote to memory of 4172	4032	installer.exe	113
PID 392 wrote to memory of 3716	392	GameBooster.exe	117

C:\Users\Admin\AppData\Local\Temp\Vega X Windows_48419713.exe
"C:\Users\Admin\AppData\Local\Temp\Vega X Windows_48419713.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4756

C:\Users\Admin\AppData\Local\Temp\Vega X Windows_48419713.exe
"C:\Users\Admin\AppData\Local\Temp\Vega X Windows_48419713.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1692

C:\Users\Admin\AppData\Local\Temp\Vega X Windows_48419713.exe
"C:\Users\Admin\AppData\Local\Temp\Vega X Windows_48419713.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3136

C:\Users\Admin\AppData\Local\Temp\Vega X Windows_48419713.exe
"C:\Users\Admin\AppData\Local\Temp\Vega X Windows_48419713.exe"
1⤵
- Downloads MZ/PE file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\OperaGX_48419713.exe
  C:\Users\Admin\AppData\Local\OperaGX_48419713.exe --silent --allusers=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Users\Admin\AppData\Local\Temp\7zS053EE088\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS053EE088\installer.exe --silent --allusers=0 --server-tracking-blob=ODg4Mzc3ZDliMTJlNjk1MGRlNGJiYTk2YzYwZjg5MDA3MDVmMDFmNGQzMjUzOTExMDc4MWEyZDQ1ZTdmNGUyYTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTk5ZGQxMGRhOWM1ZjRkNTQ5ZThiOTZhZDA2YTE0OWFjIiwidGltZXN0YW1wIjoiMTc3NzQ4NDI3Ny43NzQzIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1BCNV85NDE2XzM1NzUiLCJpZCI6Ijk5ZGQxMGRhOWM1ZjRkNTQ5ZThiOTZhZDA2YTE0OWFjIiwibWVkaXVtIjoicGEiLCJzb3VyY2UiOiJQV05nYW1lcyJ9LCJ1dWlkIjoiMmM4OGMyZTctOTZiNS00YzBkLWIwMTMtMTgyMzEzNDIxYWNiIn0=
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\7zS053EE088\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS053EE088\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.108 --initial-client-data=0x27c,0x280,0x284,0x23c,0x288,0x7ff6baa46718,0x7ff6baa46724,0x7ff6baa46730
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\.opera\4a257853-20e3-4bbc-824b-53b293e13a7a Opera GX Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\4a257853-20e3-4bbc-824b-53b293e13a7a Opera GX Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\7zS053EE088\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS053EE088\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=4768 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\4a257853-20e3-4bbc-824b-53b293e13a7a Opera GX Installer Temp\opera_package_20260429183800" --session-guid=2049ff1c-5637-4025-abec-c6ca05e1734a --server-tracking-blob="OGMwNWZmYzBlZjZlMWEyNjRkMTgzMDVjNjE4ZDlhN2I2ODBhZmRjMmRmZDFiZjk3N2QwZGVlOTE2NWM5NzA5Yzp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTk5ZGQxMGRhOWM1ZjRkNTQ5ZThiOTZhZDA2YTE0OWFjIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzc3NDg0Mjc3Ljc3NDMiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXT1c2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fR0JfUEI1Xzk0MTZfMzU3NSIsImlkIjoiOTlkZDEwZGE5YzVmNGQ1NDllOGI5NmFkMDZhMTQ5YWMiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiIyYzg4YzJlNy05NmI1LTRjMGQtYjAxMy0xODIzMTM0MjFhY2IifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=5408000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\7zS053EE088\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS053EE088\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.108 --initial-client-data=0x288,0x28c,0x290,0x258,0x294,0x7ff6baa46718,0x7ff6baa46724,0x7ff6baa46730
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4172
- C:\Program Files (x86)\Booster\GameBooster.exe
  "C:\Program Files (x86)\Booster\GameBooster.exe" install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1756

C:\Program Files (x86)\Booster\GameBooster.exe
"C:\Program Files (x86)\Booster\GameBooster.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:392
- C:\Program Files (x86)\Booster\GameBooster.exe
  "C:\Program Files (x86)\Booster\GameBooster.exe" --minimized
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3716

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\ffe8bc8bd5c6437b8ec0de4994f5e409 /t 2304 /p 5108
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GameBooster.exe

Path C:\Program Files (x86)\Booster\GameBooster.exe
Size 231KB
SHA256 f13a0407af07f4537386e5109d16e4fefd23f515ae2ca8db04f3ccaac1ffaf14
MD5 eded3e68901cfb3213e4179fbc72f566
SHA1 d88ed305e2725c0dea054b4cfafa782d3ce53609
SHA512 bafb0fa36a9f38a2d111a25b36faf81e263241a1098478d9494c637acf58d3c96815beaf8099975a1bc1af8bce090b661bfb161e74d4432a3fd3b60110a343c9
SSDEEP 3072:9iu7vwU2mo9qXeGn+4xJKXZiR8CiNHYtGoEmJ0:Qu7vGQLNR8CiNHYsoZJ0
TLSH
T1C734D712F6E18120D1B172711975AB71C7A9BD39DF70B68BE7507A5EC7312A3A830B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hgsdk.dll

Path C:\Program Files (x86)\Booster\hgsdk.dll
Size 4.2MB
SHA256 c714754c5b3a91e2ae19016526f80049e1d550ce6298480786fed52126e7bfb6
MD5 0616f27f116b73472cea900ef8df68ab
SHA1 ad19407569175e7f6bb0588db861a07104a32f3d
SHA512 a92eee081ab9871768ad7cc3f0c82c67b4396b7e560732480613ff4f92fab1c3344cf8b1f4441505bc0d4fde0ae7fbfe9c91d09bf4afe077af67323157471ca3
SSDEEP 49152:Kf7QuTm5xSlMr/l/nFVFHAIeVo1iYBGPDbpO/9VdMZ7uuJUCM/I:Kf7nTm9zl/XeK8Wv18D
TLSH
T19C16AE82FF42C0B7C08F42B1F42EE77CCE23974A8B254AD7976959986CB47502D532AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05DDC6AA91765AACACDB0A5F96DF8199

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
Size 993B
SHA256 a6f8f5d4ffd1e825ffce9a55861f16aa4dbe67871b1696b976194dd8be1fdf29
MD5 66690db6acf0bc08e16bca6a171dcd78
SHA1 5da0d5bd6d2a4808cf1632fa94a8278cc3f0ac0f
SHA512 08d6b113293d7333bf983d551c01de529599297134120d14aba4302408e912ee408672c9cc7f542177cc4bf50d918510d2675455c2bdda7a33c5090eab959579
TLSH
T1E611EFA8504C3413D186EF12DFDAED8ADD72779125D8664736A81A440850F905BF50A8
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 b47704c86ca07e4774fcc3596487d7cdf2aa78f25ec6fac8baeae3c23de7d08b
MD5 6a2107eba1925c317b352a7f5e2ecc3b
SHA1 0d3a2c8a42accd667103909338fd96f6db10da79
SHA512 d75778f21f504483231e7eeae82d334c4f0e191911aba2a1e04500057f810a5229390e826b006e4d46dd7d89fcf73dc9b46ed49b9343d97e6277d4cddf7d56a4
TLSH
T14231E99945A51E82EB530E5B7BCAC62F3CB642E030A4342E721A44C83EC43A95F0750C
MD5 SHA1 SHA512 TLSH

Submit Download

534B7EE50FA08B79E3BD07C2A811D271_7828405354F7ADA86BB305FD2E628FF2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\534B7EE50FA08B79E3BD07C2A811D271_7828405354F7ADA86BB305FD2E628FF2
Size 471B
SHA256 e82e652a641b602244c9c299711a840a24987908cdca594b7bdfeb99d0b916fb
MD5 d356a12c6505c4069c462ee365aba211
SHA1 c7d55dacd4fe5c66ac9fa8d17ce02900e0eb415c
SHA512 921e3564dab5510940678dcfc174dcec4ddcf5e1183218f9736657e96ea52c9376b20ec08dbd0d12194cc88ced7a77891d9504cf628d86dacc7c327b0a85f011
TLSH
T10DF0D4BF1670A8C0A57988151EC5D76170ABE54908FB5954343445F14C2D764EC2A08C
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 71ccd39de69ec147afd8ad4337a36829dcababbf40897250380c7770de551242
MD5 2595e903fcb3b99996adb2cc2bf504c8
SHA1 89954e0577e83e0008d58a2dc6cd0aaad2972a62
SHA512 71a76aa25ce3ea545922ad9cee54cd3fff4c971ee4e5ddf6aa4832743db48da795ae8e76883cf5e5acab6818e8aba44515c72848579c476c54bda2e43e0cac35
TLSH
T1CA31CE4EA2113027D686BF72D8CEBE93CDB033476BCAD05B18455E8229AAFD11FC81C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 3556847b4908ef50404b1b329c9624ff2b55194a6b6f030257e3e2732ee9e30b
MD5 ad3990af0099f3b88c5fc174846fb952
SHA1 d85911e524ad56dad93b9d30719d1f2aaed4ac52
SHA512 30a5cf81c8c935b214b54d86ebeb0ce1b2f7dbdd5dbc13d757db0af40cc86547fde7cbe7fdac59347760307247e1130fee5a0338766f25046ef406d805d0ce48
TLSH
T1B5F0D45311FDEC303F8508CC11D01F3D741280F49410624450BCFAD9D4159B77A2E43E
MD5 SHA1 SHA512 TLSH

Submit Download

E8EB4ABA7A3CA058EE05235F64926565_F8F0CEB6BAE1375459D29F1043DC23B2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E8EB4ABA7A3CA058EE05235F64926565_F8F0CEB6BAE1375459D29F1043DC23B2
Size 472B
SHA256 f6fbd7869ae95281c385ec7bf341ab1ec7f4f58f18fc114ec5cf3d9bc33bf9c2
MD5 a1e98e14d2f8904a922c866cffac7152
SHA1 9b3afc1a6cc29da5bdf6d26313592cb6e102f9b9
SHA512 41df37136bbd6f3845a1529780c2b05fdfc623cbf4682f7d644aa770bd49f88b759670a13b3fb6da7ca0de7a7fd091ed247d15bcbb244cc1de00e2c196601e2d
TLSH
T1BCF0D46E13710CA0ED9BC4461DF2DF9414A59BD21CE91C1F04301DFA694579D155C8DD
MD5 SHA1 SHA512 TLSH

Submit Download

05DDC6AA91765AACACDB0A5F96DF8199

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Size 170B
SHA256 f11c5a215ba81e06ab9c77cc9a8b8fcd3075b4b7606c53b9afa56702a3d6fa6f
MD5 1ed3fe3e52a9065a42cfc3b214f2f1ba
SHA1 bda2daca7d3ae0217c6756f911a2525edf43b3e4
SHA512 b36e03bf44a095a7d632d17199ac8914b817ee2fcd9e67cafc8fd2a8de80236a0e228fb6be29e85cde058c42f2be558d95904b8f77d5922c940dd0215c1da008
TLSH
T1FEC09B5463694B54F51E113D75E5160457F54609B5DAC3154B745534851464108B1D09
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 707241faf700d30aa8d7571b98637609950e496d369acc7b228e1e58ed57a7b1
MD5 35c41e20a64239617a690c8c18a8c888
SHA1 821375ae288e0a3122244845ae838cfbc1f672e8
SHA512 c9b2053f5b3c8adf663f130fe08258c274ad9342ae61576eed4fcc64a197215a80ed6b81d60f5c410d0fd515b399a5cc147db231f6ecc880bd00c7d5460317c6
TLSH
T1EFE0C0041979413CF032C93A1BCDBC6307EFD310306602F002944708B702F123D529B0
MD5 SHA1 SHA512 TLSH

Submit Download

534B7EE50FA08B79E3BD07C2A811D271_7828405354F7ADA86BB305FD2E628FF2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\534B7EE50FA08B79E3BD07C2A811D271_7828405354F7ADA86BB305FD2E628FF2
Size 418B
SHA256 1d746e25c99b4bd797108a4e87fec14dd8091519dbecbeff7c2953b10f046abf
MD5 f67b82cfa507f843c23046101fa05afd
SHA1 4d5684b5d4cab89760ad1dd8e5369cb82f471607
SHA512 e3597470e0282a3a3b9bafddd378fbf011f79296c6cfc538887cf4afce22b0c71b2249ca251ea285a46e9a280d40fdebc268f9d029aeb50e20659252c64919c3
TLSH
T1FBE0680C21FB015DF6A4ED7E47C1E7158596F521406003E601F04608A705D016C21A70
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 aa41f82b176f74aa54a3c63b497e0c81ddf285cc807804f4d3b6dac53d3518be
MD5 41b58417dd41ca14d1326902cb7b4abe
SHA1 ea149bb26b105f1e07dfea218e5e92741dc69e9b
SHA512 3946694e17d92e846f4e6974969fd93220a5ccec3d4c64dea3af19860e0c77cafb6cac522165ae47257b3946265412d0c1817845ca3af26daccf8fc6fadc8044
TLSH
T1CEC04C1177255729F15049BF159659610BF596528A9283580F70312C5416A8689E0D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 2a26dbe9cbdf112ef06bfb7a53507d1dff3b9e58dd89fae3f06f224c7877f663
MD5 97a52614440509fd12d964432ab7bc01
SHA1 b9d8d04e7a90463ddd0a669062cd9f1d02b741f8
SHA512 050e254704a89e4adfc037ee8f23636844a1d5afe96a639c5477c8844493234502a47815c1db28ec8d08bc51064aa72b23044a6ea9778fe296768071a0726061
TLSH
T1C6C09B1473694715F10D113D7DD55A141BB54145B6D6C35547741534851474148B1D05
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 6284fc0dc078d2c72e1520eb6ac2a40a2593d6626fe92122b969502366b6d81f
MD5 3a700099fa6929015250cdaca42b3125
SHA1 1bcb1fae53a0c1ad670eba5a99552e29a15bee26
SHA512 4ee100d3af135e459a6550821db9d9bded4b201d05a9deab9d08606572bd0ee1921c5e4e440257b12b6b5c97dcc9f84af80addb059258952bc7d36528e369204
TLSH
T196E0683811FA813EE1F8D4784AD8F6365946F0261438D2B00DE0AB40B202A009E22E34
MD5 SHA1 SHA512 TLSH

Submit Download

E8EB4ABA7A3CA058EE05235F64926565_F8F0CEB6BAE1375459D29F1043DC23B2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E8EB4ABA7A3CA058EE05235F64926565_F8F0CEB6BAE1375459D29F1043DC23B2
Size 406B
SHA256 8dbe9e3618108a058556ae38bd95e83120e0c72ae5f8dcc185b45d3917ac7478
MD5 e5c647a4e74e9e2691bcab1a3243fa29
SHA1 a253cb0d81f0656e389ab25710538b98b67a9dbd
SHA512 aa6451eec880c211934acad2d35d3f9ed1fa84e25ca09400d8be0e874b61fbd7b2ea5a4fbb9cf17890afe4b7a2c85e4a475b7dd5d45c56b23466e7a7feb74b03
TLSH
T167E0C61D32FE421CF1E8CC7E82C5BB00886ED622102243E210B60A486B00A022C72A61
MD5 SHA1 SHA512 TLSH

Submit Download

logo[1].png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0G5RVZXX\logo[1].png
Size 1KB
SHA256 c97e703578120c1f7a570acac3b461178a5e051ce16be9e266c1789c1d610ac0
MD5 2d4e9e8198f0c3eade53c619cd1fe4ea
SHA1 80b29f8dd0c4951ce7cad0db1fad1d9fdb275fc9
SHA512 afef06bfc6bf857a1b7966a04a8779aabf3e8a6d79b4c51867335190959acc469a4e1929b4c66430a3eece1aa5d1decddad005b326ec830c2b3a57179f3c626e
TLSH
T16A210B4723B4BEC7A2A30085230E0056A13687501168B7E58B87ED57719518542A2B86
MD5 SHA1 SHA512 TLSH

Submit Download

OperaGX_48419713.exe

Path C:\Users\Admin\AppData\Local\OperaGX_48419713.exe
Size 3.9MB
SHA256 2c133f19111cbbf4bea004ae9f668aa978a5ad093f41a7edd51d8811156c540c
MD5 cfc29a80756cd4428f6ac61554b1bd10
SHA1 2d526bb24a6f3e9a7995fe9bbcc8d8e0d230815c
SHA512 92400b2a404e2b782a9a82dccbc42a6742b20afef839d9061639db068109c58dc679aa81a6ff3c870fce94768a15594d84e78a53c662578ff93bbd202aa0bac6
SSDEEP 98304:lAYE9x9Vef3KZ/x7E3dhqSiBfu3ofErPql4FElX:VE9x9BZ7EHu4yzN
TLSH
T15A1623227B4484B5E5C322320F68F7B9D1FDF6251F6A144F37C40E6E8E70681AA36B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS053EE088\installer.exe
Size 9.0MB
SHA256 c4a265b084cdac06add82a9b7ff6dab1ab62604a73b9da35cbb6d26facc1dba2
MD5 12f51c000793f25198e98f402af4f81a
SHA1 fe3179afaa5795c9af1ab0ae3f702a8ac4d18677
SHA512 1a85b5c94f53e9ee5ec0adadc026a454ec462b0cea9592af7900ce8ea19a11f0b81cec818a52ad9e577c3088ad74256d4f82720f2fd145052b00f3e4ab911de6
SSDEEP 98304:oYPPx/37arhKVU0lpletC0dGHsaD9yIFBI3++wteEm/:rPPxv+hKq0Jk3+Bq/
TLSH
T1F4A68D43F3A601E8D06ECA748B7E562299357C564B34A3EF0A943A251E75FD49F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 4fc3739d5f48e2b4e35cc31878b6eda32fb1963c82919c787c4f83f731a4d50b
MD5 bb1ee92107ad845b86a39fe262cf1d92
SHA1 6ea0b1740210c1da5436f4b55203cb914db3eef4
SHA512 c3e1c5d180990fdae33e0c75496cd4f3df82cba26170816a0675a092e31b3dc6175e57a953339120df401dacec3cf1477cd365dd7281c5a92e7158aa1db7fd33
MD5 SHA1 SHA512

Submit Download

memory/392-129-0x00000000017E0000-0x000000000183F000-memory.dmp

Download

memory/1692-22-0x0000000003E00000-0x0000000003E28000-memory.dmp

Download

memory/1692-19-0x0000000001790000-0x00000000017EF000-memory.dmp

Download

memory/1692-21-0x0000000003DF0000-0x0000000003E00000-memory.dmp

Download

memory/1692-20-0x0000000003D70000-0x0000000003DE8000-memory.dmp

Download

memory/2612-5-0x0000000002B10000-0x0000000002B6F000-memory.dmp

Download

memory/3136-35-0x00000000025B0000-0x000000000260F000-memory.dmp

Download

memory/3136-37-0x00000000033F0000-0x0000000003400000-memory.dmp

Download

memory/3136-36-0x0000000003370000-0x00000000033E8000-memory.dmp

Download

memory/3136-38-0x0000000003400000-0x0000000003428000-memory.dmp

Download

memory/4768-119-0x00000180F1B20000-0x00000180F1B2C000-memory.dmp

Download

memory/5108-71-0x0000000002B60000-0x0000000002BBF000-memory.dmp

Download

memory/5108-72-0x00000000034D0000-0x0000000003548000-memory.dmp

Download

memory/5108-73-0x0000000003550000-0x0000000003560000-memory.dmp

Download

memory/5108-74-0x0000000003560000-0x0000000003588000-memory.dmp

Download