Overview

overview

8

Static

static

3

2026-05-28...ar.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/05/2026, 11:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_efe11fa4b2d14b74b182947910ceab83_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
  • Size 8.7MB
  • Sample260528-nvtrbad14p
  • SHA256 0e6b7a7ee6c06a34aceafae0abeb688818128041683ab1e4f14774b3445f8cf5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 38 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_efe11fa4b2d14b74b182947910ceab83_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_efe11fa4b2d14b74b182947910ceab83_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Downloads MZ/PE file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Users\Admin\AppData\Local\Temp\2026-05-28_efe11fa4b2d14b74b182947910ceab83_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-05-28_efe11fa4b2d14b74b182947910ceab83_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=121.0.5600.81 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2b0,0x2cc,0x7fff0b6e8ef0,0x7fff0b6e8efc,0x7fff0b6e8f08
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4884
    • C:\Users\Admin\AppData\Local\Temp\.opera\2afcf6d9-87d5-4063-9e9c-9295cbaae9fe Opera GX Installer Temp\2026-05-28_efe11fa4b2d14b74b182947910ceab83_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\2afcf6d9-87d5-4063-9e9c-9295cbaae9fe Opera GX Installer Temp\2026-05-28_efe11fa4b2d14b74b182947910ceab83_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3008
    • C:\Users\Admin\AppData\Local\Temp\.opera\2afcf6d9-87d5-4063-9e9c-9295cbaae9fe Opera GX Installer Temp\opera_package_202605281243381\assistant\Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\2afcf6d9-87d5-4063-9e9c-9295cbaae9fe Opera GX Installer Temp\opera_package_202605281243381\assistant\Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2164
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:4744
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2264
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4676
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:5716
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3044
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:636
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3000
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:5912
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2040
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:5328
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1728
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2016
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3052
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:5216
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4124
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:436
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:5300
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:5692
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1636
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:5452
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2676
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3596
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4040
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4896
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1696
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:2276

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 008646a2c12eaac924d58bea851bee1a09885946531ca7a03d9574ecd56c757a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 826KB
            • SHA256 2139cd323d82c5bebfa50d9e3800ae84c0f6f0b5a72aa384c7f69e59e090c272
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.1MB
            • SHA256 3b0098e7dc1894caa7d5aeebe9b84750e0584e533cebce653a8923c36b2dbb15
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 075893841e7a5ff582895beba5797764222caf56e523e3435e18214eadee2afd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 2e274a19a8463127459b4a74578d0b24a8269b902623c67ba5fc3524a053242e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 582KB
            • SHA256 7486172fa05d6651bc0101a677842313da65345f9da651fd44964f6c9cb3a55c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 840KB
            • SHA256 947c6b370fd48b6bd61b4884c188602cfc1e381aa9b2b853b25f39d521f10a27
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 d716189bd74f13d8c6e9e2a061993beb2bc0767a2341b2ed03e0f08a5653e41b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 910KB
            • SHA256 d9922c5b542aafe1726e08d3bcd92e45cb224de77937bb53c1c315f57b5e2ba7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 d15cefe944a6ee4546ec8e73f8e2de9094dec2fe1fd9c330565c52721be20ae6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 ad9b53387b010a97b14cfd7e7b716ce9de6f8e697a190d433492d3710452a417
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 3a728a27348bf6499f50246caf7ab25280e149d6adbaa5452eb30cbdcc16a971
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 805KB
            • SHA256 a04099ee6df89b7a18f6a65592edda0262ff8e10b9064aee3fa07779b478f963
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 656KB
            • SHA256 647bba85d5013e95334d1658a70190ab85969c56be04a864c16e862e76a050e6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
            • Size 6.6MB
            • SHA256 e8c567308bd148a83f6328237648b92abb87df2ea3b4a047765cf69960908103
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
            • Size 6.6MB
            • SHA256 02b01269775ae8a7727f02565b25071c1950a248e5f44f860207de39502d918e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 792850c261fa8c9335221b056f2346422f6ff8db4cb5b4b2046941997eb35560
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 4.0MB
            • SHA256 ead4118dfd4783ce57d6a38954958b2dd774b03f33c1ed73b10ab27cca996cb6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 464213cb209f4454ec989a40bbfd9d90cec5450475a7c1a107be68133645ddd6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
            • Size 2.2MB
            • SHA256 6c7f7530d153f8827535aaa811057ca986292af8f92c4063db68a5de2cedf666
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            os_update_handler.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
            • Size 2.4MB
            • SHA256 51bf7b09c30d9c72c2b79576932b451dd3433c53ad030eeb9a849b8a6fac81c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 2.0MB
            • SHA256 205e1be107d08dc42ede96ac462abca7ae14b7ee4b937acbffe5a4f2a8ddefcb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 581KB
            • SHA256 af99aed35137db6dd1f422508c56be632243d0a999d4adbc2c8670867ba93033
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 581KB
            • SHA256 4a8d361a9661368b4ddbe5713b8a9da2bf5694774be73ac8f0783ef301185dc8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 581KB
            • SHA256 4350cb7ad997ef7d0c7f63699dcca9b9dace7d9f29709065c7666579acec295a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 601KB
            • SHA256 96634d29daf9062784ff6485403bd329e1fd01bb3709476709a9eba413a56848
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 581KB
            • SHA256 feb5ec4373a372d038b854ffe890301332ef571e299e8f9c9b9a10afc36e15fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 581KB
            • SHA256 0ee7a266fb20e9c45bef3c00c96d7afb793b2c104edf44e5170e7b63f6a4b9ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 c5473d466849c200c654c37cc3eb74cfd8310f3912ebfe360474e5304dcb1c11
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 700KB
            • SHA256 a1335fc75eedce75c08450e820ae21d433c3f18d8f20e36afbd817e94323e4b5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2026-05-28_efe11fa4b2d14b74b182947910ceab83_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
            • Path C:\Users\Admin\AppData\Local\Temp\.opera\2afcf6d9-87d5-4063-9e9c-9295cbaae9fe Opera GX Installer Temp\2026-05-28_efe11fa4b2d14b74b182947910ceab83_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
            • Size 8.7MB
            • SHA256 0e6b7a7ee6c06a34aceafae0abeb688818128041683ab1e4f14774b3445f8cf5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe
            • Path C:\Users\Admin\AppData\Local\Temp\.opera\2afcf6d9-87d5-4063-9e9c-9295cbaae9fe Opera GX Installer Temp\opera_package_202605281243381\assistant\Opera_GX_assistant_131.0.5877.36_Setup.exe_sfx.exe
            • Size 2.8MB
            • SHA256 aea99ad410a597e74390c1a4c41fd8b9a0847c555e62538f20690bc4f5081073
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Opera_installer_2605281143383094520.dll
            • Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2605281143383094520.dll
            • Size 7.5MB
            • SHA256 7cac08fa3fc954671ddbeeae0a9c6c44b31b1e47ee8cf0591f6ce4f012fc0b02
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            4bb929f95a3b5d25.bin
            • Path C:\Users\Admin\AppData\Roaming\4bb929f95a3b5d25.bin
            • Size 12KB
            • SHA256 01b238a6d3bba42f480e5ac96ef53816df7c6ada787910e1fa0af8f0d0165eaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            681faa54-1c89-4cc6-884c-64f330b60c63.dmp
            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\reports\681faa54-1c89-4cc6-884c-64f330b60c63.dmp
            • Size 1.4MB
            • SHA256 f4688530b1559e374b190f63eea9fc7448f59f0ca08334a4579237a7cf625ff6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
            • Size 40B
            • SHA256 8d9582ac2a928d54f200b7f1d9005bec362070c76824d12f59884a67d4a1d6b5
            • MD5 SHA1 SHA512
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 588KB
            • SHA256 97680b8d35a830b69cd507ad617bfee711bc156dfcc069fb4eb883c592a5cc36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 812dfe8d464fbbf388fa11104a2671c0de0d75e8d10e690c6f8f1bfe8c1a4ee0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 659KB
            • SHA256 f5534cecbcf6a1430b0af21aeee8eb8099fa3becaa26dee49c5a78d040c185e9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 bdec6b70e1bf66c3d25b24522e65a70d3ad2db62eb249cd4371c18e017632b5d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 578KB
            • SHA256 c87befeb9290b536936900c753d9800b9e6f2b9c042b351e3d66b6d11e2c49e9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 940KB
            • SHA256 d6fe034642bd2b89938871dda7ca993e4b738fa6e7731692ab05ecae9a8cffa9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 671KB
            • SHA256 801d1f3d582ad2ac698e6266bb64f83c97c1ce4e7ea0cc88cb0159d86172c7c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 1ed26a28c56682bfaa71b8fca313a36dc8a68d1bc34bbe3ec0103f75cd1511a7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 5c9febb16306fba61486fa4915037f3ff2b816edbe0d59262c66b6569c852114
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 df8ac17350c5d2b27bfc6228ce16c3f6544bef26a847fe952736e7a1b7b054ee
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 885KB
            • SHA256 6fbe4c7faff8669085c099e485352732dc3ec5c3aa4da126893f8eba5615bc99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 47c7bb597d4d1cf020b62279b78f90427f989aefb2ef6ef73a9cf6693d06e965
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 661KB
            • SHA256 9e2fb31af3f82d17ef40650fbaec1bac13efb6dfade4a28174d9d82b2767d8b0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 712KB
            • SHA256 fe706fa3bf79997e31975ac7d674acaf083fd6762251a5faf21178c5f2afa679
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 584KB
            • SHA256 caf9ba39f21a0d110e4b7c06ebad687ad37615093c9234b2ff7d9a98735d7d32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 d261065b3af16cd5da38661012708a838082ec74ab153e956fa222763602cc3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 772KB
            • SHA256 f2a28f9c2a15885dfe0d8ebfc640ea547deb7c9e732265b98550fe77e1926c29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 fd2f3c5bf84e95bc650c05a65892c450148ff1a71c2dad99ed0d63433a0c10e1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 b680828a6dac426158db1b8fa03977010419639d48f6b0e6f523d1922b1a4471
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 877KB
            • SHA256 3ad9cdf299a9fcbd63360b4574e4eebe68ce3e3dee4724fd8337acad0e75ac78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 635KB
            • SHA256 f2300877a16e324c486f29f99ecee9ac7e4c088ba13aceca140bc1ec26e3a791
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/436-173-0x00000000007E0000-0x0000000000840000-memory.dmp
            Download

            memory/436-179-0x00000000007E0000-0x0000000000840000-memory.dmp
            Download

            memory/436-183-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/436-406-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/636-86-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/636-83-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/636-77-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/636-188-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/1636-189-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/1636-191-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/1728-145-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/1728-134-0x0000000000680000-0x00000000006E6000-memory.dmp
            Download

            memory/1728-139-0x0000000000680000-0x00000000006E6000-memory.dmp
            Download

            memory/2016-146-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/2040-115-0x00000000004F0000-0x0000000000550000-memory.dmp
            Download

            memory/2040-109-0x00000000004F0000-0x0000000000550000-memory.dmp
            Download

            memory/2040-144-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/2264-51-0x0000000000680000-0x00000000006E0000-memory.dmp
            Download

            memory/2264-37-0x0000000000680000-0x00000000006E0000-memory.dmp
            Download

            memory/2264-60-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/2276-544-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-533-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-530-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-531-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-532-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-534-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-536-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-514-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-537-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-538-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-539-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-540-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-541-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-542-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-546-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-547-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-515-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-545-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-549-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-543-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-519-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-518-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-548-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-535-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-520-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-521-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-522-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-523-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-517-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-524-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-525-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-526-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-527-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-528-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-529-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2276-516-0x0000020B86BD0000-0x0000020B86BE0000-memory.dmp
            Download

            memory/2676-197-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2676-410-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3000-88-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/3000-102-0x0000000140000000-0x00000001400D5000-memory.dmp
            Download

            memory/3000-100-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/3000-99-0x0000000140000000-0x00000001400D5000-memory.dmp
            Download

            memory/3000-94-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/3008-57-0x0000000140000000-0x00000001408B3000-memory.dmp
            Download

            memory/3008-58-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/3008-49-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/3008-151-0x0000000140000000-0x00000001408B3000-memory.dmp
            Download

            memory/3044-66-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/3044-182-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/3044-72-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/3044-73-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/3052-153-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3052-408-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3052-207-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3596-411-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/3596-201-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4040-414-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/4040-204-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/4124-158-0x00000000005E0000-0x0000000000640000-memory.dmp
            Download

            memory/4124-164-0x00000000005E0000-0x0000000000640000-memory.dmp
            Download

            memory/4124-166-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4124-386-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4520-6-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/4520-13-0x0000000140000000-0x00000001408B3000-memory.dmp
            Download

            memory/4520-98-0x0000000140000000-0x00000001408B3000-memory.dmp
            Download

            memory/4520-0-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/4744-147-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4744-35-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4884-14-0x0000000002090000-0x00000000020F0000-memory.dmp
            Download

            memory/4884-32-0x0000000140000000-0x00000001408B3000-memory.dmp
            Download

            memory/4884-22-0x0000000002090000-0x00000000020F0000-memory.dmp
            Download

            memory/4896-512-0x000000000CEA0000-0x000000000CEA8000-memory.dmp
            Download

            memory/4896-416-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4896-208-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4896-228-0x0000000001780000-0x0000000001790000-memory.dmp
            Download

            memory/4896-244-0x0000000001A30000-0x0000000001A40000-memory.dmp
            Download

            memory/4896-348-0x0000000009E70000-0x0000000009E78000-memory.dmp
            Download

            memory/5216-350-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/5216-156-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/5300-186-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/5300-407-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/5328-119-0x0000000000600000-0x0000000000660000-memory.dmp
            Download

            memory/5328-148-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/5328-125-0x0000000000600000-0x0000000000660000-memory.dmp
            Download

            memory/5452-409-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/5452-194-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/5716-103-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/5716-63-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/5912-196-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/5912-105-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download