Overview

overview

6

Static

static

1

tmprc1gl313.exe

windows10-ltsc_2021-x64

6

tmprc1gl313.exe

windows10-2004-x64

4

tmprc1gl313.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    02/07/2026, 12:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmprc1gl313.exe
  • Size 178KB
  • Sample260702-psrdvaas8v
  • SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 2 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 24 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 49 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmprc1gl313.exe
    "C:\Users\Admin\AppData\Local\Temp\tmprc1gl313.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\Users\Admin\AppData\Local\Temp\OpInst.exe
      "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Users\Admin\AppData\Local\Temp\7zS0877D278\installer.exe
        C:\Users\Admin\AppData\Local\Temp\7zS0877D278\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=N2M1NDY3YTk3NGY1NmQ5MDA3ZDM3ZTQwZGIxYzI4Y2Q5YjM3ZTY3M2EwYjY3YmYyZmQzNWZiMWZhZGNiMjdkZDp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4Mjk5NTc3NS40MjUyIiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiYmI4YTg3NTgtZDM2Ni00ZGVkLTg0NGUtY2RiZjlhY2Y0MDhlIn0=
        3⤵
        • Downloads MZ/PE file
        • Enumerates connected drives
        • Executes dropped EXE
        • Enumerates system info in registry
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:3512
        • C:\Users\Admin\AppData\Local\Temp\7zS0877D278\installer.exe
          C:\Users\Admin\AppData\Local\Temp\7zS0877D278\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x288,0x2a8,0x2ac,0x278,0x2b0,0x7ff728f4ad88,0x7ff728f4ad94,0x7ff728f4ada0
          4⤵
          • Executes dropped EXE
          PID:5012
        • C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\installer.exe" --version
          4⤵
          • Executes dropped EXE
          PID:2400
        • C:\Users\Admin\AppData\Local\Temp\7zS0877D278\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS0877D278\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3512 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_20260702133616" --session-guid=db2445ad-eb1d-4c72-be3f-75d395070fd9 --server-tracking-blob=NmNhZmUzMjdiZmRlMTA3NmFkZmNkOWI3YTUzNTA5ZTNhOGQ0N2ZjMDRmYmZjZjc3MWUzYTFjNzZiMWYwMTY3MTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzgyOTk1Nzc1LjQyNTIiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJiYjhhODc1OC1kMzY2LTRkZWQtODQ0ZS1jZGJmOWFjZjQwOGUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7008000000000000
          4⤵
          • Enumerates connected drives
          • Executes dropped EXE
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:3660
          • C:\Users\Admin\AppData\Local\Temp\7zS0877D278\installer.exe
            C:\Users\Admin\AppData\Local\Temp\7zS0877D278\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x298,0x29c,0x2a0,0x270,0x2a4,0x7ff728f4ad88,0x7ff728f4ad94,0x7ff728f4ada0
            5⤵
            • Executes dropped EXE
            PID:4572
          • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\installer.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\installer.exe" --backend --initial-pid=3512 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161" --session-guid=db2445ad-eb1d-4c72-be3f-75d395070fd9 --server-tracking-blob=NmNhZmUzMjdiZmRlMTA3NmFkZmNkOWI3YTUzNTA5ZTNhOGQ0N2ZjMDRmYmZjZjc3MWUzYTFjNzZiMWYwMTY3MTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzgyOTk1Nzc1LjQyNTIiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJiYjhhODc1OC1kMzY2LTRkZWQtODQ0ZS1jZGJmOWFjZjQwOGUifQ== --silent --desktopshortcut=1 --install-subfolder=133.0.5932.20
            5⤵
            • Enumerates connected drives
            • Executes dropped EXE
            • Enumerates system info in registry
            • Modifies registry class
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1796
            • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\installer.exe
              C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff66315ad88,0x7ff66315ad94,0x7ff66315ada0
              6⤵
              • Executes dropped EXE
              PID:1908
            • C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\assistant_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=0
              6⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Enumerates system info in registry
              • Modifies Internet Explorer settings
              • Suspicious use of WriteProcessMemory
              PID:1792
              • C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x504040,0x50404c,0x504058
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:4792
              • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=0
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Enumerates system info in registry
                • Suspicious use of WriteProcessMemory
                PID:1236
                • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0xdd4040,0xdd404c,0xdd4058
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:4976
                • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1880
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    • Suspicious use of WriteProcessMemory
                    PID:3752
                    • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x264,0x268,0x26c,0x260,0x270,0x7ff85ab53fe0,0x7ff85ab53ff0,0x7ff85ab54000
                      10⤵
                      • Executes dropped EXE
                      PID:2400
                  • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                    "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates system info in registry
                    • Suspicious use of WriteProcessMemory
                    PID:1232
                    • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x270,0x274,0x278,0x26c,0x27c,0x7ff85ab53fe0,0x7ff85ab53ff0,0x7ff85ab54000
                      10⤵
                      • Executes dropped EXE
                      PID:972
                  • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
                    C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x284,0x288,0x28c,0x264,0x290,0x6bc830,0x6bc83c,0x6bc848
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3344
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:4984
                      • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x264,0x268,0x26c,0x260,0x270,0x7ff85ab53fe0,0x7ff85ab53ff0,0x7ff85ab54000
                        11⤵
                        • Executes dropped EXE
                        PID:2212
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:3360
                      • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x264,0x268,0x26c,0x260,0x270,0x7ff85ab53fe0,0x7ff85ab53ff0,0x7ff85ab54000
                        11⤵
                        • Executes dropped EXE
                        PID:2700
                    • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                      "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                      10⤵
                      • Executes dropped EXE
                      PID:4348
                      • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe
                        C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x234,0x20c,0x230,0x238,0x270,0x7ff85ab53fe0,0x7ff85ab53ff0,0x7ff85ab54000
                        11⤵
                          PID:2124
              • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\de932af914ba00303d4a2778a383ac9c831101e2.crx"
                6⤵
                  PID:5460
                  • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe
                    C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x260,0x264,0x268,0x25c,0x26c,0x7ff85ab53fe0,0x7ff85ab53ff0,0x7ff85ab54000
                    7⤵
                      PID:5472
              • C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4076
              • C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\assistant_installer.exe" --version
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Enumerates system info in registry
                • Suspicious use of WriteProcessMemory
                PID:4476
                • C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x260,0x264,0x268,0x21c,0x26c,0x504040,0x50404c,0x504058
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:1820
        • C:\Windows\SysWOW64\DllHost.exe
          C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
          1⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2540
        • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
          C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3536
          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates system info in registry
            • Suspicious use of WriteProcessMemory
            PID:4692
            • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe
              C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x260,0x264,0x268,0x25c,0x26c,0x7ff85ab53fe0,0x7ff85ab53ff0,0x7ff85ab54000
              3⤵
              • Executes dropped EXE
              PID:1284
          • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
            "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates system info in registry
            • Suspicious use of WriteProcessMemory
            PID:1352
            • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe
              C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x260,0x264,0x268,0x25c,0x26c,0x7ff85ab53fe0,0x7ff85ab53ff0,0x7ff85ab54000
              3⤵
              • Executes dropped EXE
              PID:2308
          • C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
            C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x274,0x278,0x27c,0x248,0x280,0x6bc830,0x6bc83c,0x6bc848
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2840
            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1784
              • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe
                C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x260,0x264,0x268,0x25c,0x26c,0x7ff85ab53fe0,0x7ff85ab53ff0,0x7ff85ab54000
                4⤵
                • Executes dropped EXE
                PID:1696
            • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
              "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
              3⤵
                PID:4140
                • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe
                  C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x260,0x264,0x268,0x25c,0x26c,0x7ff85ab53fe0,0x7ff85ab53ff0,0x7ff85ab54000
                  4⤵
                    PID:2624
                • C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
                  "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream
                  3⤵
                    PID:2512
                    • C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe
                      C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.20 --initial-client-data=0x268,0x26c,0x270,0x264,0x274,0x7ff85ab53fe0,0x7ff85ab53ff0,0x7ff85ab54000
                      4⤵
                        PID:2080
                • C:\Windows\system32\wbem\unsecapp.exe
                  C:\Windows\system32\wbem\unsecapp.exe -Embedding
                  1⤵
                    PID:2668

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Event Triggered Execution

                        1
                        T1546

                        Component Object Model Hijacking

                        1
                        T1546.015

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Event Triggered Execution

                        1
                        T1546

                        Component Object Model Hijacking

                        1
                        T1546.015

                        Defense Evasion

                        Modify Registry

                        3
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Peripheral Device Discovery

                        1
                        T1120

                        Query Registry

                        4
                        T1012

                        System Information Discovery

                        4
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        8B2B9A00839EED1DFDCCC3BFC2F5DF12
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                        • Size 1KB
                        • SHA256 71ccd39de69ec147afd8ad4337a36829dcababbf40897250380c7770de551242
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        B46811C17859FFB409CF0E904A4AA8F8
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                        • Size 528B
                        • SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                        • Size 471B
                        • SHA256 4b00900886fc53df65f90f9bf7c1bc61d8e9588c8fb660ce2b57f89c4ba977f7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        8B2B9A00839EED1DFDCCC3BFC2F5DF12
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                        • Size 174B
                        • SHA256 8d00dd3e1ca8d50e3dec11407496ace50734ad2b44f1dec15c59a6d30ee59c07
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        B46811C17859FFB409CF0E904A4AA8F8
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                        • Size 170B
                        • SHA256 c7dd9b2dbc615b054201fcd8e2c4d867d0977b30894c6acce6474ba691f7c632
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
                        • Size 416B
                        • SHA256 e5a4c3190fe5537b658206b50a98b5b20d9ad169223d2b49571943001d310e15
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        133.0.5932.20.manifest
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\133.0.5932.20.manifest
                        • Size 225B
                        • SHA256 96eb02fb002deff259d109ef33c4dbab24a00a4fc27f828b2290a46ff7186f9c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        150x150Logo.scale-100.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\150x150Logo.scale-100.png
                        • Size 1KB
                        • SHA256 56bcd46dcfae3147a8b8b3d00ee5041dad4655e83a7e829bf637377c96538643
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        150x150Logo.scale-100_contrast-white.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\150x150Logo.scale-100_contrast-white.png
                        • Size 1KB
                        • SHA256 3829dbefe8bd528be268f3181a902e1fe78883eb8f8aac679c9985c2ad13c6b9
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        150x150Logo.scale-140.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\150x150Logo.scale-140.png
                        • Size 1KB
                        • SHA256 2637072751e1e6398c45d2c5b22c54adadfbbd4d3007238799f5da63f846167b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        150x150Logo.scale-140_contrast-white.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\150x150Logo.scale-140_contrast-white.png
                        • Size 1KB
                        • SHA256 ce3559b2efd6d547fb822440690cfbf793eb70c98154ad4dbf3a7c0e1af5e166
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        150x150Logo.scale-180.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\150x150Logo.scale-180.png
                        • Size 1KB
                        • SHA256 7ca510381079a4b166e9d5fcf0dc005d9606197e8636621b655d6459941139a0
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        150x150Logo.scale-180_contrast-white.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\150x150Logo.scale-180_contrast-white.png
                        • Size 1KB
                        • SHA256 f7eb888cd9bce4641fcb01088b05be242f616dc06c3f823e51fb63b53b6f14f5
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        150x150Logo.scale-80.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\150x150Logo.scale-80.png
                        • Size 827B
                        • SHA256 f287370ff8c7e2ba120407cafe09c1fce674ae8af5bd5fcc0c2dd1c6628b9ce9
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        150x150Logo.scale-80_contrast-white.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\150x150Logo.scale-80_contrast-white.png
                        • Size 799B
                        • SHA256 0a9129bde051c17e96e516d5bc509e1a06a1e066a5e2796627cbef8630002b47
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        70x70Logo.scale-100.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\70x70Logo.scale-100.png
                        • Size 781B
                        • SHA256 fb5662c5fde7d49862da2e0253ae03dc7e5f9afd2edc65d4efa6dc3a3026156f
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        70x70Logo.scale-100_contrast-white.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\70x70Logo.scale-100_contrast-white.png
                        • Size 752B
                        • SHA256 3fa9dfc982544f3ffda0795beec69c65d6c5883be0de37133466e643b5f3aeea
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        70x70Logo.scale-140.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\70x70Logo.scale-140.png
                        • Size 991B
                        • SHA256 84f8ebb629791e0b73cd53d7f3445d685145d0787a207e25842b237c98a8c99a
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        70x70Logo.scale-140_contrast-white.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\70x70Logo.scale-140_contrast-white.png
                        • Size 865B
                        • SHA256 99cd2b5809ab9c604613b305bc80e6f68b858c1289c07e84aadabc4c3768ff32
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        70x70Logo.scale-180.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\70x70Logo.scale-180.png
                        • Size 1KB
                        • SHA256 c5d33ee3b5e8dcb9e9aeae5f14d0e92cf9bdc16d6245ce65dd4340c8a0be4f26
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        70x70Logo.scale-180_contrast-white.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\70x70Logo.scale-180_contrast-white.png
                        • Size 1KB
                        • SHA256 e5112331e0e2684ffb5adc0ac23324d9836cf067111f1f5834c77b1153a8a5d7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        70x70Logo.scale-80.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\70x70Logo.scale-80.png
                        • Size 590B
                        • SHA256 91ba72309e34c5336c09b8f5c787a6327082f275d5d7bfe491c5430e67c80752
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        70x70Logo.scale-80_contrast-white.png
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\Assets\70x70Logo.scale-80_contrast-white.png
                        • Size 519B
                        • SHA256 37b0f1fb4a08af8a42e6d8fce4c7380ddae0272150d7a9bb8b1d138066a9ffbe
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        assistant_package
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\assistant_package
                        • Size 3.6MB
                        • SHA256 71000aefbbef427fc6c0e20d8f8cbad0c70dc6eefd95f6e90c7fc1f43d2ad0e7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        d3dcompiler_47.dll
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\d3dcompiler_47.dll
                        • Size 4.5MB
                        • SHA256 de25d109d46273045207b504443d5730aadf6b5a7fe1978043dac4d3e638ea65
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        dxcompiler.dll
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\dxcompiler.dll
                        • Size 24.4MB
                        • SHA256 90fb45ff598d7e24cfffef07924de8159ec6de15a08a8f075c187442f95cb217
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        dxil.dll
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\dxil.dll
                        • Size 1.5MB
                        • SHA256 3cb1f2c44f376ecfb64f23021776f633375ec2b42b99844f8fef4686164d1cae
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        files_list
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\files_list
                        • Size 6KB
                        • SHA256 04356be072ab31fb5ce09d26bb1d8bb664c7334883a2e6157238cdd97979e97b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        headless_command_resources.pak
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\headless_command_resources.pak
                        • Size 2KB
                        • SHA256 9337d260af693284e85d353db0926beb9932412c268558f447c74e5064bd6a3f
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        icudtl.dat
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\icudtl.dat
                        • Size 10.4MB
                        • SHA256 d0a05dcc74a5b6ce1657a2ae44a58c0df03a1a07c24a4df2e3381353911382fc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        installer.exe
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\installer.exe
                        • Size 8.3MB
                        • SHA256 c006f335efec016cf3d381a3a89d1692bdd27f5994b7f283e7619386367ae002
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        installer_helper_64.exe
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\installer_helper_64.exe
                        • Size 639KB
                        • SHA256 55c0cd782af626adcf9bf144ef26528e598e8c8efcd60372ab2e43b65881129c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libEGL.dll
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\libEGL.dll
                        • Size 492KB
                        • SHA256 24e5c900d1a8bebe2092480a2c0d5f8fd093af76b939b16d51fde1a276bef579
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libGLESv2.dll
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\libGLESv2.dll
                        • Size 7.5MB
                        • SHA256 2eff13a97dbe96393088f714d22b59be2be88973062f27ef21282fc35aedf815
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        bg.pak
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\localization\bg.pak
                        • Size 1005KB
                        • SHA256 8a151c2685798e8c559c4329496eac4845b23bf977c1f10fa97e452617179036
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        bn.pak
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\localization\bn.pak
                        • Size 1.3MB
                        • SHA256 75b433bac6b07c87874885f87d38d6a87dab684310611072e880ea157cebf967
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ca.pak
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\localization\ca.pak
                        • Size 634KB
                        • SHA256 951a872c07a86b56273a468472edc64ff1fd3072ee92f1b747c2d56862266e9a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cs.pak
                        • Path C:\Users\Admin\AppData\Local\Programs\Opera\133.0.5932.20\localization\cs.pak
                        • Size 633KB
                        • SHA256 1ad3a061c4efeb9719caff31b374f2c7461bbf26dfa83d23378f7d146d6a2961
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Opera Browser.lnk
                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\Opera Browser.lnk
                        • Size 1KB
                        • SHA256 e61058e661cd046ed0c4b84c0cd60d4dd20aa4b917e4f0ad591fe465bf898cf5
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        additional_file0.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\additional_file0.tmp
                        • Size 2.8MB
                        • SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        assistant_installer.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\assistant_installer.exe
                        • Size 2.4MB
                        • SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        dbgcore.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\dbgcore.dll
                        • Size 222KB
                        • SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        dbghelp.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\assistant\dbghelp.dll
                        • Size 1.8MB
                        • SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        installer_prefs_include.json
                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\installer_prefs_include.json
                        • Size 224B
                        • SHA256 f799101396e58ec98238b81669c288b0649788476fdc997cd029cfd5239c8aad
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        installer_prefs_include.json
                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\installer_prefs_include.json
                        • Size 1KB
                        • SHA256 ebbdfd6b577f8c50d45979287003667d02358e31b5ef82ab0bbbf08c3ea1c1e4
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        installer_prefs_include.json
                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\c69c00fc-e47c-41d2-95c1-959d23363353 Opera Installer Temp\opera_package_202607021336161\installer_prefs_include.json
                        • Size 239B
                        • SHA256 ad0a70852936dbf15eeb5accadd7acc1554959df5b85898911e4281e402e287a
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        installer.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0877D278\installer.exe
                        • Size 8.3MB
                        • SHA256 8a134a76b3ea979d3647853879db52b07bb5d1dff6249e8452e5d10d803d64ef
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        OpInst.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
                        • Size 3.1MB
                        • SHA256 66ace8943dafb797f6e604a4afc80c108c3abe01eee63784b2107884b701583f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        bg.png
                        • Path C:\Users\Admin\AppData\Local\Temp\bg.png
                        • Size 224KB
                        • SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        settings.dat
                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                        • Size 40B
                        • SHA256 7bdb55b57a94998814da1cd46c097a51c8cb9c669e2d5295c54356a2cc541a3f
                        • MD5 SHA1 SHA512
                        Submit Download