35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63

Analysis

user interaction
yes
max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FluxusZ External 1.0.2_54591936.exe
Size 702KB
Sample260801-bcpy7avajd
SHA256 35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63
MD5 cd85c75fa053954c4ae4ee338d3bcb63
SHA1 fb2fb89c667d901ef01600dae3f027c7dbfe16be
SHA512 f0d7e4732df889e6513f67e266c68bf7490c513bb78736b4fac4d90ed49040415a500ae8f0f9b696e100a92c871d5cf80fdb628bec0f42e3a531e1a636873f6d
SSDEEP 12288:utflJ50c6GeHR6Kjx288tG6rmC0tzeIiZ4fFo:ut9J6MB8gGaUtze74f+
TLSH
T123E48C16B6A801FCE1B7D179C9524912F7B1B847437297CF03A05A66AF2BAE05F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
19	4956	FluxusZ External 1.0.2_54591936.exe
17	4956	FluxusZ External 1.0.2_54591936.exe
42	3136	installer.exe

Executes dropped EXE 9 IoCs

pid	Process
5468	OperaGX_.exe
3136	installer.exe
4568	installer.exe
708	installer.exe
6100	GameBooster.exe
5072	GameBooster.exe
4644	installer.exe
4444	installer.exe
1392	GameBooster.exe

Loads dropped DLL 1 IoCs

pid	Process
5072	GameBooster.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Booster\GameBooster.exe	GameBooster.exe
File created	C:\Program Files\Booster\GameBooster.exe	FluxusZ External 1.0.2_54591936.exe
File created	C:\Program Files\Booster\hgsdk.dll	FluxusZ External 1.0.2_54591936.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGX_.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\hgsdk\CurrentVersion	GameBooster.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	GameBooster.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\hgsdk	GameBooster.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\hgsdk\CurrentVersion	GameBooster.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\hgsdk\CurrentVersion\B7F0E3FA-E812-4CE3-A5EA-174B209C1C22 = "78b6cf48f4644ad49d5ae08307eeb514"	GameBooster.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\hgsdk\CurrentVersion\B1B23168-E827-4FBF-B58D-47ECF602EFD6 = "1"	GameBooster.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\OperaGXStable	FluxusZ External 1.0.2_54591936.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	FluxusZ External 1.0.2_54591936.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\OperaStable	FluxusZ External 1.0.2_54591936.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	FluxusZ External 1.0.2_54591936.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1392	GameBooster.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1392	GameBooster.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 5468	4956	FluxusZ External 1.0.2_54591936.exe	90
PID 5468 wrote to memory of 3136	5468	OperaGX_.exe	91
PID 3136 wrote to memory of 4568	3136	installer.exe	92
PID 3136 wrote to memory of 708	3136	installer.exe	93
PID 4956 wrote to memory of 6100	4956	FluxusZ External 1.0.2_54591936.exe	94
PID 3136 wrote to memory of 4644	3136	installer.exe	95
PID 4644 wrote to memory of 4444	4644	installer.exe	97
PID 5072 wrote to memory of 1392	5072	GameBooster.exe	98

C:\Users\Admin\AppData\Local\Temp\FluxusZ External 1.0.2_54591936.exe
"C:\Users\Admin\AppData\Local\Temp\FluxusZ External 1.0.2_54591936.exe"
1⤵
- Downloads MZ/PE file
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\OperaGX_.exe
  C:\Users\Admin\AppData\Local\OperaGX_.exe --silent --allusers=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Users\Admin\AppData\Local\Temp\7zSC556961A\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zSC556961A\installer.exe --silent --allusers=0 --server-tracking-blob=YjdmNTJiNGYzYzdmODEwOGIwNmYyZThlNzlkMGI4NDA5YWMyNmQzNjM2NTkxMDVlMDEwYTJlMzhlNTcxYTdkYTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTk4YWJhYzA4ZDQ2YjQxYzc5MmI5ODUwNjQ3ODQxNzNhIiwidGltZXN0YW1wIjoiMTc4NTU0NjA3OC44MzUzIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fR0JfUEI1Xzk0MTZfMzU3NSIsImlkIjoiOThhYmFjMDhkNDZiNDFjNzkyYjk4NTA2NDc4NDE3M2EiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJmOTNjMTU2ZS0zNWUxLTQyM2UtYjJkNy02MTMwYzNiN2YzZjkifQ==
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\7zSC556961A\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zSC556961A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff6be92cd88,0x7ff6be92cd94,0x7ff6be92cda0
      4⤵
      Executes dropped EXE
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\.opera\bff7afd6-97e8-4b39-9c3d-48870865c563 Opera GX Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\bff7afd6-97e8-4b39-9c3d-48870865c563 Opera GX Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:708
  - - C:\Users\Admin\AppData\Local\Temp\7zSC556961A\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSC556961A\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3136 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\bff7afd6-97e8-4b39-9c3d-48870865c563 Opera GX Installer Temp\opera_package_20260801020121" --session-guid=edf80064-7dae-462a-a8f7-ea0922fb2db3 --server-tracking-blob=MmFjM2U1ZTg2Y2Q1YmQyNjNkMTViMjY4OTZiNTQyYWU3MDFmZGI5YTU4ZmJmNWY0YjE2ODM0OTdkNGZlY2VkZDp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTk4YWJhYzA4ZDQ2YjQxYzc5MmI5ODUwNjQ3ODQxNzNhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg1NTQ2MDc4LjgzNTMiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiI5OGFiYWMwOGQ0NmI0MWM3OTJiOTg1MDY0Nzg0MTczYSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImY5M2MxNTZlLTM1ZTEtNDIzZS1iMmQ3LTYxMzBjM2I3ZjNmOSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7405000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\7zSC556961A\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC556961A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x2ac,0x2b0,0x2b4,0x274,0x2b8,0x7ff6be92cd88,0x7ff6be92cd94,0x7ff6be92cda0
        5⤵
        Executes dropped EXE
        
        PID:4444
- C:\Program Files\Booster\GameBooster.exe
  "C:\Program Files\Booster\GameBooster.exe" install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:6100

C:\Program Files\Booster\GameBooster.exe
"C:\Program Files\Booster\GameBooster.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files\Booster\GameBooster.exe
  "C:\Program Files\Booster\GameBooster.exe" --minimized
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GameBooster.exe

Path C:\Program Files\Booster\GameBooster.exe
Size 701KB
SHA256 b0f4bc5773ab22b63c49339e2dd854df5dfe98d3d2ed1181d47fb154b9d535c9
MD5 42ba701b3a7b126946dd5e4442fe0e93
SHA1 1faeee1f3dc4124fdf4b2abecbf378d03e69358a
SHA512 8fc07ef9cdd0b931443691eb8676e73898b20e7ab0c410d8284de7dbc21bcc46782c3126140a51f51ba8d9887ef2e9b5509c17a4b5a1bf7e201f0fcba9d9fe55
SSDEEP 12288:JDENXrsN4JWFMBvD3LQjfiH9WyOjNHYsX:orsqWFMB/QjajsX
TLSH
T147E47D15E6E401F9E0B7E17889624512EB727C568731BACF439065AE8F336D28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hgsdk.dll

Path C:\Program Files\Booster\hgsdk.dll
Size 7.4MB
SHA256 2720d215168108700767f8e9b57819d55ca139d69d8d828186da186850a37c6c
MD5 90dd0a0de940c142a19aacde0f9acd11
SHA1 4a8f27bf18081e621c1ffdf7781ecb34d0056647
SHA512 e1a80f1374e5a22d5f0700ea2fe469cd5defe8d191e2bbd86f7f103e79e4b019c3135506f68a2f714d98f7d4467764eb4ec26a0696fc7f81355789e9adb4f018
SSDEEP 98304:unQ7R2/sjM64HLMDk/zMqrw1ndwkMKCRn+b:BDkrOdluR
TLSH
T132762911BA6B98ADD15AC87083474A735E2170DB0B36B9FF41D486383F69BF02B39719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 0d2833c0297374f4dab44798d2a22189c5c84550445adc9d85aa0d65f2f6f7bb
MD5 b57220b3f63e21323d5c5346d8b252f6
SHA1 0a86f46559760e5de9deea469c9b55e56b745c32
SHA512 437d9be4654a58e1c7d3e9fbde7e04af57d693323ab42b830b26183769245ccfefd799c17b19251829bc65f33493c54c64bfe04f01853ff8881f8a14b61321ff
TLSH
T1AAF0DC8329D8FC2237854CCC18EE4A7E3A2290A501914007D83E14F947956AD6FA24B6
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 0e196dcdf800e118bb3de3de21420a2614330507723a9f2b4cb7ea4ea32cf924
MD5 72a0b94c8ec7c26900e99b8afe624037
SHA1 d093ee127696d28c9d73468a98d3de1aa559fbdb
SHA512 57567343f43ccb7b881d1e2e227d67eef184887ec0387cf069efb723840f7e0253add5cbef4ce41421e3091f8938705194db02b19842d9efc0e7867493877e9c
TLSH
T154C02B0837B20155F1300D7F0643530147FAE200CD41C3000F306318C11CB024CF0C03
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 7152978b33a7ebe5016f1941bc3a9aeadd0eec646617eac31bb194fa6a434981
MD5 3971f1658ebea89eac3d6b20b77c4b54
SHA1 2eab42e2ac0aa8392fb9391c3c3b88bb55266e96
SHA512 5126f4e40424bea36776cff1e08aac09d8c3b529f20946c7711369cc10026a74a877cd9e6c5577785ad604a450b3c0a0246e753dc7d204048422da1b3fe97986
TLSH
T1DAC09B1473654715F11D113E79D61E141BB54605F5C6C3044B74113595186400875D09
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 049f7da67bc503447267bf7df886d92381ada678859a331efa1d78473fd252c1
MD5 cf2403269c2f924fee7c708af33e150a
SHA1 876fcefcc020d1efcd9fc5c21828b2a42e48d0b4
SHA512 d35b42b246fad7e920f42111f9a6c543ae12907f778ad9e5f311403754e69937a4376b1fc4ea84027b508fb4b18688d34ce4aa60c41bdc5e2ae3d51772e955b4
TLSH
T1D6E0683826FA40ADF2F4D4758BD5B9251886F066041892B00BE417087606900AE12B36
MD5 SHA1 SHA512 TLSH

Submit Download

OperaGX_.exe

Path C:\Users\Admin\AppData\Local\OperaGX_.exe
Size 3.9MB
SHA256 1c8a026b1a1131380578d1ea9daee6dd1157742e5cb10734c73a4ffe44e3a2a4
MD5 e9bf1a8b1ddfc570f632ea747d62b16c
SHA1 53816c22265a61b2fe5a09e0aacb150dfe8afdfd
SHA512 0b43def8668377b1afe17982eded6515574ea216ee84edddb56b31c8ca029076d8809731868656b8a4b22d51bf00551a233818eb3511bafb088d3f93df37c8b8
SSDEEP 98304:9A+O4QUh9mlN1MTulTh34TQUe8DQP+F+6gT:pO+wlNDThoTQUeYM+F+N
TLSH
T17B163312BBC58075C9B331310FA5F7A816FFF5260F2656AB638C06AA9E706819731F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC556961A\installer.exe
Size 9.1MB
SHA256 94e544bce1fb4f965564026d1f61eb1bf8e0f750305b1a2c82ea8a445ebb9f1a
MD5 061711589ae8a06d2bc54489c7ee1a13
SHA1 c8b0da3e2352758308d6a98293a6c3bbd70a2a29
SHA512 fcf4c99618359eb8cd0372931b2a3ad5e9b50e0404dea0c716633d1c7ba262d6973adabd859033aa650cde30e04091e88296dfe2a73a903dea5132a7a8bde16d
SSDEEP 98304:ea+ZNcMT++pJDFh113LvdDCDfImZU7QgaHG9fHFBI3++wteEmw:6NcMTbBh1Nl+BG63+Bqw
TLSH
T1D3A68D53F3EA11E8D0AFCA748B7A523299757C464B34A3DF0A9436250E75ED49B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 52fbca3fc7e4fe0ee192b97d7b13e161d3b873697f8fdaab231a67ea5e1112a4
MD5 a8977fe219bf385e14d9c081813f60e1
SHA1 0fcac1cfe9bde19c22b2fe77ed5711c166eb67b1
SHA512 e0ba9ec4c3462fddff101f09abaa7b6eacc5ff64e98399e7abe9534dd6ce7dcdbea885d4ec17f2a21debf6528fb9fe05eaf43708c9f4a0a6fc728211cf6f243a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads