Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 04:12
Behavioral task
behavioral1
Sample
OperaInstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target OperaInstaller.exe
- Size 178KB
- Sample260801-est5madr2w
- SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
- MD5 4ef32b114eaa6f05340b46d0f48154c7
- SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
- SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
- SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
- TLSH T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 29 5604 installer.exe 10 5416 OperaInstaller.exe - Executes dropped EXE 9 IoCs
pid Process 4880 OpInst.exe 5604 installer.exe 5016 installer.exe 1068 installer.exe 2848 installer.exe 1996 installer.exe 4600 Assistant_130.0.5847.41_Setup.exe_sfx.exe 5600 assistant_installer.exe 1280 assistant_installer.exe - Loads dropped DLL 4 IoCs
pid Process 5600 assistant_installer.exe 5600 assistant_installer.exe 1280 assistant_installer.exe 1280 assistant_installer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: installer.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\F: installer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assistant_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OperaInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OpInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Assistant_130.0.5847.41_Setup.exe_sfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assistant_installer.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS assistant_installer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName assistant_installer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS installer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName installer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS installer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName installer.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2788 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2788 taskmgr.exe Token: SeSystemProfilePrivilege 2788 taskmgr.exe Token: SeCreateGlobalPrivilege 2788 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe 2788 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2788 taskmgr.exe 2788 taskmgr.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5416 wrote to memory of 4880 5416 OperaInstaller.exe 90 PID 4880 wrote to memory of 5604 4880 OpInst.exe 91 PID 5604 wrote to memory of 5016 5604 installer.exe 92 PID 5604 wrote to memory of 1068 5604 installer.exe 93 PID 5604 wrote to memory of 2848 5604 installer.exe 95 PID 2848 wrote to memory of 1996 2848 installer.exe 96 PID 5604 wrote to memory of 4600 5604 installer.exe 99 PID 5604 wrote to memory of 5600 5604 installer.exe 100 PID 5600 wrote to memory of 1280 5600 assistant_installer.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\OpInst.exe"C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\7zS0130D029\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS0130D029\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=OTM0MmQ5NjU4OGM3YWEzYzZhYzZhZmRkM2YxZjI4M2NhMjY2MmMzZWZiZGJkOGQwMTQ1MTM5ODA3MDJkNDcxZDp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4NTU1NzU5NC43MDM2IiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiMzVlZDg0ZDMtZGY3OC00M2YyLTk4MDQtNjI3YjA5Y2M1MDQ1In0=3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\7zS0130D029\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS0130D029\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.26 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff7ecb89d88,0x7ff7ecb89d94,0x7ff7ecb89da04⤵
- Executes dropped EXE
PID:5016
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\installer.exe" --version4⤵
- Executes dropped EXE
PID:1068
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0130D029\installer.exe"C:\Users\Admin\AppData\Local\Temp\7zS0130D029\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5604 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\opera_package_20260801051317" --session-guid=9675240b-ffa9-4ba4-96da-44523d40d1ae --server-tracking-blob=NWQ1Y2VhNThmOWZmMDA3YzU2NDVkZTAzNmE4MDA4YTdmZjIyNGJhNDY0Y2E1ZjRjYzY0OWMyMTA1YjU2M2E4Mzp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg1NTU3NTk0LjcwMzYiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiIzNWVkODRkMy1kZjc4LTQzZjItOTgwNC02MjdiMDljYzUwNDUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=F0080000000000004⤵
- Executes dropped EXE
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\7zS0130D029\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS0130D029\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.26 --initial-client-data=0x2b8,0x2bc,0x2c0,0x288,0x2c4,0x7ff7ecb89d88,0x7ff7ecb89d94,0x7ff7ecb89da05⤵
- Executes dropped EXE
PID:1996
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\opera_package_202608010513171\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\opera_package_202608010513171\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4600
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\opera_package_202608010513171\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\opera_package_202608010513171\assistant\assistant_installer.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\opera_package_202608010513171\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\opera_package_202608010513171\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x1084040,0x108404c,0x10840585⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1280
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2788
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1072
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 1KB
- SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
- MD5 adac67e1d2da2d706db151c2db316b2d
- SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
- SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
- TLSH T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
- Size 528B
- SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
- MD5 047f3e9d21d6b325d592b1959e4362e6
- SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
- SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
- TLSH T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
- Size 471B
- SHA256 0d2833c0297374f4dab44798d2a22189c5c84550445adc9d85aa0d65f2f6f7bb
- MD5 b57220b3f63e21323d5c5346d8b252f6
- SHA1 0a86f46559760e5de9deea469c9b55e56b745c32
- SHA512 437d9be4654a58e1c7d3e9fbde7e04af57d693323ab42b830b26183769245ccfefd799c17b19251829bc65f33493c54c64bfe04f01853ff8881f8a14b61321ff
- TLSH T1AAF0DC8329D8FC2237854CCC18EE4A7E3A2290A501914007D83E14F947956AD6FA24B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 174B
- SHA256 ff7e0f63abdf338943a853e0dce6c6ed9cfdcb24e2de1e036669812355fe464b
- MD5 d8eafcea3e0b321880ff77fd8008a9f0
- SHA1 7a2f1222ddb6cbaaa06fbbff6408751c7bc1919f
- SHA512 b4e113f291ab3a54a308e126eb65652c4a1785809d5d5687e89d38baabfc201c99225b2fb0851e189e7d66a15eacce65869ffb2313dc8300aae4f254ba8b18bb
- TLSH T1DBC04C0837B54155F1304D7F1A52631157BAA6058D4183540F605259852DB4258A5D06
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
- Size 170B
- SHA256 a4648a12c0c949dbfb93207560cd47934ad5377a7a305b152bff93b7b305da37
- MD5 5098560ffa240c4aa12734c721b4ccc5
- SHA1 ac178787aa16ea7234ad85bbae0d0161a89fbe60
- SHA512 51408b97c1400956b285372c2613393a7d857981a86613280c999ea9586782717a3da015e349a6ffbe82fbe54fb09e7a8c0c69a834c64288cd46f9d57cccc62a
- TLSH T16DC09B1473654715F14D113E7DD5170417BD4205F6C6C3044B741134851864008F2D45
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
- Size 416B
- SHA256 c5788c3a101f1eefc4634bf7f9efb21e74392c661a357a11508b54d439366945
- MD5 988c0a36b852387bab419fd0047f94f2
- SHA1 90ca9e1ee6656079d1e4499e285419b681f2bdea
- SHA512 5a45b3617003d3a68c1f697bf356b9f3a690c07f1ead37b1f8fdb9c1b7df059b3463cf592927c6f1283ae6870c469e433dfeb20ba35ce24daf7ffcf165678e42
- TLSH T167E0683926FA406DE2F4D4758FD9B525188AF0260418A2B00EE007087602900BE52A36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\opera_package_202608010513171\additional_file0.tmp
- Size 2.8MB
- SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
- MD5 3b028b1188ac321e66add16f8ebadbec
- SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
- SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
- SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
- TLSH T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\opera_package_202608010513171\assistant\assistant_installer.exe
- Size 2.4MB
- SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
- MD5 b0408fa2a406f483e42c3ac102d35e9b
- SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
- SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
- SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
- TLSH T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\opera_package_202608010513171\assistant\dbgcore.DLL
- Size 222KB
- SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
- MD5 b26ebc5cde9b1726ee9f9534dd6107d0
- SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
- SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
- SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
- TLSH T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.opera\0602bcd6-9495-43ba-915e-8d551b32acc1 Opera Installer Temp\opera_package_202608010513171\assistant\dbghelp.dll
- Size 1.8MB
- SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
- MD5 021b11c0fc1a09e49a2046ef07d1747a
- SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
- SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
- SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
- TLSH T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS0130D029\installer.exe
- Size 8.3MB
- SHA256 49d33a257c47d2e32cbb967ef1c088c0ff5d71ced60950d902c9aa82311e306c
- MD5 d9534337f6a0f2c96b59dc571e694474
- SHA1 6e706ab155031e936ff35eff549d51b815c4de5b
- SHA512 becf6953874c49d217482a211ed9fd50e3075506390d4f1c33ea88665fe529f4c8e9fbad6057dc63f3ec546171886f98de6ce8ba13b906b96a9ffce012c846fb
- SSDEEP 98304:ZhLx1oEDfLTV7fi0obDaW6oTTOFO7g53QxheYNY8AFk:jLx1oKLTV7fYeDQxgXFk
- TLSH T1D9967C53F2A601E8D06FCA748B7A5232A9757C465B30A3EF0A943A251E75FD45F3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
- Size 3.1MB
- SHA256 ded2822bfbd77b35002ea1247ead6845c7db4394b4ec6d1bcba9832535843e8a
- MD5 722e4ff61a06aae3f5973e0bd83f2c99
- SHA1 4bc75a1c449dd1090f81e5bcba26c052d2f48f71
- SHA512 775e3dc21c0a25a1833bf766bbac93bb6cb3ad888c19b93ccfa63b9886f67aae22461f6564607b1176b171182f68d660a242ea99de0cdf8e1ed05e62dbcf9063
- SSDEEP 49152:qVAbwtDkQC3x3XyayaN+KYUkAjHMZ/buhf0R8sx/ggeOV2MsAwZu8DbALMKMeVPF:+AYgh3XyFaN+QiOy/ggJl3w0PLTL+M
- TLSH T1D2E5231237448475C67312320F15E7A8A5BDF9652F72878733A47A5FCEF0582EA26B0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bg.png
- Size 224KB
- SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
- MD5 21eb6b8232802f32b6483eedb96677bb
- SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
- SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
- SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
- TLSH T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
- Size 40B
- SHA256 f0d533500c9677b81ee1bdc99ae9506ce0cca2dcbf8f43847ad5e93a5825c1fa
- MD5 a0d038db232c8249d92e53355ef5896b
- SHA1 68ae282b472121015bbab13195b541e9bbd9b7be
- SHA512 67df32ff3ae4ca76b03f74ed3f97ee2e848bbf2bcd14e6d9cfac18f6cd32dbbdcddd0850622336c0f4c6188d0a1964228359cd8037e95a48732b6c1a84f98aee
- MD5 SHA1 SHA512
- Path C:\Windows\System32\y2d2uy.exe
- Size 7.2MB
- SHA256 8de080f3e99dc52ebcd862d643724eb29788d1cd8ea8ec0741f32b6c069780b8
- MD5 f93821f2444d218d60ccc8e8236ce34a
- SHA1 822fd9d95ae5fab684598c82c803e6a2abec2e5b
- SHA512 a81daef755144e2a485d78b0c00e69eb1f3668661b008456715e2cbb7e90887764cf0c93bea89f35c95b7f6891972808e996a62ecec2b11ff667b8c4bc91439b
- SSDEEP 98304:uoJhEPO306zsuYE+8ptinHgyACLuTVnLfM4Ec5Ilfmg:vK/6zz9aAy/C1Loc5Ilfmg
- TLSH T1DF767C43F85569E8C6EDD23086358252BA707C890B3077D32B61F3B92B73BD89A79354
- MD5 SHA1 SHA512 SSDEEP TLSH