35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium Executor_65415963.exe
Size 702KB
Sample260802-h64srseh93
SHA256 35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63
MD5 cd85c75fa053954c4ae4ee338d3bcb63
SHA1 fb2fb89c667d901ef01600dae3f027c7dbfe16be
SHA512 f0d7e4732df889e6513f67e266c68bf7490c513bb78736b4fac4d90ed49040415a500ae8f0f9b696e100a92c871d5cf80fdb628bec0f42e3a531e1a636873f6d
SSDEEP 12288:utflJ50c6GeHR6Kjx288tG6rmC0tzeIiZ4fFo:ut9J6MB8gGaUtze74f+
TLSH
T123E48C16B6A801FCE1B7D179C9524912F7B1B847437297CF03A05A66AF2BAE05F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
44	5940	installer.exe
44	5940	installer.exe
26	3868	Madium Executor_65415963.exe

Executes dropped EXE 9 IoCs

pid	Process
6128	OperaGX_65415963.exe
5940	installer.exe
1980	installer.exe
1520	installer.exe
5868	installer.exe
2324	installer.exe
5596	Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
2680	assistant_installer.exe
2564	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
2680	assistant_installer.exe
2680	assistant_installer.exe
2564	assistant_installer.exe
2564	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGX_65415963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Madium Executor_65415963.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\OperaGXStable	Madium Executor_65415963.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Madium Executor_65415963.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\OperaStable	Madium Executor_65415963.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 6128	3868	Madium Executor_65415963.exe	90
PID 6128 wrote to memory of 5940	6128	OperaGX_65415963.exe	91
PID 5940 wrote to memory of 1980	5940	installer.exe	92
PID 5940 wrote to memory of 1520	5940	installer.exe	93
PID 5940 wrote to memory of 5868	5940	installer.exe	94
PID 5868 wrote to memory of 2324	5868	installer.exe	95
PID 5940 wrote to memory of 5596	5940	installer.exe	96
PID 5940 wrote to memory of 2680	5940	installer.exe	97
PID 2680 wrote to memory of 2564	2680	assistant_installer.exe	98

C:\Users\Admin\AppData\Local\Temp\Madium Executor_65415963.exe
"C:\Users\Admin\AppData\Local\Temp\Madium Executor_65415963.exe"
1⤵
- Downloads MZ/PE file
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Local\OperaGX_65415963.exe
  C:\Users\Admin\AppData\Local\OperaGX_65415963.exe --silent --allusers=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Users\Admin\AppData\Local\Temp\7zS0F7DD25A\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS0F7DD25A\installer.exe --silent --allusers=0 --server-tracking-blob=MWM2MmIwOWVjYjU1OTQzNTE2MTRmYTQ3OTQwYTRjOWU0MzhkZWNhMDQ3YWFhMjhkMTc5Yjc0YWZlMmFjYTI4ZTp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTAyMWVmODA0NDQ0MTRjNjE4OWQyYTBmYzA5OTAzNGFlIiwidGltZXN0YW1wIjoiMTc4NTY1NTQxNC41OTMyIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fR0JfUEI1Xzk0MTZfMzU3NSIsImlkIjoiMDIxZWY4MDQ0NDQxNGM2MTg5ZDJhMGZjMDk5MDM0YWUiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJiY2ZhZGQ0Yi0wNDg0LTQ3YjktODg2Zi05ZWI5ODRiY2JlMjkifQ==
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\7zS0F7DD25A\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS0F7DD25A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x2a8,0x2ac,0x2b0,0x288,0x2b4,0x7ff7d235cd88,0x7ff7d235cd94,0x7ff7d235cda0
      4⤵
      Executes dropped EXE
      PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\7zS0F7DD25A\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0F7DD25A\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=5940 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_20260802082335" --session-guid=7b4e08e2-fb8a-42b8-95fb-c04e531650e0 --server-tracking-blob=YTZjMmZjN2E3MDYzMGNkNDdjNTE2YzU2MDQxOTM3MjdlNzQ1ZWFjYjI3M2FkZDhiYjJjOTg5ZmE4MmI0ODllNjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTAyMWVmODA0NDQ0MTRjNjE4OWQyYTBmYzA5OTAzNGFlIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg1NjU1NDE0LjU5MzIiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXaW42NDsgeDY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KSIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9HQl9QQjVfOTQxNl8zNTc1IiwiaWQiOiIwMjFlZjgwNDQ0NDE0YzYxODlkMmEwZmMwOTkwMzRhZSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImJjZmFkZDRiLTA0ODQtNDdiOS04ODZmLTllYjk4NGJjYmUyOSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=CC07000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F7DD25A\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0F7DD25A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.109 --initial-client-data=0x2b4,0x2b8,0x2bc,0x288,0x2c0,0x7ff7d235cd88,0x7ff7d235cd94,0x7ff7d235cda0
        5⤵
        Executes dropped EXE
        
        PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xb84b80,0xb84b8c,0xb84b98
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B
Size 2KB
SHA256 ac0e2f34a238928fb79d7699b63cb6c03167c85e0a365a6edc13e0440090db20
MD5 83c8cd9067938f6fe0e64c9b7cc5c07d
SHA1 db33440781e751ea490443c6da249ed665036588
SHA512 f0088343c65c3d5b568afcee92f887f0e931fd2ae8dc4421c0212b7b0c58b2aa94df21365c1b66c598bbe3a3f9fb2755df503f3de09660aed713e9be11855cbd
TLSH
T10A41346D1E4C3563B01A2E74E8DAAD938DF2906117C0D48EC5288A465571FCE9FCE4F7
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B
Size 246B
SHA256 d9cbfadbc7f2fb38d5fe3b511c3fbb7650efe225eb0776929b982870b7336492
MD5 12f3fb9f36f0fa964bd16fe641a9c569
SHA1 ce4ae02d71beb926aa5736d2561157c3f2ca25ad
SHA512 8ea5a6f1b9808a5bcc15e7d31b3bd1db6d9399f631a625f2cdf4afb48b4c928fc842ce5057cdeac431feaab3b3bbdac7fe488bdd16a56b14cb2eef574bac642c
TLSH
T18FD0C9305BB6560AF1B5667A6D644BC1FB249B11F506CB050BA0174C0C28F901C21F2B
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 41934aa1ac4d4559766bbc41fd612ddb3497544ea0053fbcc1386d1154474d3c
MD5 44f383857b407641e2e96330476341f7
SHA1 ffc02c98f3449494a1d8e038a8034ea8b005a5c3
SHA512 86e222dec047505b1991a5b60870381b33c7c163c1fe9802c54ef3b914c5752fe9dc5d9c6d84df6c40055894b0bc1b2984a246da4be5151731d12c467926e92d
TLSH
T15EC04C443BB64169F2704D7F1692A31147BAA505CD4183540F605699851DA425CA5D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 5c34ef06ef3b095097e966e315b4d822dd7b05eca2f3058fc4339982f7ec4d9f
MD5 b4dba53bd1b7f20a56d24ad539ef432c
SHA1 8f95b12200ce1a3cd1dee9b5424faa88531b0038
SHA512 0e9849950721e846322e58f12088375d943865aacfd2299f1a771eff044da32ec80b547f8ca1955f7b72a9ec19d75e1c3a8ce1bd6bc909890c4e5c5488a883cb
TLSH
T153C09B1477654B19F10D113D7DD5160457B5410AF5CBC3044B74153485186400D72D05
MD5 SHA1 SHA512 TLSH

Submit Download

OperaGX_65415963.exe

Path C:\Users\Admin\AppData\Local\OperaGX_65415963.exe
Size 3.9MB
SHA256 cddafce29553ddd114a65f0028984e58f3bd3296981b2acdb227f80cf719ec65
MD5 71109e40f2c0f86433c04e30e5e34d00
SHA1 10cf10dcb79837cd9e45373ee40caf3ca224219d
SHA512 c1c5db468b3d6ee16145586bfce155a6ce0374b8874721b78dff230f22047ae7e7ba0b0935a4ff018166ce6aeb5febcb07f5e0331377cf369264ff3172609dda
SSDEEP 98304:rA+O4QUh9mlN1MTulTh34TQUe8DQP+F+6g8:rO+wlNDThoTQUeYM+F+C
TLSH
T126163312BBC58075C9B331310FA5F7A816FFF5260F2656AB638C06AA9E706819731F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\additional_file0.tmp
Size 2.8MB
SHA256 0f50bda78a34e09ccfd5e33a7958de9eebe9863cc3d875e8b9c52dec3f3a9992
MD5 1bed04ab23ee645cad438456a6d465fa
SHA1 68b7d9eb6ff0bd159281a2fd55a7a24860ba765c
SHA512 9ca295d1c574e88eb8506ba3bb4096ff3860e605b7870fe11a2eff27c85a551894345b7524485fb4fd5ed5e9cfbefb917f735ed51085cfd3adbabd9a28909f23
SSDEEP 49152:MkinoAcJ53ld/JCHyHuw+yIfBfnDWUKT5qDztnvkbPsGaW6EYFZoMzu3ug:MkioJJ57RCH2uryIfi0mz+W6Eory3ug
TLSH
T1E0D533317D918476D22392330DD5FBEC66BFF5B22F229A9B3388072EAF201A24715557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\assistant\assistant_installer.exe
Size 2.5MB
SHA256 e86907d20a18c6b99e270a4422e0c279079e8a118b6bd7fbb4001161ddc881f4
MD5 31f5e82954b11ee1cbaf09294f7d5d6d
SHA1 580d39bfee5fad23b31ea4869561b4f9d15f322e
SHA512 e3ec7a6c238faaa1561b12b67217edac16e5c63ff68483daf4e7d7bf6b1bdcc16e2dda5b11a7b69434dcfd864cab6e427854d8d70a2cd7cbf744ca8b15a6fe9f
SSDEEP 49152:6P/Ojp1psS7+BMvcOZ+XMxNBfAlVH5p6h7yMo:6nOjp1psS7+BMvpiMnBfAPH5p6hGp
TLSH
T1CBC59D02B89194B5DC963032361CF77E9A345E114B364DC79B90BCD16FB9AE2223739B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\assistant\dbgcore.DLL
Size 196KB
SHA256 a2777992696c953c001dabade3f236f731987b58061efd8c894815f9939f979c
MD5 874334b4e7891772e6543f666e6d2411
SHA1 d9f0ca0263a50f254c6516aa9c8fbc671d978025
SHA512 c5b205cd580c75df43e69215028874bd233cede85c1829e4bbc67a2160c786a59124ef49681351aee383c27ce764fb7e47fc22e8b454b0eed8f0bb4020edca1f
SSDEEP 6144:pASh0NdOkBakZykbp/eyhr+SJors+k0L3nTd:8YIqFLnT
TLSH
T169148C6296840833DD9F11B8B29F333795FEEFB0139194C362549AE4E5647C06E3A2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\assistant\dbghelp.dll
Size 1.8MB
SHA256 102419e70ed462dd1ef4a30d94b714c4317ea838d7acc85ae030dfca19f609ab
MD5 7660d7d4afc11706c9b4f03aaef74a9e
SHA1 38136ffc06c49fde4dc4210e9f9f580b5aeecd53
SHA512 e8f2f71ec524dd7435515c012ccbbe2e29d0de866a64fcfe604c0a9888425f0b6a7f89baac8078a1715f6c7dc411a5da4d5c0b92c720195d9ef00eb57ef4fa1f
SSDEEP 24576:gDOSE7VspFPxh+EqYbt6lyn2GyQWKACVOxHTdMgh9IVbMAQyvyXiuVKHeeKKwsf0:gqhRcFPxhHYCBRnyHO6W6NIyX/kQs2Rp
TLSH
T1E8856A20E784813CE4EA0177E67D7A79866DE134073440CBAAD45B69782D7C3AF386DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\installer_prefs_include.json
Size 342B
SHA256 5ce6f2bbf3446f255d985dc10fb8bf348f4ea80afe0673ed82c50116bcd732fd
MD5 720d4f675d726675f13e8cc414fa146d
SHA1 88062b014ebf4264a21f044eda00d8a22368a6e1
SHA512 90a779df6e642fdc13a26f61cce7b149092ce7b2d8d55de7ed49ea343ffdd4ed6609de48efcaeb6ea501e17174cf05ba0b42974f1a261896afe9ad32bac2f4e7
TLSH
T1A6E02612802AD0E60BA1858A2DB730CE71D31C5347F1BCDEF79B852241BA96638D6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\installer_prefs_include.json
Size 357B
SHA256 b8f9fd7e273d840e03829962206fa9c889efbb6c8f71b22251417551d2e924cb
MD5 01623614a5d6c1fda502d0ca0a1c405c
SHA1 0f37a70289a24daa59e7057cb600bdc1f5c57b10
SHA512 a91d98b4989c7958fc5188692e53eb12d6c8cd02796736c06582794982c3c8b3533bafec59dbce980dc8ee7e2530a93355f222e741f8de855fc7d5be460025ef
TLSH
T109E06801802980E60B61458A29B730CE21C30C0303F1BCCEF78B8522417946524D5E4C
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\e987eea8-2cbd-418a-a1fe-9447e7a31de6 Opera GX Installer Temp\opera_package_202608020823351\installer_prefs_include.json
Size 1KB
SHA256 942962b8ca769302633d1f0d10aab178c5152dfb6c9e17f70d2732d8ee73f848
MD5 89349883a60e6c63bff5bed42c463d51
SHA1 1447f441276ef1d3eb73d3ac2017c33d4cdefbf7
SHA512 19a38a8b8380d23fdef874752fc6d1e841dc6cc130d0330aec31bbf2a51f30afa14416d671d6fc40ba1f583acf39381c7f9363170eff72cbd9dd189de20b4922
TLSH
T1FE11722980096061BF66818F9B6B394A69830D0346B874CEE5DB493650FFCA50FF9F1E
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0F7DD25A\installer.exe
Size 9.1MB
SHA256 94e544bce1fb4f965564026d1f61eb1bf8e0f750305b1a2c82ea8a445ebb9f1a
MD5 061711589ae8a06d2bc54489c7ee1a13
SHA1 c8b0da3e2352758308d6a98293a6c3bbd70a2a29
SHA512 fcf4c99618359eb8cd0372931b2a3ad5e9b50e0404dea0c716633d1c7ba262d6973adabd859033aa650cde30e04091e88296dfe2a73a903dea5132a7a8bde16d
SSDEEP 98304:ea+ZNcMT++pJDFh113LvdDCDfImZU7QgaHG9fHFBI3++wteEmw:6NcMTbBh1Nl+BG63+Bqw
TLSH
T1D3A68D53F3EA11E8D0AFCA748B7A523299757C464B34A3DF0A9436250E75ED49B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 975e8ff8dc79a0c2067b7a8d1333ef15aa5f999116d0bbd9783da233321fbc20
MD5 3267a63802424f5ec5511ba37d84116d
SHA1 d98745a280fe844ca28a1cdfffad2dfbe22a4191
SHA512 2f78d61ed6633c69ebcbea97d2ebcb21b47764ac749950692abb9a5a84bed2d2a69b0feaa6ec6b309a833c7e95f6b4cd27020592c9e7404c1d9feed05380a8d8
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads