20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaInstaller (1).exe
Size 178KB
Sample260809-g5224sscnc
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
23	3112	installer.exe
9	1116	OperaInstaller (1).exe

Executes dropped EXE 9 IoCs

pid	Process
2176	OpInst.exe
3112	installer.exe
3408	installer.exe
5516	installer.exe
4352	installer.exe
2376	installer.exe
4696	Assistant_130.0.5847.41_Setup.exe_sfx.exe
3892	assistant_installer.exe
6124	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
3892	assistant_installer.exe
3892	assistant_installer.exe
6124	assistant_installer.exe
6124	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assistant_130.0.5847.41_Setup.exe_sfx.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2176	1116	OperaInstaller (1).exe	89
PID 2176 wrote to memory of 3112	2176	OpInst.exe	90
PID 3112 wrote to memory of 3408	3112	installer.exe	91
PID 3112 wrote to memory of 5516	3112	installer.exe	92
PID 3112 wrote to memory of 4352	3112	installer.exe	94
PID 4352 wrote to memory of 2376	4352	installer.exe	95
PID 3112 wrote to memory of 4696	3112	installer.exe	96
PID 3112 wrote to memory of 3892	3112	installer.exe	97
PID 3892 wrote to memory of 6124	3892	assistant_installer.exe	98

C:\Users\Admin\AppData\Local\Temp\OperaInstaller (1).exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller (1).exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Users\Admin\AppData\Local\Temp\7zS088DA6A9\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS088DA6A9\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=ZmIxZTExOTliZTUyMTEwZDM4NmViYjljMDczZGM1ZThmZTFhNTYzYzBmMzNmYzZkZTc0MDM2NWI0YjQ2NWFmMzp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4NjI1NjY3OS41MDg3IiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiZTFlY2ZkZmMtNzk5MS00MTc1LWI5NDAtYmE4YzAyM2FiZTIwIn0=
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\7zS088DA6A9\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS088DA6A9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff6420dad88,0x7ff6420dad94,0x7ff6420dada0
      4⤵
      Executes dropped EXE
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\7zS088DA6A9\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS088DA6A9\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3112 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\opera_package_20260809072441" --session-guid=08bca350-27c8-4251-9029-92444adab56a --server-tracking-blob=N2U0MWU0NzZiOWE2ZTg4MzFiMzJjYWZhMWY3YzAxN2IxNWQ0ZWM0NTZmYTU2Mjg5ZDk3OTdlNTVjNTEwNWY5ODp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg2MjU2Njc5LjUwODciLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJlMWVjZmRmYy03OTkxLTQxNzUtYjk0MC1iYThjMDIzYWJlMjAifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E005000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\7zS088DA6A9\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS088DA6A9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x2c0,0x2c4,0x2c8,0x294,0x2cc,0x7ff6420dad88,0x7ff6420dad94,0x7ff6420dada0
        5⤵
        Executes dropped EXE
        
        PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\opera_package_202608090724411\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\opera_package_202608090724411\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\opera_package_202608090724411\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\opera_package_202608090724411\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\opera_package_202608090724411\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\opera_package_202608090724411\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x874040,0x87404c,0x874058
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 5ea73e46d4d2a45a24b689bd156e299ecf330317f54f087d1da238f060dc8ed2
MD5 b3da231c6d22b133cb9974e0b6927358
SHA1 30b6bf59f66bfb89b802cffe8e6f363d68b778b2
SHA512 28ec2ce730543f6d1b428d81c013926d72807f5897316f9c088ac1155f4e4cda5e084671d9806e2de8d2eea76c81ef3c1b119fd1727dd2448b5573827e2d67c6
TLSH
T1BEF0DCA268EEE8A56080C8AC25E145767816E02992A65142F01F04F08526AECAF3D536
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 c5ee0f50dede62447d8549bd412897ab4dad7968cfaff868ba0232957bb6d9bc
MD5 02e6fccb9d64de4fc40cfbbbc076720e
SHA1 938ba5dfa8e3b50c318bf3e207842c87a9b08567
SHA512 4d7496d3ff7ff2d1edc7fc4223a4defa63ad203c36ee7de490500952d485e011a6fc08bf184b95a56f82d65d03fc0a68cc0890042898b8a9e6cd6ae637292923
TLSH
T1ABC09B0437B54196F1704DBF1E57931147FAE505CE4183541F705259C51DF429CF5D07
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 4b4f7975289eb41e080122e14810472fd900dd16d6a5841e4ed6d2cb3057ada0
MD5 255c194022540157ae0eb01be25e66f0
SHA1 4e3075d7e9a08e8121f247e86e43e057799483d2
SHA512 65207f8c84e478e2718ec5929c1cd45ee9772b8bab99343f180988d3feee2fa86ead1f6c7d505a3c82644199d7a63aed9a5364dcded97bb490cf6bf5f9c9d54c
TLSH
T11EC09B14B7654755F11D553D7DD5160417B94105F6C6C3045BB41135852C6504C71D05
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 04e17692b72237ffe60c6628068f72ccdc516b88c5a74fdd7bc3286dde79a536
MD5 3291b14b1250711099670ef5b48c740b
SHA1 7c5fc5ff90416269a5065dcbe1ba8b2dcb742c5e
SHA512 4b55cc70d7011ff0173147508970c73a05757df4d9955f160af20cd72372cf7b5520f0a3e595f5dde8fe21401f939c5aae26020d73d6a509e97f141566294430
TLSH
T14FE0683515F6012EF1F4D4B44BDEB5224A9AF0220458A2B41EF067017207900AE12A34
MD5 SHA1 SHA512 TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\opera_package_202608090724411\additional_file0.tmp
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\opera_package_202608090724411\assistant\assistant_installer.exe
Size 2.4MB
SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
MD5 b0408fa2a406f483e42c3ac102d35e9b
SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
TLSH
T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\opera_package_202608090724411\assistant\dbgcore.DLL
Size 222KB
SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
MD5 b26ebc5cde9b1726ee9f9534dd6107d0
SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
TLSH
T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\95a5637c-088c-4f90-bcd0-3391cac8a54b Opera Installer Temp\opera_package_202608090724411\assistant\dbghelp.dll
Size 1.8MB
SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
MD5 021b11c0fc1a09e49a2046ef07d1747a
SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
TLSH
T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS088DA6A9\installer.exe
Size 8.3MB
SHA256 c2a6825b895b245bab9774e69a450a11a4352eafa8d4da5fdad0e81341d4e67e
MD5 9dbf6590b693218b7ef20ae8de7eef6f
SHA1 6d8a4f3e48bbeab782da7166a8700bc35ad39416
SHA512 ebe898c89ec43db14a2744078941647737350cc27bb515fa83713e372576c0ce77e5ede72b227d2dfc369bca1c6244b3ceca5ee443259023c05d636ba81f8147
SSDEEP 98304:2h6i+ubH0SElWmLmgm3yrglOgw+Mne2ZQYNY8AFH:Ti+ubH0SElWEZmXFH
TLSH
T1EF967C53F2A601E8D06FCA748B7A523299757C464B31A3EF0A943A251E75FD46F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 64a1d756698978c59fa852ed9c57b28287c0e4cc7a515d7a4427fdae62546f02
MD5 d48dc914af15555451e3122b9e752c87
SHA1 2d36bf78094fdb8d94c5feffb18f274539591cc0
SHA512 1a7de0e2a2ab8ad1d09d9ca1e94e1cf5c6ba9eda61a24e6fe0dc75c96e4b1826e7cc617dc24d4d2df02249c5c176523f4572c39b7a596f0d7dfef1ed98d46f77
SSDEEP 49152:wVAbwXR+eb2jcWlFwfYud53AgGKP9u1ce+UhAOlY+FGXVRrmUFLS:cAO6IWzwQuddo11ce+UnlpFGk
TLSH
T1E7E523127A81C835C5B311334F89F659A17DF9621F32D6CB37981A6F8EB06C09929F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 edf315fb2fa7d6f3b78b087a2d49b7fb75c615249bc8176630dc0e7dde061bdd
MD5 629d98f54e02e50567c4317af5fc3dae
SHA1 9a9bfe628cbbab6d69b84f1676f88afa2db3dadf
SHA512 7d81386dbe27ba73e70c026d599e1c67dd180f071c16a04e882414404fc61f131582cf1a538ba1e10eb104bc5ec67c5c75368eb82a324be9794c7dee16fa8f74
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads