Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 21:28
Behavioral task
behavioral1
Sample
OperaInstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
General
- Target OperaInstaller.exe
- Size 178KB
- Sample260812-1bmvwavepg
- SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
- MD5 4ef32b114eaa6f05340b46d0f48154c7
- SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
- SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
- SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
- TLSH T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 26 2772 installer.exe 14 4360 OperaInstaller.exe - Executes dropped EXE 6 IoCs
pid Process 4184 OpInst.exe 2772 installer.exe 4948 installer.exe 3368 installer.exe 5244 installer.exe 4748 installer.exe - Loads dropped DLL 3 IoCs
pid Process 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: installer.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\F: installer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OperaInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OpInst.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS installer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName installer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS installer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName installer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4352 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4352 taskmgr.exe Token: SeSystemProfilePrivilege 4352 taskmgr.exe Token: SeCreateGlobalPrivilege 4352 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4360 wrote to memory of 4184 4360 OperaInstaller.exe 89 PID 4184 wrote to memory of 2772 4184 OpInst.exe 90 PID 2772 wrote to memory of 4948 2772 installer.exe 91 PID 2772 wrote to memory of 3368 2772 installer.exe 92 PID 2772 wrote to memory of 5244 2772 installer.exe 93 PID 5244 wrote to memory of 4748 5244 installer.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\OpInst.exe"C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\7zS850D47A9\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS850D47A9\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=MGEyNmYwM2YwMDcyOTc4NDgxOWY2NmIxYTNhYWQ0MjVhNjdkN2Y4NzZlODY1MmZjZDE4ZTNlMWM0YzQ0MGEyZTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4NjU3MDIxMS4xODQyIiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiY2YzOTEwYjEtMjI5YS00OGJjLTk3NGEtMDNjYWNlMjZiM2MzIn0=3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\7zS850D47A9\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS850D47A9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff73280ad88,0x7ff73280ad94,0x7ff73280ada04⤵
- Executes dropped EXE
PID:4948
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\a2dad84e-fd34-4347-bad7-47ef7968b96d Opera Installer Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\a2dad84e-fd34-4347-bad7-47ef7968b96d Opera Installer Temp\installer.exe" --version4⤵
- Executes dropped EXE
PID:3368
-
-
C:\Users\Admin\AppData\Local\Temp\7zS850D47A9\installer.exe"C:\Users\Admin\AppData\Local\Temp\7zS850D47A9\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2772 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\a2dad84e-fd34-4347-bad7-47ef7968b96d Opera Installer Temp\opera_package_20260812223014" --session-guid=d7f7e85e-8dd0-41f0-9fa7-70657a486c07 --server-tracking-blob=YjczZDg1ZjhkODNhNzI1ZmQxZjVlN2M5YjdiMzI3MzFhNmJhOTNmMWQzMDAxYjQwOGY1NzJiMjYzYTRiMjJlMTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg2NTcwMjExLjE4NDIiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJjZjM5MTBiMS0yMjlhLTQ4YmMtOTc0YS0wM2NhY2UyNmIzYzMifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=F4070000000000004⤵
- Executes dropped EXE
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\7zS850D47A9\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS850D47A9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x2ac,0x2b0,0x2c0,0x288,0x2c4,0x7ff73280ad88,0x7ff73280ad94,0x7ff73280ada05⤵
- Executes dropped EXE
PID:4748
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4352
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4520
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:2404
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
- Size 471B
- SHA256 f84f5b33979cdd57f8cba10cb7bcf79c07a5a8afaf5801aac8601092a02cce6e
- MD5 ae42a9ecb0cb2908ccac9d9443725d43
- SHA1 33853e30cf837b4b049f35ae6f8f6606c10b9f59
- SHA512 83093b337bad91bfabffcfafe12b71ea75c7ba19538d78b3e715e70af6ad802f2ff92e94aaefe4d2d4c29f3e145f4d9488e7347fdf1f224c8243cd107876feb1
- TLSH T12CF0DCC24268A8103F8AC88C25F10C3F3C12B41A54EA51DFA12DA4F2961A5BEAB5C43A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
- Size 416B
- SHA256 e83457dfbce71162e47bedc4b376126a90444d78669c278667fd77254922ead0
- MD5 faba3ebb2121924d2f8a1671e6df2796
- SHA1 28b321ddf7e212d377de181703c9ba84ed42d320
- SHA512 204d4e7ef89fb1748fca420cc80b5d5f02a1a785b7259d43a665b165b04b049cb559f174236aeb75f28d687aa91d97f32e63dee060af3dc426dd8696488c2f63
- TLSH T139E0C02415F7106DF0F4F0748BE5F5354C46F026182C93F41BE40704B602940EE52A39
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS850D47A9\installer.exe
- Size 8.3MB
- SHA256 3e1ee4a6d766e4e155d4818034c8e55efcfa743368a4e96a3b966badd7e09e14
- MD5 36152668ab7d4db9a0015916f2eebfd4
- SHA1 7f551a41bb0c09ef1dbf56b76bcd68682c059435
- SHA512 0d1ba9f9533c23f5b089ea5b2bf21ef74e310b64e04ce39742ca7a0a32cf8937ad4bd579cfa56668ef232e3ea569fc0a293ced570d7d85311018c0ced893f1d2
- SSDEEP 98304:WfyPB3Qm1BgiwINXE9ynI81WT7cG8BAzFYNY8AF9:0yPB3Qm1BgDueXF9
- TLSH T114967C53F2A601E8D06FCA748B7A523299757C464B31A3EF0A943A251E75FD46F3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
- Size 3.1MB
- SHA256 c1431112d4bf9e88037be564ba787ddaffa2d4d0147840c802aedc4fea46da13
- MD5 ad6028cc93cd81e265eb35ae9a57318a
- SHA1 6faed4d3de39ce67a835e8630d0abc2ef1647ac3
- SHA512 417b477f3ea890573510b2c8a2144f7bde26524663d78a0e0cedced577bd998cfafceb1accfdd65d1ba1c43da6c0be54543da8325a9aba395c05807998063670
- SSDEEP 98304:0A3624H6UA7suEqszIwzNfnKXevaMGP/OUYXd:J6FaUMdcmtlqd
- TLSH T1CBE523127B8098B9E62210335F15E659977DB9201F26DA8BB3D41D5F8FB0282B636F43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bg.png
- Size 224KB
- SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
- MD5 21eb6b8232802f32b6483eedb96677bb
- SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
- SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
- SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
- TLSH T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
- Size 40B
- SHA256 5f589b2c9ccbbea1a8f2766c9af0d840f0bc0e2ee2ed31d20683ce8d24460b73
- MD5 e9f48dc9dc854cd14741703ed6423fbd
- SHA1 54cd1981749384ded56d1b23a682c0e9d588e841
- SHA512 37e695f05a2e4314453a13e639e53835ffa192b5bd52b4cd2367bca20bd040536807850fa9e28fe9b6224e6da0e8f1105bc2c300a4e87ec1d447f016fcef4289
- MD5 SHA1 SHA512