20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

Analysis

user interaction
yes
max time kernel
83s
max time network
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaInstaller.exe
Size 178KB
Sample260905-vf7sysyejc
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
26	3808	installer.exe
12	2136	OperaInstaller.exe

Executes dropped EXE 9 IoCs

pid	Process
1872	OpInst.exe
3808	installer.exe
5020	installer.exe
4972	installer.exe
3256	installer.exe
1736	installer.exe
5340	Assistant_130.0.5847.41_Setup.exe_sfx.exe
3460	assistant_installer.exe
3260	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
3460	assistant_installer.exe
3460	assistant_installer.exe
3260	assistant_installer.exe
3260	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assistant_130.0.5847.41_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1872	2136	OperaInstaller.exe	89
PID 1872 wrote to memory of 3808	1872	OpInst.exe	90
PID 3808 wrote to memory of 5020	3808	installer.exe	91
PID 3808 wrote to memory of 4972	3808	installer.exe	92
PID 3808 wrote to memory of 3256	3808	installer.exe	93
PID 3256 wrote to memory of 1736	3256	installer.exe	94
PID 3808 wrote to memory of 5340	3808	installer.exe	96
PID 3808 wrote to memory of 3460	3808	installer.exe	97
PID 3460 wrote to memory of 3260	3460	assistant_installer.exe	98

C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Users\Admin\AppData\Local\Temp\7zS057FB1C9\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS057FB1C9\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=YmJhM2VhNWJlMzgzYTFhOTNlMzM1NjFhMTYzMmI3OWRhOWU2OTRlNjQxN2E5N2UyMWZkYjljMTAwNmVlNTRmOTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4ODYyNzQ1Mi4wMjM1IiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiNTQ3N2Y5OGQtY2U5YS00YmNlLWI1OWEtZjgyYWU5MzNkOWM4In0=
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\7zS057FB1C9\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS057FB1C9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.92 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff7f92c2608,0x7ff7f92c2618,0x7ff7f92c2628
      4⤵
      Executes dropped EXE
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\7zS057FB1C9\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS057FB1C9\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3808 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\opera_package_20260905175734" --session-guid=29d31a1a-5d8b-419e-8aa3-00dad9e3b589 --server-tracking-blob=ZmMzYTNlODYxMmYwYzM2MDBkZWQ1MDg0MzRkODFlMjhjM2FlNjkzNTVhNWI3ZWNmOGEzOWJhOWJiOTYxZWQwNjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg4NjI3NDUyLjAyMzUiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiI1NDc3Zjk4ZC1jZTlhLTRiY2UtYjU5YS1mODJhZTkzM2Q5YzgifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=9406000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\7zS057FB1C9\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS057FB1C9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.92 --initial-client-data=0x2b8,0x2bc,0x2c0,0x288,0x2c4,0x7ff7f92c2608,0x7ff7f92c2618,0x7ff7f92c2628
        5⤵
        Executes dropped EXE
        
        PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\opera_package_202609051757341\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\opera_package_202609051757341\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\opera_package_202609051757341\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\opera_package_202609051757341\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\opera_package_202609051757341\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\opera_package_202609051757341\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x3c4040,0x3c404c,0x3c4058
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B
Size 2KB
SHA256 887a51f0bb296758a866a423842e1486159d518eaf0ed0322f8f41287cbae311
MD5 9939fb59ed692998eb191020a12f28f1
SHA1 6518f2b6331fa53ef3e9fb2a7e9396f3e1db3c56
SHA512 560f1d16665e0ea13344d6c83226c5649158b451e6ae4b8cf27e6e216d82ec9b2673c4791c0583277e76020c1dcb59c0803729857fb11a329b80ddf930064e97
TLSH
T14741726D0E8C74A3B4192E74E9C7BE878CE2906117C0A48EC5288A425531FCE9FCE4B3
MD5 SHA1 SHA512 TLSH

Submit Download

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B
Size 246B
SHA256 51460cddedeac4bd2b7bc8a351e9b68dc99f4d7f7409986f003076eb29224be1
MD5 a9568e989818679e9b140dac50be9fd2
SHA1 8657ebfd795a56ba3c939324bc8b1d656dd58a91
SHA512 4b0d1c64ba10848bc4fb3e5a3d4cd71ec88ccd1cf0294ecc8d8d4fe070c18d893e24c726c51c6d74433b4ed76fb2121a72434990b68ba7ce1836fb8b2264df17
TLSH
T128D013209B755365F65713397DE049C1B7655F166413DB051A71051D0824F501D18D17
MD5 SHA1 SHA512 TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\opera_package_202609051757341\additional_file0.tmp
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\opera_package_202609051757341\assistant\assistant_installer.exe
Size 2.4MB
SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
MD5 b0408fa2a406f483e42c3ac102d35e9b
SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
TLSH
T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\opera_package_202609051757341\assistant\dbgcore.DLL
Size 222KB
SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
MD5 b26ebc5cde9b1726ee9f9534dd6107d0
SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
TLSH
T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\7135062c-d5ab-4a0c-995f-e22dcd2e1ac0 Opera Installer Temp\opera_package_202609051757341\assistant\dbghelp.dll
Size 1.8MB
SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
MD5 021b11c0fc1a09e49a2046ef07d1747a
SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
TLSH
T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS057FB1C9\installer.exe
Size 8.3MB
SHA256 62b5c5cfda3377ef4f252b3262c8c4b72b66cc44aeb1f106ab7d56d3a89921e1
MD5 3bc6fea4389bf05337e8589728ca4ccd
SHA1 b69595c415dff086d2bf5acb391a7fd6b56bb441
SHA512 8dc5da9d5e3ffa7ed46bfbe5d0c11ef91053c46f65805733cc54ed723945cc6bca1b73dea451474b96e148846d17550934b44a6f3a163144c9b5c48a505d05bf
SSDEEP 98304:khyvRBwPUbk0+R1/ZKIZpna1xYg/ZYNY8AFl:Ay5Btw0+RRCYOZXFl
TLSH
T11F967C53F3A601E8D06FDA748B7A523299757C464B30A3EF0A943A251E75FD46B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 ce10650b42046438c10a04a1a3852e42caf2795f16e56086decfd690d1f52d40
MD5 fd42a69f938cd950acb8d20d4a279900
SHA1 52e3fc1e673186b1b575985a279f2072bd8173fb
SHA512 89f4a6123eb1ebdd09f1230e80617188e9e423df3191e95d9ea7d2f1071915c05b242773823bd0c4ec5cf01a6b84817b5a3ddc7bf33cb9b82e43db15b2d5ae1f
SSDEEP 98304:UAZSO9rr3x/p5yZac5Mk1sMNYPjTueXYKrNU/+0sWPd9:zTnxxsPNOuSRUyWPd9
TLSH
T1CCE523127B40E471D63312320F5AF7B8967DF8221F268B57B394295F8F719819A26F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 bf639307ec66789c84f0ffbbd18342c123f54eb2f3c32c3a000a62e276d6fd8a
MD5 ec6a73c97bdaf52988f59bf1b4eff242
SHA1 5447e09d5fa479f51bb2b21a2d5f3b5a0f6ec23d
SHA512 8a30e4e439d5c39aa018ba9667016c49c1037df9184e2c3a2d6442f7b7d08c950f141e30009cb959f40bdcb5cc611fc6c37447db9d81dbb36e90fe77bc3f87f8
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads