20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

Analysis

user interaction
yes
max time kernel
81s
max time network
84s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaInstaller.exe
Size 178KB
Sample260906-v33gracc94
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
13	4068	OperaInstaller.exe
32	3832	installer.exe

Executes dropped EXE 10 IoCs

pid	Process
1244	OpInst.exe
3832	installer.exe
1972	installer.exe
5848	installer.exe
2440	installer.exe
5100	installer.exe
3512	Assistant_130.0.5847.41_Setup.exe_sfx.exe
2292	assistant_installer.exe
5832	assistant_installer.exe
1148	installer.exe

Loads dropped DLL 4 IoCs

pid	Process
2292	assistant_installer.exe
2292	assistant_installer.exe
5832	assistant_installer.exe
5832	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assistant_130.0.5847.41_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{FFBC46CF-8F97-4B6A-A28F-ABBC5D3516F4}	ShellHost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	installer.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
820	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4784	ShellHost.exe
Token: SeCreatePagefilePrivilege	4784	ShellHost.exe
Token: SeShutdownPrivilege	4784	ShellHost.exe
Token: SeCreatePagefilePrivilege	4784	ShellHost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4784	ShellHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4784	ShellHost.exe
4236	ShellHost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1244	4068	OperaInstaller.exe	89
PID 1244 wrote to memory of 3832	1244	OpInst.exe	90
PID 3832 wrote to memory of 1972	3832	installer.exe	91
PID 3832 wrote to memory of 5848	3832	installer.exe	92
PID 3832 wrote to memory of 2440	3832	installer.exe	93
PID 2440 wrote to memory of 5100	2440	installer.exe	94
PID 3832 wrote to memory of 3512	3832	installer.exe	109
PID 3832 wrote to memory of 2292	3832	installer.exe	110
PID 2292 wrote to memory of 5832	2292	assistant_installer.exe	111
PID 2440 wrote to memory of 1148	2440	installer.exe	116

C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Users\Admin\AppData\Local\Temp\7zSCD454E89\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zSCD454E89\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=NmMzOTM1NjI1YTE0MTYzZTY3MGRkOWJiNGFjZWE4MWUxYjc1NmJjYmYwZjQ2OTYwYWE4NzZhMmUwOTY3NGQxZjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4ODcxNTk5My40Mjk0IiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiZjZiMjA4NjUtMWM1NC00ZjNlLWE5MjctMmIyYjEzMjNkOWY4In0=
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\7zSCD454E89\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zSCD454E89\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.92 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff60a572608,0x7ff60a572618,0x7ff60a572628
      4⤵
      Executes dropped EXE
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\7zSCD454E89\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSCD454E89\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3832 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_20260906183316" --session-guid=a31d8d8f-4480-463c-a1eb-9bdaa6b1a2a9 --server-tracking-blob=NjE1NTlmNzNiZDIwZWFiZDE0ODYwODMwNWRmODk5YjE1MmIyMGRkZWYzZDUyOWI0NmI1YTIzYmI4Mjg3ODhkNjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg4NzE1OTkzLjQyOTQiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJmNmIyMDg2NS0xYzU0LTRmM2UtYTkyNy0yYjJiMTMyM2Q5ZjgifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=C408000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\7zSCD454E89\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCD454E89\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.92 --initial-client-data=0x2c0,0x2c4,0x2c8,0x290,0x2cc,0x7ff60a572608,0x7ff60a572618,0x7ff60a572628
        5⤵
        Executes dropped EXE
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\installer.exe" --backend --initial-pid=3832 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161" --session-guid=a31d8d8f-4480-463c-a1eb-9bdaa6b1a2a9 --server-tracking-blob=NjE1NTlmNzNiZDIwZWFiZDE0ODYwODMwNWRmODk5YjE1MmIyMGRkZWYzZDUyOWI0NmI1YTIzYmI4Mjg3ODhkNjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg4NzE1OTkzLjQyOTQiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJmNmIyMDg2NS0xYzU0LTRmM2UtYTkyNy0yYjJiMTMyM2Q5ZjgifQ== --silent --desktopshortcut=1 --install-subfolder=135.0.5973.92
        5⤵
        Executes dropped EXE
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\installer.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.92 --initial-client-data=0x2b8,0x2bc,0x2c0,0xc4,0x2c4,0x7ff640e12608,0x7ff640e12618,0x7ff640e12628
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\de932af914ba00303d4a2778a383ac9c831101e2.crx"
        6⤵
        
        PID:764
  - - C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xdd4040,0xdd404c,0xdd4058
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x00000000000004FC
1⤵
PID:3200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:2544

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4784

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 ca13660d7e30cbc345b4c8eaa2f8424fd1a209fa339146f81dda2b85734213a5
MD5 5c930d8d085ad129e0b9a4718313d5d4
SHA1 8ef41ed84d3460319842930151ab1d7e7ba97fb4
SHA512 63c8db37f88a3db386492d9e303f47b4521f9d34cd6c87be37883f5cea6ccf48b7c518683b7cb8d05359a896a5f38a22279c69e8c7679b65e41622ccc343b962
TLSH
T103F0979B06FEE0203E8458EC26B04C3E2C62613E605599F1B5A818E59F6839A5E26039
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 2c665199e9928a82179ec1e09730c161314da1750f025869258c9c015f6a6bc2
MD5 60da30dfdd4b2a15d562daa387867af3
SHA1 d28fc6186033b382a5fa5afba96c0e8ec5a76743
SHA512 dea75724436e35065340eaf4a51ca6a5ea0315e761a01a0708a23099166758f2b1ce50e0be59f59ccf3530fc8c5619096cb072875c0c8a74ff21e89e4299f7be
TLSH
T1D4E0C02819F7416DF4F4D8744BF9F5314D56F02A041C93F10FE45705B607900AE12A75
MD5 SHA1 SHA512 TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\dxcompiler.dll
Size 704KB
SHA256 b593a34517c5c9b89509007a92f0518bd436a49fabbf8323f607d6f5e5c3cd8b
MD5 c00e8e71cd6c899853c0fa11bdf86def
SHA1 6f8782c1743338b27137b098f2564f3aa0d2bb12
SHA512 fadbd0704672fbd7d98cb47e4675ed8924dc3621e4e5cea99d4d56d133de7cd7840e12cc75356ad5bcb5bbec2cb8bc914504fa340ed5c56a4f4b8bddfa56f989
SSDEEP 12288:40QQ6gAquU/HBejhAJmSwzNbqwF/G3f+FEf4rKJ2QzZvwLs9EtFXQrxfsaeU8P3i:40QQ6gAIHQawxWwF/kf+FEA2J2eZWs9Z
TLSH
T15FE40A12678694ACD41AC474D7578A3ADDA830EB3B77B8FFC47491211B7ACFC1A39224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\icudtl.dat
Size 512KB
SHA256 b70405ab0848cfcf7e351c2999d8b630dd5fdbe21defd330680540ccb62b362e
MD5 fd367a14c4ce5cc15655efe2a1105500
SHA1 5337f502fad4d9f8fb4105819721a0129e9b4ce8
SHA512 cffd06ffbe8a689f0af37afdf55db86738b421cdcd7c9affb6481d1ae445457d39cd44175d98fd45a22aecd76154f9fac703ea088085b594cd8f6c5cd2c54475
SSDEEP 12288:e9PAofouQoFDdtiMlhw771h0jM7ykPG0g:nmrhw3zVtjg
TLSH
T154B45B62B1BC10ABE20FF63FD4C5782EFDEF8C2AE9158799931E7B15164E18D214170A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\installer.exe
Size 2.4MB
SHA256 cefdf36054ffdd8bc885d47bca49215700f65ef9f75ecd483f24f27d8cebafdc
MD5 91a352a506b64cab06629a6451ff3398
SHA1 ecf9ce99e5753e9fe096ab948daa0b4f62321d13
SHA512 b80de118d1c8d43892702324d68acc0017e5691c25c0384566fdf1ea617d289e18ef065fc08b386820a1f1a9f7b69d92c72844acf8c829a6698eb1e2ced54c44
SSDEEP 49152:tEC0v2hS86BFyvRptuGr3rb8r97uGbjJ+zw7nG5/:GhyvRBwP2
TLSH
T1ABC51993E36111F8C40ECCA9872D64629529748B4735B3EF0AE94A760B71FD96B3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\installer.exe
Size 896KB
SHA256 0ba326a031df82852d4863d5025c4bca643540ae1e03ae49033c2d3d8a4785f4
MD5 cce7c61ccd93e29b62ae03c9fb58d8d4
SHA1 05e04fd229067d713f8f64a6f0bc62809e08a828
SHA512 dd2b529a7be4831fcb67c38f69ec421a3ec916ddecf4cde41c67d23a2ec10bbf7707009154c4d85c172816343de6f2934a3bac31792ab0f2c943db4604bbaf15
SSDEEP 6144:KU7m7uEXAoHHkjMTL4xtQEvlyVnDelt5fhWVe3BVScQlTpueR2Q1t2t:KlGEzRnDelt5fhWVgBzQlMU2Qv2t
TLSH
T106154FE6A33222795C1FCCA59A3C2892452C34CF9135D3FE19FD49B60671ACE6B19F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\localization\ca.pak
Size 384KB
SHA256 659f7506b466c6a110dac7f53c964403cd668a758062d4ce5190016c167739d1
MD5 66bf529ce4e4d8b3dcdff9320b1acd05
SHA1 66354f7ca32c46f58ca8bc33e92f9ed5411ac6e8
SHA512 c04b6273bcc7b168c9931f05214273c43d296b92b28d29612717dcea578b3704d1c42853efca889ed4a907156d979299b82bb0bd5da407cd28ec09c79ebe625f
SSDEEP 6144:pMneGYo0zF+7Ycw6ybGbf1bCCrz+W58rPglpfmbVii6V6M6AqHl9kdkcBKMe3aRZ:pMnfYo0zY7K6ybGbf1bCCrz+W58rPgl3
TLSH
T1B18419239BC83B770493321AB746C217F48CA6847B06D254F9EE0B16228DBDCD677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\localization\cs.pak
Size 384KB
SHA256 136025adc5bdecd7a3680e9e7bc3a549915828f23d92c2671c4caba49fda76c2
MD5 7f50f49ab57fdc8d9ab045362df7f3a4
SHA1 1787f4a654b3f4f405c7df5afe9b13ec3929ab6e
SHA512 a9e941079390212c21985738c54263419ca1b598ad617ec0bda07029d82db57759f20a51e6b308b69bd8267d687bcc86cc2b7c61add1219843bca51f2be4b6e4
SSDEEP 3072:P6EIH1CQU63MxR3cIxxQULiVZSoUJffUAr8zeJhCzHktfyYEKYHGOevuIY/BTbJ1:PqCbsmQUevgWzHyYHGOXISBzg8Qtsv
TLSH
T1AF846B0FEB936539484001447BBA4228BD6E83580B6E99AB3CCFDD81257677ECEF1D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\localization\da.pak
Size 384KB
SHA256 c3b168c8bc587f3a84039c5790bf2bb170ce0a0f1a6aec776eed7fdeb34a1a3a
MD5 9bf00825a501e4eed8adb82323dc48a6
SHA1 619bdef18be46a4df97b878064d442624db1aa26
SHA512 6b2cb337ffcc7c88a825cae5d8914d03478152e2396d3d10ee87af06f1e2543b64905640d860f9b26dd0d05ee347c1ab149987d1a2c6643fdce6b85a2c306cac
SSDEEP 6144:DHFa92AtrA0qprNNvfzVWgkyxJxVtsIGMwd4AdCfwgWszZhLCRQgP8oq:rFaoj0qpTZkONse4FRQgkT
TLSH
T107846B47DC9C332F89A90764F2108D6BDFAC513CC6C4664F75D8943A29CBDA092BE2D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\localization\de.pak
Size 384KB
SHA256 8e9c8080565f637030b3707d7866b4c505706c911461fe39f2beb24d5f363bf8
MD5 011c801874172bacb8d79f561720741a
SHA1 c60c1d182fefbb98d96ae76cc0e4a5288617053c
SHA512 eeaacea13aab4f452443109bcc248d1bcf4aa2784b54ecdc9e71a6767bacde8252deb2f7982c8c9277c6dd49dc1f5d8ea7416863faf8d7dffa9cdb1e0af69e07
SSDEEP 6144:BHsqpQj3mesvHT2Wfez2UuMziMCLVDE+J1PX:BH0j38Hy+NUyMCLV1PX
TLSH
T168842A03ADDB224ED64773607301CDB77B28E36FC381322A94E9D127564B6B283AD576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\localization\el.pak
Size 320KB
SHA256 7209dcfbd9b01059e764c2d32d9298baef6e912d910165335669ca91e4d967f9
MD5 d155ca469997282d42c493f46e754371
SHA1 78c636acf0d2c1e7120ab2324f289f34cd7cfcf9
SHA512 2b7c4208c174b470af8aefbff788a9476194c006797cbdb77baba69a550778bf3e56670d36ee8538fe2fdd10aa18cfd3cc0b385ecbae8f8a9d8f98690aef4891
SSDEEP 6144:K4zqDfPpSpav5o5rzFeknj7FruB8G4eACNK9cVKyU7fOILB2ocl0aP862IAabmv1:/qfPoPFeknj7FruB8G4eACNK9cVKyU7p
TLSH
T1756464EFB1582DAD8045950385D8F07C6B862D6CF749CBD8722DCB60B9F90719A22E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\localization\en-GB.pak
Size 320KB
SHA256 99b2a69b612ffac5968076cac45b081e7e81eb668077a293713ef8e3ed2383cf
MD5 ed5a00fb89fea166b2c2958326b5e80c
SHA1 1761cac185bfbe59f0e8516d8d6f4e8a71472643
SHA512 afa5044f10228bb4ef0b9ffe1b7baef5d08e23ba63df277c7693fb47dd375f74db3cf63eed28f5bba95ef215b61fcabef720de401bb87973a28dd6481e4ba0fc
SSDEEP 3072:89WaP4PT2nSr1NxHu9mii5HCeHtzgRAnK8ODsxD0UWB6kFjABcwpNpVRvPAJxRUo:899Qz/Nii5HCcxgREDNjBc8RHGn
TLSH
T1A3645C1FF784122E069312727A4AA666FF26D07CB31116527C6D902C33B375A83777EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\Opera\135.0.5973.92\localization\en-US.pak
Size 320KB
SHA256 cb49fdcc1810338c5f036dc839b515ea606ce7e41b6b9cef1dd58007d4ad54b6
MD5 4cd4404ce24581d8a92a3d14291c12d4
SHA1 006615d7ad368ce2cd0320680d74f162ad9466ad
SHA512 7b8b72f307589bc1de52013fd255b8235d6f27d81119253733101ca21be7a03a9705f534e0ac8dd96eb5a162bc915acc781fa6c77729fb41a6dbbae45411baae
SSDEEP 3072:wdfd2zFWxq6Hwvmf0wxyLn+rORjkxCNBgkFkAngwHAjz3P06e+I8KG3ggl+fUBSv:Ed24tQ+f0wSj8ingeA/fkwGr
TLSH
T169645C1FF748122E06A352627F0A9662FF3590ADA35113563C6D802C37B376A827B7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opera Browser.lnk

Path C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\Opera Browser.lnk
Size 1KB
SHA256 2802e2cfaca99de963ddd403d8da44e5b36b633caaa99d4d98c49cfe46d28773
MD5 838e28b5088ab2b2e06b6a21a368aa85
SHA1 ca5f64ea5682b446f1e6a8eb78d4bd4ea00686ba
SHA512 479b34d185c51378b8d96c86e066e9600c21fbce021a7ced81bd16f376facd63a348722d6225d3c912262c36a2f002dbcd1eeab8998cc658cac9953a67bcfd88
TLSH
T1D22121156FDE2711E2B7C93140FAB6298136BC10AB9AAE1C4015C3493D75652E989F0F
MD5 SHA1 SHA512 TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\additional_file0.tmp
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\assistant\assistant_installer.exe
Size 2.4MB
SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
MD5 b0408fa2a406f483e42c3ac102d35e9b
SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
TLSH
T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\assistant\dbgcore.DLL
Size 222KB
SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
MD5 b26ebc5cde9b1726ee9f9534dd6107d0
SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
TLSH
T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\assistant\dbghelp.dll
Size 1.8MB
SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
MD5 021b11c0fc1a09e49a2046ef07d1747a
SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
TLSH
T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\installer_prefs_include.json
Size 239B
SHA256 ad0a70852936dbf15eeb5accadd7acc1554959df5b85898911e4281e402e287a
MD5 d89bea9bbcd4817b77b7b90014f1da87
SHA1 21cdef3b05e461f645e198bb92f7c787ad0372dc
SHA512 70f794b897b35a6d15559a05cd358e98d2887096c60f7cac5c2e1d065e1a2c39618d64cc81b9fc2c3380075705441c3856b0df03eb6feb4396e8558ab2b1cc96
TLSH
T1D6D05E59802AC0E269B00287783633DDC24B1B0288616899B3C72125806DAA226EAE1A
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\installer_prefs_include.json
Size 224B
SHA256 f799101396e58ec98238b81669c288b0649788476fdc997cd029cfd5239c8aad
MD5 a31327ed38a2e2aa048700169e5c9e89
SHA1 cee83a9db48bf9c0d963bc6d03cc125af5cc4ffe
SHA512 b302790a45f5cefca7131f81d2d15976d402a48147960dedb5eaea136205c7a5e04635521f08c63f7ab53f1b9dd283e575240076beca5f392f47f0522f105fef
TLSH
T195D0A755802BC0E365B00283783633DDC20B1B038C716899B3C71125C07DAB326E6E1A
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\a5582c45-7ef6-4f33-b5fe-0fb1d17ddfdd Opera Installer Temp\opera_package_202609061833161\installer_prefs_include.json
Size 1KB
SHA256 dacdeb76d42d9bff38693ae3a6d9b575838dee7753127acc9c332a94b98f2e0e
MD5 9af72908928222cb5ef42b18f11de003
SHA1 3d3288ebe9737eb483542177456eb676db6a9bd0
SHA512 002401ed2da17e781740189c4d1de104384f7def4b38b8148461f6f8d46e5015c356bda37887ae941154bc4135061f2d88b08dd577c12a8a1eab9d1e7fc0f76a
TLSH
T1B221B9A49502D093BB71C24FDABF2B8BD3070B03997420D572C6441D84FFDA20F98D29
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCD454E89\installer.exe
Size 8.3MB
SHA256 62b5c5cfda3377ef4f252b3262c8c4b72b66cc44aeb1f106ab7d56d3a89921e1
MD5 3bc6fea4389bf05337e8589728ca4ccd
SHA1 b69595c415dff086d2bf5acb391a7fd6b56bb441
SHA512 8dc5da9d5e3ffa7ed46bfbe5d0c11ef91053c46f65805733cc54ed723945cc6bca1b73dea451474b96e148846d17550934b44a6f3a163144c9b5c48a505d05bf
SSDEEP 98304:khyvRBwPUbk0+R1/ZKIZpna1xYg/ZYNY8AFl:Ay5Btw0+RRCYOZXFl
TLSH
T11F967C53F3A601E8D06FDA748B7A523299757C464B30A3EF0A943A251E75FD46B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 bd3af39aa8cf059a74f55373940ca8ff4787e65f46c9e309de7fd7da45850ee0
MD5 8235207da3c6159096fee8548feedba2
SHA1 8856c67f2230822df49f0f4bb5e3c313019c2d02
SHA512 c7130ee1f3ccc0f71baa692171f024c5d60e2e2d6d23dc22566ce2c498121ef6d28ae1bfa4a23bf50f85aee072d031b9247487f629cdaab0c25234a63298a605
SSDEEP 98304:qAZSO9rr3x/p5yZac5Mk1sMNYPjTueXYKrNU/+0sWPd9:VTnxxsPNOuSRUyWPd9
TLSH
T109E523127B40E471D63312320F5AF7B8967DF8221F268B57B394295F8F719819A26F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 a2b21d2f6e4a163edc6cf9d2855116ffc753d21dc73cf512b6efa7835347148d
MD5 5e65f024cb14d847be79792dcf5c22f0
SHA1 44e015d0071561d424a4cf3b0c67de85f606eda0
SHA512 ce49a575bf1fbbd7f2571a0224706ec1075f2ea0075fd4e919c5672ce8b16d1add2eade49a0c0801855586ff426f4087735031b6ca39a9d3aebcc7f71c797bfc
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads