Overview

overview

8

Static

static

3

2026-09-21...om.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/09/2026, 11:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-21_a221d57a10786e06167bccea4de98376_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  • Size 9.7MB
  • Sample260922-m7rl2svake
  • SHA256 cb4694ca0549ca92e449f67cbc76f3f34797563f098146dfa7ec6aab3b104185
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-21_a221d57a10786e06167bccea4de98376_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-21_a221d57a10786e06167bccea4de98376_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
    1⤵
    • Downloads MZ/PE file
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\2026-09-21_a221d57a10786e06167bccea4de98376_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-21_a221d57a10786e06167bccea4de98376_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d0,0x1406fbd88,0x1406fbd94,0x1406fbda0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4880
    • C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\2026-09-21_a221d57a10786e06167bccea4de98376_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\2026-09-21_a221d57a10786e06167bccea4de98376_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe" --version
      2⤵
      • Executes dropped EXE
      PID:5364
    • C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\opera_package_202609221206491\assistant\Opera_GX_assistant_135.0.5973.153_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\opera_package_202609221206491\assistant\Opera_GX_assistant_135.0.5973.153_Setup.exe_sfx.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:816
    • C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\opera_package_202609221206491\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\opera_package_202609221206491\assistant\assistant_installer.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:5368
      • C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\opera_package_202609221206491\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\opera_package_202609221206491\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=135.0.5973.153 --initial-client-data=0x224,0x228,0x22c,0x220,0x230,0xaceaf8,0xaceb04,0xaceb10
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1808
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:5260
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:4324
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:5952
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:5384
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3496
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5600
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2948
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:6072
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3524
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:5836
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1656
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4492
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4416
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4500
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4008
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:5404
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1692
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:216
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4536
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:5924
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4296
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:792
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1308
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1636
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:3248
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:5156

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 b6dc6fd0907b88a2cd2cd95f06a9d7f4af165ec4475d566324574257ff716fb2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.4MB
            • SHA256 d2b7873ec10b6a6b358ee9c563e732caa00c6075bc44775b178133c101c7207d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.7MB
            • SHA256 3c2342100962020a75f1e9b9249e75d0d4af095ec8dbf93663be4f51c06caf45
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 a0c4eed2ea465f19c71f704a79a1a04049da1426265b6c74a4b8923aeee99919
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 926bb09c5761734360494a218401fa1def0a3129030d209ad8000f53e24f71a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 7dc6523a7dcb855dc382df01f17f49bb79f76ad2b3c7095b1bb8b8aaad3377d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.4MB
            • SHA256 94f5996263bf09e64b9af737a09960b271abe07811e4c8e5b7bb626ea0dc3d88
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 23db36a599816c1a1c549862c943b769f5bab64b9b13f7a6e93bddb524c8f64e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.5MB
            • SHA256 5465d5fc95d84f608e9c0a6ff3a102f29ac74affd5e1906c89cef83df53f6e4f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 417a85cab312340f29df2a730d5ada895a0d53c74816ee7cc8b30b07a1e8328c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 af0232058ecf552bf635790d1bb754722d7520f019de79f0657cc020a34bfe98
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 d11aa731581c5d84de1feafe157026c16caa381b8827be0b2222a4f969f17f07
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.4MB
            • SHA256 44c9d79560223fab2e218b5c352a68846327576dcd28d2bbd3ea813499ec4425
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.3MB
            • SHA256 8f1f5e601787e03b0338013a250c30650a818c7ac500eae6cccce27532cb3525
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
            • Size 6.6MB
            • SHA256 199c69155342671016ac1144306d7b03302e57cbcbc61715207a8dc0a9649852
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
            • Size 6.6MB
            • SHA256 43675977b1b9b8bcc552415427974816a31c69bf3d3e000e7a1516a818eb1aa4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 817fb9ff81a71f8881f8a1e0342f082a95a52c4b40fc44160aa00ec29b46f221
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 4.0MB
            • SHA256 846cfb143f3d99d9aaf75abb34dafdbc4a77bd66e50efd9fc879ccaf468befb8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 2ce602136ce91c5dd64504be1772aae43c38fac8292594e9bc4d01c8dfb26d55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
            • Size 2.2MB
            • SHA256 57fd85b471f35befa101983a67e57f4bba36d505f81bc9f61fb9dc9657947af3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            os_update_handler.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
            • Size 2.4MB
            • SHA256 72e4aeea92f954d6e880f5bec8e7b26f2260600fb9633e1fc32ad368ce76124c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 2.0MB
            • SHA256 0af795d0f18e257d54a347fe14c4794659e09d4a468a215ec06436d6e260ab11
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.2MB
            • SHA256 2d3e3e0ecce8edfa0a783bca6f4fc51ba0e3162d55e6efbd545afdd1859c6f1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.2MB
            • SHA256 820c436259a9ccb2f059db6508d943aaf72760c8364bc1bfcd073891fa1c2106
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 6b60368ae9a7b502192ff88018630d9566b5de59eb3254b174cbcb18ddea2ffe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.3MB
            • SHA256 a457f8e5a62d48ddcc396fdcfa56b8182e6bc31f4bad4f5ffc4ca78bf776a684
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2026-09-21_a221d57a10786e06167bccea4de98376_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
            • Path C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\2026-09-21_a221d57a10786e06167bccea4de98376_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
            • Size 9.7MB
            • SHA256 cb4694ca0549ca92e449f67cbc76f3f34797563f098146dfa7ec6aab3b104185
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            additional_file0.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\opera_package_202609221206491\additional_file0.tmp
            • Size 2.8MB
            • SHA256 89079bfea9176cd7b2247e5d857ee829e5c0637fd5bd7932d29b0642160524b5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            assistant_installer.exe
            • Path C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\opera_package_202609221206491\assistant\assistant_installer.exe
            • Size 2.4MB
            • SHA256 e75377167c994ab1a95d9a123644af22b0683981dc1003708b65d392abd3b24b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dbgcore.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\opera_package_202609221206491\assistant\dbgcore.dll
            • Size 196KB
            • SHA256 a1a285bf215e06a2e2e076abc0c54a7de16291dd2aee0bbba0b7d66884627423
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dbghelp.dll
            • Path C:\Users\Admin\AppData\Local\Temp\.opera\3c9d42aa-411d-45d4-b7cd-b02ce91900dd Opera GX Installer Temp\opera_package_202609221206491\assistant\dbghelp.dll
            • Size 1.8MB
            • SHA256 62fe5f1a13499ed668d2680c39495c16132432509ea432f347f903b14f802468
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
            • Size 40B
            • SHA256 f403fe4579943b5bfd5590697c34fe984729ee665ae4e7f76804824fc3df061c
            • MD5 SHA1 SHA512
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 a22766f7bd2d77654944c05bfffcaaa7092897328d82c87a99299844fc36ceb9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 310692d2a203b06358fea3b78e9072caa8d8ca14522fecd06fae69cfb20d9889
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.3MB
            • SHA256 0de184120725dd5d815ccc7833798a88e45bfcbe2aaf1f191a4cff2fb006901a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 5f6f0ad4d175c6732c32011a0f999178883ab06c50c4fd44e45457d7153a6af2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 4f75c481e9e7ecaae17efdc494d697a66a13f6e1ced367060a0d8f56a7ed680c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.5MB
            • SHA256 eb4fe06eaf5c139d9bb32be79114ff66d0a1f907967e51b3c8f8b0e70634461f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.3MB
            • SHA256 a2237c496b15ba2f88e7a36324d8e1f0b94973c0a6a9ad57574932e77aef5e0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 aff88046cf9df83119808c3bb45771b7ded435aae50182fea64fbf5c2ba9c253
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 c8e8d33a58b6c9b441dbd35213d44929051700d82a2fc1731c6fdc8da776eaa0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 008183184a19be8972ea5e4aee2e49baec85b6640fa6c69b0dd00d58fa93a4a9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 2f3d7f76d434d040959fdfb2887f8a2912fc4ea76261cae69e38ad5450f8a5e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 d072d663b90db99809129a783faf935765361f55dea910d7e83c218e902682b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.3MB
            • SHA256 b8c8cd6119b3fbbc6a1b16968b29a042c77a2e56aa80d9f766da00de83ace2b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.3MB
            • SHA256 7052082ff9e0e1e3b96da2ecbfba5272b0385faadff0eebea82260a2762dcefe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 93f8d3906bc34e12ecf4a726227e0f95e3e0767e284c9752693733e13e9a1ed6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 c6b93e00218c48f995521646d1e7689e4b4a8bd79a21c957b7f690014dc62694
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.4MB
            • SHA256 65cc4a0294460d9ae51a5bf85218569c0bf6ffe1d7c510cbc9556e093431d4cb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 8bb6ec5c6c4a126caa945afca7dbf55921901b471d279d8c758e05796f75e275
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 1844281813c87751cb194a32ca71e0d425218d0f04198a5b2391888737a6a2dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.5MB
            • SHA256 ea581948f9943c8c718f7a2512bd86ce0211045f7e0788801ce86449abe56cdf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.2MB
            • SHA256 20551e961d208573150752997251ee37d5a079540e1645f35a3e6731326c7a6a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/792-187-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/792-396-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/1224-6-0x0000000001FB0000-0x0000000002010000-memory.dmp
            Download

            memory/1224-0-0x0000000001FB0000-0x0000000002010000-memory.dmp
            Download

            memory/1224-10-0x0000000140000000-0x00000001409DA000-memory.dmp
            Download

            memory/1224-88-0x0000000140000000-0x00000001409DA000-memory.dmp
            Download

            memory/1308-397-0x0000000140000000-0x0000000140205000-memory.dmp
            Download

            memory/1308-190-0x0000000140000000-0x0000000140205000-memory.dmp
            Download

            memory/1636-398-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1636-195-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1636-204-0x0000000001780000-0x0000000001790000-memory.dmp
            Download

            memory/1636-399-0x000000000D2E0000-0x000000000D2E8000-memory.dmp
            Download

            memory/1636-220-0x0000000001A30000-0x0000000001A40000-memory.dmp
            Download

            memory/1636-236-0x0000000009E70000-0x0000000009E78000-memory.dmp
            Download

            memory/1656-124-0x0000000000660000-0x00000000006C7000-memory.dmp
            Download

            memory/1656-186-0x0000000000400000-0x00000000005D6000-memory.dmp
            Download

            memory/1656-132-0x0000000000400000-0x00000000005D6000-memory.dmp
            Download

            memory/1656-129-0x0000000000660000-0x00000000006C7000-memory.dmp
            Download

            memory/1692-170-0x0000000140000000-0x0000000140221000-memory.dmp
            Download

            memory/1692-393-0x0000000140000000-0x0000000140221000-memory.dmp
            Download

            memory/2948-89-0x0000000140000000-0x0000000140214000-memory.dmp
            Download

            memory/2948-78-0x00000000015E0000-0x0000000001640000-memory.dmp
            Download

            memory/2948-90-0x00000000015E0000-0x0000000001640000-memory.dmp
            Download

            memory/2948-84-0x00000000015E0000-0x0000000001640000-memory.dmp
            Download

            memory/3496-56-0x0000000000540000-0x00000000005A0000-memory.dmp
            Download

            memory/3496-64-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/3496-62-0x0000000000540000-0x00000000005A0000-memory.dmp
            Download

            memory/3496-153-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/3524-104-0x00000000007B0000-0x0000000000810000-memory.dmp
            Download

            memory/3524-98-0x00000000007B0000-0x0000000000810000-memory.dmp
            Download

            memory/3524-108-0x0000000140000000-0x000000014020E000-memory.dmp
            Download

            memory/4008-154-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4008-145-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/4008-355-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4008-151-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/4296-182-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4296-395-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4324-46-0x0000000000580000-0x00000000005E0000-memory.dmp
            Download

            memory/4324-40-0x0000000000580000-0x00000000005E0000-memory.dmp
            Download

            memory/4324-49-0x0000000140000000-0x00000001401E8000-memory.dmp
            Download

            memory/4416-319-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4416-138-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4416-194-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4492-189-0x0000000140000000-0x00000001401D4000-memory.dmp
            Download

            memory/4492-135-0x0000000140000000-0x00000001401D4000-memory.dmp
            Download

            memory/4500-320-0x0000000140000000-0x00000001401D5000-memory.dmp
            Download

            memory/4500-142-0x0000000140000000-0x00000001401D5000-memory.dmp
            Download

            memory/4536-174-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4536-176-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4880-107-0x0000000140000000-0x00000001409DA000-memory.dmp
            Download

            memory/4880-17-0x0000000001FC0000-0x0000000002020000-memory.dmp
            Download

            memory/4880-11-0x0000000001FC0000-0x0000000002020000-memory.dmp
            Download

            memory/4880-25-0x0000000140000000-0x00000001409DA000-memory.dmp
            Download

            memory/5156-431-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-427-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-414-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-413-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-412-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-411-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-410-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-409-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-408-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-407-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-406-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-419-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-420-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-421-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-423-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-424-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-422-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-425-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-404-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-428-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-429-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-430-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-434-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-433-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-432-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-416-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-426-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-435-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-415-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-405-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-436-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-418-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-417-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5156-403-0x000001AC4CF90000-0x000001AC4CFA0000-memory.dmp
            Download

            memory/5260-28-0x0000000140000000-0x00000001401E9000-memory.dmp
            Download

            memory/5364-35-0x0000000001F80000-0x0000000001FE0000-memory.dmp
            Download

            memory/5364-48-0x0000000140000000-0x00000001409DA000-memory.dmp
            Download

            memory/5364-131-0x0000000140000000-0x00000001409DA000-memory.dmp
            Download

            memory/5364-37-0x0000000001F80000-0x0000000001FE0000-memory.dmp
            Download

            memory/5364-29-0x0000000001F80000-0x0000000001FE0000-memory.dmp
            Download

            memory/5384-53-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/5384-92-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/5404-158-0x00000000007F0000-0x0000000000850000-memory.dmp
            Download

            memory/5404-164-0x00000000007F0000-0x0000000000850000-memory.dmp
            Download

            memory/5404-377-0x0000000140000000-0x0000000140241000-memory.dmp
            Download

            memory/5404-167-0x0000000140000000-0x0000000140241000-memory.dmp
            Download

            memory/5600-73-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/5600-67-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/5600-76-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/5600-166-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/5836-119-0x0000000140000000-0x00000001401EA000-memory.dmp
            Download

            memory/5836-110-0x0000000000B70000-0x0000000000BD0000-memory.dmp
            Download

            memory/5836-116-0x0000000000B70000-0x0000000000BD0000-memory.dmp
            Download

            memory/5836-181-0x0000000140000000-0x00000001401EA000-memory.dmp
            Download

            memory/5924-394-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/5924-178-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/6072-173-0x0000000140000000-0x00000001401F8000-memory.dmp
            Download

            memory/6072-94-0x0000000140000000-0x00000001401F8000-memory.dmp
            Download