Windows Analysis Report
quTbWcnSay.exe

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Code function: 2_2_00406128	2_2_00406128
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Code function: 2_2_004046F9	2_2_004046F9
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Code function: 2_2_004068FF	2_2_004068FF
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Code function: 11_2_00405750	11_2_00405750
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Code function: 11_2_0041304B	11_2_0041304B
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Code function: 11_2_0040AD40	11_2_0040AD40
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Code function: 11_2_00412910	11_2_00412910
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Code function: 11_2_004132E3	11_2_004132E3
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Code function: 11_2_00412F71	11_2_00412F71
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DB0EE0	12_2_00DB0EE0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DDB18D	12_2_00DDB18D
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DDF1B4	12_2_00DDF1B4
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DDF782	12_2_00DDF782
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E2206C	12_2_00E2206C
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DD0190	12_2_00DD0190
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D6A170	12_2_00D6A170
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DD22C0	12_2_00DD22C0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D70290	12_2_00D70290
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D98480	12_2_00D98480
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DB4410	12_2_00DB4410
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EA243A	12_2_00EA243A
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D707C0	12_2_00D707C0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D80746	12_2_00D80746
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DB4730	12_2_00DB4730
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DB48E0	12_2_00DB48E0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EBC89C	12_2_00EBC89C
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EA0864	12_2_00EA0864
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DEA9F0	12_2_00DEA9F0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EBC954	12_2_00EBC954
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DB8AC0	12_2_00DB8AC0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EA2ACB	12_2_00EA2ACB
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D76C76	12_2_00D76C76
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E56D0E	12_2_00E56D0E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DB8EC0	12_2_00DB8EC0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EC4EB6	12_2_00EC4EB6
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E2D014	12_2_00E2D014
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E211A6	12_2_00E211A6
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D89180	12_2_00D89180
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EA1189	12_2_00EA1189
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EA3130	12_2_00EA3130
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DF13D4	12_2_00DF13D4
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D6F3EC	12_2_00D6F3EC
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DB7370	12_2_00DB7370
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D794D2	12_2_00D794D2
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DC54D0	12_2_00DC54D0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DE94F0	12_2_00DE94F0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E29494	12_2_00E29494
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E535F4	12_2_00E535F4
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DAD7D0	12_2_00DAD7D0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DCF8B0	12_2_00DCF8B0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E2D98E	12_2_00E2D98E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EA3A9D	12_2_00EA3A9D
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D6DA78	12_2_00D6DA78
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E9FBCF	12_2_00E9FBCF
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EC1B41	12_2_00EC1B41
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DCFB00	12_2_00DCFB00
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D7BC70	12_2_00D7BC70
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DF3DE0	12_2_00DF3DE0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DC5D10	12_2_00DC5D10
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DCFD10	12_2_00DCFD10
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DFFE30	12_2_00DFFE30
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D6FFC0	12_2_00D6FFC0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E9BFB0	12_2_00E9BFB0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D7DF40	12_2_00D7DF40

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Opera_GX_assistant_73.0.3856.382_Setup[1].exe E950F17F4181009EEAFA9F5306E8A9DFD26D88CA63B1838F44FF0EFC738E7D1F
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\installer[1].exe DA1B144B5F908CB7E811489DFE660E06AA6DF9C9158C6972EC9C79C48AFACB7E

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Code function: String function: 004026DC appears 38 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: String function: 00E9A840 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: String function: 00DABE50 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: String function: 00D63696 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: String function: 00EB42D0 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: String function: 00DAC9E0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: String function: 00DAB9C0 appears 68 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: String function: 00D61741 appears 201 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: String function: 00DABEC0 appears 133 times

Source: quTbWcnSay.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-0PI61.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: installer.exe.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (console) x86-64, for MS Windows

Source: installer_helper_64.exe.7.dr	Static PE information: Number of sections : 11 > 10
Source: dxcompiler.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: opera_gx_splash.exe.7.dr	Static PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: launcher.exe.7.dr	Static PE information: Number of sections : 13 > 10
Source: opera_crashreporter.exe.7.dr	Static PE information: Number of sections : 13 > 10
Source: libEGL.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: installer.exe.7.dr	Static PE information: Number of sections : 11 > 10
Source: mojo_core.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: opera_elf.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: opera_autoupdate.exe.7.dr	Static PE information: Number of sections : 14 > 10
Source: opera.exe.7.dr	Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: win10_share_handler.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: opera_browser.dll.7.dr	Static PE information: Number of sections : 15 > 10
Source: notification_helper.exe.7.dr	Static PE information: Number of sections : 12 > 10

Source: quTbWcnSay.exe, 00000000.00000003.1621844323.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs quTbWcnSay.exe
Source: quTbWcnSay.exe, 00000000.00000003.1621445927.00000000027B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs quTbWcnSay.exe
Source: quTbWcnSay.exe, 00000000.00000000.1620044581.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs quTbWcnSay.exe
Source: quTbWcnSay.exe, 00000000.00000002.2892680375.0000000002418000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs quTbWcnSay.exe

Source: C:\Users\user\Desktop\quTbWcnSay.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\quTbWcnSay.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\quTbWcnSay.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\quTbWcnSay.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\quTbWcnSay.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: uiamanager.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: actxprxy.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: twinapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: taskschd.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: firewallapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: fwbase.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: twext.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: acppage.dll
Source: C:\Windows\explorer.exe	Section loaded: sfc.dll
Source: C:\Windows\explorer.exe	Section loaded: msi.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: drprov.dll
Source: C:\Windows\explorer.exe	Section loaded: ntlanman.dll
Source: C:\Windows\explorer.exe	Section loaded: davclnt.dll
Source: C:\Windows\explorer.exe	Section loaded: davhlpr.dll
Source: C:\Windows\explorer.exe	Section loaded: playtodevice.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorapi.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe	Section loaded: cryptbase.dll

Source: quTbWcnSay.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal42.spyw.winEXE@35/254@0/15

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe

Code function: 11_2_00408DD2 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

11_2_00408DD2

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe

Code function: 12_2_00D8051B GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,

12_2_00D8051B

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe

Code function: 2_2_004041FC GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

2_2_004041FC

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe

Code function: 2_2_00402020 CoCreateInstance,MultiByteToWideChar,

2_2_00402020

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe

Code function: 11_2_00401DF5 GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

11_2_00401DF5

Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Mutant created: \Sessions\1\BaseNamedObjects\opera_splash_lock_0e78e69c624cbcf87c7f299659eb65c0
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Opera/Installer/C:/Users/user/AppData/Local/Programs/Opera GX

Source: C:\Users\user\Desktop\quTbWcnSay.exe

File created: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp

Source: C:\Users\user\Desktop\quTbWcnSay.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\quTbWcnSay.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\quTbWcnSay.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: quTbWcnSay.exe	ReversingLabs: Detection: 26%
Source: quTbWcnSay.exe	Virustotal: Detection: 23%

Source: set_0.exe	String found in binary or memory: Ini-install lamang ang mga setting ng shortcut at rehistro para sa kaslukuyang user. Hindi kinakailangan ng mga prebilehiyo ng sys
Source: set_0.exe	String found in binary or memory: Ini-install ang lahat sa iisang folder, lokal man o sa panlabas na media, tulad ng USB drive, nang hindi ginagalaw ang rehistro o
Source: set_0.exe	String found in binary or memory: Nabigong i-download ang Opera.(Hindi nagawa ang pag-extract ng package.;Nagkaroon ng error habang sinusubukang i-install ang Opera
Source: set_0.exe	String found in binary or memory: May isa pang pagkakataon ng installer ng Opera ang gumagawa na sa folder na ito. Alinman ay maaari mong kanselahin ang pag-install
Source: set_0.exe	String found in binary or memory: Hindi malikha ang folder na $1.JWalang sapat na mga privilege para sa pag-install sa ninanais na lokasyon.@Nabigong makakuha ng ad
Source: set_0.exe	String found in binary or memory: Hindi ma-install ang Opera.exe. Naka-lock ang ilang file sa folder ng pag-install. I-restart ang computer o i-unblock ang mga file
Source: set_0.exe	String found in binary or memory: XHindi na-reinstall ang Opera.exe. Siguraduhing hindi gumagana ang Opera at subukan ulit.QHindi ma-update ang Opera. Siguraduhing
Source: set_0.exe	String found in binary or memory: Installatie&pad#Installeer voor alle gebruikers in:%Installeer voor huidige gebruiker in: Standalone-installatie (USB) in:
Source: set_0.exe	String found in binary or memory: ran-launcher
Source: set_0.exe	String found in binary or memory: pangunahin mong dahilan sa pag-uninstall ng Opera?ZWala namang problema. Magre-reinstall o mag-a-update lang ako sa isang mas bag
Source: set_0.exe	String found in binary or memory: Een andere instantie van het Opera-installatieprogramma werkt al in deze map. Je kan de installatie annuleren, of over een paar mi
Source: set_0.exe	String found in binary or memory: Opera-installeringsprogrammInstallationsfilen ser ud til at vre beskadiget. G til <a href="tos">www.opera.com</a>, og hent Opera
Source: set_0.exe	String found in binary or memory: &Re-install
Source: set_0.exe	String found in binary or memory: Global\Opera/Installer/
Source: set_0.exe	String found in binary or memory: s Breakpad server URL, only if uploads are enabled for the database --help display this help and exit --version output version information and exit
Source: set_0.exe	String found in binary or memory: s Breakpad server URL, only if uploads are enabled for the database --help display this help and exit --version output version information and exit
Source: set_0.exe	String found in binary or memory: enable-installer-stats
Source: set_0.exe	String found in binary or memory: run-at-startup
Source: set_0.exe	String found in binary or memory: show-eula-window-on-start
Source: set_0.exe	String found in binary or memory: master-copy-installation
Source: set_0.exe	String found in binary or memory: launchopera-on-os-start
Source: set_0.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: set_0.exe	String found in binary or memory: override-additional-config-url
Source: set_0.exe	String found in binary or memory: post-elevated-install-tasks
Source: set_0.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: set_0.exe	String found in binary or memory: all-installer-experiments
Source: set_0.exe	String found in binary or memory: partition_alloc/address_space
Source: set_0.exe	String found in binary or memory: gendQ$1 kann nicht zustzlich zu einer bestehenden $2-Installation installiert werden. Laufwerk $1 ($2 MB erforderlich)-Wird herun
Source: set_0.exe	String found in binary or memory: opera-startpage-special
Source: set_0.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: set_0.exe	String found in binary or memory: run-at-startup-default
Source: set_0.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: set_0.exe	String found in binary or memory: video-on-start-page
Source: set_0.exe	String found in binary or memory: yat-emoji-addresses
Source: set_0.exe	String found in binary or memory: installer-bypass-launcher
Source: set_0.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: set_0.exe	String found in binary or memory: Path sa &pag-install#I-install para sa lahat ng user sa:'I-install para sa kasalukuyang user sa:&Stand-alone na pag-i-install (USB
Source: set_0.exe	String found in binary or memory: &Baguhin!Di-balido ang path sa pag-install$Gawing &default na browser ang Opera>&Mag-import ng mga bookmark at data mula sa defaul
Source: set_0.exe	String found in binary or memory: +Ini-install para sa kasalukuyang user ($1)
Source: set_0.exe	String found in binary or memory: Ini-install
Source: set_0.exe	String found in binary or memory: Kasalukuyang user Stand-alone na pag-install (USB)'&Tanggalin ang user data ng aking Opera5&Alisin ang kasamang App ng mga Animate
Source: set_0.exe	String found in binary or memory: y mawawala. Gusto mo bang ipagpatuloy?bHindi natapos sa Opera ang pag-install. Sigurado ka bang hindi mo na ipagpatuloy ang instal
Source: set_0.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: set_0.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: set_0.exe	String found in binary or memory: Ini-install ang Opera na may mga settin ng shortcut at rehistro para sa lahat ng user na nasa system. Kinakailangan ng mga prebile
Source: set_0.exe	String found in binary or memory: all-installer-experiments
Source: set_0.exe	String found in binary or memory: ran-launcher
Source: set_0.exe	String found in binary or memory: opera-startpage-special
Source: set_0.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: set_0.exe	String found in binary or memory: run-at-startup-default
Source: set_0.exe	String found in binary or memory: run-at-startup
Source: set_0.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: set_0.exe	String found in binary or memory: video-on-start-page
Source: set_0.exe	String found in binary or memory: Global\Opera/Installer/
Source: set_0.exe	String found in binary or memory: yat-emoji-addresses
Source: set_0.exe	String found in binary or memory: installer-bypass-launcher
Source: set_0.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: set_0.exe	String found in binary or memory: enable-installer-stats
Source: set_0.exe	String found in binary or memory: show-eula-window-on-start
Source: set_0.exe	String found in binary or memory: master-copy-installation
Source: set_0.exe	String found in binary or memory: launchopera-on-os-start
Source: set_0.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: set_0.exe	String found in binary or memory: override-additional-config-url
Source: set_0.exe	String found in binary or memory: post-elevated-install-tasks
Source: set_0.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: set_0.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: set_0.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: set_0.exe	String found in binary or memory: all-installer-experiments
Source: set_0.exe	String found in binary or memory: ran-launcher
Source: set_0.exe	String found in binary or memory: opera-startpage-special
Source: set_0.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: set_0.exe	String found in binary or memory: run-at-startup
Source: set_0.exe	String found in binary or memory: run-at-startup-default
Source: set_0.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: set_0.exe	String found in binary or memory: video-on-start-page
Source: set_0.exe	String found in binary or memory: Global\Opera/Installer/
Source: set_0.exe	String found in binary or memory: yat-emoji-addresses
Source: set_0.exe	String found in binary or memory: installer-bypass-launcher
Source: set_0.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: set_0.exe	String found in binary or memory: enable-installer-stats
Source: set_0.exe	String found in binary or memory: show-eula-window-on-start
Source: set_0.exe	String found in binary or memory: launchopera-on-os-start
Source: set_0.exe	String found in binary or memory: master-copy-installation
Source: set_0.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: set_0.exe	String found in binary or memory: override-additional-config-url
Source: set_0.exe	String found in binary or memory: post-elevated-install-tasks
Source: set_0.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: set_0.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: set_0.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: set_0.exe	String found in binary or memory: all-installer-experiments
Source: set_0.exe	String found in binary or memory: ran-launcher
Source: set_0.exe	String found in binary or memory: opera-startpage-special
Source: set_0.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: set_0.exe	String found in binary or memory: run-at-startup-default
Source: set_0.exe	String found in binary or memory: run-at-startup
Source: set_0.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: set_0.exe	String found in binary or memory: video-on-start-page
Source: set_0.exe	String found in binary or memory: Global\Opera/Installer/
Source: set_0.exe	String found in binary or memory: yat-emoji-addresses
Source: set_0.exe	String found in binary or memory: installer-bypass-launcher
Source: set_0.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: set_0.exe	String found in binary or memory: enable-installer-stats
Source: set_0.exe	String found in binary or memory: show-eula-window-on-start
Source: set_0.exe	String found in binary or memory: master-copy-installation
Source: set_0.exe	String found in binary or memory: launchopera-on-os-start
Source: set_0.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: set_0.exe	String found in binary or memory: override-additional-config-url
Source: set_0.exe	String found in binary or memory: post-elevated-install-tasks
Source: set_0.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: set_0.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: set_0.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: set_0.exe	String found in binary or memory: all-installer-experiments
Source: set_0.exe	String found in binary or memory: ran-launcher
Source: set_0.exe	String found in binary or memory: opera-startpage-special
Source: set_0.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: set_0.exe	String found in binary or memory: run-at-startup-default
Source: set_0.exe	String found in binary or memory: run-at-startup
Source: set_0.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: set_0.exe	String found in binary or memory: video-on-start-page
Source: set_0.exe	String found in binary or memory: Global\Opera/Installer/
Source: set_0.exe	String found in binary or memory: yat-emoji-addresses
Source: set_0.exe	String found in binary or memory: installer-bypass-launcher
Source: set_0.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: set_0.exe	String found in binary or memory: enable-installer-stats
Source: set_0.exe	String found in binary or memory: show-eula-window-on-start
Source: set_0.exe	String found in binary or memory: master-copy-installation
Source: set_0.exe	String found in binary or memory: launchopera-on-os-start
Source: set_0.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: set_0.exe	String found in binary or memory: override-additional-config-url
Source: set_0.exe	String found in binary or memory: post-elevated-install-tasks
Source: set_0.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: set_0.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: set_0.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/installer/transactions/move_file_operation.cc
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/installer/transactions/unpack_archive_operation.cc
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/installer/service/task_scheduler_v2.cc
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer_main.cc
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/installer/common/association_utils.cc
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer.cc
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/installer/transactions/change_reg_value_operation.cc
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/installer/transactions/copy_file_operation.cc
Source: assistant_installer.exe	String found in binary or memory: ../../base/process/launch_win.cc
Source: assistant_installer.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: assistant_installer.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/installer/transactions/create_folder_operation.cc
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer_steps.cc
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/installer/transactions/create_reg_key_operation.cc
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/installer/status/json_installation_status_writer.cc
Source: assistant_installer.exe	String found in binary or memory: post-elevated-install-tasks
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/installer/transactions/delete_file_operation.cc
Source: assistant_installer.exe	String found in binary or memory: ../../opera/desktop/windows/installer/transactions/delete_reg_key_operation.cc
Source: assistant_installer.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: assistant_installer.exe	String found in binary or memory: Try '%ls --help' for more information.

Source: C:\Users\user\Desktop\quTbWcnSay.exe

File read: C:\Users\user\Desktop\quTbWcnSay.exe

Source: unknown	Process created: C:\Users\user\Desktop\quTbWcnSay.exe C:\Users\user\Desktop\quTbWcnSay.exe
Source: C:\Users\user\Desktop\quTbWcnSay.exe	Process created: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp "C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp" /SL5="$20458,832512,832512,C:\Users\user\Desktop\quTbWcnSay.exe"
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe "C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe" --silent --allusers=0
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x398,0x39c,0x3a0,0x374,0x3a4,0x6c5ae5e8,0x6c5ae5f4,0x6c5ae600
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe" --version
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe "C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7664 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240206153514" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=MzkxOTZlNTA1MDhiZTNiZDVjZDA3YTZhNDU1ZWNiYmNiZDVjZmNmNDM1NWIyYzk2ZWVlZmZlYjNlMTFiNDI3OTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0xP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1JPX1BCM19ERF8zNjYxJnV0bV9pZD04ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSZ1dG1fY29udGVudD0zNjYxXzI1NzciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MDcyMzAxMTIuNjE5OCIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fUk9fUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yNTc3IiwiaWQiOiI4ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImU3MTYwMTNjLWIyODgtNGRiMC04OTgwLTJkNjBlMzZjNjlmZCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0806000000000000
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x388,0x38c,0x390,0x364,0x394,0x6ba1e5e8,0x6ba1e5f4,0x6ba1e600
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe" --version
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x334,0x338,0x33c,0x310,0x340,0xf14f48,0xf14f58,0xf14f64
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe" --backend --initial-pid=7664 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=MzkxOTZlNTA1MDhiZTNiZDVjZDA3YTZhNDU1ZWNiYmNiZDVjZmNmNDM1NWIyYzk2ZWVlZmZlYjNlMTFiNDI3OTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0xP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1JPX1BCM19ERF8zNjYxJnV0bV9pZD04ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSZ1dG1fY29udGVudD0zNjYxXzI1NzciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MDcyMzAxMTIuNjE5OCIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fUk9fUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yNTc3IiwiaWQiOiI4ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImU3MTYwMTNjLWIyODgtNGRiMC04OTgwLTJkNjBlMzZjNjlmZCJ9 --silent --desktopshortcut=1 --install-subfolder=106.0.4998.74
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2a4,0x2d4,0x7ffdfb94a5b0,0x7ffdfb94a5bc,0x7ffdfb94a5c8
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe "C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe" --scheduledautoupdate 0
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe "C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe" --start-maximized
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\BDDCE5348F09\installer.exe "C:\Users\user\AppData\Local\Temp\.opera\BDDCE5348F09\installer.exe" --version
Source: C:\Users\user\Desktop\quTbWcnSay.exe	Process created: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp "C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp" /SL5="$20458,832512,832512,C:\Users\user\Desktop\quTbWcnSay.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe "C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe" --silent --allusers=0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x398,0x39c,0x3a0,0x374,0x3a4,0x6c5ae5e8,0x6c5ae5f4,0x6c5ae600	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe" --version	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe "C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7664 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240206153514" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=MzkxOTZlNTA1MDhiZTNiZDVjZDA3YTZhNDU1ZWNiYmNiZDVjZmNmNDM1NWIyYzk2ZWVlZmZlYjNlMTFiNDI3OTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0xP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1JPX1BCM19ERF8zNjYxJnV0bV9pZD04ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSZ1dG1fY29udGVudD0zNjYxXzI1NzciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MDcyMzAxMTIuNjE5OCIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fUk9fUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yNTc3IiwiaWQiOiI4ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImU3MTYwMTNjLWIyODgtNGRiMC04OTgwLTJkNjBlMzZjNjlmZCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0806000000000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe" --version	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x388,0x38c,0x390,0x364,0x394,0x6ba1e5e8,0x6ba1e5f4,0x6ba1e600	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe" --backend --initial-pid=7664 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=MzkxOTZlNTA1MDhiZTNiZDVjZDA3YTZhNDU1ZWNiYmNiZDVjZmNmNDM1NWIyYzk2ZWVlZmZlYjNlMTFiNDI3OTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0xP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1JPX1BCM19ERF8zNjYxJnV0bV9pZD04ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSZ1dG1fY29udGVudD0zNjYxXzI1NzciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MDcyMzAxMTIuNjE5OCIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fUk9fUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yNTc3IiwiaWQiOiI4ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImU3MTYwMTNjLWIyODgtNGRiMC04OTgwLTJkNjBlMzZjNjlmZCJ9 --silent --desktopshortcut=1 --install-subfolder=106.0.4998.74	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x334,0x338,0x33c,0x310,0x340,0xf14f48,0xf14f58,0xf14f64
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2a4,0x2d4,0x7ffdfb94a5b0,0x7ffdfb94a5bc,0x7ffdfb94a5c8
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe "C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe" --start-maximized
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\BDDCE5348F09\installer.exe "C:\Users\user\AppData\Local\Temp\.opera\BDDCE5348F09\installer.exe" --version
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp

Window found: window name: TMainForm

Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe

Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Opera GX 106.0.4998.74

Source: quTbWcnSay.exe

Static file information: File size 1672111 > 1048576

Source: quTbWcnSay.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: assistant_installer.exe.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000B.00000003.2080708697.000000000347D000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000C.00000002.2085440415.0000000000EF5000.00000002.00000001.01000000.00000014.sdmp, assistant_installer.exe, 0000000C.00000000.2082501798.0000000000EF5000.00000002.00000001.01000000.00000014.sdmp, assistant_installer.exe, 0000000D.00000000.2083663959.0000000000EF5000.00000002.00000001.01000000.00000014.sdmp, assistant_installer.exe, 0000000D.00000002.2086375048.0000000000EF5000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: set_0.exe, set_0.exe, 00000008.00000002.2707253029.0000000000651000.00000040.00000001.01000000.0000000C.sdmp, installer.exe, 0000000E.00000000.2434562541.00007FF6FAF81000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000E.00000002.2671316945.00007FF6FAF81000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000002.2703850860.00007FF6FAF81000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000000.2439225002.00007FF6FAF81000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000028.00000002.2608443840.00007FF7F24B1000.00000002.00000001.01000000.0000001B.sdmp, installer.exe, 00000028.00000000.2548735956.00007FF7F24B1000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: browser_assistant.exe.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000B.00000003.2080708697.0000000003751000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: jyKJvjQuuEeSXFxWJ.exe, 00000013.00000000.2483862376.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000014.00000000.2485670854.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000015.00000002.2888716675.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000016.00000002.2886810654.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000017.00000000.2489723023.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000019.00000002.2889213969.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 0000001A.00000002.2888060387.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 0000001B.00000002.2887166190.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 0000001C.00000000.2508513507.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 0000001D.00000000.2514339988.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 0000001E.00000000.2521152904.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 0000001F.00000000.2524673543.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000020.00000000.2526989449.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000021.00000000.2529094326.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000022.00000002.2887687228.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000025.00000000.2541216607.00000000001CE000.00000002.00000001.01000000.00000019.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000027.00000000.2544650787.00000000001CE000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: mojo_core.dll.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000B.00000003.2080708697.0000000003751000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000B.00000003.2081307134.0000000003D70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ller_lib.dll.pdb source: set_0.exe, 00000004.00000000.1839051703.000000000088C000.00000080.00000001.01000000.0000000C.sdmp, set_0.exe, 00000005.00000000.1841922680.000000000088C000.00000080.00000001.01000000.0000000C.sdmp, set_0.exe, 00000006.00000000.1846415856.000000000078C000.00000080.00000001.01000000.0000000F.sdmp, set_0.exe, 00000007.00000000.1851965103.000000000088C000.00000080.00000001.01000000.0000000C.sdmp, set_0.exe, 00000008.00000000.1855739405.000000000088C000.00000080.00000001.01000000.0000000C.sdmp
Source:	Binary string: .exe.pdb source: set_0.exe, 00000004.00000000.1839051703.000000000088C000.00000080.00000001.01000000.0000000C.sdmp, set_0.exe, 00000005.00000000.1841922680.000000000088C000.00000080.00000001.01000000.0000000C.sdmp, set_0.exe, 00000006.00000000.1846415856.000000000078C000.00000080.00000001.01000000.0000000F.sdmp, set_0.exe, 00000007.00000000.1851965103.000000000088C000.00000080.00000001.01000000.0000000C.sdmp, set_0.exe, 00000008.00000000.1855739405.000000000088C000.00000080.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\launcher.exe.pdb source: installer.exe, 0000000E.00000003.2446149285.000002C973191000.00000004.00000020.00020000.00000000.sdmp, launcher.exe, 00000023.00000002.2850858789.00007FF64AD33000.00000002.00000001.01000000.0000001A.sdmp, launcher.exe, 00000023.00000000.2537172061.00007FF64AD33000.00000002.00000001.01000000.0000001A.sdmp, launcher.exe, 00000026.00000002.2661332331.00007FF64AD33000.00000002.00000001.01000000.0000001A.sdmp, launcher.exe, 00000026.00000000.2544576973.00007FF64AD33000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: browser_assistant.exe.pdbe source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000B.00000003.2080708697.0000000003751000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: set_0.exe, set_0.exe, 00000004.00000002.2702734129.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000005.00000002.2711059391.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000006.00000002.1849878966.00000000005CB000.00000040.00000001.01000000.0000000F.sdmp, set_0.exe, 00000007.00000002.2677961973.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000008.00000002.2707253029.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, installer.exe, 0000000E.00000002.2671425164.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000002.2704055669.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: assistant_installer.exe.pdb@ source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000B.00000003.2080708697.000000000347D000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000C.00000002.2085440415.0000000000EF5000.00000002.00000001.01000000.00000014.sdmp, assistant_installer.exe, 0000000C.00000000.2082501798.0000000000EF5000.00000002.00000001.01000000.00000014.sdmp, assistant_installer.exe, 0000000D.00000000.2083663959.0000000000EF5000.00000002.00000001.01000000.00000014.sdmp, assistant_installer.exe, 0000000D.00000002.2086375048.0000000000EF5000.00000002.00000001.01000000.00000014.sdmp

Source: dxil.dll.7.dr

Static PE information: 0x7DBE8527 [Fri Nov 7 02:32:07 2036 UTC]

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe

Code function: 2_2_00405D2E GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00405D2E

Source: set_0.exe.2.dr	Static PE information: real checksum: 0x338020 should be: 0x33c6b9
Source: set_0.exe.4.dr	Static PE information: real checksum: 0x338020 should be: 0x33c6b9
Source: OperaGXSetup[1].exe.2.dr	Static PE information: real checksum: 0x338020 should be: 0x33c6b9
Source: inetc.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0x1255d
Source: quTbWcnSay.exe	Static PE information: real checksum: 0x0 should be: 0x198525
Source: is-T5V69.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x1dd9c
Source: is-0PI61.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x31d65f
Source: is-S11RF.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x1dd9c
Source: quTbWcnSay.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0x312b03

Source: quTbWcnSay.exe	Static PE information: section name: .didata
Source: quTbWcnSay.tmp.0.dr	Static PE information: section name: .didata
Source: is-0PI61.tmp.1.dr	Static PE information: section name: .didata
Source: Icreplo_98220[1].exe.2.dr	Static PE information: section name: .didata
Source: set_1.exe.2.dr	Static PE information: section name: .didata
Source: Opera_installer_2402061435131327664.dll.4.dr	Static PE information: section name: .00cfg
Source: Opera_installer_2402061435131327664.dll.4.dr	Static PE information: section name: .rodata
Source: Opera_installer_2402061435131327664.dll.4.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2402061435131327664.dll.4.dr	Static PE information: section name: malloc_h
Source: Opera_installer_2402061435134067684.dll.5.dr	Static PE information: section name: .00cfg
Source: Opera_installer_2402061435134067684.dll.5.dr	Static PE information: section name: .rodata
Source: Opera_installer_2402061435134067684.dll.5.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2402061435134067684.dll.5.dr	Static PE information: section name: malloc_h
Source: Opera_installer_2402061435138567768.dll.6.dr	Static PE information: section name: .00cfg
Source: Opera_installer_2402061435138567768.dll.6.dr	Static PE information: section name: .rodata
Source: Opera_installer_2402061435138567768.dll.6.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2402061435138567768.dll.6.dr	Static PE information: section name: malloc_h
Source: mojo_core.dll.7.dr	Static PE information: section name: .00cfg
Source: mojo_core.dll.7.dr	Static PE information: section name: .gxfg
Source: mojo_core.dll.7.dr	Static PE information: section name: .retplne
Source: mojo_core.dll.7.dr	Static PE information: section name: _RDATA
Source: Opera_installer_2402061435144237796.dll.7.dr	Static PE information: section name: .00cfg
Source: Opera_installer_2402061435144237796.dll.7.dr	Static PE information: section name: .rodata
Source: Opera_installer_2402061435144237796.dll.7.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2402061435144237796.dll.7.dr	Static PE information: section name: malloc_h
Source: notification_helper.exe.7.dr	Static PE information: section name: .00cfg
Source: notification_helper.exe.7.dr	Static PE information: section name: .gxfg
Source: notification_helper.exe.7.dr	Static PE information: section name: .retplne
Source: notification_helper.exe.7.dr	Static PE information: section name: CPADinfo
Source: notification_helper.exe.7.dr	Static PE information: section name: _RDATA
Source: opera.exe.7.dr	Static PE information: section name: .00cfg
Source: opera.exe.7.dr	Static PE information: section name: .gxfg
Source: opera.exe.7.dr	Static PE information: section name: .retplne
Source: opera.exe.7.dr	Static PE information: section name: _RDATA
Source: opera_autoupdate.exe.7.dr	Static PE information: section name: .00cfg
Source: opera_autoupdate.exe.7.dr	Static PE information: section name: .gxfg
Source: opera_autoupdate.exe.7.dr	Static PE information: section name: .retplne
Source: opera_autoupdate.exe.7.dr	Static PE information: section name: CPADinfo
Source: opera_autoupdate.exe.7.dr	Static PE information: section name: LZMADEC
Source: opera_autoupdate.exe.7.dr	Static PE information: section name: _RDATA
Source: opera_autoupdate.exe.7.dr	Static PE information: section name: malloc_h
Source: opera_browser.dll.7.dr	Static PE information: section name: .00cfg
Source: opera_browser.dll.7.dr	Static PE information: section name: .gxfg
Source: opera_browser.dll.7.dr	Static PE information: section name: .retplne
Source: opera_browser.dll.7.dr	Static PE information: section name: .rodata
Source: opera_browser.dll.7.dr	Static PE information: section name: CPADinfo
Source: opera_browser.dll.7.dr	Static PE information: section name: LZMADEC
Source: opera_browser.dll.7.dr	Static PE information: section name: _RDATA
Source: opera_browser.dll.7.dr	Static PE information: section name: malloc_h
Source: opera_crashreporter.exe.7.dr	Static PE information: section name: .00cfg
Source: opera_crashreporter.exe.7.dr	Static PE information: section name: .gxfg
Source: opera_crashreporter.exe.7.dr	Static PE information: section name: .retplne
Source: opera_crashreporter.exe.7.dr	Static PE information: section name: CPADinfo
Source: opera_crashreporter.exe.7.dr	Static PE information: section name: _RDATA
Source: opera_crashreporter.exe.7.dr	Static PE information: section name: malloc_h
Source: opera_elf.dll.7.dr	Static PE information: section name: .00cfg
Source: opera_elf.dll.7.dr	Static PE information: section name: .gxfg
Source: opera_elf.dll.7.dr	Static PE information: section name: .retplne
Source: opera_elf.dll.7.dr	Static PE information: section name: _RDATA
Source: opera_gx_splash.exe.7.dr	Static PE information: section name: .00cfg
Source: opera_gx_splash.exe.7.dr	Static PE information: section name: .gxfg
Source: opera_gx_splash.exe.7.dr	Static PE information: section name: .retplne
Source: opera_gx_splash.exe.7.dr	Static PE information: section name: _RDATA
Source: CUESDK.x64_2017.dll.7.dr	Static PE information: section name: .00cfg
Source: dxcompiler.dll.7.dr	Static PE information: section name: .00cfg
Source: dxcompiler.dll.7.dr	Static PE information: section name: .gxfg
Source: dxcompiler.dll.7.dr	Static PE information: section name: .retplne
Source: dxcompiler.dll.7.dr	Static PE information: section name: _RDATA
Source: dxil.dll.7.dr	Static PE information: section name: _RDATA
Source: installer.exe.7.dr	Static PE information: section name: .00cfg
Source: installer.exe.7.dr	Static PE information: section name: .gxfg
Source: installer.exe.7.dr	Static PE information: section name: .retplne
Source: installer.exe.7.dr	Static PE information: section name: _RDATA
Source: installer_helper_64.exe.7.dr	Static PE information: section name: .00cfg
Source: installer_helper_64.exe.7.dr	Static PE information: section name: .gxfg
Source: installer_helper_64.exe.7.dr	Static PE information: section name: .retplne
Source: installer_helper_64.exe.7.dr	Static PE information: section name: _RDATA
Source: launcher.exe.7.dr	Static PE information: section name: .00cfg
Source: launcher.exe.7.dr	Static PE information: section name: .gxfg
Source: launcher.exe.7.dr	Static PE information: section name: .retplne
Source: launcher.exe.7.dr	Static PE information: section name: LZMADEC
Source: launcher.exe.7.dr	Static PE information: section name: _RDATA
Source: launcher.exe.7.dr	Static PE information: section name: malloc_h
Source: libEGL.dll.7.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.7.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.7.dr	Static PE information: section name: .retplne
Source: libEGL.dll.7.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.7.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.7.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.7.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.7.dr	Static PE information: section name: _RDATA
Source: vk_swiftshader.dll.7.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.7.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.7.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.7.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.7.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll.7.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.7.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.7.dr	Static PE information: section name: _RDATA
Source: win10_share_handler.dll.7.dr	Static PE information: section name: .00cfg
Source: win10_share_handler.dll.7.dr	Static PE information: section name: .gxfg
Source: win10_share_handler.dll.7.dr	Static PE information: section name: .retplne
Source: win10_share_handler.dll.7.dr	Static PE information: section name: _RDATA
Source: win8_importing.dll.7.dr	Static PE information: section name: .00cfg
Source: win8_importing.dll.7.dr	Static PE information: section name: .gxfg
Source: win8_importing.dll.7.dr	Static PE information: section name: .retplne
Source: win8_importing.dll.7.dr	Static PE information: section name: _RDATA
Source: Opera_installer_2402061435148407828.dll.8.dr	Static PE information: section name: .00cfg
Source: Opera_installer_2402061435148407828.dll.8.dr	Static PE information: section name: .rodata
Source: Opera_installer_2402061435148407828.dll.8.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2402061435148407828.dll.8.dr	Static PE information: section name: malloc_h
Source: assistant_installer.exe.11.dr	Static PE information: section name: .00cfg
Source: assistant_installer.exe.11.dr	Static PE information: section name: .voltbl
Source: assistant_installer.exe.11.dr	Static PE information: section name: CPADinfo

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Code function: 11_2_00412C00 push eax; ret		11_2_00412C2E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E9B10C push ecx; ret		12_2_00E9B11F

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435148407828.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\win10_share_handler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\assistant_package	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\mojo_core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435134067684.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061436127016648.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\OperaGXSetup[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_autoupdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\dxcompiler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\mojo_core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Icreplo_98220[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\notification_helper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Opera_GX_assistant_73.0.3856.382_Setup[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_crashreporter.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\win8_importing.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\launcher.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435131327664.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer_helper_64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\CUESDK.x64_2017.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	File created: C:\Windows\is-0PI61.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\opera_package	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\BDDCE5348F09\installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435144237796.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\launcher.exe.1707230173.old (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\dxil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\is-S11RF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\is-T5V69.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_gx_splash.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_GX_106.0.4998.74_Autoupdate_x64[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\browser_assistant.exe	Jump to dropped file
Source: C:\Users\user\Desktop\quTbWcnSay.exe	File created: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435138567768.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_elf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\installer[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\additional_file0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	File created: C:\Windows\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061436131277280.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_browser.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\BDDCE5348F09\installer.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061436242703168.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	File created: C:\Windows\is-0PI61.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	File created: C:\Windows\unins000.exe (copy)			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\opera_package			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\assistant_package			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20240206153513538.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20240206153515017.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	File created: C:\Users\user\AppData\Local\Temp\assistant_installer_20240206153537.log
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20240206153613326.log

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Source: C:\Users\user\Desktop\quTbWcnSay.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe

Code function: 12_2_00DCA6D0 rdtsc

12_2_00DCA6D0

Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\opera_package	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435148407828.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Dropped PE file which has not been started: C:\Windows\is-0PI61.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435144237796.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\win10_share_handler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\assistant_package	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\mojo_core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435134067684.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061436127016648.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\dxil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_autoupdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_gx_splash.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_GX_106.0.4998.74_Autoupdate_x64[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\browser_assistant.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_elf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435138567768.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\installer[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\dxcompiler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\mojo_core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Icreplo_98220[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\notification_helper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_crashreporter.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\win8_importing.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Dropped PE file which has not been started: C:\Windows\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435131327664.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061436131277280.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_browser.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer_helper_64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\CUESDK.x64_2017.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\BDDCE5348F09\installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2402061436242703168.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_12-71552

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe

API coverage: 6.5 %

Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Code function: 2_2_00405D07 FindFirstFileA,FindClose,	2_2_00405D07
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Code function: 2_2_00405331 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_00405331
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	Code function: 2_2_0040263E FindFirstFileA,	2_2_0040263E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Code function: 11_2_004033B3 GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	11_2_004033B3
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Code function: 11_2_00402F12 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	11_2_00402F12
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DC9120 PathMatchSpecW,FindNextFileW,FindClose,FindFirstFileExW,GetLastError,GetFileAttributesW,	12_2_00DC9120
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E59AE2 FindFirstFileExW,	12_2_00E59AE2

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: explorer.exe, 00000012.00000002.2923858273.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000012.00000000.2467564612.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000012.00000000.2467564612.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000012.00000002.2923858273.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000012.00000002.2891409803.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: setup.exe, 00000002.00000002.2895127853.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW hb%SystemRoot%\system32\mswsock.dll(
Source: explorer.exe, 00000012.00000002.2914007528.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000012.00000002.2923858273.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000012.00000002.2914007528.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000012.00000000.2467564612.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: quTbWcnSay.tmp, 00000001.00000002.2893887149.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, quTbWcnSay.tmp, 00000001.00000003.1709163527.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2895127853.0000000000632000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.1890721663.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2704598316.0000000001420000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2704598316.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.1875444698.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.1880671252.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2920248221.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.2467564612.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.2467564612.000000000982D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: quTbWcnSay.tmp, 00000001.00000002.2893887149.0000000000797000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: setup.exe, 00000002.00000002.2895127853.0000000000617000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: explorer.exe, 00000012.00000002.2923858273.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000012.00000000.2465864091.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2914007528.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000012.00000000.2467564612.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000012.00000002.2891409803.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000012.00000002.2891409803.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	API call chain: ExitProcess graph end node			graph_2-3198
Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe	API call chain: ExitProcess graph end node			graph_2-3200

Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe

Code function: 12_2_00DCA6D0 rdtsc

12_2_00DCA6D0

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe

Code function: 12_2_00DC6AE0 GetCurrentThread,IsDebuggerPresent,GetCurrentThreadId,__Init_thread_header,GetModuleHandleW,GetProcAddress,__Init_thread_footer,

12_2_00DC6AE0

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe

Code function: 2_2_00405D2E GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00405D2E

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EB97FB mov eax, dword ptr fs:[00000030h]		12_2_00EB97FB
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EA7C65 mov eax, dword ptr fs:[00000030h]		12_2_00EA7C65

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DDAD1E GetCurrentProcessId,CreateEventW,CreateEventW,CreateEventW,CreateEventW,SetUnhandledExceptionFilter,CreateThread,	12_2_00DDAD1E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E2206C SetUnhandledExceptionFilter,SetConsoleCtrlHandler,_strlen,_strlen,_strlen,_strlen,_strlen,SetUnhandledExceptionFilter,_strlen,_strlen,SetProcessShutdownParameters,__Init_thread_header,__Init_thread_footer,_strlen,	12_2_00E2206C
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DDC3B6 GetCurrentProcessId,SetUnhandledExceptionFilter,	12_2_00DDC3B6
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00E9A428 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00E9A428
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00DDACEE GetCurrentProcessId,CreateEventW,CreateEventW,CreateEventW,CreateEventW,SetUnhandledExceptionFilter,CreateThread,	12_2_00DDACEE
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00D71C00 SetUnhandledExceptionFilter,	12_2_00D71C00
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: 12_2_00EABE76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00EABE76

Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x398,0x39c,0x3a0,0x374,0x3a4,0x6c5ae5e8,0x6c5ae5f4,0x6c5ae600	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe "C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7664 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240206153514" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=MzkxOTZlNTA1MDhiZTNiZDVjZDA3YTZhNDU1ZWNiYmNiZDVjZmNmNDM1NWIyYzk2ZWVlZmZlYjNlMTFiNDI3OTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0xP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1JPX1BCM19ERF8zNjYxJnV0bV9pZD04ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSZ1dG1fY29udGVudD0zNjYxXzI1NzciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MDcyMzAxMTIuNjE5OCIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fUk9fUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yNTc3IiwiaWQiOiI4ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImU3MTYwMTNjLWIyODgtNGRiMC04OTgwLTJkNjBlMzZjNjlmZCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0806000000000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe" --version	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x388,0x38c,0x390,0x364,0x394,0x6ba1e5e8,0x6ba1e5f4,0x6ba1e600	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x334,0x338,0x33c,0x310,0x340,0xf14f48,0xf14f58,0xf14f64
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2a4,0x2d4,0x7ffdfb94a5b0,0x7ffdfb94a5bc,0x7ffdfb94a5c8
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe c:\users\user\appdata\local\temp\nsne22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=106.0.4998.74 --initial-client-data=0x398,0x39c,0x3a0,0x374,0x3a4,0x6c5ae5e8,0x6c5ae5f4,0x6c5ae600
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe "c:\users\user\appdata\local\temp\nsne22.tmp\set_0.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7664 --package-dir-prefix="c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_20240206153514" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=mzkxotzlnta1mdhiztnizdvjzda3ytzhndu1zwniymnizdvjzmnmndm1nwiyyzk2zwvlzmzlyjnlmtfindi3otp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmsisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0xp3v0bv9zb3vyy2u9ufdoz2ftzxmmdxrtx21lzgl1bt1wysz1dg1fy2ftcgfpz249ufdox1jpx1bcm19erf8znjyxjnv0bv9pzd04ztjjnjnkogflnzu0mzyzotq3zjvmmtjlmme0njkymsz1dg1fy29udgvudd0znjyxxzi1nzcilcjzexn0zw0ionsicgxhdgzvcm0ionsiyxjjaci6ing4nl82ncisim9wc3lzijoiv2luzg93cyisim9wc3lzlxzlcnnpb24ioiixmcisinbhy2thz2uioijfweuifx0sinrpbwvzdgftcci6ije3mdcymzaxmtiunje5ocisinvzzxjhz2vudci6iklubm9eb3dubg9hzfbsdwdpbi8xljuilcj1dg0ionsiy2ftcgfpz24ioijqv05fuk9fueizx0rexzm2njeilcjjb250zw50ijoimzy2mv8yntc3iiwiawqioii4ztjjnjnkogflnzu0mzyzotq3zjvmmtjlmme0njkymsisim1lzgl1bsi6inbhiiwic291cmnlijoiufdoz2ftzxmifswidxvpzci6imu3mtywmtnjlwiyodgtngrimc04otgwltjknjblmzzjnjlmzcj9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0806000000000000
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe c:\users\user\appdata\local\temp\nsne22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=106.0.4998.74 --initial-client-data=0x388,0x38c,0x390,0x364,0x394,0x6ba1e5e8,0x6ba1e5f4,0x6ba1e600
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe "c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_202402061535141\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=73.0.3856.382 --initial-client-data=0x334,0x338,0x33c,0x310,0x340,0xf14f48,0xf14f58,0xf14f64
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe "c:\users\user\appdata\local\programs\opera gx\106.0.4998.74\installer.exe" --backend --initial-pid=7664 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_202402061535141" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=mzkxotzlnta1mdhiztnizdvjzda3ytzhndu1zwniymnizdvjzmnmndm1nwiyyzk2zwvlzmzlyjnlmtfindi3otp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmsisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0xp3v0bv9zb3vyy2u9ufdoz2ftzxmmdxrtx21lzgl1bt1wysz1dg1fy2ftcgfpz249ufdox1jpx1bcm19erf8znjyxjnv0bv9pzd04ztjjnjnkogflnzu0mzyzotq3zjvmmtjlmme0njkymsz1dg1fy29udgvudd0znjyxxzi1nzcilcjzexn0zw0ionsicgxhdgzvcm0ionsiyxjjaci6ing4nl82ncisim9wc3lzijoiv2luzg93cyisim9wc3lzlxzlcnnpb24ioiixmcisinbhy2thz2uioijfweuifx0sinrpbwvzdgftcci6ije3mdcymzaxmtiunje5ocisinvzzxjhz2vudci6iklubm9eb3dubg9hzfbsdwdpbi8xljuilcj1dg0ionsiy2ftcgfpz24ioijqv05fuk9fueizx0rexzm2njeilcjjb250zw50ijoimzy2mv8yntc3iiwiawqioii4ztjjnjnkogflnzu0mzyzotq3zjvmmtjlmme0njkymsisim1lzgl1bsi6inbhiiwic291cmnlijoiufdoz2ftzxmifswidxvpzci6imu3mtywmtnjlwiyodgtngrimc04otgwltjknjblmzzjnjlmzcj9 --silent --desktopshortcut=1 --install-subfolder=106.0.4998.74
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe "c:\users\user\appdata\local\programs\opera gx\106.0.4998.74\installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=106.0.4998.74 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2a4,0x2d4,0x7ffdfb94a5b0,0x7ffdfb94a5bc,0x7ffdfb94a5c8
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe c:\users\user\appdata\local\temp\nsne22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=106.0.4998.74 --initial-client-data=0x398,0x39c,0x3a0,0x374,0x3a4,0x6c5ae5e8,0x6c5ae5f4,0x6c5ae600	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe "c:\users\user\appdata\local\temp\nsne22.tmp\set_0.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7664 --package-dir-prefix="c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_20240206153514" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=mzkxotzlnta1mdhiztnizdvjzda3ytzhndu1zwniymnizdvjzmnmndm1nwiyyzk2zwvlzmzlyjnlmtfindi3otp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmsisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0xp3v0bv9zb3vyy2u9ufdoz2ftzxmmdxrtx21lzgl1bt1wysz1dg1fy2ftcgfpz249ufdox1jpx1bcm19erf8znjyxjnv0bv9pzd04ztjjnjnkogflnzu0mzyzotq3zjvmmtjlmme0njkymsz1dg1fy29udgvudd0znjyxxzi1nzcilcjzexn0zw0ionsicgxhdgzvcm0ionsiyxjjaci6ing4nl82ncisim9wc3lzijoiv2luzg93cyisim9wc3lzlxzlcnnpb24ioiixmcisinbhy2thz2uioijfweuifx0sinrpbwvzdgftcci6ije3mdcymzaxmtiunje5ocisinvzzxjhz2vudci6iklubm9eb3dubg9hzfbsdwdpbi8xljuilcj1dg0ionsiy2ftcgfpz24ioijqv05fuk9fueizx0rexzm2njeilcjjb250zw50ijoimzy2mv8yntc3iiwiawqioii4ztjjnjnkogflnzu0mzyzotq3zjvmmtjlmme0njkymsisim1lzgl1bsi6inbhiiwic291cmnlijoiufdoz2ftzxmifswidxvpzci6imu3mtywmtnjlwiyodgtngrimc04otgwltjknjblmzzjnjlmzcj9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0806000000000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe c:\users\user\appdata\local\temp\nsne22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=106.0.4998.74 --initial-client-data=0x388,0x38c,0x390,0x364,0x394,0x6ba1e5e8,0x6ba1e5f4,0x6ba1e600	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe "c:\users\user\appdata\local\programs\opera gx\106.0.4998.74\installer.exe" --backend --initial-pid=7664 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_202402061535141" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=mzkxotzlnta1mdhiztnizdvjzda3ytzhndu1zwniymnizdvjzmnmndm1nwiyyzk2zwvlzmzlyjnlmtfindi3otp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmsisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0xp3v0bv9zb3vyy2u9ufdoz2ftzxmmdxrtx21lzgl1bt1wysz1dg1fy2ftcgfpz249ufdox1jpx1bcm19erf8znjyxjnv0bv9pzd04ztjjnjnkogflnzu0mzyzotq3zjvmmtjlmme0njkymsz1dg1fy29udgvudd0znjyxxzi1nzcilcjzexn0zw0ionsicgxhdgzvcm0ionsiyxjjaci6ing4nl82ncisim9wc3lzijoiv2luzg93cyisim9wc3lzlxzlcnnpb24ioiixmcisinbhy2thz2uioijfweuifx0sinrpbwvzdgftcci6ije3mdcymzaxmtiunje5ocisinvzzxjhz2vudci6iklubm9eb3dubg9hzfbsdwdpbi8xljuilcj1dg0ionsiy2ftcgfpz24ioijqv05fuk9fueizx0rexzm2njeilcjjb250zw50ijoimzy2mv8yntc3iiwiawqioii4ztjjnjnkogflnzu0mzyzotq3zjvmmtjlmme0njkymsisim1lzgl1bsi6inbhiiwic291cmnlijoiufdoz2ftzxmifswidxvpzci6imu3mtywmtnjlwiyodgtngrimc04otgwltjknjblmzzjnjlmzcj9 --silent --desktopshortcut=1 --install-subfolder=106.0.4998.74	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe "c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_202402061535141\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=73.0.3856.382 --initial-client-data=0x334,0x338,0x33c,0x310,0x340,0xf14f48,0xf14f58,0xf14f64
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Process created: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe "c:\users\user\appdata\local\programs\opera gx\106.0.4998.74\installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=106.0.4998.74 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2a4,0x2d4,0x7ffdfb94a5b0,0x7ffdfb94a5bc,0x7ffdfb94a5c8

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe

Code function: 11_2_0040247A AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_0040247A

Source: installer.exe, 0000000E.00000002.2669941845.000002C9731D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager_12
Source: installer.exe, 0000000E.00000003.2446149285.000002C973191000.00000004.00000020.00020000.00000000.sdmp, launcher.exe, 00000023.00000002.2850858789.00007FF64AD33000.00000002.00000001.01000000.0000001A.sdmp, launcher.exe, 00000023.00000000.2537172061.00007FF64AD33000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: ..\..\opera\desktop\chrome_imports\chrome\browser\win\ui_automation_util.ccGetCachedBstrValue property is not a BSTR: GetCachedInt32Value property is not an I4: Cannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.Could not activate the menu item.ProgmanSysListView324
Source: installer.exe, 0000000E.00000002.2671425164.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000002.2704055669.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: ..\..\opera\desktop\chrome_imports\chrome\browser\win\ui_automation_util.ccGetCachedBstrValue property is not a BSTR: GetCachedInt32Value property is not an I4: X64Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.Could not activate the menu item.ProgmanSysListView324
Source: installer.exe, 0000000E.00000002.2669602457.000002C971732000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnder
Source: explorer.exe, 00000012.00000003.2724122497.000000000CBC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2716903611.000000000CBA8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: set_0.exe, 00000004.00000002.2702734129.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000005.00000002.2711059391.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000006.00000002.1849878966.00000000005CB000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: ..\..\opera\desktop\chrome_imports\chrome\browser\win\ui_automation_util.ccGetCachedBstrValue property is not a BSTR: GetCachedInt32Value property is not an I4: X64Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.No rectangleCould not activate the menu item.ProgmanSysListView324
Source: installer.exe, 0000000E.00000002.2669602457.000002C971732000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2920248221.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.2464186318.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: set_0.exe, installer.exe, 0000000E.00000002.2669602457.000002C971732000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000002.2702791372.000001C843E51000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.2464186318.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: installer.exe, 0000000E.00000002.2669602457.000002C971732000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progmanfer
Source: explorer.exe, 00000012.00000000.2469307862.000000000B2AC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnde
Source: explorer.exe, 00000012.00000000.2463791892.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2891409803.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000012.00000000.2464186318.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000002.2900589445.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000013.00000002.2902705643.0000000001950000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000012.00000000.2464186318.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000002.2900589445.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, jyKJvjQuuEeSXFxWJ.exe, 00000013.00000002.2902705643.0000000001950000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe

Code function: 12_2_00E99EB0 cpuid

12_2_00E99EB0

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,		11_2_004021B3
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	Code function: GetLocaleInfoW,		12_2_00EB769C

Source: C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\installer_prefs_include.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\files_list VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\root_files_list VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\files_list VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\pref_default_overrides VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\installer_prefs_include.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\custom_partner_content.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe

Code function: 12_2_00E1CB18 GetVersion,CreateNamedPipeW,

12_2_00E1CB18

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe

Code function: 11_2_00401841 ??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLocalTime,SystemTimeToFileTime,??2@YAPAXI@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,

11_2_00401841

Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe

Code function: 12_2_00D80746 GetUserNameW,GetNamedSecurityInfoW,GetNamedSecurityInfoW,GetExplicitEntriesFromAclW,CheckTokenMembership,BuildExplicitAccessWithNameW,SetEntriesInAclW,SetEntriesInAclW,LocalFree,LocalFree,LocalFree,LocalFree,SetNamedSecurityInfoW,SetNamedSecurityInfoW,LocalFree,LocalFree,

12_2_00D80746

Source: C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe

Code function: 2_2_00405A2E GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

2_2_00405A2E

Source: C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Credential API Hooking	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Windows Service	11 Access Token Manipulation	21 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	11 Input Capture	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 Software Packing	NTDS	35 System Information Discovery	Distributed Component Object Model	1 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	13 Process Injection	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	3 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	13 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
quTbWcnSay.exe	26%	ReversingLabs	Win32.Trojan.Offloader
quTbWcnSay.exe	24%	Virustotal		Browse
quTbWcnSay.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\installer[1].exe	100%	Avira	TR/Redcap.eotnr
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Opera_GX_assistant_73.0.3856.382_Setup[1].exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Opera_GX_assistant_73.0.3856.382_Setup[1].exe	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\installer[1].exe	79%	ReversingLabs	Win32.Trojan.Mamson
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\installer[1].exe	68%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Icreplo_98220[1].exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\launcher.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\launcher.exe.1707230173.old (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_gx_splash.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\additional_file0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\browser_assistant.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\mojo_core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\_isetup\_setup64.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
http://autoupdate-staging.services.ams.osa/v4/v5/netinstaller///windows/x64v2/Fetching	0%	URL Reputation	safe
http://sto.farmscene.website/track_polos.php?tim=1707230103&rcc=US&c=2577&p=0.95	100%	Avira URL Cloud	malware
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1627&a=2577&dn=286&spot=2	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_inl2.php?tim=1707230103&poid=2577&p=1.25Inno	100%	Avira URL Cloud	malware
http://eventquill.online/daf.php?spot=6&a=2577&on=434&o=1670	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/v	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/siSIPVerifyIndirectDataDllFuncName	0%	Avira URL Cloud	safe
https://www.leestcruv.cloud/	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/v	0%	Virustotal		Browse
https://desktop-netinstaller-sub.osp.opera.software/o	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/=	0%	Avira URL Cloud	safe
https://www.leestcruv.cloud/	0%	Virustotal		Browse
https://desktop-netinstaller-sub.osp.opera.software/siSIPVerifyIndirectDataDllFuncName	0%	Virustotal		Browse
https://doc-hosting.flycricket.io/health-tracker-privacy-policy/e1662a21-b082-4dae-bcb0-3abd33859f1c	0%	Avira URL Cloud	safe
https://sync.opera.com$1	0%	Avira URL Cloud	safe
http://autoupdate-staging.services.ams.osa/	0%	Avira URL Cloud	safe
http://localhost:3001api/prefs/?product=$1&version=$2..	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/SysWOW64	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/=	0%	Virustotal		Browse
https://desktop-netinstaller-sub.osp.opera.software/o	0%	Virustotal		Browse
http://guideveil.xyz/	0%	Avira URL Cloud	safe
https://doc-hosting.flycricket.io/health-tracker-privacy-policy/e1662a21-b082-4dae-bcb0-3abd33859f1c	0%	Virustotal		Browse
https://desktop-netinstaller-sub.osp.opera.software/LocalLow	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/SysWOW64	0%	Virustotal		Browse
https://desktop-netinstaller-sub.osp.opera.software/Y	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_polos.php?tim=1707230103&rcc=US&c=2577&p=0.95http://eventquill.on	100%	Avira URL Cloud	malware
https://desktop-netinstaller-sub.osp.opera.software/W	0%	Avira URL Cloud	safe
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1627&a=2577&dn=286&spot=	0%	Avira URL Cloud	safe
http://guideveil.xyz/	0%	Virustotal		Browse
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software	0%	Avira URL Cloud	safe
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2577&dn=244&sp	0%	Avira URL Cloud	safe
https://www.innosetup.com/	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/Y	0%	Virustotal		Browse
https://desktop-netinstaller-sub.osp.opera.software/J	0%	Avira URL Cloud	safe
https://eventquill.online/da.php?a=3876&cc=US&t=1707230103InnoDownloadPlugin/1.5/USERAGENT/silentget	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/F	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software	0%	Virustotal		Browse
http://sto.farmscene.website/track_inl2.php?tim=1707230103&poid=2577&p=1.25	100%	Avira URL Cloud	malware
https://desktop-netinstaller-sub.osp.opera.software/W	0%	Virustotal		Browse
https://advancedmanager.io/eula	0%	Avira URL Cloud	safe
https://eventquill.online/	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/F	0%	Virustotal		Browse
https://yandex.com.tr/search/?clid=1669559&text=	0%	Avira URL Cloud	safe
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1627&a=2577&dn=286&spot=2&t=	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/J	0%	Virustotal		Browse
https://advancedmanager.io/eula	0%	Virustotal		Browse
http://eventquill.online/daf.php?spot=2&a=2577&on=286&o=16272	0%	Avira URL Cloud	safe
https://yandex.com.tr/search/?clid=1669559&text=	0%	Virustotal		Browse
https://eventquill.online/	0%	Virustotal		Browse
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1675&a=2577&dn=441&spot=	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/J	0%	Avira URL Cloud	safe
http://eventquill.online/daf.php?spot=3&a=2577&on=244&o=331D	0%	Avira URL Cloud	safe
https://www.innosetup.com/	2%	Virustotal		Browse
https://www.inlogbrowser.com/pp.txt	0%	Avira URL Cloud	safe
http://eventquill.online/daf.php?spot=3&a=2577&on=244&o=331H	0%	Avira URL Cloud	safe
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/J	0%	Virustotal		Browse
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1675&a=2577&dn=441&spot=5&t=	0%	Avira URL Cloud	safe
https://www.inlogbrowser.com/pp.txt	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://eventquill.online/daf.php?spot=6&a=2577&on=434&o=1670	setup.exe, 00000002.00000002.2889230780.0000000000409000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/odirmr	explorer.exe, 00000012.00000002.2914007528.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.2465864091.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://yandex.ua/search/?clid=2358536&text=	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
http://sto.farmscene.website/track_polos.php?tim=1707230103&rcc=US&c=2577&p=0.95	setup.exe, 00000002.00000002.2895127853.000000000057E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2889230780.0000000000409000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: malware	unknown
https://download3.operacdn.com/ftp/pub/opera_gx/106.0.4998.74/win/Opera_GX_106.0.4998.74_Autoupdate_	set_0.exe, 00000004.00000003.1890721663.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1627&a=2577&dn=286&spot=2	setup.exe, 00000002.00000002.2895127853.000000000057E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2889230780.0000000000409000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://desktop-netinstaller-sub.osp.opera.software/v	set_0.exe, 00000004.00000003.2701526132.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2701396477.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2705176382.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://legal.opera.com/terms	set_0.exe, 00000004.00000002.2702734129.00000000006A9000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000005.00000002.2711059391.00000000006A9000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000006.00000002.1849878966.00000000005A9000.00000040.00000001.01000000.0000000F.sdmp, set_0.exe, 00000007.00000002.2677961973.00000000006A9000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000008.00000002.2707253029.00000000006A9000.00000040.00000001.01000000.0000000C.sdmp, installer.exe, 0000000E.00000002.2671425164.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000002.2704055669.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	false		high
https://www.deezer.com/sr/login	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
http://sto.farmscene.website/track_inl2.php?tim=1707230103&poid=2577&p=1.25Inno	setup.exe, 00000002.00000002.2895127853.000000000057E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2889230780.0000000000409000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: malware	unknown
https://api.browser.yandex.ua/suggest/get?part=	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000012.00000000.2465864091.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2914007528.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://desktop-netinstaller-sub.osp.opera.software/siSIPVerifyIndirectDataDllFuncName	set_0.exe, 00000004.00000003.2452032863.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2701526132.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2052264887.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2701396477.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2452224294.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2705176382.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.leestcruv.cloud/	setup.exe, 00000002.00000002.2895127853.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://desktop-netinstaller-sub.osp.opera.software/o	set_0.exe, 00000004.00000002.2704598316.0000000001486000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.1875444698.00000000014A2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.1890721663.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.1880671252.00000000014A4000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.1961786659.00000000014A2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://help.opera.com/latest/	launcher.exe, 00000026.00000002.2609155254.0000033800284000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000012.00000000.2467564612.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.2465864091.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2914007528.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2920248221.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://addons.opera.com/extensions/download/13655f413caacdcc677b24dc0c615d1f5328d6a3/	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://download.opera.com/l	set_0.exe, 00000004.00000003.1875320127.00000000014D2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://policies.google.com/terms;	set_0.exe, 00000004.00000002.2702734129.00000000006A9000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000005.00000002.2711059391.00000000006A9000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000006.00000002.1849878966.00000000005A9000.00000040.00000001.01000000.0000000F.sdmp, set_0.exe, 00000007.00000002.2677961973.00000000006A9000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000008.00000002.2707253029.00000000006A9000.00000040.00000001.01000000.0000000C.sdmp, installer.exe, 0000000E.00000002.2671425164.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000002.2704055669.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	false		high
https://www.baidu.com/favicon.ico	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ff.search.yahoo.com/gossip?output=fxjson&command=	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/=	set_0.exe, 00000004.00000003.2701526132.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2701396477.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2705176382.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://doc-hosting.flycricket.io/health-tracker-privacy-policy/e1662a21-b082-4dae-bcb0-3abd33859f1c	setup.exe, 00000002.00000002.2895127853.000000000057E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://autoupdate-staging.services.ams.osa/	set_0.exe	false	Avira URL Cloud: safe	unknown
https://sync.opera.com$1	hi.pak.7.dr	false	Avira URL Cloud: safe	low
http://localhost:3001api/prefs/?product=$1&version=$2..	set_0.exe, 00000004.00000002.2702734129.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000005.00000002.2711059391.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000006.00000002.1849878966.00000000005CB000.00000040.00000001.01000000.0000000F.sdmp, set_0.exe, 00000007.00000002.2677961973.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000008.00000002.2707253029.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, installer.exe, 0000000E.00000002.2671425164.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000002.2704055669.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	false	Avira URL Cloud: safe	low
http://www.opera.com	set_0.exe, 00000004.00000003.2701643601.00000000497B8000.00000004.00001000.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2056557196.000000004974C000.00000004.00001000.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2705900056.0000000001745000.00000004.00000020.00020000.00000000.sdmp	false		high
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	set_0.exe, 00000004.00000002.2702734129.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000005.00000002.2711059391.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000006.00000002.1849878966.00000000005CB000.00000040.00000001.01000000.0000000F.sdmp, set_0.exe, 00000007.00000002.2677961973.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000008.00000002.2707253029.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000B.00000003.2080708697.0000000003310000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000B.00000003.2080708697.000000000347D000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000C.00000000.2082501798.0000000000EC7000.00000002.00000001.01000000.00000014.sdmp, assistant_installer.exe, 0000000D.00000000.2083663959.0000000000EC7000.00000002.00000001.01000000.00000014.sdmp, installer.exe, 0000000E.00000002.2671425164.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000002.2704055669.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	false		high
https://desktop-netinstaller-sub.osp.opera.software/SysWOW64	set_0.exe, 00000004.00000003.2452224294.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2705176382.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://guideveil.xyz/	quTbWcnSay.tmp, 00000001.00000003.1709163527.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000012.00000000.2465864091.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2914007528.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://desktop-netinstaller-sub.osp.opera.software/LocalLow	set_0.exe, 00000004.00000003.2701526132.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2701396477.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2705176382.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.opera.com/extensions/download/0239ef3d7c95570d61b12b2fb509af435ccc2131/	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.deezer.com/no/login	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.deezer.com/ro/login	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://desktop-netinstaller-sub.osp.opera.software/Y	set_0.exe, 00000004.00000003.2452032863.00000000014D2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_polos.php?tim=1707230103&rcc=US&c=2577&p=0.95http://eventquill.on	setup.exe, 00000002.00000002.2895127853.000000000057E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2889230780.0000000000409000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: malware	unknown
https://desktop-netinstaller-sub.osp.opera.software/W	set_0.exe, 00000004.00000003.2052264887.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://listen.tidal.com/	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1627&a=2577&dn=286&spot=	setup.exe, 00000002.00000002.2895127853.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000012.00000000.2465864091.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2914007528.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software	set_0.exe, 00000004.00000002.2707097483.0000000004A5D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://addons.opera.com/extensions/download/ad5beaae2fc679ccba1db1f7b3c9503d8da6ec70/	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.opera.com/gx/.74https://www.opera.com/gx/est/features-dna-requirements	launcher.exe, 00000023.00000002.2847737095.00000F3C0028C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2577&dn=244&sp	setup.exe, 00000002.00000002.2895127853.000000000057E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2889230780.0000000000409000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	quTbWcnSay.exe, 00000000.00000003.1621844323.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, quTbWcnSay.exe, 00000000.00000003.1621445927.00000000026C0000.00000004.00001000.00020000.00000000.sdmp, quTbWcnSay.tmp, 00000001.00000000.1623987212.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://www.innosetup.com/	quTbWcnSay.exe, 00000000.00000003.1621844323.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, quTbWcnSay.exe, 00000000.00000003.1621445927.00000000026C0000.00000004.00001000.00020000.00000000.sdmp, quTbWcnSay.tmp, 00000001.00000000.1623987212.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://desktop-netinstaller-sub.osp.opera.software/J	set_0.exe, 00000004.00000003.2452032863.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2701526132.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2701396477.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2452224294.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2705176382.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.deezer.com/fi/login	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://download.opera.com/download/get/?id=52318&autoupdate=1&ni=1c	set_0.exe, 00000004.00000003.2452032863.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2701526132.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2701396477.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2452224294.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2705176382.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://download3.operacdn.com/	set_0.exe, 00000004.00000003.1890526974.0000000001500000.00000004.00000020.00020000.00000000.sdmp	false		high
https://eventquill.online/da.php?a=3876&cc=US&t=1707230103InnoDownloadPlugin/1.5/USERAGENT/silentget	setup.exe, 00000002.00000002.2895127853.000000000057E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://desktop-netinstaller-sub.osp.opera.software/F	set_0.exe, 00000004.00000003.2701396477.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2705176382.00000000014D2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_inl2.php?tim=1707230103&poid=2577&p=1.25	setup.exe, 00000002.00000003.2796115138.0000000002B89000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2908068672.0000000002B85000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2895127853.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.so.com/favicon.ico	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.deezer.com/mx/login	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000012.00000002.2914007528.00000000079B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.2465864091.00000000079B1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://advancedmanager.io/eula	setup.exe, 00000002.00000002.2895127853.000000000057E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wns.windows.com/L	explorer.exe, 00000012.00000000.2469716689.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2930674856.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://crashpad.chromium.org/	set_0.exe, set_0.exe, 00000008.00000002.2707253029.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000B.00000003.2080708697.0000000003310000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000B.00000003.2080708697.000000000347D000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, assistant_installer.exe, 0000000C.00000000.2082501798.0000000000EC7000.00000002.00000001.01000000.00000014.sdmp, assistant_installer.exe, 0000000D.00000000.2083663959.0000000000EC7000.00000002.00000001.01000000.00000014.sdmp, installer.exe, 0000000E.00000002.2671425164.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000002.2704055669.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	false		high
https://eventquill.online/	setup.exe, 00000002.00000002.2895127853.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://addons.opera.com/en/extensions/details/dify-cashback/	installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	false		high
https://www.deezer.com	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://autoupdate.geo.opera.com/geolocation/	set_0.exe, set_0.exe, 00000008.00000002.2707253029.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, installer.exe, 0000000E.00000002.2671425164.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000002.2704055669.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	false		high
https://duckduckgo.com/?q=	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://yandex.com.tr/search/?clid=1669559&text=	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://crashstats-collector.opera.com/collector/submit	installer.exe, 0000000F.00000002.2702791372.000001C843E20000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.2674097405.000000D800238000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	false		high
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1627&a=2577&dn=286&spot=2&t=	setup.exe, 00000002.00000002.2895127853.000000000057E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2889230780.0000000000409000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000012.00000002.2914007528.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000012.00000000.2465864091.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2914007528.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://addons.opera.com/extensions/download/4d3d8f7f070d279fbe0d2795e10e69fbab5d3824/	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
http://eventquill.online/daf.php?spot=2&a=2577&on=286&o=16272	setup.exe, 00000002.00000002.2908068672.0000000002B73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000012.00000000.2465864091.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2914007528.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1675&a=2577&dn=441&spot=	setup.exe, 00000002.00000002.2889230780.0000000000409000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://opera.com/privacy	set_0.exe, set_0.exe, 00000008.00000002.2707253029.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, installer.exe, 0000000E.00000002.2671425164.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000002.2704055669.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	false		high
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000012.00000000.2465864091.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2914007528.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://autoupdate-staging.services.ams.osa/v4/v5/netinstaller///windows/x64v2/Fetching	set_0.exe, 00000004.00000002.2702734129.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000005.00000002.2711059391.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000006.00000002.1849878966.00000000005CB000.00000040.00000001.01000000.0000000F.sdmp, set_0.exe, 00000007.00000002.2677961973.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, set_0.exe, 00000008.00000002.2707253029.00000000006CB000.00000040.00000001.01000000.0000000C.sdmp, installer.exe, 0000000E.00000002.2671425164.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 0000000F.00000002.2704055669.00007FF6FAFA7000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000028.00000000.2549062400.00007FF7F24D7000.00000002.00000001.01000000.0000001B.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.ico	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/favicon.ico	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000012.00000000.2465864091.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2914007528.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/J	set_0.exe, 00000004.00000003.2452032863.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2701526132.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2701396477.00000000014D2000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.2452224294.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000002.2705176382.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://addons.opera.com/extensions/download/3ed7347a5e10c404ea6cb96281265ff23092cf8f/	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://addons.opera.com/extensions/download/e27cf3ebc2172a1a7d9cb6978a031ef52ed55596/	installer.exe, 0000000E.00000003.2444601145.000002C9716FD000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	setup.exe, setup.exe, 00000002.00000002.2889230780.0000000000409000.00000004.00000001.01000000.00000007.sdmp, setup.exe, 00000002.00000000.1711024840.0000000000409000.00000008.00000001.01000000.00000007.sdmp	false		high
https://autoupdate.geo.opera.com/v5/netinstaller/gx/Stable/windows/x64yO	set_0.exe, 00000004.00000002.2704598316.0000000001420000.00000004.00000020.00020000.00000000.sdmp	false		high
https://download3.operacdn.com/D	set_0.exe, 00000004.00000003.1890610754.0000000001500000.00000004.00000020.00020000.00000000.sdmp, set_0.exe, 00000004.00000003.1890526974.0000000001500000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000012.00000000.2465864091.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2914007528.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://eventquill.online/daf.php?spot=3&a=2577&on=244&o=331D	setup.exe, 00000002.00000002.2908068672.0000000002B85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.deezer.com/ru/login	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.inlogbrowser.com/pp.txt	setup.exe, 00000002.00000002.2895127853.000000000057E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://eventquill.online/daf.php?spot=3&a=2577&on=244&o=331H	setup.exe, 00000002.00000002.2895127853.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.opera.com/extensions/download/434b0a6daa530638a964132e86b8a01d7b39aa7c/	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://addons.opera.com/extensions/download/aad01b6c6f7f2f01bea6584af044c96d8850f748/	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/a/answer/9122284	hi.pak.7.dr	false		high
https://addons.opera.com/extensions/download/313b7f796952f2b34bf6bce6ba10a7b51bd18913/	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
https://translate.yandex.net/main/v2.92.1465389915/i/favicon.ico	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high
http://eventquill.online/das.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1675&a=2577&dn=441&spot=5&t=	setup.exe, 00000002.00000002.2895127853.000000000057E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2889230780.0000000000409000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.opera.com/extensions/download/505f20c0ceb331ebec9f6b8d9def5e0f59be4612/	installer.exe, 0000000E.00000003.2507259487.000073F800804000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.208.40	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.195.183	unknown	United States	13335	CLOUDFLARENETUS	false
159.223.29.40	unknown	United States	46118	CELANESE-US	false
45.88.79.143	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	false
172.67.152.108	unknown	United States	13335	CLOUDFLARENETUS	false
37.228.108.132	unknown	Norway	39832	NO-OPERANO	false
23.1.33.16	unknown	United States	20940	AKAMAI-ASN1EU	false
104.21.71.199	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.8.172	unknown	United States	13335	CLOUDFLARENETUS	false
192.229.211.108	unknown	United States	15133	EDGECASTUS	false
104.21.74.72	unknown	United States	13335	CLOUDFLARENETUS	false
107.167.110.217	unknown	United States	21837	OPERASOFTWAREUS	false
107.167.110.211	unknown	United States	21837	OPERASOFTWAREUS	false
107.167.96.30	unknown	United States	53755	IOFLOODUS	false
107.167.125.189	unknown	United States	21837	OPERASOFTWAREUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1387592
Start date and time:	2024-02-06 15:34:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	18
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	quTbWcnSay.exe renamed because original name is a hash value
Original Sample Name:	7332fbc6fd5023cc26cd2e7414e8c40312783cc39b40815b91b7618b1d4c49b2.exe
Detection:	MAL
Classification:	mal42.spyw.winEXE@35/254@0/15
EGA Information:	Successful, ratio: 37.5%
HCA Information:	Successful, ratio: 68% Number of executed functions: 117 Number of non-executed functions: 263
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
14:36:22	Task Scheduler	Run new task: Opera GX scheduled Autoupdate 1707230173 path: C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe s>--scheduledautoupdate $(Arg0)
14:37:07	Task Scheduler	Run new task: AdvancedUpdater path: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe s>/silentall -nofreqcheck -nogui
15:36:17	API Interceptor	11x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.208.40	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	theoryconnection.website/lamp.php
159.223.29.40	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	kapetownlink.com/installer.exe
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	kapetownlink.com/installer.exe
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse	kapetownlink.com/installer.exe
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	kapetownlink.com/installer.exe
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse	kapetownlink.com/installer.exe
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse	kapetownlink.com/installer.exe
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	kapetownlink.com/installer.exe
	iguufjAqnn.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse	kapetownlink.com/installer.exe
	fNEOQV1Qo2.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse	kapetownlink.com/installer.exe
	ZmWSzgevgt.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse	kapetownlink.com/installer.exe
172.67.152.108	2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe	Get hash	malicious	Unknown	Browse
	6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe	Get hash	malicious	Unknown	Browse
	D1E33311A3E42A9C958CED92087534253817C228A36A6.exe	Get hash	malicious	Unknown	Browse
	0AD888FB7715FA597961E058A51D397B78F5518EC63D1.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse
	MassTube_Plus_1700502_Portable.exe	Get hash	malicious	NetSupport RAT, Stealc, Vidar	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CELANESE-US	uOnCYVz68U.exe	Get hash	malicious	RedLine	Browse	159.223.64.235
	365g2pmXib.elf	Get hash	malicious	Mirai	Browse	148.163.178.223
	file.exe	Get hash	malicious	DarkTortilla, RedLine	Browse	159.223.92.119
	file.exe	Get hash	malicious	DarkTortilla, RedLine	Browse	159.223.92.119
	file.exe	Get hash	malicious	DarkTortilla, RedLine, zgRAT	Browse	159.223.92.119
	2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe	Get hash	malicious	Unknown	Browse	159.223.29.40
	6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe	Get hash	malicious	Unknown	Browse	159.223.29.40
	D1E33311A3E42A9C958CED92087534253817C228A36A6.exe	Get hash	malicious	Unknown	Browse	159.223.29.40
	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse	159.223.29.40
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse	159.223.29.40
CLOUDFLARENETUS	SecuriteInfo.com.Win32.PWSX-gen.17762.9680.exe	Get hash	malicious	LummaC, Amadey, Fabookie, Glupteba, PureLog Stealer, RedLine, Stealc	Browse	172.67.199.120
	https://usw2.nyl.as/t1/112/b5dzey0gdaiy1k2ezfqzzafw0/0/4f5d37d8e8cc5a18370f9042d95e8772481fb0af14b8846bc3090e217b97d1a3	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	zsGh6GOugh.elf	Get hash	malicious	Mirai	Browse	172.68.1.224
	ZPxpPStblJ.elf	Get hash	malicious	Mirai	Browse	104.31.18.162
	https://simplebooklet.com/sevenair	Get hash	malicious	Unknown	Browse	104.17.2.184
	R49jLE923E.elf	Get hash	malicious	Mirai	Browse	162.158.206.213
	xGFgXWrVPV.exe	Get hash	malicious	Unknown	Browse	172.67.172.63
	https://link.mail.beehiiv.com/ls/click?upn=z-2BRdIR5R5JCqmd8KqF9tC8GVLbVr7mzuZoTVRZyhS737lQqgzDlDqMf1GIeusZF-2F-2FIF8FsL8Vwd-2BMR7VKPzoQdKU6XLeWasvnZdF-2BIesSf1aVUYhijNivWqNmv254uVgozqBQy895TLACW4XzH6cMILnc3v5XdP8J60jAHPmBbA-3DMlpL_RxYQb75RtIxvgJrGgi2sNKAG4r-2FmM2dAPVuLS82mtV38wh6bnsZPeBQgXuBtquit9syA3XR14iNoOje29L7lS5ql0mEYUNvnIVOBqEYLkary9fFbBU50lTgzOLGk6xBRnbZ1ULiSsMgx-2Bt3SgU28uzorg5xQ34NzwTCTzGsdFQcCbGEKnZPShSFtbfgrr1-2FueFbzwRUvAlM4jv8navMLkfynbVns-2FYrRuXAHPMrhWYgDATpd3E04AkkzW-2BGfUBCVvS9ILGTX1tsQq5i-2BW0L0-2FLxPuFtbDrZKFQC1GgQrBlOHeNEhEZccx-2FC3pc6wgJnYclE8MtqhF9JBzEJvFXBEFiMvDZnYmtYIkvmUbAldaloK4h6Y1Ed-2B5eOfL-2Bo0Lyg-2FpTEkF-2Bkrt-2F376Tsw3q0d-2BUnAx7mc51p5IIAHU-2Fzaxv4QqzGiF0bZpFf-2BIjUaQ6xp#/?cfg=c3lsdmllLnNwZXVydEBhZnRyYWwuY29t	Get hash	malicious	Unknown	Browse	104.18.69.40
	FW Agreement Approval..msg	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	OZ68lnCT2m.elf	Get hash	malicious	Mirai	Browse	1.3.103.19
ON-LINE-DATAServerlocation-NetherlandsDrontenNL	FU6bitbdJF.elf	Get hash	malicious	Mirai	Browse	185.235.146.207
	tuc4.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	45.82.70.219
	tuc2.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	45.82.70.219
	tuc6.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	45.82.70.219
	tuc5.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	45.82.70.219
	7E18416DE1803F8E39A3F4459532F5DEBEEB67D0D7E49.exe	Get hash	malicious	DCRat	Browse	77.83.173.248
	CMkbnGtfmp.exe	Get hash	malicious	RedLine	Browse	213.166.71.117
	7Qt6s0iCSn.exe	Get hash	malicious	RedLine	Browse	80.89.229.168
	https://info-zoomapp.com/?af_xp=custom&gclid=CjwKCAiAjrarBhAWEiwA2qWdCFTfcDLj2is-hkYjyqVsrmrpwVE3EUzsayZIqul26CSfTGPvDFUbahoC0r8QAvD_BwE&pid=777&shortlink=4gngjr73&source_caller=ui	Get hash	malicious	Unknown	Browse	45.12.213.62
	JlsamXyn4T.elf	Get hash	malicious	Mirai	Browse	85.208.184.123
CLOUDFLARENETUS	SecuriteInfo.com.Win32.PWSX-gen.17762.9680.exe	Get hash	malicious	LummaC, Amadey, Fabookie, Glupteba, PureLog Stealer, RedLine, Stealc	Browse	172.67.199.120
	https://usw2.nyl.as/t1/112/b5dzey0gdaiy1k2ezfqzzafw0/0/4f5d37d8e8cc5a18370f9042d95e8772481fb0af14b8846bc3090e217b97d1a3	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	zsGh6GOugh.elf	Get hash	malicious	Mirai	Browse	172.68.1.224
	ZPxpPStblJ.elf	Get hash	malicious	Mirai	Browse	104.31.18.162
	https://simplebooklet.com/sevenair	Get hash	malicious	Unknown	Browse	104.17.2.184
	R49jLE923E.elf	Get hash	malicious	Mirai	Browse	162.158.206.213
	xGFgXWrVPV.exe	Get hash	malicious	Unknown	Browse	172.67.172.63
	https://link.mail.beehiiv.com/ls/click?upn=z-2BRdIR5R5JCqmd8KqF9tC8GVLbVr7mzuZoTVRZyhS737lQqgzDlDqMf1GIeusZF-2F-2FIF8FsL8Vwd-2BMR7VKPzoQdKU6XLeWasvnZdF-2BIesSf1aVUYhijNivWqNmv254uVgozqBQy895TLACW4XzH6cMILnc3v5XdP8J60jAHPmBbA-3DMlpL_RxYQb75RtIxvgJrGgi2sNKAG4r-2FmM2dAPVuLS82mtV38wh6bnsZPeBQgXuBtquit9syA3XR14iNoOje29L7lS5ql0mEYUNvnIVOBqEYLkary9fFbBU50lTgzOLGk6xBRnbZ1ULiSsMgx-2Bt3SgU28uzorg5xQ34NzwTCTzGsdFQcCbGEKnZPShSFtbfgrr1-2FueFbzwRUvAlM4jv8navMLkfynbVns-2FYrRuXAHPMrhWYgDATpd3E04AkkzW-2BGfUBCVvS9ILGTX1tsQq5i-2BW0L0-2FLxPuFtbDrZKFQC1GgQrBlOHeNEhEZccx-2FC3pc6wgJnYclE8MtqhF9JBzEJvFXBEFiMvDZnYmtYIkvmUbAldaloK4h6Y1Ed-2B5eOfL-2Bo0Lyg-2FpTEkF-2Bkrt-2F376Tsw3q0d-2BUnAx7mc51p5IIAHU-2Fzaxv4QqzGiF0bZpFf-2BIjUaQ6xp#/?cfg=c3lsdmllLnNwZXVydEBhZnRyYWwuY29t	Get hash	malicious	Unknown	Browse	104.18.69.40
	FW Agreement Approval..msg	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	OZ68lnCT2m.elf	Get hash	malicious	Mirai	Browse	1.3.103.19

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\installer[1].exe	2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe	Get hash	malicious	Unknown	Browse
	6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe	Get hash	malicious	Unknown	Browse
	D1E33311A3E42A9C958CED92087534253817C228A36A6.exe	Get hash	malicious	Unknown	Browse
	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse
	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse
	A1318324E8604DD73AFC5FE4241F1FC29771DE37DE98B.exe	Get hash	malicious	Unknown	Browse
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse
	2960752406911082906D73A7BD80BD2B5815425A6ED0E.exe	Get hash	malicious	Unknown	Browse
	0AD888FB7715FA597961E058A51D397B78F5518EC63D1.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Opera_GX_assistant_73.0.3856.382_Setup[1].exe	2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe	Get hash	malicious	Unknown	Browse
	6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe	Get hash	malicious	Unknown	Browse
	D1E33311A3E42A9C958CED92087534253817C228A36A6.exe	Get hash	malicious	Unknown	Browse
	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse
	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse
	A1318324E8604DD73AFC5FE4241F1FC29771DE37DE98B.exe	Get hash	malicious	Unknown	Browse
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse
	2960752406911082906D73A7BD80BD2B5815425A6ED0E.exe	Get hash	malicious	Unknown	Browse
	0AD888FB7715FA597961E058A51D397B78F5518EC63D1.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.688784034406474
Encrypted:	false
SSDEEP:	24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
MD5:	78F2FCAA601F2FB4EBC937BA532E7549
SHA1:	DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
SHA-256:	552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
SHA-512:	BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
Malicious:	false
Preview:	0...0..x..........W..!2.9...wu\0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0....H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...sn..\|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..\|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0....H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.045024851223198
Encrypted:	false
SSDEEP:	6:kKedgLDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:4gLYS4tWOxSW0PAMsZp
MD5:	B2EE37A1AC3432727C6FC543E24D3C99
SHA1:	547EA852735C42E47A3E6F0730D85904CB2AF875
SHA-256:	22BF899178593C26D31EB6A596F0C57AAD9B80D3AB0526A5FB672F829EDE5175
SHA-512:	41D423436A6C3D2169D1DB27E62814D6733CA3B520F20FFD15EA1CB84E064E43E2A81A3C7F1F5A2F6C1B7772CEFD724CCCF6D4D1172A92E0B9E5EB45F6C601D4
Malicious:	false
Preview:	p...... ....l....GD..Y..(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	109624
Entropy (8bit):	4.023278234079597
Encrypted:	false
SSDEEP:	768:AZp7FDIkDk2XGu/f5pjk0ygGPHjhd/N/LyrrJEn5KxQ6RR1v/0oVeXmcypJ3MdhM:0dk2/9G/VdSchgiPGjnf+PFYKJyRF/
MD5:	279809E7F7804C60CDD19F7CAEA74E9D
SHA1:	AF72291D30ED46EFA8E9DD3ED1E1E58817B1A928
SHA-256:	6F16B5E72A155C42B473DC3A1A3DE9400D14835079171F8326C4FD50DDB5C2A6
SHA-512:	2A765E7E345EB5BD21A5428471D5572D89BC8E791661E6F7834EB80809D38C9B36D9F859F58B077C36D08A5AEA8BC9A498CAD27A142E68DE19AA3479663204A3
Malicious:	false
Preview:	....h... ...8..........P..............Z...8...a........... ...........X.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................. ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002d.db

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	107824
Entropy (8bit):	4.036546168696297
Encrypted:	false
SSDEEP:	768:7ZkmF4t5yk0GJzuFvjjk0m5OyhSwrvBGNGLw1eJQ+aoxZz8R1vIhokb1m/ypu3a/:tnk3uIcyQsvzKhginGJnoUFkKeo2aphH
MD5:	12DDC4D090A298A20235F5520486D595
SHA1:	F57B9F2CBEE09689EB284E298A18E9139417B950
SHA-256:	CF3167488BB24BEA88B677526D776DFDF1E0A77E165CA2087EAEC0C7BF831617
SHA-512:	ED381ADA7BBF82CD62A2FF2FEFF6D790D5633C837370C66135B208CCB3BA99E86FC71535DD15D2CCAD83C04C4020DC9D82AAC66E90632C1ECE218C434DB35F6A
Malicious:	false
Preview:	....h... ...0..........P..............Z...8...a........... ...........X.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................. ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002e.db

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	105952
Entropy (8bit):	4.050159086408296
Encrypted:	false
SSDEEP:	1536:rGktfyGupcojuiqzGh8iGGMngCF0KJqb4XSmw:ykJyGupcojuNzGh8iRCFz9S3
MD5:	BA5C73DA6B133BD4E8A876BE873563E2
SHA1:	E3443FC553D47B2FD68A728C35872B5809BFAF18
SHA-256:	0F43EC258DC60DB54777CA342F5D21D9A827C77CA06DB22D39E3D21DD0BD0C4C
SHA-512:	15473D7E053BA8A4D030321782BC6A45883CE8566A348C5BEDF83375E58D30C19E2B225C3CAAF00E64B5C1E28385A65BC241F3D1A902CC9C9A55B79DDFA94068
Malicious:	false
Preview:	....h... ...............P...............Z......a...0..............x...X.......e.n.-.C.H.;.e.n.-.G.B...............P..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................. ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Opera_GX_assistant_73.0.3856.382_Setup[1].exe

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1499104
Entropy (8bit):	7.985603261747699
Encrypted:	false
SSDEEP:	24576:4ACKcQz8HkfJ8dQnd4GrbwsgY+UfLBCQdI5f3cjCRgCPPWCUZry8k/GUrbN:5pT8HkfJ5eGrbmR0afsXCBrG
MD5:	E9A2209B61F4BE34F25069A6E54AFFEA
SHA1:	6368B0A81608C701B06B97AEFF194CE88FD0E3C0
SHA-256:	E950F17F4181009EEAFA9F5306E8A9DFD26D88CA63B1838F44FF0EFC738E7D1F
SHA-512:	59E46277CA79A43ED8B0A25B24EFF013E251A75F90587E013B9C12851E5DD7283B6172F7D48583982F6A32069457778EE440025C1C754BF7BB6CE8AE1D2C3FC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: 2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe, Detection: malicious, Browse Filename: 6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe, Detection: malicious, Browse Filename: D1E33311A3E42A9C958CED92087534253817C228A36A6.exe, Detection: malicious, Browse Filename: 5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe, Detection: malicious, Browse Filename: F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe, Detection: malicious, Browse Filename: 5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe, Detection: malicious, Browse Filename: A1318324E8604DD73AFC5FE4241F1FC29771DE37DE98B.exe, Detection: malicious, Browse Filename: F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe, Detection: malicious, Browse Filename: 2960752406911082906D73A7BD80BD2B5815425A6ED0E.exe, Detection: malicious, Browse Filename: 0AD888FB7715FA597961E058A51D397B78F5518EC63D1.exe, Detection: malicious, Browse
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@.................................7........................................b......................H................................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\da[1].php

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\track_inl2[1].htm

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:F:F
MD5:	EFF5BC1EF8EC9D03E640FC4370F5EACD
SHA1:	92A949FD41844E1BB8C6812CDEA102708FDE23A4
SHA-256:	DC51B8C96C2D745DF3BD5590D990230A482FD247123599548E0632FDBF97FC22
SHA-512:	672F8FF4AE8530DE295F9DD963724947841E6277EDEC3B21820B5E44D0A64BAEF90FB04E22048028453D715F79357ACC5BD2D566FE6EDE65F981BA3DDA06BAE4
Malicious:	false
Preview:	ok.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\das[1].php

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\features[1].json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1417
Entropy (8bit):	4.395216393786374
Encrypted:	false
SSDEEP:	24:YpiRAS3R+GRH4rRUtRCRMR6mR5DR3RoRY+RWEIiRGiRCR8xRbRIjRuAcBpDRlDRH:YpiRhR/RYRUtRCRMR6mR5DR3RoRJRWEf
MD5:	DA0FFF89499F2F97A18D7C2F36A0E26C
SHA1:	735459D83F4FFCD74FBE936E7E6AC7B8234DACD2
SHA-256:	23CE6F08B735CA050DF44E39AB3D4286E60F62ADF4693FB13F53DACE25935EFE
SHA-512:	062140AA683304F3612D96E9104003C6B08328E9DC23F48B2BFE81450BFBB6FD6112BAD400E3553BA32F33B8E104648286A2090DCBA719874AB3E5D784EDD5A5
Malicious:	false
Preview:	{"features":{"13e025f64bd6":{"state":"disabled"},"13eeaf851da7":{"state":"enabled"},"15322f489976":{"state":"enabled"},"1ad69b007ce5":{"state":"enabled"},"1c4dddb65bac":{"state":"enabled"},"1d24dceb937a":{"state":"enabled"},"278deecb29a1":{"state":"enabled"},"2c1429a5a72e":{"state":"enabled"},"40db6e644d2c":{"state":"disabled"},"50796754ffc7":{"state":"enabled"},"5448a57d6689":{"state":"disabled"},"54726ed4401e":{"state":"enabled"},"56d717ae3ad6":{"state":"enabled"},"5a28d66c82cd":{"state":"enabled"},"603cade21cf7":{"state":"enabled"},"654296fe9d6c":{"state":"enabled"},"7e93fef4a11d":{"state":"enabled"},"818c3ef12d0b":{"state":"enabled","dna_filter":{"required_dna":["64336fb81a04836eb8108d24fbca3aa3682db0a5"],"forbidden_dna":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"]}},"8511df77ed15":{"state":"enabled"},"970fe421a344":{"state":"enabled"},"9ec4e68ae70a":{"state":"disabled"},"b2a2a32b832b":{"state":"enabled"},"b7751444d14a":{"state":"enabled"},"b9677b166709":{"state":"disabled"},"c2410

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\installer[1].exe

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4724720
Entropy (8bit):	7.0944141075328115
Encrypted:	false
SSDEEP:	98304:5YoIz3Q2HM5Qp4WzMIaX8/BG6v/gIV0sba5mFkDzLb:5i3QDCpQaJGkDegFwL
MD5:	FA24733F5A6A6F44D0E65D7D98B84AA6
SHA1:	51A62BEAB55096E17F2E17F042F7BD7DEDABF1AE
SHA-256:	DA1B144B5F908CB7E811489DFE660E06AA6DF9C9158C6972EC9C79C48AFACB7E
SHA-512:	1953201D8CD448AA7D23C3E57665546ACE835F97C8CC8D0F323573CEF03A6F317F86C7C3841268ECE1760B911C67845D7E6AA198A44F720DCA02A5A8BCB8E21E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 68%, Browse
Joe Sandbox View:	Filename: 2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe, Detection: malicious, Browse Filename: 6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe, Detection: malicious, Browse Filename: D1E33311A3E42A9C958CED92087534253817C228A36A6.exe, Detection: malicious, Browse Filename: 5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe, Detection: malicious, Browse Filename: F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe, Detection: malicious, Browse Filename: 5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe, Detection: malicious, Browse Filename: A1318324E8604DD73AFC5FE4241F1FC29771DE37DE98B.exe, Detection: malicious, Browse Filename: F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe, Detection: malicious, Browse Filename: 2960752406911082906D73A7BD80BD2B5815425A6ED0E.exe, Detection: malicious, Browse Filename: 0AD888FB7715FA597961E058A51D397B78F5518EC63D1.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............S...S...SA..R...SA..R+..SA..R...S...R...S...R...S...R...SA..R...SA..R...SA..R...S...SO..S...R..S..=S...S..US...S...R...SRich...S................PE..L...G.gb..........".......!.........D.........!...@.........................../.....'.H...@.................................$..(..................x.G.x.....-..[....$.p.....................$.......!.@.............!.......).`....................text.....!.......!................. ..`.rdata..di....!..j....!.............@..@.data.......0..j.................@....rsrc.............................@..@.reloc...[....-..\...D-.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Icreplo_98220[1].exe

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11065129
Entropy (8bit):	7.96991159694097
Encrypted:	false
SSDEEP:	196608:pm7CwA/6hJij8gZbSgazIhsdiFlDOp0aPT+9IRZt5o9Y:OCAhJQ8USgachs4FlDq0aPbjo9Y
MD5:	C060CC25B2F5B27A73D320F1173D1BE9
SHA1:	4667FCDACFC6DAD7176ABDED4A4888E54B00E920
SHA-256:	129F005C2043E43438B0CB621BF7D6289B12B34E6D7C4D24B9AE15523D171042
SHA-512:	28D261461D86909BF30D876125DEDEFE062A23E4265EB495E07A58724C0656BB1256A5313D947362E1D021DA94E76320328D4250344EB44C06E3F7FD94F9795D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@.......................................@......@...................@....... .......p.......................................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_GX_106.0.4998.74_Autoupdate_x64[1].exe

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139990888
Entropy (8bit):	7.999994927046636
Encrypted:	true
SSDEEP:	3145728:pebrmlLOr6pGFfpHQjxDaMxuQdyfYkfW7+qG/pR4oK4hQ8zcjT:Ehr6pJVxpdyfXcGUuXzm
MD5:	D9A07B746D1C7BBE738964B4F727AC27
SHA1:	01224816F2F34ECE24728D7DE552BCF76B647C6F
SHA-256:	36015707ABD77EB3487FBF6B83D0ACB980C37B8B0676CDB654C89A35B8651EFE
SHA-512:	7A057FDA77EE1613B77BF584BFD1EA539707C2BCE71AB7D647382BF4A0F97D4839C51EF8AEFDE9DEAEA91CE7060C983688AA4C1A24F923112A6D7DEFF179C809
Malicious:	true
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..................................@X......................................b........................W..)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\1698947853-custom_partner_content[1].json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1824)
Category:	dropped
Size (bytes):	1344708
Entropy (8bit):	6.081849998191263
Encrypted:	false
SSDEEP:	24576:idUTvr+x0E4H3CAHkd0OhPVVUCs4dxemFiG7V76d5vQVUCaxU:iKTHhySkuz/G65v1y
MD5:	1FB07CF2B20D516ADC1067D9C4C57BB7
SHA1:	DA0BFEB9A98B2FDAF422A1B52FFA33ECA0684EA1
SHA-256:	294592F92BDDA407A531D81D64B7D141979F7B5B052370C1041430530DB7C481
SHA-512:	F4B17E1E60281465A3288E5BDE7C537AC419236A72B680AD533E93CAE81DC8E12221339A737C27257B0A561192F655C70230D818EB0219CCB5E4641B5FF811D8
Malicious:	false
Reputation:	unknown
Preview:	// DUwgkzpRs2UBZDQI77+cT3P6rFCB1A0dTs323s0P8VwKPNxJg7UC76QDbcCRMySUWu6oS1yzTCguRlUYTcidqpeZdtHOL09/z+luPzIHHqB/vQ9rnmKvNPJpGrBJkKfytTOuw9v8frDeZaeH6r4iB1b3IcxXDVBG/cZiVMvhj0/b9SbAbkgN94GUrDjIArHEo49eBMFcYKuLFjOUmbiRuESFn3Rlx1SFNsPk2GEohrRvsb3Fzh9UH6hwKFUEBxwUWIGMtPpf2rIDmUxAEUigjvrWMiGoDk4x5FdM+p5livY9OVeyVGtcfDm8zZJ3psJ6Uz8cqK1ZhYsebZFUup9rZA==.{. "version": 32,. "partner_id": "std-1",. "user_agent": "std-1",. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed_ysrcunow",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed_ysrcunow",. "wiki". ],. "speed_dial_index_list": [0].

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\OperaGXSetup[1].exe

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	3355816
Entropy (8bit):	7.7768157039053945
Encrypted:	false
SSDEEP:	98304:M0Yl5VdpeXteaZ5AYFl+3sJX0hjStE426Z+0eAjrJq6hqb+wXwr4Nbw+:05VdwpbAIl+cJSGtZZ+
MD5:	CFCF91EF96623A139475B53B686229DC
SHA1:	D38D63B2B59C8A0A035B5E6BE792045B9F643E6C
SHA-256:	BFD52C7C2ECA1BB09D745582455A7D9DB13E85CCFE47B35E7BFD549DF70C8EA0
SHA-512:	28354E842D3DFD7B32B6301122070FFD78ADFFE5EBB7F98FA2113FF971E98B7444454DD0EAC4A0AFFE814FBD53C7CE30B6B54CE5A3E2C5EF0A8995E3A92A0D8B
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e..........".......2..@....#...V...#...V...@...........................V..... .3...@...................................V.......V../............3..,....V.$...........................t.V.......V.............................................UPX0......#.............................UPX1......2...#...2.................@....rsrc....@....V..2....2.............@...4.02.UPX!....*.A.....;eV...2...U.&.......U..SWV.....e..E...E..E.........d....M........}...........M.1..U..Nf.........M.).).....9..L.M.4.9.r.9.wz.u..t.SPQ....K..U.....B...B..M...;}.}>.M....w..Z.9.r....X$...........`.......t.`..A..yN...~.1..E\.6.......^_[]...@>..;!.h...../h...Q......,...0\|.....f.U......Ed..p....U.M. ..2.._.@.. ..}..F..E.....op..E...X0.n.......}..u..fF.E.@@..;E.}^.....W.._.9.s...e.)..9.w...r....9...wKc'SQR...........f}.>..W.....O\|......[..d..1..M.d..HB..7.8..B?_.....@>..E

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\das[1].php

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\106.0.4998.74.manifest

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.956657181398446
Encrypted:	false
SSDEEP:	6:KdhlRu9TbX+A8/5RFYpfkjwX0CdiYCWoA1G:KLuVA5cp8jE07vWBG
MD5:	8738EB091D37D89347E4B0F92E8214E3
SHA1:	3CBE834ABB9951D9B8B2753497FC78863F56CBAA
SHA-256:	4085A27DAD28D2C51F9B7439FEBB2EAB1C4B005A9721D9996385F68661198560
SHA-512:	8E86C7240B7E77D3A4735FA12D18DFD2CF7D388FA77E6798810A3CB0F6724973649675AF4AA118F44C786DD2DFD6FD313021A4A5BC4BE47B90C1EF26F50791E8
Malicious:	false
Reputation:	unknown
Preview:	<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='106.0.4998.74'.. version='106.0.4998.74'.. type='win32'/>.. <file name='opera_elf.dll'/>..</assembly>..

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\22c8bf83-3981-4d01-98e2-4e90ba5bac7c.tmp

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	395193781
Entropy (8bit):	7.089053750448825
Encrypted:	false
SSDEEP:	3145728:RkgrIbisUWa4SxGSCvGHYL52LZByhNvFfQisoYN3U2DDPDjo1VknvTbeq71lT:RfLYLILZByvvFfGzEoDPv2g
MD5:	4F35205D6273CD18C45FCB6EA54FF455
SHA1:	F41FDB4E26BA84D389B9A2F44431BF910B19E07C
SHA-256:	F795B7E2271898FA5CB79EAE8C7810BAC68D2F65B77562CCE2B664E711611B77
SHA-512:	08DB42654A3A8B7CF2EA810EF1DB9B59B5AA4EB9B1FBEC24F04E5B05AC83C46F700F255F2DADEBA67EAEC7A0E1532EBF4E71CF5D181C0033876F21AF96F42556
Malicious:	false
Reputation:	unknown
Preview:	<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='106.0.4998.74'.. version='106.0.4998.74'.. type='win32'/>.. <file name='opera_elf.dll'/>..</assembly>...PNG........IHDR.............<.q....LIDATx...1..... ..6.^`...................{........m.m].m.m.m........[s....._.....N.Nw..._w..P...R... ......`........_[.i1...`.$.......C......*..,...v.l.>.ZP.B...E@......!?d..!.d.R......g)0...^H[.u.4.k`....0<.d.1.....0...Q`..I.._T..!...\|pG.m=..a&.e.U(...C...n.^`........FB.X...Oio...z!...:.Tx.8;..9.[a........{.~.^......P.].r..d..A...?....<y.v"......l......^..._.....MA.o....?.>u._.d..`......E.@.5........E..................R...A..O}{.k..2.....jx\..5U.a.%."#.nA....6.!..W2.............R..j6r..v...."....N.GA..8.......>..p..#..,X.....Q...y..#.a..)....Q.e.zc\.'@.Al.....io....=......D.......F......A#6.^.^.Ma5...b.b...D...+.P.. .[.o..z....,...#<U.0.O.#..Z..........Q{...jA..ka\|}...q.s.y^.!.Gh..R....t.g....F.......g

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\150x150Logo.scale-100.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	7.807674908350133
Encrypted:	false
SSDEEP:	48:Pe+1prHq0WWdnFX5lKhqEiJVk10s5pqe/cme:G+1prHqXkhrWqEiJa10ae
MD5:	B5A21B88B3D8A42DF265817EBEB742BB
SHA1:	E0BE32B4FC158DB4E9783094CCE614922114B742
SHA-256:	9635C074C9D8EDDE0BAF3111DBD7DB49CBDC370C4F729C80AC382949F32BE526
SHA-512:	21ECE0DCF17B038400D09565438FCE8BE61746DAA0250F2FA9D0526BBA3D1CE6F8DA5CCE944EF8FA685C5EB6CF857B073D2A50ADA44A44A76D84813871FAA5D0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.q....LIDATx...1..... ..6.^`...................{........m.m].m.m.m........[s....._.....N.Nw..._w..P...R... ......`........_[.i1...`.$.......C........,...v.l.>.ZP.B...E@......!?d..!.d.R......g)0...^H[.u.4.k`....0<.d.1.....0...Q`..I.._T..!...\|pG.m=..a&.e.U(...C...n.^`........FB.X...Oio...z!...:.Tx.8;..9.[a........{.~.^......P.].r..d..A...?....<y.v"......l......^..._.....MA.o....?.>u._.d..`......E.@.5........E..................R...A..O}{.k..2.....jx\..5U.a.%."#.nA....6.!..W2.............R..j6r..v...."....N.GA..8.......>..p..#..,X.....Q...y..#.a..)....Q.e.zc\.'@.Al.....io....=......D.......F......A#6.^.^.Ma5...b.b...D...+.P.. .[.o..z....,...#<U.0.O.#..Z..........Q{...jA..ka\|}...q.s.y^.!.Gh..R....t.g....F.......gt..6...7YjaU....0........3..l.#.. =.h0t.06.v..C...T.}m..%...g..i,Cq..8.g.q..hx. .>..Kz...1....VF.)..q..$....._Z-.U...(....~>...-z]$.mh.%...e.+.....\|.n.2..:...N._R..x..>.\|S......i?.P....Q.F.d..U.8..i...T...........I.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\150x150Logo.scale-100_contrast-white.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 150 x 150, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1828
Entropy (8bit):	7.716814612583543
Encrypted:	false
SSDEEP:	48:uIrxqF+qFL9yUaKagPWex0mLgIbPdyFKD0YTkogFey6mkAN7G:3wFRoGagTx0A4KDfTko6eCZG
MD5:	0BAE0648C3E320C4D439F158B4FD5531
SHA1:	4E860AE24F03522C89BDF37F3CCC10B54832861E
SHA-256:	28CE8FCB22080CE1F69346CB0720BBE5662959E413426F00062B706013DA8C28
SHA-512:	6A5E4105CCBE1664546798DB057B93622C9CBD6D5AF4967E6BE4E390A18FEC0FFCC807E3331F09ED0DE63ED85569BE7EC5EED5A7C663DF6CE4A5B70E09500371
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................i....IDATx...i.]U........J..RT.H....T...seV..)b.B.5.@.a.Q..P.c. 2E....eR...P(.....P........I...s..v...y...u......Q.EQ.EQ.EQ.EQ.EQ.EQ.EQ.EQ...S.n...j.."....p..\|B..]....>.......9.32.....Y.l.R..y.\.8.4.....p.K..EY%}.5.h.[.\|.V..i.F..q~...;..W61.M5_..1F...Gj..IZ..u. ....w....oS..D.r.).U....j.y.#..y..U..;S.-"...n..v.^i.UW.j.hk...n.....,...LRe[.i.}....H.z@.9.q..".v.U9.""n.)....DD.iX.b.....'....v5.#..~.$.7.]..Tm.....i......+....m...x.j_.'"NG.]..n.j.vl{..Ls...;.T.=E..3...1;.v..xB..."^.1U..8...xL,7]...D.9.i.."..N.."...c..D...X...c+.t..8M...[......"f.........R..0R.1..Xh..;ND.=U.ID.a.....v..8...'.uct.....k.q>.q.jc.+b...F....r....AN.....}.....Y.J.k~.;4.3".U....s..$....n.q.b{.q.j......".Y_..E...b.=.S.".4...[...S....Y.6O.L...."...."......i../"..!M.>..4ED.....I..""60x.Ct.i...4.."..f..`(.....4..5.L....o........W....xX.M...E..C...r.....U...8..<'.G.}D....E.k!.8...ED..iL...V.8.."b.C3[Dl..gED..^....-...NDL.iBs..O...`m..zW...k.A

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\150x150Logo.scale-140.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 210 x 210, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3140
Entropy (8bit):	7.81304512495968
Encrypted:	false
SSDEEP:	96:X4+RWiQZwj2bSjtW8+i2elETWt5nQ1pzuiV8:ozEW8+iZECt9kzuie
MD5:	7E529063A02E4E83736B0263CB1B82E0
SHA1:	17A3C4B76962E90B1D2FA8A49441157949F4DC78
SHA-256:	A36A13A5D5E3D39E3018CCC5F8859944C87256F8BE24A3C08A6BF3CB06A26804
SHA-512:	571806725F83FECA90360B246D167A8857EDFD9EDC8DC0EF7EEEF80F291FD06088C405A5653513CB8AA309DF08CD609DF85A95E3379E3E5907566C876CA77CDE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............?..B....IDATx................................................{..dg.8....m....m.Z.m..;;y...s.GI?..Su..k=.T#..#.;..}/\.g..:b..a+.....t.A}...q..hq.-.}...`:.gk....tm.$...Ax.....B....c.ih....G6L.....;...T.U0...l....~...........W....=<j.....X..O.....r.Y..-..Q..1.....q`..PC..jL...x.'9........y.b=L.m..(U........a.....W......`:.Me.jh..U0.......;..{..I..\|.W..C..4...b.nt.......L..a.........`9.!..7N@.......E.?..$.._.q..6..":.+`....W.O.G>o.F.K.c..G.28..Q.....\|.....m..#X......N.P..{:...1.........4...F.....w......Z89.Y.w`.L...v.DC.h'......h...[=...c.2...&ze*h..t..j...@?..cpN......0...KC.....f..F.....2"...c1..m.)y..q..(..C,.e..!w.N@I..q4.......!.A...;q..Y..sy.{...."L.p..#<...'.-8.!u.C#...O;.......y<.=....h.c<.=...5N...s....._...p,..Ia...yo....=...Y..4...t.}m@....g._.......#.M{...t........t...;.bjh..l..84.C8..z....B9..[.D.R..}...r..e.pl...~.....<.~ `...Ep..b...L.^.9..x.vB..IZH.a,k..c..L..U...M0....}.n........H..<.!..B.(Y

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\150x150Logo.scale-140_contrast-white.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 210 x 210, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	2659
Entropy (8bit):	7.828610258666657
Encrypted:	false
SSDEEP:	48:zQX9JrPPPPPPnouwOlIbylOhFARjcSY1E1y0fAiKb+Y+GzYvpSYWTX5sPPPPPPPn:z0rPPPPPPojFby+m00fAiKiySSYWTXqP
MD5:	EBE7D27ED3B4CB6566A10165ABFAA941
SHA1:	FDF7C27058CF5DAF7061756E938A33C1BBB26C3D
SHA-256:	0BD63FE653885286E180FBDF6D1DADC66AF242B8ED6BD1D03D8C5ECCC20E91D7
SHA-512:	50EC8592D78F00A6387F06E077E0DEF88DB26723C0FB8632C4EA06F2E09488DB0FB82E0EB1F03DA53F9C750F6CEBD29F7889B1DE342E4F0AE69F88C4B7B1425B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............V....IDATx...{.]U}......"... .!.#..D .k..:.....5...6B..Q@+..lq.(%my.P..C-..Eb..<L5..<C!.1.$wu...f..}........5..Yk...^{.}..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)u.d.Y.b?t..Q.E.,u......$o.-..rK....nw..7..w.TF..-...5=.r....?N...a.N.....~7..7,...r..-..q.}..R....Ye#y.u...IF2...Z..6.o.F....R1<w..]T..H..zw{.k..Y.L.Fm.k.ay.W.P.....I..,5G..C..........v.]...].-R..A......1.a;J-..>E....Qe'............#^VF.J.J-.....LRe.....\|....g.M.e.+<.l$gHM.l..y..T.s#.Ow.o+....=...4....P"..J...("...]...~....z...h...P...QD....Fg.a..7m...W.`.j..C.q...E....D........8.i..D...^c...J.,.../.&rH[M..9.4._kfzN..#..bD.....[.D.4M3.....2Cs.........._k.Z%....bs7+...wkf...'.%..D.j..!M4A.z-R.k5.....q+-.*&j,..GE......p..(.j_V"......i.M...7.....E..LUz.8>i..jm....[.T.].F.%Q.;.2.....X.x.....-...b...;EQ..dU...avR[..V...f....`,.....J........K...........NWe.....Z:YT.>..{....-..(.uvV......P.x...m..ku.)q..Z>9vU;.)..xTC........j"..ra..D..(..6...t.Ib.O.....D

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\150x150Logo.scale-180.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 270 x 270, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3904
Entropy (8bit):	7.301300867894784
Encrypted:	false
SSDEEP:	48:Fe0zdfrjvg/ofL7NkqKgOL6bq64wL3XtakhXSTxyfO8cg7WZUScsO62vSQ6Q4MCR:JdfrYoDdbJlXBRSMoj6H626Qr45eg
MD5:	F332E088E89B88070EF1EFBECA5B90F8
SHA1:	86129A8B1E2E7F78D6CE23C58A37FAC9DA5E566D
SHA-256:	6A8F64754C75EDCC9ABC1138E44ACBD7064D7E8E2A28783939241DBD6AFA30A5
SHA-512:	2314AAE692C024F914661E46CFD76531DA6C09B94C084FE915A0594625927DF30282D09518A950EAFCFDD2E499B1E4877CF3CDBF5509DE0CC756DADCDE43FD45
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Oo......PLTE.....N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N...*....tRNS..8Uq...........jO+..D......o3.0y..b...g..a...@........_....d'...7Qp......K;..^h.\.W.../...S....-..J......&......Y..I!.P.w#...uT \|....:.V...1.z%.Fn.6....N..L..$.2.?.e.s".ti

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\150x150Logo.scale-180_contrast-white.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 270 x 270, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	3673
Entropy (8bit):	7.8322183683928195
Encrypted:	false
SSDEEP:	96:nBWR5fosUcvpqnOtkeU4ghCboMmSaj+5UZy:MvHUUMnOtpz4Csz65UZy
MD5:	98B9F7A4F4322E7B46DE392FD20F66E5
SHA1:	D009D227522206C40CF592E460C9642CD03B8769
SHA-256:	A706B332E6A846357A86C30D0E8BB7697E7DD55C2AE592DD45611DDCE0C0BF14
SHA-512:	3B3E5BAF3CFC57119E0812DE2816DF6C7DCB42E96C4891E47C4F32320FD3BE2F27A0118051A6651595BAAAA30069BB1C0D78AA701744A44534CABE7547D4BECD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............1.... IDATx...k.u.......:......o..I..J...L.H.(a...1....6S.....b.6..2M...fD.M..TN.5..o qx....;g..}^........."""""""""""""""""""""""""""""""""""""""""""""""""""""""q2.3Qr..z..<r....D.w.2.".r....s.......\..)d+.XJ.A........8Vq....g...vo.%..B..._M{.a&.XZ;.\|r.v%."NaN.Q..R6....c.cN..~H..M1.X..a'%.d,=iZwF2...;.l.xU.H[..i.6;q.....#.y...w...... m.$~..$...L\E...l. .IM2s5.==.%..-....\|.:,.`..........<.c-.".\....l...3...j4...B.sn@....Oxb.%.....B......$...-...WC).j..ru.s+.{.2"..5.c.q.e-...;.`-O1...@.G.F3.El.'..>$...(....d....6....%.CG\.e.[8.5.!.#....`q.3.W]X.%...$y...&...DZI....K..W.x.....%.......H+.O%../..n...~....C4...9nAZ..`..F...2.S.khhtz.E.(.CX....Uf....^&J:..@....$M......(.2..U.].O'vc...mzxlm....obq.M6....,.."H...}J'\yll..,....Jx..$/..X.uH.&.].....r,P-...[9.Q...Lr:....(..>..\|..;.h4V.%y.\|.]...$#....[[..d...U. ..B.H9..d.26.#.w..5.b....q....oq..0Z.y.NP..1.c.V!!.D=.k1.:.?.q'-..w.]..B,P..B...\|....+X....j,..2q....

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\150x150Logo.scale-80.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.769427546963699
Encrypted:	false
SSDEEP:	48:MtXb2ikqrN+EMaUeTPMSEGS6CT/GF2MdJtDHBkZH39Hmgwiw:CXbzrzfUsUGS6A/ETJtHBYNG1iw
MD5:	1F2FB1BF463B2FF2BEC96784DEBFEF84
SHA1:	AE6F721AD937FE39F86602F71002435B18BF1EDD
SHA-256:	7E6B0D9EA7FDA1B5CA7A0B01290521DFF943DA4CBF1498412CA7D749DB42C32D
SHA-512:	0C92C4F75E620D0B636CFD83E89C69A44F6A96A00006FBD0B13637BA5DCC77C9B302029E62F4B80766811F31810F9C20AC1A98B65C38789951CA0E19A5BB6894
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....IDATx......... ..................s....P...m.m.m.m.m.6N......w.......-...g2/...)z.....K....~(^..`...j...z.^Sc.n.,.....0.VW..al6...a.....R0...k.Q..N..P.x.J[ol2..)o...A....x.....c.m;F...t.16.....L8....vb=AQ0.<.X).@....M......g.....k..,.AN...-..R......$....b..`...... %H....`6.g#..h.]q..5._.@dA..c0.;X....a.. .2...~..;.1..:.x.....q[@R....,4.w.v.._..s;.b..s.Qu5..U.\|.6Zj...P..........\...qa. ..D..W.L...c.~.....A...F1g@x....V..`..,..D.=..d.i..Q...o.c...N......$.`....]...P}.G....BT. .?.......L.n..+nG./..cC.>0.N1.\.C..B..4.l./L.3....T.c.S..bf.0..t...J..!.aU..p`.....0./..}.iL.).w..hc.M..'.. ..;'.p.Rt....R.g......8.%14...S....<.Jf./@..U.h'.G.R..D.\..z.4......<....2K.S.bj.1....=.../pd.........cfPL$7....S[.M.%H.M..W..T...ZP.aA~....D...+..~EYK.#..zOZ.]fA~...fz..].....7.>..\|.........[...v..M..vb.........L....z.`.P...X..RP{.....`...+.0...l/..>...i.w...W. .....x....T...............t..+B}d`/..+.;L...J..._...iC..pv..gA~..k.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\150x150Logo.scale-80_contrast-white.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 120 x 120, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	7.721284228612739
Encrypted:	false
SSDEEP:	24:sRv0SxfL9UEp3g4/RjUG894TBRVPvhjfghucgXy2nRlWzIXQuohMU9ocyMDh:sRv0sq4/tU10XVPZjhy0Izy9srWcyUh
MD5:	17471BB63ED62A6E545B6B626A763511
SHA1:	586B9EFDE7B3A04580A49F8FE7739593D42D303E
SHA-256:	DFD1054F989CDEE25F19EA792F363F042A125CAB537A424F0224BBEE13607E39
SHA-512:	F619D963B62EDB07C8077C3C6AE60ED8D3F3DD5BB1D05A2B83DCA1A7A4A346598B055F6C7EA22E05BF281B1DE0F205F5D1054819000759D9450EE1FE8F6491AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x......m.Y...XIDATx...m..e....}....d...9]9\...r2..L..37...S..."s..SV..].t)..I..dh.Em..`A ...9.`......./..u.}...........v].KUUUUUUUUUUUUUU...~.p.....M.6Y..l.]...Fv..W;..o..d.l...r..{.d..r....a....r.y...@..>.z..C.l.qh............7{E:d.w.W..ZD.2[.~_..y^4.q.!./;GK......Z."s.m..9...{^.g...g...i..[$"F..x.Pj9.b[E...,.q.^.......v. w...4.I.E\....D....9......C".Q.._El0].=.Z`?.>gD....&Y-b...+E...(.f..~`..."^....Z...:\.h....S.v.v-KE,.8.....W.....Ag.V.....q..yD.<..6....x.d.N.....d..?.Q...[..".WZ&.,....v......Z...vG..k.4."...tv....".T.K.L.q..sQZ%.M3V..D...D.!.-.T.b.n\|W.u..xVl....X..._.."...n...5...W.?.1U7Z...p.>#.R.p..#QzJl.;D\..;E....Q..zl.w..wD.4 .j.u....D,.SE<..Bl.........U.Z.[D..._.4K..u.....mJ.e....&.m......-7*..X...:T.K.}..;~....."6(...O..(M..=.#.q.{..xHl..E,...v...3.`......X.[.E\|S.IF......C.b.....r......9....o.\.x..WM..J..5.&.IJ......\|...........q.J..!{t9L.Y.}D./5.."Vv\|./4V.v....i...8Ji......ae18...>.q....0...X.,

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\70x70Logo.scale-100.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	7.78686155071436
Encrypted:	false
SSDEEP:	24:kO3Sxd5HLMZAoBjXkaBPxrX6hzB6eCvTYJSM2nY2YptQ/ceAV5ulBbYZwix2:MLLMWcV2z8nryWY2SDV5uPsqiw
MD5:	C3722E0232EC20AC8F99CCE7A040B294
SHA1:	91CA47DA87EC045ED3EF5D97243167F08FB9E10B
SHA-256:	A333D7E4293F5269426B3FCB673A284F3708A66F957DE62403B6570B24BAE8F5
SHA-512:	71940B8431E36307BA5176939A169B9259BB6B43C32529A10A12C5EA31447BDDCCAD7EB9EF7CB309B175EE7BD56E70926BD5AA0855D0FD9497547ECD7FF93158
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...F...F.....q......IDATx.....L../..m.m.m.m.m{.._...+...d...[.\|..y.'.{8..N8..N8....x0..$.iA&..d..@r........&X...../.z..../.....{..../u~....\|.._4$5..4...6....q..P..D.U...u...W....o@#..j .o....j...r..MI.n..X.RI.]..Wg.g..;...\|.D...2..._.#..$.....A......I..r..GOF#F...L)..P.8.....G.. .l.m..J.=(+.{..@#....CH..\|.:..n.%..0...{...O.+.Q.ORp...7L)dxS2H..Ge....e....$..k....iJT.~...eZP..A2....g..PUB..\|....v.......>..k..~h3...40.x...(.......v.%.F......vl..h`>...P...4...W4.D...\o.9...z....3]........`.}t.......XI.[z..%....S<.e... .D..TA...'.....h....l...,...$7.......0,%....I[Au"...d&?.j......,..\|...~F..pB...]......L.]d.v5...U%..h:}%..._.$...X.m.....S.yL...Bc.R;K..8.....TiP.}5.g..p..m..s].ZU....H.{P.!,..?......t.U....=m-<.a.v..I$...u.T5..LG..b]...c6.19d;k%...3......,..I.[.1..:...YN...h.5...W..._....dL6.v.Rch..~...i.1G....\|].AU.k...H.[Q.a,6.5-....Gt.9U......n(.#...D.v......_....@I.}...i.u.@..w.T%...&Y.:o.X..3.Z.m..fW..5.....D...

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\70x70Logo.scale-100_contrast-white.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 70 x 70, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1341
Entropy (8bit):	7.829707677562043
Encrypted:	false
SSDEEP:	24:vHNfCYvjHq3yow73tnF7H1r8IR07iBa/ptAFjLmocqM3LNpi+MaG9vz:vHsY7Hq3QzT7H1r8Wr0/zAxfyLNp1Pab
MD5:	504D80D276ADCC0163A8E4720013F9E7
SHA1:	6D34A0593FFCE916CD19B66D61004FD7E7EB2CD1
SHA-256:	EBBE0B4761EA8968A0A3FAFB383AC7AE175E98CD31A0F41BDF5FCB43469B58EC
SHA-512:	9961259704FF97C0E1899A33259F62155B73264E272064F3FA90E64124513C7C8BD6AB69A39C1EFB271ECC2972AB8FD86FB836F22153A9BB35419C3816D11337
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...F...F......'.....IDATx...{L.U......#A../.9S.&:/..%]ti...TL][Hm.n..8,gsZ..Zk....:u....lF...".I..[.H(.q...{.sx.</......y....9.9.<."""""l%.J..2.L...xFp?...?.8....:N.M..`2.i..M.uZZ+'..C......9.f.1.X.}He....b...$..V.."..'T........[.s..}..F.........t.lnK..d.5...Yr..ld..x.\...iP... ....X......a ...i.C.D.E.H.&......Y....h..G.....1..h..C..>t...$...m..+..../.<.n4.."..(w..%,.R-...t.$.?..#.QB.+.ep..-.....r3.LYo....A...1CVK..$=.ER....}.o.m<.....#....D]O 1\..}..^....,.\|[..L..j..`...n.,...C.N.K..U...k..(.IF......1.....B6..X..U......oK..cvm...tP.....,lM....iAq.+...~.t..M.&...0......i(.y.Gq......Zw.,.H.\|... .H...zXR...>....K... )S...E......V..H0UR...P.....\.I......n.fj.\|..1...U(=.....~@=.X....Hq...4.....D..4S-...x.t;.....X0.....`....j....+..X8....z.t..DV.6c.\....=Ri2.y.{ac..../Gv./....X.n..o....x..ha.d.....p..V.QRg....8...?.[Qrxo!...r....Ni.4tOHz...Ca...z.K....er....3...;....(.0..[r)6.J.3.S'..(.v....l..~t..".&Fwx..M....P....>.7.E.Z.Y.%.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\70x70Logo.scale-140.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2005
Entropy (8bit):	7.837796638299837
Encrypted:	false
SSDEEP:	48:FtyHJuovwDhlXRvUCvqfPAuwdESKbtU04aQkClnRU8lbPxbsFIV4hEIA:FtygGwDhlX1oHO4KwCAQ9MEIA
MD5:	667BFBAAEB2D2B372B6E0D4BF4992CE4
SHA1:	4C6C2E07183963F59391945FBEE077B55F8F6B2A
SHA-256:	207519F1C7B6C7509BFEB7B55724997EEC6456C8BAF55E882E72FC5CD43DA221
SHA-512:	AC63A3DD2F6088E7849E3824C35FD58CA78EC77DC31E1F6CBD47DE7CC394318CBA7D2309912206A94180267BE057C2AF5C835424019E2A03EE33A2AB801BA9A4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...b.............IDATx..........S.d..........=...F...m...5.r..........m....g{......[1..q./.D.B."......)h.a.o..x.p..r....]..\....b fR......W.a.."..Ix............58.G.G%D.....0lE..E1D.<...u<o...6>....-.`..FX....l\.....K.....{..Y........D...............B.<G.....7.5...8...\....?.!j.b..F..PH..X....8."..,..R....X...((..G.0..&~a...{..DA<v.....H.4Q.u..a..#<Bk...E ..b\@'...3...U.\..4M...o.m.m.m.m.m..$..R9......&..NMW..{..4].....m....h..y/..x....a.[e..7.ua.^.lC8....l0....1...r.&........G.......c.....d....F]...M.a&.M..V..?[..t.P.Xx...<.(...s...'.Q....'.~{_......8....R.%..7\|O.Bl......Sr....^..@..........us.".M..?x.....T.....A....&.l........H`g..."...I}E.7..].=...C.gz........V!.EE.....7WvB.!.d..vJ...k.{?.......1.n/.Q.{.....LD..;k...\....]G..S.+....F3.}z.=F(.....$..D.[.y.... /Q..eU...]M.[r.......}.f.s..;..!...s..C...x...Y3...<....0.O.p.\..&5...f.u.....4..A..".. .lD..7.#..P.../.i. ......+...M...}/..U\...}..Ah3"t.....D...!v..V$

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\70x70Logo.scale-140_contrast-white.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 98 x 98, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.76630495035972
Encrypted:	false
SSDEEP:	48:TyhJvOYkuSoLYIWawZM7SkzaacHxXgr4RzhQpKP7C:6JWiEIOuWkCxCSzhQpCC
MD5:	93223E8777B581E988B703DF82593B17
SHA1:	40A035464C27041CCC87C7935C45100D93D1C948
SHA-256:	464AFAF960C32ABDC2C3937A48BF14C5D1A819B017E719FDED591D43A65D94C4
SHA-512:	B8A3EE4A71E609625EAB51F0F6DAFCC82CC47BA2C567CC8BF73CF6423056F9171276289BFDCC8428B7C07645097664065EE9B0B78874425BFF800178222FED12
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...b...........hIDATx...........9.Q.f..ttS....u....%..1.a.s.!f..c.b.b.K7QFg3..Y..2M5..6:B..z9.%..N.s>9.{.=..........\|.7------------..QNt.G..].E.....b.s.e..X.C...Q.b.;.p..m......g....L.\te.G\.d...F..X..=f..]y.A..\e.t....Ei''...d.X...X..7[TYh.1J..g...y....]/.,r...........mi..2.6J.6Yte.....g.....<o...;..v.T..KJm..\T....i...G.."Qe.c..1.I.T#.6...2...7.y.K.'.....p..J.2S.V...zf..Z%b..Z.6.z._j.}K..w..R.2.Y..M...P..l..d.JG..Sm..0V..o.u.'R..6...(U.k...k.+m..i].n.ub..D.b.JwJ......-1..(. U..\|.^....(."UO..z;.@,2Vi..D,...;K.NAi.."f.TO.j.XlO..}$..M6..".iC.."..MO]-..[(]"U.i..E...J.K..zn..".V..M..i....q.(=%.5...R.e...:P."..(.U..[...M.G~C......Q3)..]o.%U.*./.c....t..:J...q..k...g...R....\...A.@.kl...H.vJ...x..../....9.:..?q...Y..":@i...4f..E.Yi.T}^.....Q..#..h.#"...4S.y.l...AiG.kl.QWI.nJ.E.F.}M.tP...9...U.f..g...../....]..U:N.{..B..A.2..i.Ru..A"..+jg.kE./Ru..R.g.D...n.q..X-b...f...b.+.q......gD.Y.....q.....t..kA.."&j..Ru..."...j..D..4n.S.wD..gG.x..

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\70x70Logo.scale-180.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 126 x 126, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2699
Entropy (8bit):	7.8799233652993115
Encrypted:	false
SSDEEP:	48:Is+9LgA+9fj19UhKwdgrviOztr/CrWbqCLRTFxFCEEgq0Ol81sqAGz:IlSN1gBTOztr/jbzdh1y0wl1+
MD5:	704D0A2693B350E7C463B0FF2143835B
SHA1:	0313AD4C3690A590AC54552D2C27806E73776600
SHA-256:	D6367DBC074E37F3488C26B0BAD229BFE99F5C6BB0E28D37B41906C436152B57
SHA-512:	4517B2FA911149885EC5549F3173D3C774716740826873E4B2199C804B17E776A5296565930E5ACDB8D5476710A391B21E6DA8941DF64C525A487DB4619A1EA7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...~...~......#.....RIDATx......................f..`....6..m..j#fm.qm.Am.m......%_...q.i-.>dh.........q.o!!..]...LC.TF..D.o.8...8.O..\|.iLC#$PO<..1P.....wX....J..<5...$`O1.YU..g.L....<.....h....K.4Aw.....[.I...yU)....D\|..x......`f..................9f....Y...p..!..E..U%...]......l.#.....#gPB.5...^C4.G.........g...5R... ......W.~H@. .....8.....G...N.U...c....J".....YQ.m0....b.5.V.Y....:.......(W1.E...yb.,..a.bT.^.O!a...6...+!:...\|O1......ZQ9...M.6.....!.6..O.XI...#jF..w.o.#\|c...%Y.h.m.m.m.m.m.......8.qog.N.....3.}...R.....8...P.M.....].....B......3xs...:M!...K.;.mL.7l.N..=..7......sfJ.;..\|Q........}:m..08...y.+.5...D..:....\|8.m.]........04Z..b.......c.r....\|.....m.6/..!...Y..)4._..0KY.e.[.qL.!...X ..jk.....\|.....Ki....q...28...-.....<....4.d`.Z{.-]\|B..3 PJ.gP.iW-..]m..61c...8.b.,.. P?&.0........A..!_k`.\.s.>.......d..R...."<.e../.A.S .+...O.Oq.&.B.Y.6...S.!W^....... ..3.A.....GA.uX.\|[..Oh..=..[..9....l-.l..+...mM..Xu_.#)..

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\70x70Logo.scale-180_contrast-white.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 126 x 126, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	7.8839656878677005
Encrypted:	false
SSDEEP:	48:W/zeI9zj1u/VwgVNR+vEgxOfU99BpcZlp9uqRhq4eZDU0BMK:W/zn51gxN4RxH9hUlpkAMt/BT
MD5:	39E2FCF13C20103C5F449C06D3A4CF75
SHA1:	AE8E1BCE2BE17ED450D891864E6AA22642AF39AC
SHA-256:	5D46E4056F3915C279F1FA9EDF61D93529FBCAE5C59D616380EC5D9405B7763D
SHA-512:	8E4902262B064008804D49D1B5F27BB7B8F33ECEFB05181AA69534E1D21662719DD4F8E0677C58215F6C5CA9EB4FB92FCA54A89F9720230AFBF06A70216ABF26
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...~...~.....Hm.....IDATx...{p......1\0<.%.1<........L.(.0P....R.(Hkk.3.>(-.X.t...>.Q........#P.H.JECxZ.<...5...${.7......../...g........x<.....x<u.0.Y<.f.s.r..7..1.Q.#.#...X...C\|.r.......h...b.e..D.[.H..RG.q..f\.9RhV.y....<.Z..0..K.9.c.s(.C9...d=.4..YJ.V....l2..Y,.....u..kH&........rFh.Na.k8A%J..<.-D...Wc.EL'..T~.......I.........N..F...<E.Q$..-N2..a.D..;H Jt..%q.....ml......3L$.n..-.Ha0SX..\.#..w..28..W...Z.......Y.......o.......v5.......\|...xv.X.G5m.e....tzq.e.7.G.r..Q...D2l.^....E)J..14............~..HCg8...JZ..TN....id..l...3.Vz9...` ....%3.F..v.JG'....Y...,.lc"-.K.]y...h.m.0C.I....".(Gq....g.S>E#....C..+.....].u...+..I...g....b.H....3d.S =.O,.7[...q.\|.6/..U.U(.ed.,....DX{.JA}.im;..)..ld.p.?....QK.....H..i.....#.~&=.&....pZ..&.2....J.s....p..r...y.e.....c..3.g.H.z".#....C'M.h...?......v...&"...z.e(i.+Wz].....<....?....M+s.&....d.....0n.....s...<Ws?I....?.{...`5z3..w8.........s.B.d..K..K....LLY.j..^...a.p.~.z....-......l.dM.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\70x70Logo.scale-80.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	7.755097954664401
Encrypted:	false
SSDEEP:	24:TDh4JYYFMId219dZt07Zcglb4iS/cFEAAabL3/006Fs:B4JBMPVEbCe/006Fs
MD5:	32D3E390613CDDBD639E70DDB2511AC0
SHA1:	C96AC088E72D756F31896B16776EF100379F802C
SHA-256:	DC20E5AA2B500CD5B5C9F89647D3487810685C94268F22678E27820E2454BB3E
SHA-512:	7381CEB8FEE84F398082177F30DC01593BEEFA729C73B0166AF686BCD25D54312B202D9243834B754769DE41E9A1DEED74CA91A76DCDA918A749CDB4F08C124B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...8...8.......;.....IDATx...S.,I....[k.m.m.m...k.f....0..Ag5..<.w.1...r:..g.+...+........MX.k`=l......\(...........,vDq>.......x..`wl.U...x..[.....(..p...@u..z...1M../.D>...z..'vJ..U..'C.......?c:..U........GQ...,.P.T<...-..\|$~....q..n=L..iF....X....q.......p.6{q8.u'.R..C...Qg..YCN.:........#g^.R...w.......U..j...H5..eF......iO`..4r.R.[.....0...9{....u.v....X6!>.F`.Nk.....J...5.P..}..F.\..Lk._.`.#...od..7..4!V.......-...{r.P....9^5.2.(.G..OT..<9}1....A..Q...U.{C.....o..S.....S...b....z..T...o....z..Z.xv......O\|.8.....u......c...?.....u.u........p4.v`......kQ..4.....jzf.^....F..4...j:.._K.;..z]..0.0>..........\|..W..Z5!6.b?....2O.....,.>.Q.y..-...._..k..w.}.V....s.o....W..._Q...X..=Tcmc{N.P..1..j..'...l.-.?j^2..~}Zo.J..7..F....D.91.....#2^..7.}7........$.:P..oc"6I..)n...\|A..G.....l'..x..bM#.\|...e.yT...k..y.]9...2.ao.z~.g`4....e0L..........t....n*.....}D.>.O..Vv..vE.Qs.\.~...s..........v.....T..7..A.9.s.]zQ...Gb.q).2....e...

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Assets\70x70Logo.scale-80_contrast-white.png

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PNG image data, 56 x 56, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	901
Entropy (8bit):	7.682141855410327
Encrypted:	false
SSDEEP:	24:x2BZqWXRHKkqILfEDtySHnb98XPA8KWstHNMufZ4jJO2C:xZQEC8BywBmPAGpC4jJa
MD5:	E6ADD5AFC73F7B06FC2348550595F8D6
SHA1:	4D658BDDB93FA6CB423EBC61BD20DB37E4D37DB6
SHA-256:	DD6F46D32C3E235508F9E4C7D7F993BD807D955BCA7E63CF3D57C6C4C102F46D
SHA-512:	55437DFEA7F68A4572DFC86B5428CBE9DB86C0D32D0B09BA6B7B1CF8E49E5F1BB94285BBDC97D8EE00D70BA75921DB59644787C1BE1672FE37CEE09441F249B6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...8...8...........LIDATx...mh.e...c....#.."aM..f!Dh....eFaa......0$3.a.bS.(!..$..@%1-+.,.ge..\.9..=<...}...=..7.\'7.-////...T.2.x.F...Ur.5.v..L...Iv..-..a.1&...Y!...U.S%..a......k.V!=....'..M.Pl.F!..s.V..B8g.n..9a......Z.k.....vH..i]V.Yx.....ve:R.I-.c.d...\......S.s<.?....`....).Ab.za^.s.1....~r4[...6a.......$6.o.I.z..A.Z.HG.:.r.C..E..<+.#Q..P.J.._.xYX-...[I.'l.o.{...Q.Y.E.'.V..3...H........i'.w...........:a<...W2.I..0P8(K...IL.V....).V......=". .....;.,....F&..U$6.....d...e.T.}aK...4I.!.(.U."...,}-\G.Rx[&..O...$Kk.I$.k.[&..c......S,.v.....(.Ao...,...K[&T..\|.......G.G.6a.++t\...?...La......F.....r9..t.U.9.DG.8.o#..j.d..L.~..;B....e.f....,.......b{./.....N.......`.e$npL.U..f.j.I..A....Oa.^.F.N8`...xU.........@?..t%$.,...l.n)._h0/U.d.....l.C...I....R..)..........3H...N....h.9j.2.{.n_...y..m.9.5.^...H7.i.A.....e.?..R....]....IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\CUESDK.x64_2017.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	485344
Entropy (8bit):	5.205582677943175
Encrypted:	false
SSDEEP:	6144:plTZkQQzVVTgmAffw5QTzL6+75I+qZojZdz:pzkQQzVVTgmAffMQTjO+xP
MD5:	C96BDDD32F87687C1C941F104BC2D2CA
SHA1:	B6B34184F3F8184AD1388F8EA2B6909A412516D4
SHA-256:	31A6BB7059CED338295B6243133D008795ED055D0B631F227247E44C5C06CA48
SHA-512:	16DDA22CDC96305F19D98D9A309772281A88367195B7B324F36CAC5D12BE6FF7F9C3407F5D68C5E16A2A06D2A092750119E90BCA9F9B57F6AD4BA0029A0B0F86
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.y..........xE....h.+....h.+....h.+....h.+....f.+......p..ci.+...ci.+...ci).....A...ci.+...Rich...........PE..d....v\|_.........." .....N...........L..............................................VS....`.............................................#............`..6.......,F..."...E...p..(...@...8...................`...(....................................................text...hM.......N.................. ..`.rdata...)...`......R..............@..@.data...............\|..............@....pdata..TN.......P..................@..@.idata..X!......."..................@..@.tls.........@......................@....00cfg.......P......................@..@.rsrc...6....`......................@..@.reloc.......p......................@..B........................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\MEIPreload\manifest.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.824253848576346
Encrypted:	false
SSDEEP:	6:v5975JVSS18iMkh26VlcmutLwyAGI/zj//gQNMC:Bbt18l+LlMLqGU/gQNMC
MD5:	442699C95B20A60470421C6A4D29960F
SHA1:	C7317F2D2414C991C21205BA3C68A187B997E3C1
SHA-256:	44844CF3DDE6E80087AE0E6BF0D9326D7EF7D23326D24AC83AF0850BE26923D2
SHA-512:	C89CF089F7FEEB80C6DED11F1FCE84287ABE8216A6E05723D1A7FAF567C501C043CD1246FF8DBEE1240D2D79C41B698EF4CC3459589E68E5BFC5BED7FC3A150B
Malicious:	false
Reputation:	unknown
Preview:	{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "update_url": "https://clients2.google.com/service/update2/crx", . "description": "Contains preloaded data for Media Engagement".}.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\MEIPreload\preloaded_data.pb

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	8254
Entropy (8bit):	6.795641289553097
Encrypted:	false
SSDEEP:	192:bTOpyeS7AOv6EVp/m3FPKk15jjKVcOmQppXavFbeLfzrLyp:bTOk7AdEugo5jjK+5QppXaBebzrLyp
MD5:	D5E4C2634EFF8A9B3FAF432BF406D6D1
SHA1:	A691F5C9877079193C1F7DFB16DBC30BB0372EC9
SHA-256:	C6070A157B4E28D16FBCCBD233E93846DDB070C85E1A1BC64469B7A5F1424FAD
SHA-512:	B264E28AC8F111DF01C553445AADC7BCDB3F32A38A1A19D3F9D458270DFEAF80EFA7144407BD999892022AF9DDE9DBF8A0E19E7212720E1C6511EA9125AFB166
Malicious:	false
Reputation:	unknown
Preview:	..@5..0@...@y@o@.AK@X@.@w.!@.@.@.A.A.@.@B@.@.@.<A.A2A_..6strea.....kpo..anim..^...elo.tele..g....pan..bancidiz...don...Ikor........D...ap.cuem...ukleren.squl......ve..vco.. ....sten.tid..+v........dou...myvrs..=bb.jl..#streamfai..P2...nkk........10...f..R527......p...7............85.231.223....11.90.159.13...movie..w23serie...3tv.co...h...pla...00mg...bstrea..W93.178.172.11...49.56.24.2...........secure...\|qo.....routk..nitetv.roge..}map...ndavide..ci.t...view.abc.ne..O...j....lianonlinenetw............r..'oora4liv......8.topgir..33.sogirl..rshow12...ayospor.......mc..s...k......sian..nime.c..n......prof..ba..Mtochk..Zkra..Tg...-....K............@.'..2.vos......m..rig...r.. ......@g..>..........perpl..)...tualpi...gintvgo.virginme...eo...mbox.skyen..@aplay.O.E0B...d....W......portal.jo.._...e...ma..........Lsearch.ya...frida......a..Qhnex..jvarzes..ey...........e....y...d.tv...stfr......l......seigr..U...d...q.....z....serial...r...cuevana..Amovistarplu..a.......f

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\Resources.pri

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	3.118957212117411
Encrypted:	false
SSDEEP:	48:Whs+6rek/gF1A6Gbi+4eTy8iPTUucUITUuqQTUGUQTUsITU6UQTUQITUuUQTU0I0:WWnep/FFLxPoRJo+oGpoBo6po1oupop0
MD5:	400817D0A91767CB830767AA94383F31
SHA1:	73F36C895190223F94E4D52657F14454B2BCBA44
SHA-256:	35D92C86C1C054D1C03F4E58B83681BBFD8573143EE5E4CFB4CBD788A1FFC107
SHA-512:	2216DFC65E24961A18A4622FF6D8D8A1330283E64477A0E44BAC5B8F9A4CB5690FC90F598BBC152214EE6AA8770FE6608C4C809EC6F2CC73547D8166603B3E15
Malicious:	false
Reputation:	unknown
Preview:	mrm_pri0........ ...............[mrm_decn_info].............8...[mrm_pridescex].........8...H...[mrm_hschema] .................[mrm_res_map__].............@...[mrm_decn_info].........8.......................................................................................................................................................................................................................................W.H.I.T.E...8.0...1.8.0...1.4.0...1.0.0.............8...[mrm_pridescex].........H...........................................H...[mrm_hschema] ...................................U^........m.s.-.a.p.p.x.:././.O.p.e.r.a./...O.p.e.r.a.....................L.......................F...........A...........O...........1.../.......7...!...................................F.i.l.e.s...A.s.s.e.t.s...O.p.e.r.a.P.R.I.C.o.n.f.i.g...x.m.l...7.0.x.7.0.L.o.g.o...p.n.g...1.5.0.x.1.5.0.L.o.g.o...p.n.g..........................................[mrm_res_map__].........@.......,.......................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\assistant_package

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2975648
Entropy (8bit):	7.995833280717432
Encrypted:	true
SSDEEP:	49152:PpDH40urxwmLqFP3S8ytVJvYmp3UPdJPuPswCoUpBJmJUpjwyux:Pp40u7iq8y1Aa3UPemJmypjwZ
MD5:	5265EA7650B71CEA4E44E8AE0C3F9B8E
SHA1:	7370E500D66DF6E4EEB55F3924EA41D845DA0FD4
SHA-256:	622AD5D483EF31A21EEFDCA421C5B49E09EFF43ED83F46803A19A45A4694E23C
SHA-512:	52B21AC5DE93E43FBFB0D116EDECC2CD01615F79D85E9BFC8D7049EB726CA22369A857B2FC317729B918DC40D9C3945C051510530187A3BD679E7D1CAB5BEA46
Malicious:	true
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..................................\.......................................b.......................>-..)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\d3dcompiler_47.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4927400
Entropy (8bit):	6.402939366843168
Encrypted:	false
SSDEEP:	49152:BCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNS:IG2QCwmHPnog/pzHAo/A6z
MD5:	16D7A60E45ECEA0A9C09D31BB860C8DF
SHA1:	FF1102004A569166961DE5F7F96F68C9A766717A
SHA-256:	F79358C6ADFD156CB2A621DC0826EAE5E0E34F75C4B3BECC88070D4921F4BB56
SHA-512:	3AE19D410C6083B40C0FADA3FED6DCC3E784ABDE8289951290D27A652214C3E3D3FC342B88600D60AF16F281A67129CCEFB87FCF26E5083D785BEA6C65540CD5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....Z"L...`A........................................`%G.x....(G.P.....J.@.....H.......J..O....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\dxcompiler.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21676960
Entropy (8bit):	6.537117787581431
Encrypted:	false
SSDEEP:	393216:AYZikEW54N1l/xEqqSsajxV+mdMqoO2aKzbryMPqS:AXLFrG1aK3ryMz
MD5:	1139B1137E42B8151D9B5D1DAE5C06A6
SHA1:	A152CAD5103B30D0A44782EA5918793D46AD6664
SHA-256:	6DE9CF45C960EFF38F0672CD9998EA00644B54717A93B1F1C1FB894D90727A55
SHA-512:	F3053B63AA78DE7E8F1EDA02B4FFC92885966D8ADD2D58C20B284D396CAB1BAA72DAE5B3830CB19E567B8E70563C09516F9600AE20A439EA38102452AE9D0115
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." ..........E......G.......................................`K....../K...`A............................................p...H...x....@J......0@......J..)...PJ.\|.......8...................p...(.......@...........p................................text.............................. ..`.rdata...:.......:.................@..@.data...\|.....?..n...^?.............@....pdata......0@.......?.............@..@.00cfg..8.....I......NI.............@..@.gxfg....0....I..2...PI.............@..@.retplne......J.......I..................tls......... J.......I.............@..._RDATA..\....0J.......I.............@..@.rsrc........@J.......I.............@..@.reloc..\|....PJ.......I.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\dxil.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1519000
Entropy (8bit):	6.516141360369862
Encrypted:	false
SSDEEP:	24576:VCfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkrG:VCfhbh3v3mtEAQrW41obCraeRhy9ou68
MD5:	4F9BD56CCA7D2D3E1597B878A282D096
SHA1:	BE38C9277295D000CF6885BA8E83E6117280DBB4
SHA-256:	81FE8878F1F21EEB7311C421B2A6D4E1A574AC8795A439888E7C5EA939171943
SHA-512:	189115304C588EC8C369BC3480FFF23FA358661ADAF89F6EDEA3125C7DF99913F1DB8CF22BDC41E33A5CBD7C4A086664F45421AE3FF671AAA335A9924637D8A5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@AC.. -.. -.. -.OX).1 -.OX... -.OX(.. -.VU(.. -..R,.. -.. ,.. -.OX$.. -.OX-.. -.OX.. -.. ... -.OX/.. -.Rich. -.................PE..d...'..}.........." ........."...............................................@............`A............................................l...l...P............`..t........O... .......o..p....................o..(....m..@............................................text...\........................... ..`.rdata..F...........................@..@.data....{.......T..................@....pdata..t....`......."..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\files_list

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3699
Entropy (8bit):	5.219994817076452
Encrypted:	false
SSDEEP:	48:ZIlvE3eCPTuqaeDCOLIG4AUsKyIYKJhNewb059RVtZtDGSVRScScSuS0rgB6D:ZIyTf85XZyITJhowbO7VtiORFnbwU
MD5:	564DD1BE525B0C94E488CAF6CD945B33
SHA1:	5183DE6D8A636998A77332C52558FBC038CFCEC2
SHA-256:	1A5D4A7A16BE41F567CC4E13E7E355887EE486F72280C56BA3BF0E59F41EFDC0
SHA-512:	15369F5D5BEEE18536576EB38F60F0B97F197DD5E1CDC0F5B0D29DB28F156850BEEB72B72C7C0109AF8EF59249AF0050A43F1F584F49D152F474805347AFB336
Malicious:	false
Reputation:	unknown
Preview:	106.0.4998.74.manifest..CUESDK.x64_2017.dll..MEIPreload\manifest.json..MEIPreload\preloaded_data.pb..d3dcompiler_47.dll..dxcompiler.dll..dxil.dll..headless_command_resources.pak..headless_lib_data.pak..headless_lib_strings.pak..icudtl.dat..installer.exe..libEGL.dll..libGLESv2.dll..localization\bg.pak..localization\bn.pak..localization\ca.pak..localization\cs.pak..localization\da.pak..localization\de.pak..localization\el.pak..localization\en-GB.pak..localization\en-US.pak..localization\es-419.pak..localization\es.pak..localization\fi.pak..localization\fil.pak..localization\fr.pak..localization\hi.pak..localization\hr.pak..localization\hu.pak..localization\id.pak..localization\it.pak..localization\ja.pak..localization\ko.pak..localization\lt.pak..localization\lv.pak..localization\ms.pak..localization\nb.pak..localization\nl.pak..localization\pl.pak..localization\pt-BR.pak..localization\pt-PT.pak..localization\ro.pak..localization\ru.pak..localization\sk.pak..localization\sr.pak..localiza

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\files_list.1707230173.old (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3699
Entropy (8bit):	5.219994817076452
Encrypted:	false
SSDEEP:	48:ZIlvE3eCPTuqaeDCOLIG4AUsKyIYKJhNewb059RVtZtDGSVRScScSuS0rgB6D:ZIyTf85XZyITJhowbO7VtiORFnbwU
MD5:	564DD1BE525B0C94E488CAF6CD945B33
SHA1:	5183DE6D8A636998A77332C52558FBC038CFCEC2
SHA-256:	1A5D4A7A16BE41F567CC4E13E7E355887EE486F72280C56BA3BF0E59F41EFDC0
SHA-512:	15369F5D5BEEE18536576EB38F60F0B97F197DD5E1CDC0F5B0D29DB28F156850BEEB72B72C7C0109AF8EF59249AF0050A43F1F584F49D152F474805347AFB336
Malicious:	false
Reputation:	unknown
Preview:	106.0.4998.74.manifest..CUESDK.x64_2017.dll..MEIPreload\manifest.json..MEIPreload\preloaded_data.pb..d3dcompiler_47.dll..dxcompiler.dll..dxil.dll..headless_command_resources.pak..headless_lib_data.pak..headless_lib_strings.pak..icudtl.dat..installer.exe..libEGL.dll..libGLESv2.dll..localization\bg.pak..localization\bn.pak..localization\ca.pak..localization\cs.pak..localization\da.pak..localization\de.pak..localization\el.pak..localization\en-GB.pak..localization\en-US.pak..localization\es-419.pak..localization\es.pak..localization\fi.pak..localization\fil.pak..localization\fr.pak..localization\hi.pak..localization\hr.pak..localization\hu.pak..localization\id.pak..localization\it.pak..localization\ja.pak..localization\ko.pak..localization\lt.pak..localization\lv.pak..localization\ms.pak..localization\nb.pak..localization\nl.pak..localization\pl.pak..localization\pt-BR.pak..localization\pt-PT.pak..localization\ro.pak..localization\ru.pak..localization\sk.pak..localization\sr.pak..localiza

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\headless_command_resources.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	2874
Entropy (8bit):	7.929554105128607
Encrypted:	false
SSDEEP:	48:AAlAoYTpMRk3l4C9A+mVNJwTHTsf6vGpXEG9tqPrGBjTDn0owubFfa8yyHZda8Ff:fcTSRo2bNJeTsfWaGPrG50onlaQdaOQG
MD5:	C804FF6690145A181A4F444DF0FFDF31
SHA1:	03A873D07E7C75B604903459E3400CC8DD8E05C9
SHA-256:	E5FF4FDB0367F89E030CDC1CCAAC4B848490EB7F64EEBD38A37C2BFEA61498EE
SHA-512:	EE8397C7BAFC4ACC27F033A5F3742BD0F37DDC46D439B8E42B2849A623A5F41D8810DE79FACF53341D272A4562D6FD385725E629285DEBEA51B2F4AA2915D731
Malicious:	false
Reputation:	unknown
Preview:	.............i.....i......:.............-.1k.0.....Kv....h........."=G.^....Uqo9...R..1g.w..mqv..e.~.x...,+..[.<.8/...!..........6C..tTR.@..P.Xq....-_#O.........4`.P......\|...J.5........~.8.6...p.:..l.].l.Y._EY.................Y[O.H.~.WT.hlo..d.... .#.(MF......nO..o...C......6!.(...[}.R.T..#.nh.X2......j....U...-..v....#R"..:...............v.2.v~..M.Q]..6......b..$}S...u..N.N>.OPY.8......p...............>g..XA..?.....;-.!zy..p.U.....C.Y.'.....5..}.F"...z.".m...K......u..f."U.\..i6#r.Y ....B....m...U.f,_..A...J~jQ.@../n..9.`~._\|H.v...!W.p..O..$...E..S.(..i...R..0.MR...N(..P.3..W-.........X..<.P..>z. ...F=.........."y\.........E..W...d.~6...Wk[..x`....w.......q..K.=q..B............."j)a$'.....K..).@..N....2~j..7...1F........._.q.^nH....#....j...n.#.Z...gP.......s.E4.k....CT...3C....Zq$5.\|.lZ.;.I7U.&....Mq..W.....8A.T.7AyH<(........D....kQ......PF7^=0....R.R(mZ...Cxx..._.b.Y...L/..........+r4.....Q9H....H=...-._>A..."h.(....

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\headless_lib_data.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	962251
Entropy (8bit):	7.975901301978194
Encrypted:	false
SSDEEP:	24576:VPVVG7Hq0cFDAh1y+cBpoO0TOcu/zNItYDCpD:VPG7HEZpDBKOcaBDQ
MD5:	9CC5EF3D1B7D1446CC4B9683001E97EF
SHA1:	E57A05B3A2DFDBE81B63990553371F9C17C82251
SHA-256:	BA704D469107F14A6C34B6BC853707BAFD22BF908F8BB28252B777F02B6F3805
SHA-512:	46A2B3E22DC14F5D126373E8A42D87F06C52583DD98A59C0E2D07F3DECA535F0FBBDCED2593A8BD15772AC87176E14AC42BE6372C93351FD29BDE9526CAFCBDD
Malicious:	false
Reputation:	unknown
Preview:	........b...f.......R...........H.....Z......(....W...........".........................................O.....o.....M.........aj"...bjX...cj....djX...ej....fj....gjS...hj....ijR...jjX...kj*...ljJ....j.....j.....j.....j.....js....j.....j.....j.....j.p...jf....j.....j.....j....j.....j2....j.....jX....j....j....4l....5l ...6l....7l....8l....9l8...:l.....m!....n.....n.....nm....nU....nN....n.....n.....n\....n.....n.....n.0...n.3...n.7...nd;...n#<...n<?...n.@...n.B...n.C...n.G...n)N...n.S...n.T...n.Y...n.[...n.\...n>^...nF_...nw`...n<b...n.i...n.j...n.m...n.y...n1\|...n.....n}....nZ....nY....nw....n.....n.....n.....n.....n.....n,....n.....nw....n.H...n.I...n.Y...n.....n....nO....n.....n.....n(....n....n ....nk...ry0...sy....ty$...uy....vy?...wy....xy....yy....zy....{y....\|y\|...}y\...~y>....y.....y.....y.....y9....y.....y.....y.....y.....yU....y.....y.....y ....y.....y.....y]....y.....y.....ya....y+....y.....y.....y)....y.....y.....y\....y.....y_....y.....y.....y.....y.....y?....y.....y..

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\headless_lib_strings.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	3121305
Entropy (8bit):	7.980222567949498
Encrypted:	false
SSDEEP:	49152:LubwHD8J031/Lrwz3WBChxQx4isCeXOGEmUP9gOgpBH47xxnCEa3uFlrTPcauJif:abwHgu31/LrwrWB+Qc8mTHWCF3UlfPcm
MD5:	8FDE8D26BBD02385CB63FB986FAD0873
SHA1:	66B9EB7B4D0A5E021FEA075ED557465C85796362
SHA-256:	2253B6E7409AB4B06026352B4496CA9964DDA800445303DFC040F0F131E054D1
SHA-512:	36971DB4A4EC602D19E7CAE900DAA8FD648BF600EFB64B2845D8AA8C294AE64709393C21E72993BFE6B0A7E5C3A53131574BB2E4D3FFC7C548AA94112A895220
Malicious:	false
Reputation:	unknown
Preview:	........%.s....l.....l.....l.....l.....l....lm.....m.....n....+n.....n.....n.....n.....o....vo.....o.....p.... p....yp.....p.....p.....q....Tq.....q.....q.....q.....r....\r.....r.....r.....r...."s....Gs....^s.....s.....t....Ft....^t.....t.....t....0u....>u.....u.....u.....v.....v....\v.....v.....v.....v....Fw.....w.....w.....w....9x....px.....x.....x.....x.....y....2y....<y....~y.....y.....y.....y....Bz.....z.....z.....z....#{....l{.....{.....{.....{....3\|....\\|....g\|.....\|.....\|.....}....&}....o}.....}.....}.....}....I~.....~.....~.....~....D.............................B.....b.....w................*.....9......................8.....}.....................7.....}.......................\.......................}...............=.....................>.............................F.....h.....x.......... .....Q.....f................2.....O.....Z.....b.....i.....l.....m.....u.....}...........................................................................?.....L.....V.....g.....y.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\icudtl.dat

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	10750576
Entropy (8bit):	6.281341985010261
Encrypted:	false
SSDEEP:	196608:oQPBhORiuQwCliXUxbblHa93Whli6ZU6WOH:oMwkDliXUxbblHa93Whli6ZkI
MD5:	5784C2B7CA4736D45F771838D3DDA6E2
SHA1:	82A1CD2E1221044773ADDF27A32575DF6C06ADF1
SHA-256:	3A04D42D8C3149F2FC9350A16BDF2354FDDA46D68E3BA1ACE727E6DA2D98D17B
SHA-512:	5E465A22EA41658A9A910FDBCE276E805A2D6FD4D042750E96F3AB95A5C92C5EEAA76A160F745AA66B44AB8EB3FCC37FCFE5907AE19E16EE2FBB2C10CB82104B
Malicious:	false
Reputation:	unknown
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......F......,F...0..?F...1..RF...1..bF...9..uF...9...F...j...F..0k...F...k...F.......F.......F..0....F.......G......G......+G......>G..`...QG......dG..p...wG......G.......G.......G.. ....G.......G..@....G..0....G.......H..@..."H......5H......HH......[H.. ...nH.......H.......H..0....H.......H..@....H.......H.......H..@....I.......I......%I..0...8I......MI......eI..@...zI.......I.......I..0....I.......I.......I..0....I.......I.......J...3..$J..`3..7J...3..GJ...g..ZJ...h..mJ..Pk..}J...k...J...k...J...M...J.......J...$'..J...0'..K..01'.+K.. 8'.EK..p8'.\K...@'.sK...A'..K..@F'..K...H'..K.. K'..K...X'..K....(..L....(.$L....).=L....).\L...Y.~L......L.. -+..L....+..L....+..M...W,.7M..@.,.NM..0.,.lM....,..M....,..M....,..M....-..M..`g-..M...h-..N...T/..N.. ./.>N..p.0.UN....0.qN....0..N....0..N..P.0..N....0..N.. /0..N..p/0..N.../0..N...[0..O..@\0.$O..

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6896544
Entropy (8bit):	6.821344034536639
Encrypted:	false
SSDEEP:	98304:O++972SpVr5NHmjfFqy/ce50CD2UdjnMSrn2vTd:d+972ml5NH1HeqCbKs2h
MD5:	38CA4FA9A427D35D0F3229E784ABACD8
SHA1:	3585E728245C0CFB43B407A7EB12EE3D304E4FF4
SHA-256:	97BAEAD81C48262E357C4F9699401793DB88535B482D086568C5C4677A3D5143
SHA-512:	A13B0909EF72E03C8067F716ACBE97699B6BD05DA358852DD315FCD2317EC365154B7269D178A19E4BE01D4DDC6DDC319546F0F28287CB8480E2775EDFB98701
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........."...........d................@..............................i......ji...`.....................................................P.........b......;....i..)....i.$...L...8...................0...(.......@............................................text...k........................... ..`.rdata..Td.......f..................@..@.data...hJ....... ...f..............@....pdata...;.......<..................@..@.00cfg..8...........................@..@.gxfg...P&... ...(..................@..@.retplne.....P...........................tls.........`......................@..._RDATA..\....p......................@..@.rsrc.....b.......b.................@..@.reloc..$.....i.......i.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer_helper_64.exe

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	613280
Entropy (8bit):	6.219566766958555
Encrypted:	false
SSDEEP:	6144:hK1lTTI1REJl5n+Vak4i1lE+NkloonNSkd7NRN6EH8+nXeXooh8rP6UGz4gnq:E1D9kakF1lE+NqNbpRNukXKooWpGDnq
MD5:	8C993870769665AAB5619C9C1EED78FB
SHA1:	C3DFEEE609DDCE14CE243367F75D0567D5BA283E
SHA-256:	32CDCAF6C2AC01C0EB02A684B02DC347F8BD0E672D727D6C1E1C32B4393023F6
SHA-512:	196F7C80AA46247C0C1E7A53D848E96E41F39E133BB1A10FE080CB1AE3977ED706B33DEEE13AFF90A42D38E0D0DAB5B85D6D6631CE63C73261C168AFDD6425BA
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e..........".................@p.........@.............................0............`..................................................Q..x.......P....P...E...2...)... .......J..8...................pI..(....1..@...........XV...............................text............................... ..`.rdata..,....0......................@..@.data...tk..........................@....pdata...E...P...F..................@..@.00cfg..8...........................@..@.gxfg...p$.......&..................@..@.retplne.................................tls....)...........................@..._RDATA..\...........................@..@.rsrc...P............ ..............@..@.reloc....... .......$..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\launcher.exe

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2294176
Entropy (8bit):	6.471339679882766
Encrypted:	false
SSDEEP:	49152:EiOsyw8HMIc9BnsKgma2BbvosRMs1ONZlV:ZO4BsKgfIvosS3
MD5:	C76F1E24C27D10347C3851ED2B7767C4
SHA1:	42DF4C074792F81ACFD0487ED83BA42E69EA9122
SHA-256:	85FCAFA1AFA1DF27CE6A79886FE1596BCA1BE5F4813808124C96EA088BAF11FE
SHA-512:	2B3E8DF573381AA9482AB4B0347E716919A4AE03B1DA96F21C35B38E222A5EFD2F05C418B979614BD555693097CA15F0AB4BBA828BDA78FE9F90E7EB67917CB0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........."............................@.............................@$.....!.#...`......................................... ...b.......h....@". ..... .,....."..)... $.\.......8.......................(....C..@............................................text............................... ..`.rdata..8....0......."..............@..@.data...............................@....pdata..,..... .....................@..@.00cfg..0.....!....... .............@..@.gxfg..../....!..0.... .............@..@.retplne......!....... ..................tls..........!....... .............@...LZMADEC......."....... ............. ..`_RDATA..\.... "....... .............@..@malloc_h.....0"....... ............. ..`.rsrc... ....@"....... .............@..@.reloc..\.... $.......".............@..B................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\launcher.exe.1707230173.old (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2294176
Entropy (8bit):	6.471339679882766
Encrypted:	false
SSDEEP:	49152:EiOsyw8HMIc9BnsKgma2BbvosRMs1ONZlV:ZO4BsKgfIvosS3
MD5:	C76F1E24C27D10347C3851ED2B7767C4
SHA1:	42DF4C074792F81ACFD0487ED83BA42E69EA9122
SHA-256:	85FCAFA1AFA1DF27CE6A79886FE1596BCA1BE5F4813808124C96EA088BAF11FE
SHA-512:	2B3E8DF573381AA9482AB4B0347E716919A4AE03B1DA96F21C35B38E222A5EFD2F05C418B979614BD555693097CA15F0AB4BBA828BDA78FE9F90E7EB67917CB0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........."............................@.............................@$.....!.#...`......................................... ...b.......h....@". ..... .,....."..)... $.\.......8.......................(....C..@............................................text............................... ..`.rdata..8....0......."..............@..@.data...............................@....pdata..,..... .....................@..@.00cfg..0.....!....... .............@..@.gxfg..../....!..0.... .............@..@.retplne......!....... ..................tls..........!....... .............@...LZMADEC......."....... ............. ..`_RDATA..\.... "....... .............@..@malloc_h.....0"....... ............. ..`.rsrc... ....@"....... .............@..@.reloc..\.... $.......".............@..B................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\launcher.visualelementsmanifest.xml

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.996593526126476
Encrypted:	false
SSDEEP:	6:ejHyaVic4subiL/bWHMjizddDhkQwYZXXKmJfFmkQwYEbghuPYEpwhugVFQ:eF8iDbWHMjizd2O/fbrghuP5whuQFQ
MD5:	E8D8EAA4C2826C083AB9243B5CBD7BF8
SHA1:	534361AE03417DFD14EBD6F961B707C75A2AF41A
SHA-256:	B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
SHA-512:	8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
Malicious:	false
Reputation:	unknown
Preview:	<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\libEGL.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	480160
Entropy (8bit):	6.40242761130664
Encrypted:	false
SSDEEP:	6144:LVmesvX6ZsNBhoEJqfpIkNYygga04BcKRebwLM:cZv6ZmBhoEJWln54BvY
MD5:	3ACC473E0D0AC70CE8E9FBB35D92B86D
SHA1:	D576A67EC2E71EE73E0548FB76CECF798BFA34E5
SHA-256:	38973A7ACC72AB08106B7F106630ADFF9B422A3F3E29775DFECDAA1237A45B14
SHA-512:	B59F6CB29368D7964285959314CAC4BB5706AFD2EB5C5D08DBF92F3B294D990AE37ED7FA128B231A76805D4C3397025BD950B2D2B48A62EA41D80C16CD3523F8
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." .........$...........................................................`A............................................h...8...(.......H........A...*...)......H.......8.......................(...@...@...........`................................text............................... ..`.rdata..t...........................@..@.data....K....... ..................@....pdata...A.......B..................@..@.00cfg..8....0......................@..@.gxfg... &...@...(..................@..@.retplne.....p...........................tls....!...........................@..._RDATA..\...........................@..@.rsrc...H...........................@..@.reloc..H...........................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\libGLESv2.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7785376
Entropy (8bit):	6.490783624840005
Encrypted:	false
SSDEEP:	98304:7FYqwEz5PNrTVMt9UuM9n9/mZ2xaRIerK0o5xy+YXm3sqV:7FN7tUt9UXQRIRylCsm
MD5:	C903757B89C2852C46AEF7E040792391
SHA1:	76C84F8C7CED56EDB64F990FCBA1B07ABF249BCA
SHA-256:	15990BC469C23264D4FE08717894CE4998E62ACD8869D3AF4162304ED9E6CA09
SHA-512:	710F9E71D6FBD4DF1819B5C207FEDE3A84699AFA5BBB794289F55A2B879142D1664B5679F6ECDAD99239577C8FB57E81E7CC3AED2071815EB75DE4CE42F12AF1
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." .....J[..R........I.......................................w.......w...`A..........................................n.....K.n.d.....v.......s..V....v..)....v.......m.8....................m.(....a[.@...........X.n.......n.@....................text...%I[......J[................. ..`.rdata...`...`[..b...N[.............@..@.data.........o.......o.............@....pdata...V....s..X...<s.............@..@.00cfg..8....Pv.......u.............@..@.gxfg....,...`v.......u.............@..@.retplne......v.......u..................tls....B.....v.......u.............@..._RDATA..\.....v.......u.............@..@.rsrc.........v.......u.............@..@.reloc........v.......u.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\bg.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	804211
Entropy (8bit):	4.786533013572949
Encrypted:	false
SSDEEP:	24576:VAdW1ZRh3QWnN/fhIWIu6g2HK2zxMfvYvdAs1aEUiVbZ7q3lNKVDxL0s3ySCH0Rp:edBWnFIlK2zxMfvYjUiVbZqzKVDxL0sv
MD5:	6473CEEA755B8DE138BC6B62811DFEEC
SHA1:	56A6C77A06708C1BB42FA20A685A738A440B8E85
SHA-256:	62ACE5BBE86926657387ADDF4396E2447E22B6B319A8B3E0C3B31B88A0085924
SHA-512:	5C3374265D389AE55457479E68A9F02987A230F2C6542C9C155546EB13634D42ABD8CF98460E8D9F6989326D6D28D89FECB3207259B1543B047D54C280842234
Malicious:	false
Reputation:	unknown
Preview:	........!%..e.P...g.X...h.]...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....a.........................................S...........[...........{.......................^.................O.......................A.................F.................D.....0...........P.................b.............................d...........b...........w.................M.....................................................D.....k...................................B.................i...........Y...........(.................. ..... .....!....r!.....!....'".....".....".....#.....#....<$.....$.....$.....%.....&....='....o'.....(.....(.....(.....).....).........a.....*.....+....7,.....,.....,.....-....u...........^/.....0.....0.....0.....1.....1....j2.....2.....2.....3....z4.....4....05.... 6.....6.....7.....7.....8....y9.....9....A:.....;.....;.....;....7<.....<....b=.....=.....=.....>.....?

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\bn.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	1032955
Entropy (8bit):	4.376919270271039
Encrypted:	false
SSDEEP:	3072:IseJ9J++6Ojrk1gtrxq21aRGiH19OFbBTFW1+1slRjnM:3eJ9Y7DOF1uCbNFhGk
MD5:	E59A4AE01F2609DFAD3178AF753E8388
SHA1:	70E60F97A2FD9393C39D64C7451F7585369E0235
SHA-256:	6004A37537E5D7A3E63D6631F2C02C0907A615451F2851F28351E805A4717452
SHA-512:	6429D85BB60A29E329C52AFEB5356DF9CD0079354B5BBE77D8964D943E1E1839376A21E29FC592F72B68FE3071D542EBF8BADD5AA0FE80B7A17CECE2535C9308
Malicious:	false
Reputation:	unknown
Preview:	........B%..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.?...y.E...z.T...\|.Z...}.l.....t.....y.............................................................................7.....t.................d.................l...........E.....j.....d...........a.....Y.....8.......................b.......................b.............................l.............................u.....d.....4.......................f.............................x.......................l.................!.....g...........B.................6...........c ..... ..... .....!....H".....".....".....#....C$.....$.....$.....%....1&.....&.....&....P'.....'....<(...._(.....).....).........(....J+....f,....1-....y-....s.....B/...../.....0.....0....)1....g1.....1....e2.....3.....3.....3.....4.....5.....6.....6....H7.....7....%8....Z8....?9.....9....H:.....:.....;....1<.....<.....=....D>.....?.....@.....@.....A.....B.....C.....D.....D.....E.....F....KF.....G.....G....RH.....H.....I

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\ca.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	509235
Entropy (8bit):	5.4339629194385095
Encrypted:	false
SSDEEP:	12288:YPIQ8yz7Y6ybGbf1bCCrz+W58riURkcvKOl3nRWg+O5F5ibSFRoCQrGy4SHN1e92:Ygp8U/V5nRrXk2g0tjPeX
MD5:	0580D2114A505397B0CEF4FAF1CE9062
SHA1:	B3C199E399B851FE2ABC397E3717B1E3909B56A2
SHA-256:	375400C9F8673228FD141E9D7AB970BCCD752E01E46A5B8170E1439B3ECEF120
SHA-512:	67F822CF631C08961953D638AAE1C010D66C473A647885AB1E6245A88F865AE1DD29BB1111166A55F699C611224F7E5F663DDF1010D750C2B4068559E8198347
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.>...g.F...h.K...i.S...j._...k.n...l.y...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................#.....+.....3.....:.....A.....H.....I.....J.....L.....f.......................d...........`.................T.................I...........-.....L.................G.....d.................F.....Y.................=.....N...........8.....z...........-.......................u.................1.................".....6.................Y.....t.............................{.......................g.......................E.......................E.......................T.......................A.............................e.......................U.........................................R.......................M.......................d.................3.......................s.......................V.......................`.............................6.................C.........................................;........................ ..... ..... ....'!

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\cs.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	502673
Entropy (8bit):	5.866616725282955
Encrypted:	false
SSDEEP:	6144:4gMkdlsM/TOimzetrNOBs8SBB8QKssA1JjbiLqvv4OT:4gddls+DmzetrNO68SnrH
MD5:	86054BF4C6429599BCEA1A0E794CCAE7
SHA1:	4BDD15B9CA09EE20FE7C76F3BD229130A265B4FD
SHA-256:	F1E24FB55ABBB7A01AFF4C2A5AE151701A05EE40235FB8ECDAA3D12AB1BFC34A
SHA-512:	C5568019B9BC48DC864B506724BB43DEFF50F62E91093AFC534239261164BC8590B75430CF44CABC0376C7998ED94F52F63588FEDC4B28D8F13675FCBBE50368
Malicious:	false
Reputation:	unknown
Preview:	.........$=.e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...\|.P...}.b.....j.....o.....w.........................................................................................\|.................^.................&...................................8.....P.................F.....Y.................).....<.................F.....l...........}.................Y................. .................(.....8...........(.....g.....\|...........w.................2............................._.......................?.....d.....u...........B.....{.................R.......................C.....n.....{...........E.....}................._.................#.......................L.............................e.......................l.........................................T.......................Q.......................~.................6...........$.....e.....w.............................g.......................q.......................u.......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\da.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	466623
Entropy (8bit):	5.497729824929994
Encrypted:	false
SSDEEP:	6144:pPqY+H12lHXZRwzVW4FsMhL+s0d46RGwPwmzZhNqENiQ3pqj7N7DecFsppK0lpB4:tYH181MhuR77qENiWKFK9TB4
MD5:	AA6980D61FD803D14F70AE552797CD68
SHA1:	EDB00FC9E304D8C61920AB74B84BA2C5F280F599
SHA-256:	234ABF4BA8682A26063D8107C3626979BDD3686B00E6A0E54089C2D5809E2875
SHA-512:	63FCC92124C7AD4C4F1C401AED02667E3FAEB64FB3F6A8969AFAD747C5FC6624C0D7FD91398414B673BDCBC0B5BBB00614FB8076C7E04F6A46585AB96956CD6B
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....g.....h.....i.....j."...k.1...l.<...n.D...o.I...p.V...q.\...r.h...s.y...t.....v.....w.....y.....z.....\|.....}...............................................................................3.....G.....`...........G.......................y.................Q...........&.....B.................B.....V.................,.....9.......................%.......................7...........#....._.................\.........................................Q...........%.....?...........X.................&.............................f.......................?.....c.....q...........7.....h.....{...........<.....l.....\|...........0.....[.....h.................5.....?.................%.....3.................w.................D.....k.................!.....?.....W.......................+.................M.................<.....a.....z...........G.....w.................9.....w.................n.................V.................3................./.....A.............................m.......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\de.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	508744
Entropy (8bit):	5.526111701363247
Encrypted:	false
SSDEEP:	6144:4w8ABBbRsgWL93OUnz8Cxldz8bSuT3P94x1SmlmkVQiEmX:dZ5UoCxr8Tf9fz8X
MD5:	D7DE72052ECF5DAA6103F19BF3942887
SHA1:	F9F6AD8BEBF9EECED54A47F6CACBFACD805F86A5
SHA-256:	B8067E58254CA6BE29A0839AF9A8409296517C8868815F1166711B9B9FA971F8
SHA-512:	851C5F840AABC816FB4282F8DD935844A1C3744F988CBBE50A63C9A916BEB49C94EF29C072C842BCC0DEF70292168929BDC54781C7E1A720C669CD308FF3A920
Malicious:	false
Reputation:	unknown
Preview:	.........$\.e.T...g.\...h.a...i.r...j.~...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.-.....5.....:.....B.....J.....R.....Y.....`.....g.....h.....i.....k.....\|.............................7.................$...................................=.....W...........M.........................................9...................................4.....V...........l.................G...................................V.....h...................................>.................#.......................4.......................G.......................v...........@.....W...........E.....\|.................s.................%.......................T.............................I................. .............................{.......................~.................S.................?......................A...........&.....R.....e...........\.................3............ ..... ..... ....2!....n!.....!....."....."....."....."....#.....#.....#.....#....S$.....$

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\el.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	869279
Entropy (8bit):	4.877941125668382
Encrypted:	false
SSDEEP:	24576:RWs01fjWCKb9wBZKD2x0EbvL7FMrX+mIeJdlmipqpWbIzK0Yt2cd9oM6zberOykm:Rb01fjWCKb9wBZKDFEbvL7FMrX+mIeJv
MD5:	60D08DAE18FD40747887DE8F5ED564B8
SHA1:	3D2BE8AEB79F50A494A0ECBCACE1A9798EEAA473
SHA-256:	7BD6FB6D3F7CA1B6448D83ADC98910ADA9B3CE34F6871F11A1A5E6CC665A371E
SHA-512:	50224E66DB5C451FA9C42A2F6E993B51F69CCA3B670B571CDDE5EC0F2768CF7B985663636B083A6A15282A5E5B742ED432CC87F4818DE84041436121EC42D4C7
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....g.....h.....i.....j.....k.....l.....n.%...o....p.7...q.=...r.I...s.Z...t.c...v.x...w.....y.....z.....\|.....}...............................................................................T...........................................................E.....M.....!................."...........7...........4.................;...........o.......................q...............................................e...................................C.....4...........x...................................o..... .....l...........C...........9.....^.......................-.................N ....y ....B!....."....p"....."....j#....@$.....$.....$.....%....J&.....&.....&....~'....B(.....(.....(.....).........h+.....+....m,....5-.....-.....-....n...........-/....I/.....0.....0.....0....!1.....2.....2....J3.....3....G4.....4....-5....T5.....6.....6....?7....q7....\8.....9.....9.....9.....:.....<.....<.....<.....=.....>....U?.....?.....@.....A....(B....YB.....C.....C....HD....jD....qE....kF

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\en-GB.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	410751
Entropy (8bit):	5.554486356490802
Encrypted:	false
SSDEEP:	6144:aXQq7qF/f4rkBc1Rz9zf0yvzaKgU46d92WRg:EP7qOrlrXn46lRg
MD5:	7E80E58FC590DD49E1ADAA5FFC94303B
SHA1:	3BB1075A93D4CD7D60D7DDECD573FACE4848BFD3
SHA-256:	D8B7615CE7A44DF67C12F4B2C511695AA5705D00AF2A10D63615D68B2EE8FFE5
SHA-512:	E3928C6DA1BAE5F87058CE585727410703E224607EA977A4FD486986CC4BF2EC579648B071B09E8B436E6D3749C5CF2AE86A94715559F8C116D29C6B44D8E5EC
Malicious:	false
Reputation:	unknown
Preview:	........3%..e.t...g.\|...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...\|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................:.......................N.......................D.......................H.......................$.....j.............................U.....b.......................4................. .....8.............................h.......................6.....~................. .....~.......................J.....e.....t.............................X.............................j.......................F.....s.......................6.....A.............................I.......................".....{.......................Z.....}.......................9.....N.............................j.......................Q.............................[.......................?.....w.................b.................!.....x.................&.....n.......................2.....T.....d.............

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\en-US.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	413189
Entropy (8bit):	5.552566492820274
Encrypted:	false
SSDEEP:	6144:3xoXazA0EeHjErnngn/C3ZwiAbyvbBw5/26O9bUR6:3xoXBq4r5ZwBaG26PR6
MD5:	606C30A8D35DA73F2C39B6699465C45B
SHA1:	97BDAAE7FC9486352FFB25A62323F45BF8F5EA4B
SHA-256:	C4C45E0DA2CEF56C79E32E678D5C8D33D14E4A8636CB82AED18D3424CC433699
SHA-512:	37FD8635B236C9BDB8E422E32BB47D6CEA6F8C47B52FBB04D018AAA2717F0BAC9320928A217F6106C1E1034571864482D7EFB44951BCA560E5AE3222533169A9
Malicious:	false
Reputation:	unknown
Preview:	........T%..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.7...v.L...w.Y...y._...z.n...\|.t...}.................................................................................................w...........#.....6...............................................+............................._.......................$.....g.......................-.....R.....i.................Q.....i.................;.....I.............................g.......................Q.......................D.....{.............................=.....G.............................M.............................w.......................>.....g.....r.................&.....1.....z.......................T.......................O.............................M.....m.......................5.....D.......................C.............................B.......................'.....g.................#.......................H.......................I.............................Q.....s.................+.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\es-419.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	497838
Entropy (8bit):	5.407436827719351
Encrypted:	false
SSDEEP:	6144:xrsmyRMOHlp70XvEXuHkd/Vfm+dJGGqYSlcoyEKG2BrpB3F9iB3KiI4:xA/RM6lpWvaum/5GcoyfYaid
MD5:	E0731EE8CD647DB19BFD822D7FCB67A6
SHA1:	EE63F1019F062AAE3B009F41B38462473DCD7F9D
SHA-256:	11E649A8C5F030A70E979C7352ACB7F65B889377CE196037302EF47A832359A3
SHA-512:	7CC423EB788D9F159B14D954FE5F4AACA9F9A21DFE2D665F9C3CF9D83FE1783B6B9B4677CE4596CA3C7CB960FCC9960E60F633B67F2ED5A1A18BFB62792D4A5F
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.@...g.H...h.M...i.V...j.b...k.q...l.\|...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................&...........6.....=.....D.....K.....L.....M.....O.....a.....v.................5...........).....D.................a.....y.........................................7.....R.......................2.......................(...........".....h...........!.......................p...........!.....4.................G.....^...........J.................E.................D.......................%.....{.......................r...................................=.....P.................R.....^.................;.....F.......................).................7.....G...........:.......................a.......................c.................T.................%...............................................u...................................4.....N...........c.................n...........-.....[...........A ..... ..... ..... ....2!....U!....h!.....!....Y"....."

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\es.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	494787
Entropy (8bit):	5.3950461154341935
Encrypted:	false
SSDEEP:	6144:8O7ajRykLs12SjsriKB7ev6PZZk8jOf19Xgc+JMLyOm+KnwzP1X7jHUo0WyE:80aj8Uii7eSw7ZLyU7jXnyE
MD5:	70CC8ABA977446D14D4E911610F6CB0D
SHA1:	465E6C14ED5CD6F3C23745395CD327F2182099A2
SHA-256:	942621FF43034FC6310E3B097C3A08625D0B0DC16B7087CB327F10C85CCE0D64
SHA-512:	3EEA1EE1DB3C980CB037F288EA589136F3828FFEF9E9F3B8C10D73551C40352CC0C5F69014A1933CF3F40B6ADB76DD219E6ACCA855B792536870C102075CD3A1
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.0...g.8...h.=...i.E...j.Q...k.`...l.k...n.s...o.x...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................%.....,.....3.....:.....;.....<.....>.....Q.....f.....{...........)...........!.....<.................d.....z.........................................3.....N.................8.....H.................2.....C...........=.................1.......................u...........#.....4.................@.....U...........I.................A.................*.......................(.....~.......................p.........................................,.......................!.....u.......................\.......................S.......................b.................8.......................7.........................................:.....M...........B.................'.....s.......................q.................1.......................w...........[.....r.............................q............ ..../ ..... ..... ..... .....!....v!.....!

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\fi.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	463392
Entropy (8bit):	5.472777831938294
Encrypted:	false
SSDEEP:	12288:PkZnG19CPf2IEqWaNT4YfXlplzvIViYHtYlVtyKXbUkc1JQ:P0D2PmudI1
MD5:	1FA82B7C349BB552462B8DDCC1C516C2
SHA1:	BCEBF029B0B7D82532398526BD2FFD61B8E3703A
SHA-256:	070A9E08E7B31282619AA22EAA53DB053E9C5D7EFE26AA5A7ADFCCD304987066
SHA-512:	3D567CB6CC18A9038AB41B5B6ADCFE1E65719344FD674D8964E34D5A9B079C580AF6B0E8FFE65A73E3B1818E34A2ED5FC4E642A60DC75C26524B8256D3BCF098
Malicious:	false
Reputation:	unknown
Preview:	.........$M.e.r...g.z...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.$...z.3...\|.9...}.K.....S.....X.....`.....h.....p.....w.....~.....................................................d...........7.....J.................C.....V...........3.....m.................W.......................L.....y.......................=.....M.......................9.................^.....x...........*.....V.....l...........,.....[.....p...........-.....^.....\|...........f.......................q.......................D.....g.....u.................).....5.............................d.......................I.......................%.....\|.......................[.......................n.......................`.....\|.................@.....b.....{...........>.....b.....q...........=.....t.................&.....=.....L.................-.....?.................4.....N...........Q.................".......................2.............................O.....h.....x...........,.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\fil.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	517013
Entropy (8bit):	5.305512565004012
Encrypted:	false
SSDEEP:	6144:OBiz3jmCmgogFpPVD5ZPvyLWCy/bK+fmX:5toWQWCyKBX
MD5:	D6155A09459E3BDE17A61C33E3C02671
SHA1:	0D4E4C2686C072D8788A0B6B19FB4B8244B179FD
SHA-256:	BB91A553AEDD5724837C09EB2363AFD5790BC282402B50F91E069C2EEAD3B732
SHA-512:	C0FDD197AA25150F4774068F7946C817F1AE61A13B0535F7F531251F9431B54E07CC58FB49F94726ED0E77E594034244F57F50D6C8C36064451A3430037817EB
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....g.....h.....i./...j.;...k.J...l.U...n.]...o.b...p.o...q.u...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................$.....%.....&.....+.....8.....Q.....g........... .................-...........$.....i...........&.................:.........../.....s.................S.......................f.................=.............................3.................".......................q.................7...........2.....\|...........+.................9.................#.....@.......................#.....x.......................}...........(.....>.................@.....O.................D.....R.................D.....R.................G.....U...........V.................'.......................!.....s.......................p.................:.................*.......................5.................F.....a...........U.................^...........a ....w .....!.....!.....!....."....~".....".....#....7#.....#.....#.....$....-$.....$....#%

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\fr.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	528796
Entropy (8bit):	5.429448798126092
Encrypted:	false
SSDEEP:	12288:gO4U1B1h4HQLKpz2yxPgxPIHSWtTr/lNKZ/rMYnYbnBe3zZGAJgXJRCvB2gjSWWl:4LK8+GA+n
MD5:	BD2E22400E811266BDC4033912E456C2
SHA1:	06758D64BD65C47DBF5ABED28279AB4223ADF355
SHA-256:	CDEAED60E590FEC735AE848C1C7F054146399DFF949D6209B3DB7C4150AE13D2
SHA-512:	388F3C5EB7CEA69D772FF79A25E9D67586700716808963B0A9C3AF5B3F8F36A8678447282F4D90D9C4C973ADFB21177C801FC9C069EF48283C7049EA75F7891D
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....g.6...h.;...i.L...j.X...k.g...l.r...n.z...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................$.....,.....3.....:.....A.....B.....C.....E.....U.....f.....x...........,...........L.....n...........U.................=...........".....>.................m.................J.....v.................Z.................5...................................>.....b...........@.......................i...............................................#.......................d.......................^.......................d.......................\|.................-.......................0.............................{.......................z.................A...........%.....<.................0.....N.......................$.................*.....F...........Q.................-.....\|.................-.......................z...........,.....L...........J.................8.................. ..... .....!....h!.....!.....!....0"....]"....q"....."....]#

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\hi.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	1060976
Entropy (8bit):	4.405231340898169
Encrypted:	false
SSDEEP:	3072:upcJGR03YAb9Ky0+NpTV/BB0ZV1d1EGZDS71exEWUu2bhtWi2V8nC5kb6AbWLgeS:upnR4YAxKEOwMLA8He
MD5:	E8C9AAB233B99B6F644E073F272EF1B5
SHA1:	346CEA2917FCF52BFA13EA1281F9AF0AB1C73627
SHA-256:	B4AD8B7E076675CAE9E7D326BC38E540664D4DE1BC8487841658B364DA1B4DE0
SHA-512:	3BA61F6EB7817E49E04BA86CFE12CB419EB18118539F66AEFC0585C2BC19B91E1DD26E7B7723955C64323860D643A1A077A20ED8D2002BE9A22297B1B06A1B0B
Malicious:	false
Reputation:	unknown
Preview:	........!%..e.P...g.X...h.]...i.n...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.).....1.....6.....>.....F.....N.....U.....\.....c.....d.....e.....g.............................>.....D...........:.....6.............................B...........u.....h.....4.......................s.......................G.......................h.................%...........u.................]...................................8.....C.....(.................=.....:...........3.......................4...................................L ..... ..... ....z!....8".....".....".....#....G$.....$.....$....p%.....&....p&.....&....1'.....'..../(....H(.....).....).........8....E+....6,.....,.....,.....-....`.................t/...../....(0....M0.....1.....1..../2....[2....I3.....3....~4.....4.....5.....6....[6.....6.....7....j8.....8....*9....-:.....:.....;.....;.....=....M>....7?....h?....v@....FA.....A.....B....EC....'D.....D.....E.....F.....F....0G....wG....tH....@I

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\hr.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	493647
Entropy (8bit):	5.562173513123377
Encrypted:	false
SSDEEP:	3072:suBLkZQV30FNNJA03DLxicP2aBV08LQfvBAGC7xuV9c3RqF7caDn3LWO5AHs1lBd:b+QVkTN93HxHXqAgcPqh0wg5ar8C0Tw
MD5:	167E2468D8A4C53E8D32697F4911D8E4
SHA1:	F2E39D8979AADE8FD12EC5FF3118F99D468F1BCB
SHA-256:	DBBF5A6FE66C08D50AFB68DD2C59F6FF8C190F33F1945D6F3A71DFBE171B0001
SHA-512:	F0F8D7BD14252151E9D4F67E78670AE6381D92385F6F9B440A1F37659419A3A1B80377F96A19F30053F2CFC5137F65A9B98B0BA6B3D50515DDF5EF0CE02DD60C
Malicious:	false
Reputation:	unknown
Preview:	........9%..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.,...y.2...z.A...\|.G...}.Y.....a.....f.....n.....v.....~.................................................................p...........^.................K.........................................j.................!.....~.......................r.......................q.................%...........".....v.................d.................$.......................F................. ...........9.......................o.......................I.....k.....\|................./.....?.................9.....N.................+.....:.................=.....R.................%.....5.........................................X.....s.................5.....R.......................8.......................%.................J.....{...........&.....K.....a.................`.....y...........Z.................R...........-.....?...........'.....e.................L.....{.................).....G.....Y...........5

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\hu.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	526476
Entropy (8bit):	5.673633958440337
Encrypted:	false
SSDEEP:	6144:mMVtkmDjAJDlgtqCWRhqPCwtGEmewL9X2BdpEN/3ICzqPHzA9skatED5HGTZfp67:HtkmHKJICHhBYALD5HGyEb+X
MD5:	21F4E2BE311873BA5EBC6402CD709FF4
SHA1:	B7327CAE62BD134390468CB58BCDB4AAF66F174E
SHA-256:	E7BF364CE1D240ABA4F489B393FBC7E01872E71D6E68549875D7FB08AEB59A6A
SHA-512:	5AD624FE2BA0520E8401A92CA67C0A284AD84444EE6C29C6E195F7BA9F32ED46254AD7BBD7491F953E16E9062EF92C3AE4A8D13C6F34BE01568AFCDA20622EF1
Malicious:	false
Reputation:	unknown
Preview:	.........$4.e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.#...t.,...v.A...w.N...y.T...z.c...\|.i...}.{.....................................................................................................k.................o...........9.....L...........P.................L.........................................&.................5.....V...........V.................`...........E.....i...........O.........................................`...........#.....=...........`.................I.......................y.................1.................4.....L...........n.................B.............................9.....}...................................G................./...........D.........................................7.......................M...................................V.................B.....f.....~...........A.....n.................w.................v .....!.....!.....!....?".....".....#....C#.....#....R$.....$.....$....%%.....%.....%.....%....^&.....&

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\id.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	446894
Entropy (8bit):	5.4246151431172684
Encrypted:	false
SSDEEP:	6144:8iD5d6ksTNOWkX9lZpjwkK5YFSzvHVhGMtaNBesIWDM:8cd9hWkjZpsV1taNSWA
MD5:	10E18CB02EB994F07E3A97D862445D1A
SHA1:	E8967E1850C3BECDD18BD376C1222F7BD91E3E9C
SHA-256:	2B5124827DA75518EA801AE15DFD2D368D34BA161AC7093341C5B2E253661C26
SHA-512:	730E068DBD4D135CF9FEBD62B08B73A3D8BCA9AA3A048F8D1001189CC4384A7ACCC0432E946415CE5287657A7527F12A41D7A7A7C08196DAA814414FEECC2B75
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....g.$...h.)...i.:...j.F...k.U...l.`...n.h...o.m...p.z...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................!.....(...../.....0.....1.....3.....A.....S.....c.....u...........[.......................\.......................\.......................v................. .....q.......................B.....c.....z...........9.....h.................D.....v.................0.....Z.....g.................<.....I.................J.....]...........8.....}.......................0.....A.............................S.......................,.............................d.......................<.....h.....r.................B.....N.......................;.................%.....7.............................:.....z.......................X.......................<.....m.......................-.....;.......................*.................".....;...........3.......................e.......................l.......................3.....R.....b...........!.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\it.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	495016
Entropy (8bit):	5.3289754384955605
Encrypted:	false
SSDEEP:	6144:8jXxgnn0s/NVsIefGBAFK54qG0eiqMvfrCLSny5kxAjNumsQmYgDcGujgNz7JRTm:8FgnPjCL6ZO28gyY+
MD5:	D331E2448BC65868892BB30E2488D5EE
SHA1:	A8C6A33F2A3603B9812172197BA4B479BD286C25
SHA-256:	2F95BE82147111FB8909A901AA2A98727FDC3B354191DB5BE67A26639422B82B
SHA-512:	34CF8FFCE42D6EB3C32A02A1EFA44F3973CA46326CC39518FF8F88D60CE97BA03EC66CCC18B7A038B99149ABD5A50F68D236586F15E6855F7482E05733ADEF2F
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....g.....h.....i.$...j.0...k.?...l.J...n.R...o.W...p.d...q.j...r.v...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................0.....D.....].....n.............................y.................'............................./.......................\.......................+.....t.........................................t...........C.....h...........7.....}.................N.......................u.................\...........#.....A.......................9.............................U.......................8.......................@....................... .....n.......................B.....p.....y.................O.....Z...........A.......................K.....t.............................2.......................!.................D.................".....H.....].................#.....6.................n...........#.................*...........$.....p...................................6.....v.......................x.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\ja.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	595020
Entropy (8bit):	5.823647817476678
Encrypted:	false
SSDEEP:	6144:FS1gHw/9uwwmD5/PHlV8fBednyyYNaQ36:kSi1dPIednyyYsQ36
MD5:	9E63F118253E3515A92946F39B4EFD0C
SHA1:	BED8621CB00150D4F02BD123ED16F1BB916146A5
SHA-256:	21F1CC7F47C11455057E48D629AEC3758BF71444D30F329E15B6C8CB1B714612
SHA-512:	246D264B23033067E6D81B330740A50FAB4D97ACF0B2DC6C96BA5DA0CEE5AE4B60EC614A57546041AC9D9BD03FFC1976A9BBFC8F84926EA158E5743D09867A4A
Malicious:	false
Reputation:	unknown
Preview:	........^$..e.....g.....h.....i.....j.....k.....l.....m.....o."...p./...q.5...v.A...w.N...y.T...z.c...\|.i...}.{...............................................................................................?.....`.............................u...........).....A...........l.......................K.................`.........................................%...........!.....X.....}.............................d...................................#.....2.................J.....Y...............................................!...........".....c.....~...................................3................./...................................O.....a...........L...............................................9.................9................................... .....A...........-.................5.................3...................................!.....a.....\|...........Q ..... ..... ....I!.....!....Q"....f".....".....#.....#.....#.....$.....%....F%....g%.....%....U&.....&.....&....:'.....'.....(

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\ko.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	498162
Entropy (8bit):	6.165588605643824
Encrypted:	false
SSDEEP:	12288:cCp7VymsTG+tlq7Hh1mrOeUrA1iNa5Z6xzSKdKV2WBMV:kGLnr68
MD5:	8B2E24140559B0EECB76E117DA167636
SHA1:	A3B240E2D5E5A6E2E534F7CB0BE76D1E8B5095FB
SHA-256:	403A641CC5BBAA775C4198DC4B3D1295D6EB3F893FF53C623CF9C233A73DD1B0
SHA-512:	60AB6B849133D01766DB18D9BAFC1981461484C7E5D7AD76C8D653A836279ECAA7AB351991DD8D9993207679FDB689BB6859FEDCC9985C95FDEF286E7B92928A
Malicious:	false
Reputation:	unknown
Preview:	........7$..e.\|...g.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....y.....z.....\|.%...}.7.....?.....D.....L.....W....._.....n.....s.....z...............................................P.................(.................B.....U...........9.......................c.......................w.......................{.........................................?.......................X.......................L.......................K...................................D.....[.................1.....H.......................#.....{.......................{........... .....<.................4.....D.................?.....R.................>.....N.................=.....M...........B.......................M.....n.................H.....p.................S.....y...................................=.....z.......................[.......................O.........................................`...............................................v.......................k...................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\lt.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	527910
Entropy (8bit):	5.6672870650640625
Encrypted:	false
SSDEEP:	6144:g/Vqwla5s7wPI2KiHhbXa3ctYnj/O2IZ6Sx9CsTOWwaVfxP2g:a5a5s7+IjiHh4nj/E6Sx8sRwmN2g
MD5:	57C65082E6B8196853B3091964F44CAD
SHA1:	160FE1859016122DBC1C8DE9BC3B42438B1687DE
SHA-256:	1842413F04148D4B28E25332BEC45201E416E2E060F7A72C1887843AAB8223BB
SHA-512:	CE2F1BED4103D176905C2DD9C36AFBC80A2E5BB58EB276028E06EBFF6A5062D7AD6BF6DF715D21A1CD339678FA65452D01409BD09C0F53F6096493AACF1A1388
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....g.....h.)...i.:...j.F...k.U...l.`...n.h...o.m...p.z...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................!.....(...../.....0.....1.....3.....A.....].....q.............................!...........7.....~...........1.................%.................T.....n...........g.................%.......................x...........&.....K...........^.................6.......................k................./...........G.................8.................4.................=.....X...........;.....k.....}...........i.................).......................n...........(.....7...........5.....p...................................7.............................&.....y.................}.................X.................=.........../.....e.....}.............................m.............................2.....t...........% ..... ..... .....!.....!....U"....."....."....H#.....#.....$....*$.....$....\%.....%.....%.....&....s&.....&.....&....,'.....'

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\lv.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	526147
Entropy (8bit):	5.670589583133561
Encrypted:	false
SSDEEP:	6144:59QUMRO9B28c9csRHy7/157YXNGBi57ArMkHrpmNxtVFL88RJet8Dssr4Atgd:5SnRO9v7d5QG1MkHiMJ7
MD5:	6B012E871C0286506C1F34CACF3EFAB9
SHA1:	8F9DEC6080A5A2B9669C585B0FDE7C0E941C178F
SHA-256:	92C1EF8C144EA3EC340FC041C5854F8FD19F4FB3A9AF39E944ADD8332647514C
SHA-512:	15BD2FD467F671F8A3D74B5E8174B1A45EEBC8B3BA366EBEDEF465859564836CC88A336C5053C7DCF3CCB661A13683C182CBECC104F6207765867AD4F801BDDD
Malicious:	false
Reputation:	unknown
Preview:	........,%..e.f...g.n...h.s...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.'...\|.-...}.?.....G.....L.....T.....\.....d.....k.....r.....y.....z.....{.....}.............................\|.....8.................%.............................8.................$.......................o.........../.....:.........../.....g.....y...........i.................Z...........R.....v...........w.................5.............................2.....z........... .................7.................(.....>.................4.....F.................@.....T...........e.................%.......................P...................................8.....I...........A.....\|.............................).........................................R.....r...........A.....f.....u.............................o...................................O.....h...........f ..... ..... ....`!.....".....".....".....#.....#.....#.....#....j$.....$....,%....<%.....%.....&....)&....K&.....&....b'

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\ms.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	461241
Entropy (8bit):	5.319316110667384
Encrypted:	false
SSDEEP:	6144:R6sL+DhW+aYm7iMKn8cEO8wPtvfOQxCHUlp2ThM2:R6CyhWuaInNEO6Qxpy9B
MD5:	9ECBA46C5EE4206B17EEDB8EEF59A8C2
SHA1:	022475B57BAD57C693F6A850BDF2183A61E8C59C
SHA-256:	5AD9DB4490DD5B84B615AB26D99C24C7C91E43E7D6CAEB35E8F32F244EFC3752
SHA-512:	BD9E584EAAC5402249F72C9C4C9CF850BFE8BEB43CAFCB9FC12612BCA4C17BC6EB3B603D465DEAC19FB1F1EC23C5DC76D28BBCFA416A1E45F615F107F4CD0047
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....g."...h.'...i./...j.;...k.J...l.U...n.]...o.b...p.o...q.u...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................$.....%.....&.....+.....>.....S.....m..................................._.......................s.................5.................P.....h.................C.....V.................7.....H.................?.....b...........M.......................P.....{................./.....Z.....e...........'.....^.....o...........`.......................V.....q.................".....G.....S.......................(.................).....:.................,.....6.......................).....}.......................m.......................{...........4.....G.......................-.............................a.......................G.......................7.....v.......................[.......................h.................?...................................%.....@.................%.....2.............................S.......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\nb.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	451701
Entropy (8bit):	5.472620487842144
Encrypted:	false
SSDEEP:	6144:kQdPwogKJPp8WrCH6q9Mrg8o836QokquuCrU0x3xrjtCT:ka49KJx8WrI6mN836QlqvCIkxrjtCT
MD5:	182A81F66FD3DE370039ED6A6A436311
SHA1:	066385BB51FD7DB76168C5E68098DB931F90A8A9
SHA-256:	DF9F7D151E9A3345681D47B37C1AF625479AAFFEA920BB7C585C518D1DFFFD66
SHA-512:	C8B2DF8925E0D1A2AD49A3D1A5DFA25A6134E5CD1B6E1A03296DD8CC4AF6BB420ED2152647B680E147640616A40A1B588A858CD003D3C8E4ED6D67BD4C747BDF
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....g.....h.....i.*...j.6...k.E...l.P...n.X...o.]...p.j...q.p...r.\|...s.....t.....v.....w.....y.....z.....\|.....}....................................................... .....!.....#...........B.....U.....l.............................q.................!...........0.......................b......................._.......................L.....u.................T.........................................r...........?.....^...........8.....p...............................................\.....~.................+.....9.............................r.......................[.......................q.......................s.......................q.......................c.......................r.........../.....G.......................1.............................m.......................t...........!.....X.................2.....K.................D.....\.................\.....p...........K.................)...............................................k.......................N.......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\nl.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	464538
Entropy (8bit):	5.4124218906381545
Encrypted:	false
SSDEEP:	6144:kD0RU3kTiDdSn86ej0ilOlGpk/zfQnoTCRXMs5vGDIK4mJu7y:KU5ns0ilOlGpk/zfmoTCRcs5+DIoJu2
MD5:	5568B85F35B8C1FD99A8801C34389B83
SHA1:	D38588E1EAEBD9881BDB77E84F2F5628589F4E08
SHA-256:	3D97DEA1E2A4B379E33E30C75E055537B95059902EBAC9E1B368CE2D7E0E745C
SHA-512:	D69AB6BFFC0F84142DA9A25481C86AB790E1C609962F59E4D95B09A7E9F9F39D8FEB71438771A2A227D60A679169D55DC3517006077AFA214364FFB8F9B464D8
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....g.6...h.;...i.L...j.X...k.g...l.r...n.z...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................$.....,.....3.....:.....A.....B.....C.....E.....Q.....k.....\|...................................k...................................G.....]...........*.....`.....w...........".....K.....Z.......................<.................K.....l...........D.....{.................Y.......................h.................&.......................o.................G.............................l.......................@......................./.......................1.............................i.......................H.....t.................=.....q.................\.......................k.......................Q.....r.................?.....g.....y...........K.......................P.....n.................F.....x.................[.................A.................(.................X.....}...........H.....y.................1.....U.....e...........'.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\pl.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	511053
Entropy (8bit):	5.786571756641256
Encrypted:	false
SSDEEP:	12288:VGAPdVH3w4O3QF8WoOBCs9/8fQfM6HCkbd/P2CUd7ze3mBR9GYYdmMsucZr1auuN:UAk43SMp
MD5:	737BD6A70DB9340C2A34567CAC564837
SHA1:	C656CBC599F8346A0C81713BE6184A8F7B2EF787
SHA-256:	73C515CF97FE807F8A8EA252CF68F4D1FAA28E65A57B4ADF3D94AECA485952D3
SHA-512:	E0CC5B98688A5CCF6FFEDE281689C81F5A5653CE1AE6F7BA45837742C7CF765A27E0749D3A8C67967BEAEC5229DE10E955FE5AF720B7DCA8CB63A56EFD8EF957
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....g.....h.#...i.4...j.>...k.M...l.X...n.`...o.e...p.r...q.x...r.....s.....t.....v.....w.....y.....z.....\|.....}........................................... .....'.....(.....).....+.....:.....Q.....f.....{.......................1.................9.....L...........a.................+.......................C.......................<.......................]...................................].................L.......................a.....................................................x.................8.....M.....n.................*.....:.............................c.......................q.......................m.......................^.......................N.......................e...........'.....?.............................m.......................Y.......................{...........#.....T.......................".........................................?.....Y...........L.................9.......................w.......................T.......................8.......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\pt-BR.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	486700
Entropy (8bit):	5.464263399446838
Encrypted:	false
SSDEEP:	6144:waMEVezbsEcR0+uesRNcBYNBXBLSXpnDRFedE1:NQzbcoesRCJ
MD5:	CF1B4D6659F62717A7C8F8E85F6349EA
SHA1:	A500CC790C1EEAE0F9BEBE1CE459FBC8E7A3B615
SHA-256:	F1F483EAC061C7D8E19D170D34E4663C02B4D2540AD0D2E8C745EE85B471E006
SHA-512:	1AAAA2E5DEFC9E53E5A300ECDC3BBCF9D2A6E39E187E5D797F5B8D7C54F1688DC5ADE39E767424986717D9CBC3B5DBC0FFB961AFB52F4928ACAC32AE41078E7C
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.<...g.D...h.I...i.Z...j.f...k.u...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}............."..........2.....:.....A.....H.....O.....P.....Q.....V.....h.....}.................B................F.................F.....V...........s.................U.......................W.......................<.......................h.................H...........=.........................................=.......................k...........).....B...........N......................._.......................O.......................L.......................U.......................N.......................-.....[.....e.................5.....?.................4.....E...........@.......................H.....l.......................?.......................3...........,.....g.................5.....N.................N.....a...........1.....\|...............................................P.....{...........-.....U.....h.................+.....@............ ....U ....u

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\pt-PT.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	492315
Entropy (8bit):	5.443481237378021
Encrypted:	false
SSDEEP:	6144:tSam1OWZa48UrcbSSRsoQu4JVJJxh0zlaYmF4CZ:8z1xHrQSSR+B
MD5:	B3493B1436FEA5D64FA3C0015B739735
SHA1:	6277A1CB70C30C466EEACB176B367C981986F9E2
SHA-256:	EB3C51D1EE6581ABC73BACEC65989C990F321FDEB046D30B1FD417717EDC5FD7
SHA-512:	385793B735387B2D8A440C1AE22F076D89AA67F7A019D92C823D3C86562B50268CC4C4DBD69075752FEBF91F0FDCBA339BA5FDFA42D72A3F4B624F8AC153E653
Malicious:	false
Reputation:	unknown
Preview:	........7%..e.\|...g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...\|.C...}.U.....].....b.....j.....r.....z.................................................................q...........V.....q...........<.................%................. .................O.....s.................@.....P.................$.....6...........$.....f.................t.................D.......................c...................................5.....J...........@.......................l.......................Z.......................].......................m.......................n.......................Q.....~......................W.....a.................L.....]...........;.......................K.....u............................;.................,.....F.................l.................5....._.....q.................U.....j...........+.....y...............................................C.....g...........J.......................>.....c.....x...........F

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\ro.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	505330
Entropy (8bit):	5.501095594115375
Encrypted:	false
SSDEEP:	6144:iemFVnWv+weNV4s29h6Vbuq62XTZp468lZqhRsGIKwCAug+UL:H4WsNeh6G2Xnz8lEzsGVwyp2
MD5:	4F3186F37E6D686148B7464B4A90BAF3
SHA1:	00BC72E7AF74783F3DB23D55987D39ECEE1B27B0
SHA-256:	BA8A1AE5798B51AAEF2D67CFF13BBA85BB5B5D7DDEDBEBA29B11C1D03F72F037
SHA-512:	50FB4BFC36C40B3FFD4EA1E33EE4F67F3001792C709ABCC69F66F6463B51AEAE70877DE87D17E3ADAB351C3142B549FD9455DDFF49AA2507BE49282B0E81B790
Malicious:	false
Reputation:	unknown
Preview:	........"%..e.R...g.Z...h._...i.p...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.).....1.....6.....>.....F.....N.....U.....\.....c.....d.....e.....g.....v.......................@.................8.................2.....F...........M.................>.......................^.......................A.......................P...................................K.....o...........M.......................q.................,.......................}...........M.....{.................8.....U.......................$.....u.......................Z.......................W.......................D.............................j.......................R.........................................L.............................d.......................i.................6.................!.....s.......................d.........................................4...........1.................&.......................s.................#.....w.......................y.......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\ru.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	806136
Entropy (8bit):	4.941503077631742
Encrypted:	false
SSDEEP:	12288:VEexDDfQjRo4YVepEaX+Pcw10f9XIGnGtjVFYw2T5tqnjf3QjIvj3lDRxhCz52Wq:VEexI50xdB
MD5:	8EDCD84A3BA8242015542095F1AD0275
SHA1:	F06B8A866F99A277311DF1C97A5A9DEA3F6AB326
SHA-256:	23B20A08FE29DE86F398650D3661131F5CA051D6D31BE237FAE33AABD21ECBB6
SHA-512:	B32C7F8C790BB9952C7DD51FD7A7CF29805E349A0485A6B22F25665804659DB7E277BD21E3DABC8287FC5B4FA27B9354BF417F0F60C368301080B31521805153
Malicious:	false
Reputation:	unknown
Preview:	.........$k.e.6...g.>...h.C...i.T...j.`...k.o...l.z...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................$.....,.....4.....;.....B.....I.....J.....K.....M.....j.............................Y.......................;.......................l............................o...........X...........`.................5.....y...........D...........6.....r.....e.....(.......................5.................c...........D.....i.....!...........K.....x.....\|.....v...........E...........X.................F...................................%.....B...........G.................K...........%.....J...........M.................'.......................j.................).....;.......................< ..... ..... .....!....\|!.....!.....!....."....."....4#.....#.....#.....$....V%.....%.....&.....&.....'.....'....@'.....'....o(.....(.....(.....)....'...............+....J,.....,.....,.....-..........C/...../....A0.....0.....0.....1.....1.....2....N2....g2....?3.....3

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\sk.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	510792
Entropy (8bit):	5.831316727188874
Encrypted:	false
SSDEEP:	6144:NYpbzY8y5bgx9GWiHQgC55fLwxdjJ6gGwLXIkqVvZleIEFBt4PY:NEYPWwxHQgelLwxd9NXIkqVgvt4Q
MD5:	294D3C5A8E7FEFA8D401B339DBA20942
SHA1:	5A766AAEE3A0583ABC5B84A2252983563F8BF23C
SHA-256:	A9395944DF28675F462E805496F4F152FA997DB61432856950BCB23BA7BFEB30
SHA-512:	0467861F82049C9C3C0D49437CF1F23397BC65E971231D3EF1FEC85CA694D2E72803B44051B091B8F92FD3C65F7E2AFAEC9157E787B24AEE751E97009A302E75
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.@...g.H...h.M...i.a...j.m...k.\|...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......$.....).....1.....9.....A.....H.....O.....V.....W.....X.....Z.....n.......................[...........x.................t.................N...........".....<.................F.....]...........,.....[.....n...........'.....P.....d...........=.....r...........2.................!.................S.....l...........O................."...................................i.................:.....Z.....o...........0.....V.....h...........).....P.....b...........B.......................s.........................................&.......................E............................. .....k.................#.....>.....R.................#.....8.................:.....J...........G.......................j................. .....y.................@.............................B.................=.................. ....v ..... .....!.....!....s!.....!.....!.....!....."....."

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\sr.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	756339
Entropy (8bit):	4.883883118097412
Encrypted:	false
SSDEEP:	12288:kVPuCaM641l9TxqJumgf3768/k/SZy7PrXZ9lIUjv10S4sNQBke8meeDv4DWXWvq:YPRR9g8wy
MD5:	F36B0C7A66C684148A3FB95329A8860A
SHA1:	D532B0B7DA5E7F03D9230545CF27A3C1CB716091
SHA-256:	0234C568FCE02C6AC1CFC9F229568B9E3067F80B403F44D1F41C849F39A2D8B3
SHA-512:	09715F25F7A3EE4D1E8FC2CCFE6ED1712775BD9C0753C72C9CCAACB3A61A44EB492289132B9707EF0669F7AAA99BF87B6EE33E6DAFF7C53EB6B53CFC444691EB
Malicious:	false
Reputation:	unknown
Preview:	........<%..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.%...w.2...y.8...z.G...\|.M...}._.....g.....l.....t.....\|.................................................................F.....3...........t...........l...........y.................b..................................P.............................~...........;.....R.....$.................N.....N.............................4.................}...........v.................8.............................p...........=...................................E.....h...........e.........................................P...........%.....F..........._.................a...........$ ....E ..... ....t!.....!.....!....."....b#.....#.....$.....$.....%....D%....l%.....&....{&.....&.....&.....'....-(....z(.....(....g).....)....Z.....*....M+.....+.....+.....,.....,....m-.....-.....-..........N/...../.....0.....0.....1....R2....p2....^3.....4....w4.....4....{5.....6....Z6....{6.....7....v7.....7.....7.....8....D9

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\sv.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	457059
Entropy (8bit):	5.581376596585994
Encrypted:	false
SSDEEP:	6144:09yDYlvEIYvp9X4pbvigNhhIp4gfaVvZ4otlsvHIKI16wKg7mX06Un/4i054nQUr:lmEypbvo5K/
MD5:	8C1F46BCEA9E70786374A73C367A86A8
SHA1:	A3D3CA3A0893DBBF70D01F93C1CEB6E83505DE9D
SHA-256:	EF49188DBCC8AD652143AD4ADD3BA0C76A918AF5B300C5F0EC283B05267A06E2
SHA-512:	091BBD65E823A1F2355ED7233465F74F0568242C1A0D8F2AF32C917B4C6EAACD42FD392DC683CEB019910C246F084579B48E6BCDF76E4BD2FDBD09EE082369A4
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....g.$...h.)...i.:...j.F...k.U...l.`...n.h...o.m...p.z...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................!.....(...../.....0.....1.....3.....D.....Z.....n...................................N...................................W.....p...........@.....y.................K.....z.................J.....{.................o.................A.......................t.......................~...........-.....=...........9.................5...........#.....B.............................o.......................L.......................@.......................M.......................B.......................2.......................).......................4.......................I.......................".....r.......................C.....d.....v...........N.......................o.......................`.......................V.................!...................................>.....d...........0.....`.....s.................+.....9.............

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\sw.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	473542
Entropy (8bit):	5.41002434678886
Encrypted:	false
SSDEEP:	12288:apWBLJSWFKkuQ/XPX/XnJqC5bbCfRdkULbsD4JkE1h8H1KTeEN:apeLsisd
MD5:	1778B695186494D1DFCE964D079CD822
SHA1:	71ABC26C0E668B21B171234ED97F1FDFF47C19FB
SHA-256:	4469108829043A60B8C2391A255A1221246590E642FA3732636A9510B838F159
SHA-512:	323288BA144C291E96DC1476B3051AB885B7A5F060B3DA9DFC46B2DE2422A3DEBA3A85C24D767E969337AFBA26BD76EA42D6C5B630B0280D73807AC89A7321BC
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.$...g.,...h.1...i.<...j.H...k.W...l.b...n.j...o.o...p.\|...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................#.....*.....1.....2.....3.....8.....J.....c.....w...................................c...................................Z.....p...........$.....W.....k.................@.....O.................).....7.................8.....^...........\.................3.......................A.......................B...................................X.....t.................F.....a.............................h.......................Z.................#.....{.......................\|.................&.....z.......................f...................................0.....I.................(.....D.................7.....X.................T.....d...........@.......................\.....}.................>.....f.....x...........T.................>.................'.................L.....i...........^.................$.....x.................F.......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\ta.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	1204486
Entropy (8bit):	4.142153948657093
Encrypted:	false
SSDEEP:	6144:n0CLdc1vdtRlcA2ytm1vYpiMapYhDvscZsU/:0CL4vDcA2ytm1vYpiMaU/
MD5:	0594AD99E16040A7B3886D4A651FF50B
SHA1:	49153ABE427606D0E5004107CDE46771423D37D5
SHA-256:	A7B81B277CE0078070D1F2B279D227E2ED1C08075B071872606EB3B9E27E233C
SHA-512:	033D4C683B9EF416D7A8642CAD752BE77F2099F7455E488A8E3C0DEE5F41D02137916139B96B071CE2DDC162205A3FFA30CD16A1CEB3C44618E8CAD7A196D09D
Malicious:	false
Reputation:	unknown
Preview:	.........%..e.....g.6...h.;...i.L...j.X...k.g...l.r...n.z...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................$.....,.....3.....:.....A.....B.....C.....H.....v.................p...........k.....1.....Z.............................^.......................%.....[...........)....................................................H.....L...........7.............................4.....J...........0.....q...........<.....m............ ..... ....E!.....".....$.....$....N%....Q&.....'....n'.....'.....(.....).....)..........+.....+....;,....o,.....-..........6/...../....y0....j1.....1.....2.....3.....3....i4.....4.....5.....6.....6....,7....&8.....9.....9.....9.....;....p<....L=.....=.....>....s?.....?....$@.....A.....A....+B....\|B....QC....:D.....E....RE....{F.....G.....H.....H....iI..../J.....J.....J.....K.....M.....M.....M....aO....tP....UQ.....Q.....S....\|U.....V....(W....zX.....Y....FZ.....Z....&\....L].....]....]^....a_....N`.....`.....a....@b....oc

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\te.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	1102827
Entropy (8bit):	4.390768443049786
Encrypted:	false
SSDEEP:	12288:gYv0vj7McKNR/AH2Te1ITjJAq8EtUuiEN/gJshTWFHvqdW/3wkAE26KO+ymN8uVE:gYXtntQ
MD5:	BA164DEEE9DFEB5ACB7B43C57973C5A1
SHA1:	B58180A0C3413E80EDCFDDCBDB79CA9B14BE4445
SHA-256:	F241CF348039190CD8A812FF9EFF40E5D7CF94542D454C4E0F098A2A31A8B0F7
SHA-512:	31FE310482750B56F591F7386878A3EF7B77813CC654ADA2B86B95E88C2FB541F74F78D69CCFB30CF2E42A98FC8D9BD7B0E22871708A9839D2947884EC16AA1B
Malicious:	false
Reputation:	unknown
Preview:	........\|%..e.....g.....h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................".....#.....$.....).....`.................E...........-...........h.................F.................5...........Z.................O...........l...........h.................\|...........,.....K.......................s...........i...........................................................;.....g.....e ..... .....".....#....h$.....$.....%....^&.....&.....&.....(.....(....@).....).........Z+.....+.....,....W-....A.........../....Y0....31.....1.....1.....3.....3....b4.....4.....5.....6.....7....I7....o8....C9.....9.....:....\;....R<.....<....,=....->.....>....=?.....?....O@.....@.....A....PA.....B.....B.....C.....C....#E.... F.....F....GG....HH.....H....XI.....I.....J.....K....GL.....L.....M.....N....>O....zO....LQ.....R.....T....ET.....U.....V.....W.....X....ZY....GZ.....Z....*[....1\.....\....c].....].....^....._

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\th.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	947387
Entropy (8bit):	4.452455588274606
Encrypted:	false
SSDEEP:	12288:GqNSApzN9LyZYAG+mFkcSrkIOkZGKDVEwPqXqWmhI+Tiw1p5M7M3CbU37BU6CZ8Z:1LIWM
MD5:	B505E7DD4CA9125D185DF470681F8D1A
SHA1:	46DEDCE10BB61CA8F18A112587EDB89B08EF8FCC
SHA-256:	9B5F0E5747BBCF4CA7C12575E2A4B832DD85E77397AA86E44C54BB17246EEE59
SHA-512:	2C944B7BD2BB19851E478540F33A97F84BD5E684960EF7E8B2F1D7EC5A2886EE5CAF4CC6ACC42B45ACA275B1D7CC0C5FA56A585E76B1D924FD961A0112DBC0EB
Malicious:	false
Reputation:	unknown
Preview:	........t$..e.....g.....h.....i.....j.....k.%...l.+...o.3...p.@...q.F...r.R...s.c...t.l...v.....w.....y.....z.....\|.....}...............................................................................0.....f...............................................A.............................I.......................>...........1.............................;.......................z...........c.....Z...........k.................3.......................G.......................U.................'.................................................................!...........y..................................."............ .....!....9!....."....."....&#....M#.....$.....$.....$.....%.....%.....&.....'....-'....G(....D).........0.........o+.....+.....+.....,....+-....t-.....-....I...........0/....`/.....0....51.....1....;2.....2....P3.....3.....3.....4.....5....u5.....5.....6....,7.....7.....7.....8.....9....}:.....:.....;.....<.....=.....>.....>.....?....)@....Y@.....A.....A.....B....!B....C.....C

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\tr.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	486079
Entropy (8bit):	5.657086029848131
Encrypted:	false
SSDEEP:	6144:lETTzjBV0OuZqTvJzApi1tBedlAswfzCM6TzAVzBzQjg/ZThgon7d0JiMz:lkLj0orJW0vl0H
MD5:	9A7318AE7BA5E8762597EA1512E56ECA
SHA1:	E417CB04E35FB7A124DE0F451CEEF72122BCCB85
SHA-256:	EAEF9B2769B9EF0EC4916CE9254501C72C8CE46DF9CA5ECBC46275A2586CBF40
SHA-512:	FCA8F99987E94FD574032F389295644DD164C5E2C6F0C5F2B0CD5ACB03686A064A5B4999E9FDB3B66293D9C8EF4E9175F7B18A9BFCDFBB6533E9FBC10E1361D4
Malicious:	false
Reputation:	unknown
Preview:	........1%..e.p...g.x...h.}...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y. ...z./...\|.5...}.G.....O.....T.....\.....d.....l.....s.....z.................................................................k.................O.................$.......................].......................a.......................H.......................R...................................7.....T.................K.....\.................:.....J...........6.....y...................................H.......................H.......................E.......................E.......................X.......................f.......................c.......................`...................................V.....o...........5.....b.....~...........(.....J.....e.................G.....Y...........0.....j.................9.....X.....h...........,.....W.....l...........@.................G..........._.....q...........v.................s...........-.....I............ ....= ....R ..... ....+!

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\uk.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	801697
Entropy (8bit):	4.9761114710036445
Encrypted:	false
SSDEEP:	12288:G6+Qe/CNC9B3IjfAK+PTcTVu1xtq+4uL2uyVsyCvdqhqFoCT7g0lN:+QkdT9
MD5:	4FD6B5F30381A3B79A1845B10C809C97
SHA1:	B422650DAFD4744AD6A3C0A2B0CD650DC21EAEEF
SHA-256:	9A89D8F6751AE55B1BB109F4BE758F5EB511216D8BE5830F55E12E772686E56B
SHA-512:	AA9F4A05F5917DC7CBD0263C5E23950665B4DC7E61841AD81CA40240488A85B46770056B6BBE5395392C0A0C9598893255A597BEBA7A4836B8003B6B03112627
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....g.....h.....i.....j."...k.1...l.<...n.D...o.I...p.V...q.\...r.h...s.y...t.....v.....w.....y.....z.....\|.....}........................................................................./.....V.......................i.......................b.......................p...................................:...........].................{...........g.....\|.....8...........$.....].....J.......................z...........t...........B...........6.....W.................5.....b.....Q.......................e.................4...........=.....}...........%.............................I.................g...........A.....\...........m................._...........%.....D...........W.................. .....!....."....P"....."....b#.....#.....#....;$.....$.....$.....$.....%....@&.....&.....&.....'....}(.....(....l).....)....m..........*....u+.....+....9,....f,....=-.....-....C.....o.....a/....50.....0.....0.....1.....2....&3....j3.....4.....4.....4.... 5.....5....'6....f6.....6....W7.....8

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\vi.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	570628
Entropy (8bit):	5.839367137148999
Encrypted:	false
SSDEEP:	12288:gbl2R+c182J5cy6stVziNHb30Pqyo/8rtf8v6O2wQghMtj9ysMYgn:gbl2R+c18K56stpiN730iyo/8Jf8v6Op
MD5:	818C831174BFE5A6930D94AD3968D3F0
SHA1:	FDF75529B95723C4A3AF3EC59E6762BF14E48A5A
SHA-256:	07EBEE2599A8F30DE5C0CAE97E2CBF6B7D8BFAB1AAA9454824B6FE6683C1EA8E
SHA-512:	CB06546083F99DEA788EA973B580ACAD3BA876F2768CC41189916A58CE75EF462425C17017B871AD64D908014E3485E51BA52657DC167ADB72DF14E09CDEFC88
Malicious:	false
Reputation:	unknown
Preview:	.........$.e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.%...r.1...s.B...t.K...v.`...w.m...y.s...z.....\|.....}.....................................................................................&.....E.......................7...........K.................e...........Y...................................@.......................5...................................Q...........C...........U...............................................I.....`...................................^.................b.......................\|.................'.................C.....T...........R.........................................1.......................F.......................Y.............................d.................i.................4.................3................`...........)...........%.....t...........X.................= ..... ..... .....!.....!....."....Y"....."....##.....#....9$....M$.....%.....%.....&....J&.....&....3'....h'.....'.....'....T(.....(.....(....9).....)....!*

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\zh-CN.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	410465
Entropy (8bit):	6.746826206487886
Encrypted:	false
SSDEEP:	6144:c+2ukSJOuA1yoteVUBqBn5J7VelUOsia8Np7P+WkVoj7:kuk7uA1yo+uqBn5J7/Ga8j+WkVG7
MD5:	68F4A45CAD710965CDA0995AFDD80C6B
SHA1:	B498A99647FDBCC5212669CB9873F264965FF24B
SHA-256:	8984A847DF4A47393644308259D1B61225F1656423289AA7B5B2F5B52AE792D9
SHA-512:	64517F1668D27C702D60BCA43F5E4C1EEFE5B5EF40FE31B4EFC83ADF65308AC05F7935BAE94E2C735466C197B51D8AE17E91E9FA6C2BA483D8EAD81AA85F89AB
Malicious:	false
Reputation:	unknown
Preview:	........f$..e.....g.....h.....i.....j.....k.....l.....m.....o.....p.....q.!...r.-...s.>...t.G...v.\...w.i...\|.o...}.............................................................................................................W.....i.................L.....X...........!.....Y.....k...........*.....l.................).....O.....[.......................(.........................................1.....C.................3.....@.............................y...................................%.....7.............................D.............................R.....r.................L.......................@.....i.....u...........&.....U.....a.................,.....8.........................................9.....M.............................v.......................h.......................K.......................:.....}.......................\.......................Y.................&.......................\.......................k.......................;.............................c.............

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\localization\zh-TW.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	414401
Entropy (8bit):	6.74932083877727
Encrypted:	false
SSDEEP:	6144:YJ/SSbXB0uxG8fZl7Hex1k0T15bUxoX9d63wnTLkIJGkr:YJ6SbmR8fTk1xtdpfkIJGkr
MD5:	90C958A994A80B5C165D83EAA2EE493C
SHA1:	D8CCEE4ED3A60521B1EAC3780E14C91A6879C0D6
SHA-256:	97492FACA1FC863EDEB2441D4E0A142CE085A5FDE11A43E41589071DD3D636C0
SHA-512:	1D3EBB1848BF6876E40F640F8FD3415E8235EBE933D3FF27341D62EB1B1F8810EAAE982C363D3968D260BBA520B34EC3C8A89C74069B39AFBA1AF1AC4B9790F1
Malicious:	false
Reputation:	unknown
Preview:	........u$..e.....g.....h.....i.....j.....k.)...l.4...n.<...o.A...p.I...q.O...r.[...s.l...t.u...v.....w.....y.....z.....\|.....}.........................................................................$.....3...........#.....a.....s.................D.....P.................B.....T.................1.....C....................... .....l.......................H.......................<.......................4.............................q.......................l.................!.......................'.....g.....{.................%.....E.....Q.......................".....u.......................R.......................5.............................q.......................J.....s.................G.....\|.................".....<.....P.......................j.......................V.......................?.............................I.....l.....~...........1.....`.....z...........f.................).......................;.............................F.....[.....h.................9.....K.......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\mojo_core.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1719712
Entropy (8bit):	6.5008502116352025
Encrypted:	false
SSDEEP:	24576:iOHxZpFgLQXAAs4B8HZK2pok9Z9ys+dOoQJPGVo4S7os:rRZpOLQXrYo2Kk9Z9ys+dTMPGVPFs
MD5:	3A78A5A86C4758B383E31B5E1A8280A6
SHA1:	EA5EF3AA9031CE2A712A874DEEF8E64412923E64
SHA-256:	EEF56C4AE2A488E40E54E26911CDC14CDCCD75B4BD4FF44360D201330D3E6C1D
SHA-512:	78F24C81BD10AAC46904F017AF75B363DF18EEA747F4A003B7EE2C756892D3B2F415DAF0DD64190DBC31EFF0672F968CD6AF4373F7624094937695ADAC533713
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." .....8...........H.......................................@............`A.........................................N..p... O...........................)... ......l;..8...................P:..(...`b..@............U...............................text...67.......8.................. ..`.rdata..L....P.......<..............@..@.data...H...........................@....pdata..............................@..@.00cfg..0...........................@..@.gxfg....*.......,..................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\notification_helper.exe

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1368992
Entropy (8bit):	6.5152433915915005
Encrypted:	false
SSDEEP:	24576:P+80NUzGW7DZfUgR0l9ly9qb6877UQoeT7GNrm3:P0NUzGODpR0lNTfU0HG8
MD5:	366FAFAE6EFCABA2CA61ADFB6736B528
SHA1:	CBBCE98941A710D80CB20933556E627D40286251
SHA-256:	7E0A0D8C382661D68C128C9A0BE3CB58D45FF43C14318F3F85D59011C0852DFE
SHA-512:	813361CEFD2F6CE8ED6AC18580343246F6B470CB490308CBF8E60425850A50C4090462DA3DEB9545BF2B8EDFD12130335E83E528FBD3A6E8267EB5F9D40062C5
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........."............................@............................. ......=.....`.........................................(..\.............. .......P........)..........L.......................0...(...."..@............1...............................text...&........................... ..`.rdata..`.... ......................@..@.data...............................@....pdata..P...........................@..@.00cfg..0....p.......`..............@..@.gxfg...p,...........b..............@..@.retplne.................................tls................................@...CPADinfo@...........................@..._RDATA..\...........................@..@.rsrc... ...........................@..@.reloc..............................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera.exe

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1466272
Entropy (8bit):	6.40589832313238
Encrypted:	false
SSDEEP:	24576:us9ODY2nnjuULzZjiOiVV3K0EAbTykeLJIbPDUkD:XsDYqy8ljfE3fEmfeLJC5
MD5:	39DDB5A73323607B679EE5901EF4152E
SHA1:	DB6E47C1C0A1BAB84F867A7B1E7B8C9B72894E39
SHA-256:	9A3567A92EA07D08A3931E41E89F21C3A03569DC2AF97B79CC4F0108AF132F9E
SHA-512:	26DDA00171DD0B00C045A099759F8029CD6BE03CD079B1C2ABB79A1FF89BB4A7C6C4B82152AD50F42EA9EA663AFF45B6CA1ED2E7DD5849380782665431439BFD
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........."......\...........d.........@.............................P.......^....`.........................................-P..k....P..P.......8........}...6...)...0.......:..8....................8..(...`...@............V......hG.......................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data...............................@....pdata...}.......~..................@..@.00cfg..0.... .......X..............@..@.gxfg....*...0...,...Z..............@..@.retplne.....`...........................tls.........p......................@..._RDATA..\...........................@..@.rsrc...8...........................@..@.reloc.......0......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera.exe.sig

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	7.595546020183886
Encrypted:	false
SSDEEP:	24:+iCNV9ue/BbGNo7H6lah8keReriJ8gLIcO5v4Duvw5HjgTa/if3XrPXMuHVeb+ky:+iCHMepSN078kfipLIckwFj8a/oPMu1R
MD5:	38DB29A7213F0F0440A2B74CF1282231
SHA1:	FEB43DBD097464E0DEE7094FD4EC10A1EDA1CB2C
SHA-256:	86C3075094D5C07C8F27434300D3DE2E42F1C29D8EDBF91688AFD9B4B5F4E36C
SHA-512:	512642295BC5E15B7DDCB8B8030962998656BBA8A0FC3AAFA9AFBA33E74FEB428934E72E0D3A0B328E9F9F0AF7E735348B047CD9C89A80511A79BE08A485D311
Malicious:	false
Reputation:	unknown
Preview:	....0...0................K)..3...[.40....H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...180627202339Z..280624202339Z0..1.0...U....PL1.0...U....DOLNOSLASKIE1.0...U....WROCLAW1.0...U....Opera Software AS1.0...U....DESKTOP1.0...U....DESKTOP PROD1'0%...H........wdzierzanowski@opera.com0.."0....H.............0.........x.....jn...)>a.....-} .v...P..S..x.>k{.........Tr..Yo.D....d.....l.v.wU. .A.W5..oor....-Vs.o.......yH.pJ...?.Whs0`....Jb....3/. tl..8c........C..Byq>h..3A8..{..p....\..n...Q.t....0mQ{j......U\|.W\...........s!....K...'.....s..s....P..r8..........0..0...U.......`..\../X.l...e....w0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0....H..............D.G....gtpx.......~...v.....c..%.I.....c2Y.Y.....Y^..Aa..A.b.Y.f..Zra*.),K.....n.1r.C...Z...)....W.r.gu.Z....l......S.CF.m.Y...P.W..y.f.\,.$.>...!...FK....j....XHn.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	45999898
Entropy (8bit):	7.927384020696815
Encrypted:	false
SSDEEP:	786432:HuHZkWCkxBJ/9F7OSlKLbNPbGN+ULZBFQMg2m39Q7AGA2FI4:HGeleX9ASYL5bMjLZBuhh92AGAL4
MD5:	59030EC34C6AFA8A7193B1EFBAD57AEF
SHA1:	C8535FC538CDB0E8BCCDB2FBCFE9F2E1EF447EE2
SHA-256:	F3ACDBDD7C17884D3CA3D1C8E2EE2CD5D251425633C98D31DFBE782F7FE4C876
SHA-512:	C7B3B4BAEDEA72E0A6EE5EB73825E55CAD9F70AD8F853C09890008F20544A770AC49C542E221794CF3D23E7CC8D0487736C629234054E94DB6D295F4ADD84B4C
Malicious:	false
Reputation:	unknown
Preview:	..........$.f..M..{.jX..\|.>[....(_....:a.....l....7.................q..........._...........k.........../.....O.....-..........=.....=.....=.#..:>K2..;>.5..<>.9..D>.>..E>)A..F>.B..G>.D..H>.F.. ?.I..!?...."?....#?r...$?....%?....&?k...'?z...(?V...)?G...*?)...+?....,?....-?.....?0.../?.....?.....?@....?0....?$....?.....?.....@S....@5....@.....@.....@.....@.....@.....@.....@.....@.....@.....@0....A#....A.....A.....B.....B.....BX....C\....C.....CA....C....C.....C`....CU....C....C.....CS....C.2...D.....Dy..."GcM..#G.O...H6^...H.e...Hvm...H.p...H.v...H.}...H....H.d...H.B..bM.z..cM.\|..dMH...eM...fM....gM.....M.....M....M....M....M....M....M....N\....N.....N....RN=...SN....TN....UN....VN....WNe...XN....YN....ZN(...[N....\N.....O.....O.....O.....O'....O~4...Of>...O:D...O.G...OuW...OlY...Oe^...O.a..`O.f..aO.g..bOJk..cO.u..dO.v..eOPy..fO.}..gOy~..hOJ...iOH...jO....kO(...lO...mO;...nO...oOz...pO....qO.....O}....O.....Ou....O.....O.....O.....O.....O^....O.....O.....O.....O.....O.....O..

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera.visualelementsmanifest.xml

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.996593526126476
Encrypted:	false
SSDEEP:	6:ejHyaVic4subiL/bWHMjizddDhkQwYZXXKmJfFmkQwYEbghuPYEpwhugVFQ:eF8iDbWHMjizd2O/fbrghuP5whuQFQ
MD5:	E8D8EAA4C2826C083AB9243B5CBD7BF8
SHA1:	534361AE03417DFD14EBD6F961B707C75A2AF41A
SHA-256:	B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
SHA-512:	8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
Malicious:	false
Reputation:	unknown
Preview:	<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_100_percent.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	1231948
Entropy (8bit):	7.958236134700672
Encrypted:	false
SSDEEP:	24576:TB4oO0TODS0KeuX7D3WldzlZzA+3s8q1iv75ioMIXi5QUCAXll7deAIS:t4BKODS0NwDGldzd3/q1873XnUbXllY6
MD5:	75C2B6F6C8010058D42D5EB0BA39471F
SHA1:	FCEC790F7F4BDAC63D405940FE0A1C80A29671CD
SHA-256:	DDC196141F17A37184C7C906793E8C30191ED3EC98416F1C653ECE1A51EBC050
SHA-512:	618C0A369C16CEC0433DAD260104DE476F5E1468DBC7C544A3F6ABC216D604C0AB7E606D1CF6E4DF379B79AE0764E903E3ABB86E9E9870C7AF7FC17EA43101B2
Malicious:	false
Reputation:	unknown
Preview:	..........4..............jz....j@....j.....j-....j.....jj....jw"...j.%...j.'...jS*...j.,...j10...jT2...j.<...j.G...j.J...j.N...j.R...j.T...j.U...j.Y...j.Z...j&]...j.a...j.d...j.g...j\|i...j.j...j.k...l.m...l.~...l.....l~....l.....n3....nT....n.....n.....n.....n(....n9....n.....n.....ns....n.....n.....n_....nR....n.....n.....n.....n7...ry....syv...ty....uy....vy....wy....xy....yy....zy....{ys...\|yH...}y(...~y.....y.....y.....y.....y.....yt....y.....yR....y.....y!....y.....yN....y.....y.....yZ....y)....y.....y.....y-....y.....y.....yY....y.....y.....y`....y(....y.....y+ ...y. ...y. ...yK!...y.!...y."...y~"...y.$...y.-...y./...y.2...y.8...y,C...y.D...y.M...y.S...yKY...y.^...y.e...yGg...y.k...y.o...y?y...y_\|...y.....y.....y;....ys....y.....yA....y.....y.....yr....y....y....y....y.....y.....y.....ye....y<....y.....y@....y.....yR....y.....y.....yI....y.....y<....y.....y<....y.....y.....y.....y.....yz....z\....z.....z.....zw....z.....z.....z.....zv....zd....z@....z.....z.....z.....zR....z..

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_125_percent.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	1323194
Entropy (8bit):	7.956725168724986
Encrypted:	false
SSDEEP:	24576:4P6edh+WS0KeuX7D3Wldz4Zz4l8T2Xla0hm0gfnAxrcmuwz5QUCAXllIdeAIS:4Pjr+WS0NwDGldzp5Xla83gPAJcmuwGN
MD5:	955D32856E3EF0DF9AF4E3376DE9DD27
SHA1:	71B167ACB95E5A2B8D34D8C551D8BB1F184BE2D4
SHA-256:	683CB727472230B739CABF53EFF3DED1544294AA9A08AAA5F783C9433039BAED
SHA-512:	70764ABC24E3C987ADE51CB04E0CFEE2F822AE6F2C5E810DF2DB18591A0BF55236721940262CB6714B4C5ED893DA6078A866E639B95F3AD37C2A754D897903FC
Malicious:	false
Reputation:	unknown
Preview:	..........,...>.........ryL...sy....ty....uy....vy$...wy9...xyr...yy....zy....{y....\|y....}y....~yB ...y'!...y."...y."...y.#...y.$...y.$...y!%...y.%...y.&...y\|&...yt'...y(...y+)...y.)...y.+...y.+...y.,...y.-...y.....yY/...yl0...y&1...y.2...y.2...y.3...y{4...y.4...yS5...y.5...y+6...y.6...y.7...y.7...y.8...y.8...y.9...y";...ydD...ymF...y.I...y.N...y.Z...y.[...y.d...y.j...yXp...y.u...y.\|...yx~...y.....y.....y.....y.....y#....y.....y.....y.....yK....y....y.....yK....y?....y.....y.....y.....y.....y.....y.....y.....yi....y.....y.....y.....y.....y.....y.....y.....yh....y.....yS....y.....y.....yy....y.....y.....yg....zU....z.....z.....z.....z^....z.....zU....z#....z.....z. ...z. ...z.!...zr"...zG#...z.$...zJ%...zL&...\|M'../\|.'..0\|.(..1\|j(..2\|.)..3\|K..4\|$+..5\|.,..6\|.,..7\|%-..8\|{-..9\|.-..:\|9...;\|....<\|....=\|.5..>\|.8..?\|.9..@\|.:..A\|.:..B\|4;..C\|.;..D\|e<..E\|.<..G\|.=..H\|.=..I\|i>..J\|.>..K\|A?..L\|.?..M\|{@..N\|.@..O\|EA..P\|.A..Q\|.B..R\|.B..S\|.B..T\|ZC..U\|.C..V\|PD..W\|.D..X\|!E..Y\|.E..Z\|.E..[\|bF..\\|.F..]\|.G

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_150_percent.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	1486334
Entropy (8bit):	7.957860933036681
Encrypted:	false
SSDEEP:	24576:v16edh+zS0KeuX7D3WldzJZzL3T6WbeDcG3ZXsRGIXa/S7wG/TcqYr87PD2R5QUi:tjr+zS0NwDGldzXG6eMRhB0GbcR8P24N
MD5:	67DCD2DAF586DF6AD139242B245AAE87
SHA1:	09B4541A28EEBB479C803EAEEC80BDB567D2C6B3
SHA-256:	1F2674DB6D546AA671176622CC0D47A2E65947076250D8EF78192F6BBEF1D5DE
SHA-512:	2A1B65C3E23E30B7C810A9EFD120B1AD56377AC596F16A189D3577E1823594C4801BA2CBA060B62F938030C7B0347A49C92228E702FD58F35495406F6323C73A
Malicious:	false
Reputation:	unknown
Preview:	..........,...>.........ryL...sy....ty....uy....vy&...wyZ...xy....yy....zyr...{y....\|y....}y" ..~y.!...y."...y.#...y.$...yW%...y.%...ya&...y.&...yg'...y.'...y?(...ym)...yP...y.+...ys,...y.-...y.....y./...y.0...y#2...y.2...yY4...y.5...y{6...yW7...y.8...y.9...y.9...yf:...y.:...y>;...y.;...y.<...y.<...y =...y.=...y&>...y5@...ywI...y.K...y.N...y.T...y._...y.`...y.i...y.o...yku...y.z...y.....y.....y%....y.....y.....y....y6....y'....y....y.....y^....y.....y.....y^....yR....y.....y.....y.....y.....y.....y.....y.....y\|....y.....y.....y"....y.....y.....y.....y.....y{....y.....yf....y.....y.....y.....y.....y.....yz....zh....z.....z0....z.....z.....z]....z.....z.....z.$...z.%...z`&...z6'...z.(...z.(...z.)...z....z.+...\|.,../\|?-..0\|.-..1\|....2\|....3\|./..4\|.0..5\|r1..6\|.2..7\|.2..8\|.2..9\|K3..:\|.3..;\|.3..<\|R4..=\|r:..>\|h>..?\|.>..@\|.?..A\|.@..B\|.@..C\|<A..D\|.A..E\|mB..G\|.C..H\|bC..I\|.C..J\|TD..K\|.D..L\|ME..M\|.E..N\|EF..O\|.F..P\|'G..Q\|.G..R\|.G..S\|pH..T\|.H..U\|GI..V\|.I..W\|.J..X\|.J..Y\|.K..Z\|fK..[\|.K..\\|:L..]\|.L

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_200_percent.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	1924585
Entropy (8bit):	7.9606211726580325
Encrypted:	false
SSDEEP:	49152:9vKjrOK9S0NwDGldzUK8ZOo6C5xI5ieR3Y0b+EUbXl2Y6:VKuK9S0NlzUbZOW5G5ieR3Sb+
MD5:	6223070E641210F4BCE728B087693C53
SHA1:	BD7377BED166269932F9CD67CE29417E8BD05BDE
SHA-256:	35ED540CEA657DB4D59C3D0E46E1D3EF26BBBFA5A475868CD88DCE1D286BC11E
SHA-512:	BBEEF6A649AC96C3F7EAFB3A4D75CD9B92D6BC6B4C5A2AC181CB472FDA6907417002CF67F293F8E7EE0C61FCAC1679AA95809E8F238E7ABB7C297D86CA30177F
Malicious:	false
Reputation:	unknown
Preview:	..........4..............j.....j.....j."...ji(...j.+...j.,...j`3...j.8...j.;...j.C...jYG...j.O...j.S...j.h...j.\|...j....jG....j.....j3....j....j%....jj....j.....j0....j9....j.....jK....j.....j]....l.....lh....l ....l.....l.....n?....n....nT!...nH$...nM'...n....n.....n.2...n16...n.:...n-;...n.<...n.=...n.>...n.?...n+@...n.....n...ry....sy....ty....uyZ...vy...wyN...xy....yy....zy....{y....\|y....}yi...~y4....y....y.....y.....y.....y.....y.....y.....yo....y....yG....yR....y#....yJ....y.....y-....y....y.....y....y....y.....y....y.....y.....y.....y.....y{....y.....yS....y.....y+....y.....y.....yw....y.....yW....y`....y.....y.....y.....y.....y.....y.....yK....y.....y.....yk....y.....y.....y.....y.!...y.*...y.....y.7...y.A...y>F...y.G...y.P...y>Y...y.[...y1^...y>b...ySi...ykj...y.q...ySv...y.y...y.}...yQ....yO....y<....y]....yN....yv....ys....y.....y.....yF....y.....y.....y.....y.....y.....y.....z.....z.....zt....z.....z5....z.....z.....z.....z.....z.....z.....z'....zK....zl....z`.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_250_percent.pak

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	1715610
Entropy (8bit):	7.958116988111234
Encrypted:	false
SSDEEP:	49152:PRjr+2reURB8oY8jL/nU2SZ17nnVJJ9VBIUbXl2Y6:Zv6YBA8jLUnnnjl5b+
MD5:	58CC1287307344B9EC8C9E26ED6C3501
SHA1:	46A1C9A8EB6E3D751A6ACEC9443F2E4B033EA8CD
SHA-256:	2844CDC18872169D49502F757FD8C86F2581A72AB90A3E4DCD83CD46E0BA3992
SHA-512:	0BF43D89FA8C4AFFCCF4313F2FBCDDF74410E274623C9FAE54A4769FED4BF36DD633CA3D589017338A6382BA0F939D2E872C8AC918A00AC2AD5F5B8991ADB4EB
Malicious:	false
Reputation:	unknown
Preview:	........../...B.........ryP...sy....tyd...uy:...vy....wy....xy....yy....zym...{yF ..\|y9"..}y+$..~ym&...yx(...y....y.,...y4-...y.-...y.....y.....y.....yh/...y./...y.0...y.1...y.2...y.3...y.5...y.6...y.9...yD:...yK<...y.=...y.?...y.@...y.A...y.B...y.D...y.D...yRE...y.E...yF...y.F...y.G...ynG...y.G...y.I...y5S...y>U...y.X...y.]...y.h...y.j...y.r...y.y...y)....y.....y.....yI....y....y....ye....y.....y.....y....y.....y.....y.....y.....y.....y.....y.....y.....yy....y.....yc....y.....y.....yW....y:....y.....yV....y.....y.....y.....ya....y.....y9....y.....y$....y.....y.....yJ....y[....yl....y8....z&....z.....z{....zQ....z. ...z #...z.%...z.*...zz/...zb0...z#1...z.1...z.2...z.3...zd4...z.5...z.6...\|.7../\|.8..0\|e8..1\|.8..2\|r9..3\|.:..4\|.;..5\|X<..6\|.=..7\|.=..8\|.=..9\|]>..:\|.>..;\|.?..<\|d?..=\|.E..>\|zI..?\|.J..@\|.J..A\| K..B\|.K..C\|NL..D\|.L..E\|.M..G\|.N..H\|tN..I\|.N..J\|fO..K\|.O..L\|_P..M\|.P..N\|WQ..O\|.Q..P\|9R..Q\|.R..R\|.S..S\|.S..T\|.S..U\|YT..V\|.T..W\|,U..X\|.U..Y\|.V..Z\|xV..[\|.V..\\|LW..]\|.W..^\|.W.._\|SX..`\|.X

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_autoupdate.exe

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5707168
Entropy (8bit):	6.529563568287021
Encrypted:	false
SSDEEP:	98304:C4BUgxhSN2As/i1e8KXMjcZMSQfSJZ2mor3Zxa:C47A5ecj0MSV8Ba
MD5:	4D96E6FCF0FD4774EEBCD45B76A2A022
SHA1:	2DEA7486BA0C2EB11C46AAC9FAF389F3A5846105
SHA-256:	E7F9657E7512A1C042354CC73E5D7A478ABD6A3983BE96F6CE39E7C3F7EF1F87
SHA-512:	35C9588B54C33A19EB0E3F541F9FFF54D21425ACD746C484BAC4EDF931EE39DEEAEB3A604BACE15BA7108055A2677A9DD0FF1021D1CFFFE2D66E882FF0EE09D2
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e..........".......G...........-........@..............................X......3W...`..........................................P.Y.....P......@W.0I...@T..2....V..)....X. ?...dP.8...................pcP.(....3G.@.............P.8...8.P.@....................text.....G.......G................. ..`.rdata....... G.......G.............@..@.data...lf....Q.."....Q.............@....pdata...2...@T..4....R.............@..@.00cfg..0.....V.......U.............@..@.gxfg...@5....V..6....U.............@..@.retplne......V......DU..................tls....i.....V......FU.............@...CPADinfo@.....V......JU.............@...LZMADEC.......W......LU............. ..`_RDATA..\.... W......^U.............@..@malloc_h.....0W......`U............. ..`.rsrc...0I...@W..J...bU.............@..@.reloc.. ?....X..@....V.............@..B........................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_autoupdate.licenses

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14004
Entropy (8bit):	5.037159328058129
Encrypted:	false
SSDEEP:	384:SrNYrOXburxrs4rsFm1DLTryOibEYI3WSOZzxrsCrsRm1DLY7/ymu:KYXtBLDLTryLQ4ZllRDLs/ymu
MD5:	2528B26988213FE5C0EE9CE75ACC2935
SHA1:	D45F0A12E3E0DE6137AE389C7DD680295ADA2A68
SHA-256:	42E58027E502EDAE71B2065ED0A6AB057907C41124C220E54AB75EAA84B0B0E7
SHA-512:	F99295BD23D475D854DD872521F385568EDF28E4DB778F82A03F00FCD7061394A48D3C1644B5817FADFA31BDBCB53AD131ABDB6DD11F8E615020C26A1A970F72
Malicious:	false
Reputation:	unknown
Preview:	This software includes the following third party libraries/code portions:.. - libcurl, which is covered by the following license:..COPYRIGHT AND PERMISSION NOTICE..Copyright (c) 1996 - 2012, Daniel Stenberg, <daniel@haxx.se>...All rights reserved...Permission to use, copy, modify, and distribute this software for any purpose.with or without fee is hereby granted, provided that the above copyright.notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN.NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,.DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE.OR OTHER DEALINGS IN THE SOFTWARE...Except as contained in this notice, the name of a copyright

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_autoupdate.version

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:SWhv:SW5
MD5:	0589F66713BC44029A1A720B9A0D850D
SHA1:	2FDF7D04F0372055C9D77CA43D9A3C08798905F3
SHA-256:	64D23F858EF51B0F996E4966D4E27C0371B437E2D2787890B1F7AD22D4EC5663
SHA-512:	31B29544FC93EAC2109CD1E4A617B5D5CB361C0BA608A954E873A64648E93DD65C7B4AED7F4B687F85C47E9909852FEC93B224D929BABDE1E0145A58DEA33634
Malicious:	false
Reputation:	unknown
Preview:	1.3.0.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_browser.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	221057952
Entropy (8bit):	6.696390746872539
Encrypted:	false
SSDEEP:	1572864:1cOkhs7wwYZlQ1a305pSPY3VHNG4BpeWABwcWM1fDPDjo1awB/+BPJZOkRjfr7Be:1soYN3U2DDPDjo1Vkne
MD5:	6C3E134767CB6D943675C232B6B3B379
SHA1:	3057CF76932E304D4C4A5C207823264AD7EBA530
SHA-256:	BB9EAFECE785C97BFFE19FCE610B985B1E7313605ED3F0A403E091C50D02D431
SHA-512:	0E9EF7437539A69EFD75BE67266CA2CC51590C59BE503F1A9F9B53D4EACB0199FD06698C8742ECB88F0A8A50EB8E76DF4DDEF1EA804CEBE3DEEAC7A5A8E5D498
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." ......H..................................................`......b8-...`A........................................\|......X..\|.....m.........48Q...,..)....n.lU......8.......................(.....I.@...................`...`....................text.....H.......H................. ..`.rdata....p...H...p...H.............@..@.data...H.`.....&.................@....pdata..48Q......:Q.................@..@.00cfg..0....0l......6..............@..@.gxfg....D...@l..F...8..............@..@.retplne......l......~...................rodata.......l..................... ..`.tls..........l.....................@...CPADinfo@.....l.....................@...LZMADEC.......l..................... ..`_RDATA..\.....l.....................@..@malloc_h......m..................... ..`.rsrc.........m.....................@..@.reloc..lU....n..V..................@..B................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_browser.dll.sig

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	7.59373694717507
Encrypted:	false
SSDEEP:
MD5:	38C01BC417B9C9935832C914DA5ECA45
SHA1:	E8D76E1F62D9B07FE7A63B2B3189EC98DBFBA832
SHA-256:	475DDE4AE359FF106B09BB476C9CAACFAA4E3B39B2F5DA23E1A076FCFC0CAC5A
SHA-512:	0C3A36B9A0469D3944A826EF67FA5922A2CDDE603F106DC0B8006C1628E6C1D75C2865DB3E709D8FC2EC22AA6035FEE957D64356ADCF5EC1D2C89B229F8DE0F9
Malicious:	false
Reputation:	unknown
Preview:	....0...0................K)..3...[.40....H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...180627202339Z..280624202339Z0..1.0...U....PL1.0...U....DOLNOSLASKIE1.0...U....WROCLAW1.0...U....Opera Software AS1.0...U....DESKTOP1.0...U....DESKTOP PROD1'0%...H........wdzierzanowski@opera.com0.."0....H.............0.........x.....jn...)>a.....-} .v...P..S..x.>k{.........Tr..Yo.D....d.....l.v.wU. .A.W5..oor....-Vs.o.......yH.pJ...?.Whs0`....Jb....3/. tl..8c........C..Byq>h..3A8..{..p....\..n...Q.t....0mQ{j......U\|.W\...........s!....K...'.....s..s....P..r8..........0..0...U.......`..\../X.l...e....w0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0....H..............D.G....gtpx.......~...v.....c..%.I.....c2Y.Y.....Y^..Aa..A.b.Y.f..Zra*.),K.....n.1r.C...Z...)....W.r.gu.Z....l......S.CF.m.Y...P.W..y.f.\,.$.>...!...FK....j....XHn.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_crashreporter.exe

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1996192
Entropy (8bit):	6.484249197226973
Encrypted:	false
SSDEEP:
MD5:	5D006C2C07ADFADBF44E14529B0EB18F
SHA1:	2DF529DF00DA96EDDB4F3CF5CDF642F5EA2438B2
SHA-256:	114002E36EF80DC11105983A5CFE677445B469BB276FD934C51AEF1B1BC547CE
SHA-512:	1B6B6C11F05FE59D81F88F9584839158E83BD3F19A41895F66C67BD8B39C6FB0939406B1FC733EE1CD3B52B2EEAC5A6AF550D1CD4E9B22A4B3B42C71B5E84DCA
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........."......x..........0..........@....................................@q....`.........................................[V..\....V............... ..8....L...)...........A..8...................`@..(.......@...........H`.......U..@....................text....v.......x.................. ..`.rdata...............\|..............@..@.data...D....0......................@....pdata..8.... ......................@..@.00cfg..0...........................@..@.gxfg...@........0..................@..@.retplne.....0...........................tls.........@......................@...CPADinfo@....P....... ..............@..._RDATA..\....`......."..............@..@malloc_h.....p.......$.............. ..`.rsrc................&..............@..@.reloc..............................@..B................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_elf.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1246112
Entropy (8bit):	6.507201820061807
Encrypted:	false
SSDEEP:
MD5:	297161CB74389B65BE6D1E75E8CB47F3
SHA1:	DB74A72DFD8D7AF7DCBB7F3B3B46FA8C2305C03D
SHA-256:	2218D12D8084665D0371233280599E892ED6F0C373C0255FC4A2868F3AD18463
SHA-512:	0C2EA0B6F9549373011CFBF6BF4050CD91ED920CC2C1CF2F2C393AE8FE33BF41CA799092BDA2541457642D0ED32901EF2961BBA23E8DF3889A5C4F94A16203EC
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." .........J............................................................`A........................................Tk......Ul..(...............`........)...........\..8....................[..(...P...@............p..P....h.......................text.............................. ..`.rdata...x.......z..................@..@.data...<.... ......................@....pdata..`...........................@..@.00cfg..0....`......................@..@.gxfg...0-...p......................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\opera_gx_splash.exe

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2255776
Entropy (8bit):	6.689801630019627
Encrypted:	false
SSDEEP:
MD5:	4D8773DDEECF6222E7F8E904159A81AE
SHA1:	0A8AEB08990EB081EE0F47B87174109603F4C736
SHA-256:	5F28C53C82603DFFD03E6E0AFCEF17898EF9645AE488A86F7C5F425A3B25ADC6
SHA-512:	18017C73362AB6E0930392271E0BAB40C718AD332C6D03BF9380789834A4FCC0A310BDA30374CB31A649B5C6467DF80C85168676BDE0C3C218A2F7DF87B0E852
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........."............................@.............................`#......n"...`.........................................S...X................M..........B"..)...@#.........8....................~..(...`...@...........@...........@....................text............................... ..`.rdata..(y.......z..................@..@.data........@.......*..............@....pdata..............$..............@..@.00cfg..0...........................@..@.gxfg...@+.......,..................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@.rsrc....M.......N..................@..@.reloc.......@#......,".............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\013E742B-287B-4228-A0B9-BD617E4E02A4.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.286080774872623
Encrypted:	false
SSDEEP:
MD5:	91A97B1678EA6F166A6ADF4370BEC2E6
SHA1:	2D4B52234F490887463B75DB53983F7133C6E46A
SHA-256:	1AC6DBE3F6EE18BAA94EF8660B41528F7B8EF79148BC7B58C21485B85476A9A9
SHA-512:	9D0855444968B4F4A777CE690776EAB00BF0DAA6AFD01B52BE96DFF2305572C133E1141FC79C07BC8DD4C739EC330813A7A737D7A7BAECEB46EBC35D33AB834A
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?...?...?...?...........?...?...?...?...?...@.......@.@.?...?...?...?...?...?...........?...?...?...?...?...?.. @. .>...?...?...?...?...?...?...........?...?...?...?...?...?...?...?...?...?...?...?...?..+K...........?...?...?...?...?...?...?...?...?...?...?...?...?..........Uo...?...?...?...?...?...?...?...?...?...?...?...?..+K..........c{......r....?...?...?...?...?...?...?...?...?...?..............9W...........?...?...?...?...?...>...?...?...?...?..........+K...?..........9W...?...?...?...>...@. .?...?...?..Uo...........?...?..9W...........?...?...?...@.@.....>...?...?..........+K...?...?...?..........9W...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\07593226-C5C5-438B-86BE-3F6361CD5B10.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.560345262666608
Encrypted:	false
SSDEEP:
MD5:	74FDAC19593602B8D25A5E2FDB9C3051
SHA1:	81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
SHA-256:	F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
SHA-512:	8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................\|S..{R...z...z...V...\|...\|...\|.......\|...\|...\|...\|...\|...\|...\|...h...V...\|...\|...[...~...~...~.......a...a...a...a...a...a...~...\|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................\|...............................................................................<...............................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\0CD5F3A0-8BF6-11E2-9E96-0800200C9A66.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	17542
Entropy (8bit):	2.247918084411713
Encrypted:	false
SSDEEP:
MD5:	CA6619B86C2F6E6068B69BA3AADDB7E4
SHA1:	C44A1BB9D14385334EB851FBB0AFB19D961C1EE7
SHA-256:	17D02E2DB6DBEDB95DD449D06868C147AC2C3B5371497BCB9407E75336A99E09
SHA-512:	30F8F8618BFBCD57925411E6860A10B6AD9A60F2A6B08D35C870EA3F4CEC4692596A937FF1457CEFF5847D5DA2B86CEBA0200706625E28C56A2455E6A8C121D3
Malicious:	false
Reputation:	unknown
Preview:	......00.... ..%..F... .... ......%........ ......6........ .h....@..(...0...`..... ......%.........................................E...................................................................................................................................................?...................................$...........................................................................................................................................................................................B............................................................................r...P..........................................................................................9...............-........................................................r...................................................>......................................................................$..............................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\1AF2CDD0-8BF3-11E2-9E96-0800200C9A66.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.17081824784348
Encrypted:	false
SSDEEP:
MD5:	64AD26B9B9D8E4DA8CD564FE4843E65F
SHA1:	9D1D05134F36EBA77ED18F725BC0CA2121FA2686
SHA-256:	E5DCCC694E7F34DAF334B3A48B68DA450D5B34FE8A4E06842D864E99F400770A
SHA-512:	5F77BF6EC0D46C99E02A268E63587C9CD552B61FDB55ECE3955B50CC470EC103B06B2360EDA86BD49AA45458E1885F7A4E8256DA7B47DC8B8B343BCEF5CDCEA1
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@.......................................................................................................................................................................LVZ.G\e.................................................3u..PPP.PPP.PPP.PPP.:m..........................................Bbn.3w..OQR.PPP.PPP.PPP.NRS.+...................................PPP.E^g.....4t..PPQ.PPP.PPP.PPP.G\c.............................PPP.PPP.Cam.........9n..PPP.PPP.PPP.PPP.........................PPP.PPP.PPP.............6r..PPP.PPP.PPP.........................PPP.PPP.PPP.........LUY.PPP.PPP.PPP.PPP.........................PPP.PPP.PPP.....1y..PPP.PPP.G\d..\|..............................PPP.PPP.PPP.....?gv.(...........................................PPP.PPP.PPP.....................................................PPP.PPP.F]e.....................................................PPP.Cal.'.....................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\1CF37043-6733-479C-9086-7B21A2292DDA.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.6549496934735806
Encrypted:	false
SSDEEP:
MD5:	0342F103B6960E1565D24EABD5A6079D
SHA1:	7C6C7EF5E86A83BC7FD75729BD641244CFFC8CB4
SHA-256:	F92DC912529EB9D75655DC9C41557D2AF532425D1A6C8BAFB0879109C850F955
SHA-512:	E37D8445CE9E0AE80E1519A11831075994F1F3255A85E8883F1CC171204DD3A4CC9560655E54F1AA27B4602A44B1FB4711AE352942319D6F0714F17AB48EB2D4
Malicious:	false
Reputation:	unknown
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... ..........................^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]0..T$..T%.._2..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..........\...^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..[-..........}..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...g..........Y..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..W'..........g=..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]/..............^0..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..wQ..........V'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..V'..........wQ..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^0..............]/..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..g=..........W'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..Y...........f..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...}.........[-..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..\/..........^1..^1..^1..^1..^1..^1..^1..^

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\2A3F5C20-8BF5-11E2-9E96-0800200C9A66.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.1885512297205745
Encrypted:	false
SSDEEP:
MD5:	2C40ED190AA02EB3A2CDC38B89F4458D
SHA1:	F6E1F3E63098CCB207CBCF5127B7619AD294A4E2
SHA-256:	FB15A61B133EC3333B377B947059550EC69304F0F9DA6FB333A54048F3E04E5D
SHA-512:	1068EE61996222DCCD50C007BDC4A99D83DCC928E22AE845D27419952854A21B716878815FDA5747B75F1226DBC478F67AD9FCF177F80E326695D603B7FE7FAE
Malicious:	false
Reputation:	unknown
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... ................................a...................................................a.......a...........................................................a....................................................................................................mmm.>>>.............................................FFF.............999.....................................,,,.kkk.............'''.....ddd.............................................MMM.............fff.............................BBB.TTT.........kkk.................yyy.........................................###.///.............JJJ.....................YYY.===......................................................................... .........BBB.............;;;.............@@@.............GGG.............:::.CCC.............PPP........................................................................................................................................a......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\2F8F0E41-F521-45A4-9691-F664AFAFE67F.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.2795862597625223
Encrypted:	false
SSDEEP:
MD5:	93E4504D4C585CFDA1979B37E75FE39A
SHA1:	5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
SHA-256:	69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
SHA-512:	072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\3B6191A0-8BF3-11E2-9E96-0800200C9A66.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	5.6318458632047665
Encrypted:	false
SSDEEP:
MD5:	9796ED786D95606D51BE9DAB54FB5350
SHA1:	6EE48A6F912384D8F9CCE8BF7931BED779DC1D9D
SHA-256:	74368197CB53191E522E3A73AAB974D53EAE8E38DA694A1ED2CFA06F39176E58
SHA-512:	E9D14BA4486E73AB0FBB30F0C505E8AB2D8D5F55A3F87EC33AAE994F3B796EA415564136E70812B6ED09595D1BEAB345FEE1B7199694CE3F12118307065330D1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .....&......... .h.......(... ...@..... ...........................;.p.5.o.6.o.6Dd.0.........................................................................................d.0.o.6Do.6.o.4..;...;.p.3.o.3.n.3.q.3.n.3.r.7.n.5.o.6up.8Pn.7)i.2.................................m.3.n.6*q.8Po.7tn.5.n.4.n.3.q.3.n.3.n.3.p.3...;...;.q.3.s.4.s.4.v.5.q.4.r.4.q.4.q.4.q.5.q.5.q.5.q.4.p.4.r.5.p.4.q.4.q.4.q.5.q.4.r.5.q.5.q.5.q.5.q.4.q.3.r.4.u.5.s.4.r.3.p.3...;...;.t.5.w.5.v.5.y.6.u.5.w.6.x.7.x.7.w.7.x.8.y.8.y.9.z.9.z.9.v.7.w.9.y.9.z.9.v.8.v.7.v.8.v.7.v.6.v.6.v.6.z.7.x.6.v.5.t.5.r.3...;...;.u.5.x.6.{.7.y.6.y.7.z.8.\|.8.}.9...;...<...<.~.<...<...<.{.:.\|.;.}.;.z.:.{.:.\|.:.z.:.{.:.{.9.{.9...:.{.8.\|.8.w.6.t.5.t.5...;...;.v.5.z.7...9.}.8.}.9...9...;...;...<...=...=...>...>...?...=...>...>...>...>...>...>...<...<...;...<...<.\|.8.~.8.y.6.t.5...;...;.w.5...9...;...;...;...;...<...>...>...?...@...A...A.................@...A...A...?...>...>...>...>...=...;...<.}.8.v.5...;...;.z.7...:...<...<...>...

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\3BFDFA54-5DD6-4DFF-8B6C-C1715F306D6B.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.1032077050059135
Encrypted:	false
SSDEEP:
MD5:	BD5865B6A3787241931895B562D1AAF9
SHA1:	AB4636F3D534E11F8FCFDEA8A5070CD5D203F9C5
SHA-256:	A81AD17502B90A50BB491911F35D44BEF0A855BDA2F9BFCD7D98868AD0678718
SHA-512:	247766FE6585C0E965E7861AEDC48511CF825812B4C72345CB6FDBB148C3ED6A654C70D216187B4095770FB3BE1B5A18CD5A7289F5EE3BE0E6D01CB2AA12F40A
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................(H. 'D.p'D.#C..'D..'D..'D..'D..#C..'D.'D.p(H. ........................................................................(D.@%E.'E..'E..'E..]s..]s..x...........k...5P..'E..'E..%E.(D.@........................................................ @..'D.'E..'E..%E.(E.`...............................(E.`%E.'E..'E..'D. @..............................................%E.0'F..'F..'F..(D.@.......@.........................'F.%E.0....(D.@'F..'F..'F..%E.0....................................(E.`'F..'F..(F.....&F.P#C..........F.d.F.d....s.z........3r..<...3x..&F.P....(F.'F..'F..(E.`............................%E.0'G..'G..(E.` @..'G.'G..B[.........F.d.F.d.E.Z.F.d.F.d.F.d.F.d.F.d.>...'G..'G. @..(E.`'G..'G..%E.0.................... @..'G..'G..(H.` @..'G..'G..'G..\p.........F.d.F.d.E.T.F.d.F.d.F.d.F.d.F.d.>...'G..'G..'G.. @..(H.`'G..'G.. @..................'G.'G..(H. P..'G..'G..'G..'G....

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\4C95ADC1-5FD9-449D-BC75-77CA217403AE.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.0366948059247445
Encrypted:	false
SSDEEP:
MD5:	3264B65E59E51CA4943AE076748BFCEC
SHA1:	59AD003192DB03CA1E089924955FDCE0E25D159D
SHA-256:	65944B9D2003DCB988A8E3E03D29074A8C142520431EFBA1CC115036A8072F47
SHA-512:	7D81E6EE46A4389274C11178CB8E4CCF04BAAF1EEAD91BA44F27D7AF0290C55F55FBA2E7EC9E72DECA58D5138BA13238DCFB0956974E82059FE5285994090192
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................................................................7M$..(........................l......n.D.%.`...]R..P...A0 .4.%.'.)..................].........-.m...u...h...[...M...?.!.2.%.%...B...........v.........]w.G...........f...X...K...>.".0.&.#...........<....................................H:..;.#.-.'. ...................$..................................8a#.+.(..}.................................................... .6.$..).......uj.i.......`........................................kG..*..........[.p}....U...........................................]fw./......:....oo...............................................4...........-...?...............................................'...........?...O...^.d.......................................1.E.........S...b...q.....f....................................................t.'...............n...FE..].........................................................0.......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\5BBBDD5B-EDC7-4168-9F5D-290AF826E716.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.867292544398476
Encrypted:	false
SSDEEP:
MD5:	7868D43BE5BE8978E247DA73B69A50AC
SHA1:	8F30676FF39D8A5DA69D2DCC624A6279FD323A13
SHA-256:	FA6C55B1C6F924242A2EE556859BB935A2427320AFC7D2C911AD4192727662A2
SHA-512:	52C174144A81B0218695FBB8F9152EEC917D914CD5DF2662A03706E161025FA962CDF4E952B42D990C254377B0B1A4B5B4B01AAF4E62AC6072847CE947252767
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ............................................%...1...7...8...8...8...8...1...$.......................*...........................................................,.......@....Z...Z...Z...Z...Z...Z...Z...d.........$.................Z...Z...Z...Z...Z...Z...Z...Z...Z...Z.........1.......'.... o...Z...Z.. o...................Z...Z...Z.........8.......1.....Z...Z...Z.......................Z...Z...Z.........8......./.....Z...Z...Z.......................Z...Z...Z.........8.......#....@....Z...Z...d...................Z...Z...Z.........8.................d...Z...Z...Z...Z...Z...Z...Z...Z...Z.........8...........%........p... o...Z...Z...Z...Z...Z...Z...Z.........6...............B.............................Z...Z...d........./.....................d..................`....Z...Z..P..........#.....................Z...Z...Z...Z...Z...Z...Z...Z.............................`.... o...Z...Z...Z...Z...Z...Z.............-..................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\66DD4BB6-A3BA-4B11-AF7A-F4BF23E073B2.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.1885512297205745
Encrypted:	false
SSDEEP:
MD5:	2C40ED190AA02EB3A2CDC38B89F4458D
SHA1:	F6E1F3E63098CCB207CBCF5127B7619AD294A4E2
SHA-256:	FB15A61B133EC3333B377B947059550EC69304F0F9DA6FB333A54048F3E04E5D
SHA-512:	1068EE61996222DCCD50C007BDC4A99D83DCC928E22AE845D27419952854A21B716878815FDA5747B75F1226DBC478F67AD9FCF177F80E326695D603B7FE7FAE
Malicious:	false
Reputation:	unknown
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... ................................a...................................................a.......a...........................................................a....................................................................................................mmm.>>>.............................................FFF.............999.....................................,,,.kkk.............'''.....ddd.............................................MMM.............fff.............................BBB.TTT.........kkk.................yyy.........................................###.///.............JJJ.....................YYY.===......................................................................... .........BBB.............;;;.............@@@.............GGG.............:::.CCC.............PPP........................................................................................................................................a......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\6D3582E1-6013-429F-BB34-C75B90CDD1F8.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.560345262666608
Encrypted:	false
SSDEEP:
MD5:	74FDAC19593602B8D25A5E2FDB9C3051
SHA1:	81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
SHA-256:	F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
SHA-512:	8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................\|S..{R...z...z...V...\|...\|...\|.......\|...\|...\|...\|...\|...\|...\|...h...V...\|...\|...[...~...~...~.......a...a...a...a...a...a...~...\|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................\|...............................................................................<...............................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\76C397A8-9E8E-4706-8203-BD2878E9C618.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.638581632319262
Encrypted:	false
SSDEEP:
MD5:	15CC60C14626AE2549F3305C25B249F7
SHA1:	A5DB46CDB09B46FD644BE78D2E3B798AE1C3DAEE
SHA-256:	2D2E6EDAD6C27FD6BC79F2B02E15C1F8B227C1621536F902F065673FE03D0667
SHA-512:	75BC0B4C13D40C253B796FEF48AAF4F9BF8C5981B20D287E740AD9950CD95CBAB32456E57804A907D68475C8E0E2B174A4964C9014849B6A84EAB658052E6812
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@...................pn..b..%U.1#M.B!H.L!G.O!G.Q!(9..%&..%".......................)._]w..P...I./.E.>.D.H.C.K.G.E.N.;.^. .]u,.............. ...4...F.oEz..=...9.'.7.3.8.;.:.?.?.;.H.0.[...BX........... ...3...M...`.g=w..7}..5~&.4.0.3.4.5.5.9.2.C..V...(5B..........+...E...c...r.e8w..5\|..5.5.5.=.4.;.5.6.9./.B.$.N\|....o..........6...W...v...\|.e7{..7.?.8.W.8.Y.8.S.:.J.<.>.F.,.Dl$..........#...A...i.......\|.c8.F.:.i.;.w.;.w.;.q.<.h.>.^.D.L./\_.............M...s...}..:w.s9._.;.s.5.m.6.m.9.r.:.n.:.e.:.U.0M_..........+...O...i...k..{xW.5.P.0o..)i..(n..x..,...,...-...{j...b...c'.fVU.?J..(I...9...lW.+K./)N..h..q..s..)v..'...3v...e...o.............{....)....)G./+b..,w..,{..,y..+v..$u..E^z..h...l...z...................k.1/~..1...1...0....... h..]XF..i...k...r...~...............3..15...7...7...5...1....^..t^ ..h...j...m...q...t...w...x..v..8..1:...<...=...<...5...4q...`...e...i...l...m...l...k...k..j..4..79...<...=...=...:...K...~m'.}l&..k..v

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\8D754F20-8BF5-11E2-9E96-0800200C9A66.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	6518
Entropy (8bit):	2.407909805152941
Encrypted:	false
SSDEEP:
MD5:	5E5293480F2EE9B15767E01F4D5DBAF5
SHA1:	4AF378AE27C39DC0128EF2094A5E6B657ADB60B0
SHA-256:	87CFD63B77DA23BF2B7C342F666138C3C35CEC7F2AABD51618447913AEE97DA3
SHA-512:	3CDE31C1641B945BF1007AAE8468E815E29B1712AB877AAE2FE9C94A4AB3C1BF39F027A4FD113F962B466903E2550D52AD88E9AA5826BC66D96F43CA4AA8F3DB
Malicious:	false
Reputation:	unknown
Preview:	............ .(...&... .... .(...N...(....... ..... .........................................................................................................................................................................................................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d.........................................................................................................................................................................................................................................................l...................o.......................................$......

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\AD2FD2BD-0727-4AF7-8917-AAED8627ED47.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	1.6159828216175358
Encrypted:	false
SSDEEP:
MD5:	58605FAE7FE4E695F5FD358A7465565B
SHA1:	F47615D987B3F2D8FCE40DC93D55DEE71A78CDDC
SHA-256:	831CC92E9F60D151B3446E5125AF5A8C45E613636D384324179AE565DFEC08FC
SHA-512:	C045AC34FC39BBF1D7B108EB85165C57E551B47239D8A6515F7EC843C2AAE0CAEDA9E3E1CB919F1AED2FF9F98FF8D34934ED961ECEBCA1413A1FCBDA4F09343F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@......................................................................................................................................*..........................................................h.......:...............z....................................................................................................................................................A...........,.....................................R.......T...............M..............................w..............7...............Q..............................7...............0....................................................................<..................................................................u...................................................................................................................u...............w..................................................................................................E...H......................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\B478FE0C-0761-41C3-946F-CD1340356039.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.994300674852024
Encrypted:	false
SSDEEP:
MD5:	D2F1F9CE53773F7F51412AFFFEE0D97A
SHA1:	748398747AAA25473BBB58353FCBCCB424E78849
SHA-256:	00764980C4713198CBCDF7BD6A657BBAFFE15AE3BAA4E09A8EF19F32606BB6F0
SHA-512:	010734637DCE084DBADD5C8D7A5ACC73FF262F37331AF4C9FD318310A12986917C647FFFFABF97C102C97A496D07CBF7F834DD358901D65DBC6CD77CD1F827D3
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@....................................<...<.k.<...=...=...=...=.k.?...N...U...................<...<.t.=...>...>.d.=.?.=.?.>.d.>...E...[...V...G.4.........<...<...>...>...................................E.j.A.1.........<...>...?.......D.+.G.].H.y.H...G.y.E.N.D.......?...=.......<.+.=...>. .@.o.C...H...L...N...N...L...H...C...A.<.?. .>...<.+.<...>.......B...H...L...O.Y.R.4.S.6.S...O...H...C.......>...<...=...>.;.....E._.H.......... `.. _.F.\...U...M...F.......>.<.=...=...=...............X.0!b..%j..%j..!b...X...P...J.B.....>...=...=...=.......J...P...X..!b..%k..%k.."c...Z...S...........>...=...=...>./.....G...M...U...].."b.."d.A!`...........H.......>./.=...<...>.\|.....C...I...O...U...W...V...S.'.M.e.H...D.......>.{.<...<.@.>...?...A.Y.D...I...M...P...P...M...I...D...A...?...>...<.@.....<...>...?...B.).D...G...I...I...H...F.^.C...@...>...<...........<...<...>...?...........................?...>...<...<...............<...<...>...>.}.>.0.>...>...>.0.>

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\C665D993-1B49-4C2E-962C-BEB19993BB86.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.2795862597625223
Encrypted:	false
SSDEEP:
MD5:	93E4504D4C585CFDA1979B37E75FE39A
SHA1:	5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
SHA-256:	69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
SHA-512:	072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\CCCED631-6DA2-4060-9824-95737E64350C.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.2795862597625223
Encrypted:	false
SSDEEP:
MD5:	93E4504D4C585CFDA1979B37E75FE39A
SHA1:	5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
SHA-256:	69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
SHA-512:	072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\CFCE84E5-9A95-4B3F-B8E4-3E98CF7EE6C5.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 6 icons, 16x16, 2 colors, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	34686
Entropy (8bit):	1.1787188557524333
Encrypted:	false
SSDEEP:
MD5:	5337074698C608F4996D7F6AC571DBB9
SHA1:	66CB3910242DDA40A4E17C76FDC73829C8DB99BD
SHA-256:	B3C8A7AA2BC429AA15A764574D7C7D54F2672628DFF75CA830A5DB4CBC878B3D
SHA-512:	D48AF3344304FFE613511529C227F0CDE3443C6409F14058D3E381754D6FE9295B71332840BBE8D55EFE40C893AB0513B15C70EC36008844508BA4FCC8E492DB
Malicious:	false
Reputation:	unknown
Preview:	..................f......... .h............. .....~... .... .........00.... ..%......@@.... .(B..VE..(....... ...................................3........................................f..8........................................'...........s...1.............................(....... ..... .....@...............................................................................................................................................................................................................................................................................................3..n3...3...3...3...3...........3...3...................................9...3...3..o............3..43..)3...............................9...3...3..p................3...3...........................3..,3...3...3...3...............3..q3...3..>................3...3...3...3..O3..Z3...3..*........3..$3...3...................3...3...3...........3..93...3..X........3...3...3...........3...3...3...............3...3...3.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\CFD4BE41-4C6D-496A-ADDB-4095DFA1DD0E.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 8 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5686
Entropy (8bit):	3.499087745233182
Encrypted:	false
SSDEEP:
MD5:	CAE06CD4B5B7BE327CCB00A6DD6F588C
SHA1:	91AB18740E8C44D89F0C66485DEE5E616999921B
SHA-256:	0031AC87D8B67D608BF586EE097204782580EE645891C5D3D05591AE00F47953
SHA-512:	AD0DEEB131E9D78A58E0C61F0433F06332F0116129EA55F16739FF2C6A3767F5082500152B98273140296B8A8F1A7CAF984289AF5D562969B2515143E75E48B6
Malicious:	false
Reputation:	unknown
Preview:	..............h...&... .... .........(....... ...........@............................2)......7..............le..TL..............vo..e^..........g`......}w..........zu..............E=....91......YQ..[T...........z..........>6..OG..ic..........]V..b[.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\F3F34CBB-24FF-4830-9E87-1663E7A0A5EE.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.6549496934735806
Encrypted:	false
SSDEEP:
MD5:	0342F103B6960E1565D24EABD5A6079D
SHA1:	7C6C7EF5E86A83BC7FD75729BD641244CFFC8CB4
SHA-256:	F92DC912529EB9D75655DC9C41557D2AF532425D1A6C8BAFB0879109C850F955
SHA-512:	E37D8445CE9E0AE80E1519A11831075994F1F3255A85E8883F1CC171204DD3A4CC9560655E54F1AA27B4602A44B1FB4711AE352942319D6F0714F17AB48EB2D4
Malicious:	false
Reputation:	unknown
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... ..........................^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]0..T$..T%.._2..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..........\...^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..[-..........}..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...g..........Y..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..W'..........g=..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]/..............^0..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..wQ..........V'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..V'..........wQ..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^0..............]/..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..g=..........W'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..Y...........f..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...}.........[-..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..\/..........^1..^1..^1..^1..^1..^1..^1..^

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\F98D4D4C-8AA7-4619-A1E7-AC89B24558DD.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.5312914343989297
Encrypted:	false
SSDEEP:
MD5:	192A42730EEA5A6A3238F50285F01010
SHA1:	28FC94448C726E0D62375942866A1FAFC916F61A
SHA-256:	4515919BA9C8A1AE19DEAE230F2FDFBB94DE5C29753DC3FB7C2A877B474F4F0F
SHA-512:	B680B643CC66B7687108C34ADBE80996851A5B24BEAE2E7EA58C8C8AB86D4900DF12D5A4E8380186A53D7A46F923B6A4D7DB46555C5BCB0F90021DDA10D4568A
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@..........................f............j...=...................................................<...s??....................g...!...............................................*...q.................N.......................................................\|..........._.......................................................v...........................................................%.......................................................M..................q...............................9.....................................................J..............................i.................................................n...;...............................{.......................4.........................................................................Y...........................C..................................................................Q.......................................................................K.................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\FDC2CCAB-E8F9-4620-91DD-B0B67285997C.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.560345262666608
Encrypted:	false
SSDEEP:
MD5:	74FDAC19593602B8D25A5E2FDB9C3051
SHA1:	81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
SHA-256:	F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
SHA-512:	8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................\|S..{R...z...z...V...\|...\|...\|.......\|...\|...\|...\|...\|...\|...\|...h...V...\|...\|...[...~...~...~.......a...a...a...a...a...a...~...\|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................\|...............................................................................<...............................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\FF57F01A-0718-44B7-8A1F-8B15BC33A50B.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.6877369236023396
Encrypted:	false
SSDEEP:
MD5:	4CA6A47462D19D539F9A32B702B10177
SHA1:	1F53B02309B901C8E7CC20F8640187F4F185F393
SHA-256:	1BACA3300AEA9840985CFBFBAF1622BE00922BA193168C1FC4246BDB8898F217
SHA-512:	E08A0013A7D8664CBBD88EAA1235A27704DBB4BD13D849D45B3A529F7373844D67C11A2B13881823EF6586840980B670C8FB278CF220D1093976CD00148CA2B6
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................u.].X.:.W.9.r.X........................................q.W.S.4.S.4.S.4.S.4.S.4.S.4...Q....................0........p.W.S.4.X.:.................D..A...f.........................K.H.V.8..........................F..B.....................6.......................................B..............................................B..B..B..B..B...s..........................................B..B..B..B..B...z.................5.................................................................../P..9G.................................................0........Wb..5C..;I..................P\.....................0................Wb..5C..5C..5C..5C..5C..5C..kv..........................................\g..:H..9G..[f....................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\FFF3F819-B6CE-4DE6-B4E4-8E2618ABC0D9.ico

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.9160268464631507
Encrypted:	false
SSDEEP:
MD5:	72460DF2C3C16ED7FFFA3988F5E86CBA
SHA1:	B17DACC408D124A0AEF2650A92F3C0AB2F9D4F54
SHA-256:	8D2A443307CEBA1D996D0DDAF5FCE63B838B5DAFA6F09AAEFF2D83127F38DE01
SHA-512:	516720411D964823FD88A63BB1B0AD49F8A98BEE03D13CCDF23EB5775C8B4A02E743D099A481573C02B311B27E447F646DEEA5AEB6066FABF38EFFE96E712876
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .................................................................................................................................................................................................................................!.......F?..................................MG..............................OJ..................................................................ZT......................................................( .............................."..................................."................................................................................{..........................................UO..................................................................ZS......................................................93...................................&.............................. ...........................!.............................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\ab_tests.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	2561
Entropy (8bit):	4.511287976109681
Encrypted:	false
SSDEEP:
MD5:	1A9CD4E4812B2D130CA45228BCB33700
SHA1:	10A4DA3CDBE3320CA8DE96C810AF22576333B2F0
SHA-256:	C42F8D9E12DB61B769D6D8D345CECD6668EC4847C80A107910BBF87530223C32
SHA-512:	FF13EBB69177190393F62528216F05170BD68A2E2A3CA511DDD92E40ACABABDB5CC002FB546ED8451FD952F1FF2FD4A6C93658DF3FCE987D7193B1F1D9615CC2
Malicious:	false
Reputation:	unknown
Preview:	// tQtPYzJXnVa9SzjE0kXvU4xD/vLOQ3hg9wx9hzaCwIr7vvWyxsfKcoeBDzRhH32rMbTc8JdyS136pCaw/VzcEkpqwBXdOAhorEbiIX/gdISGtTN+l0c0xcOi4TVRtVh9eZ0PXwx9DhHn9UNOg9blF6mFcTxEWtnio8SP17o7RjmUzXyw7Vgxkq05I6iDTeLJYSIa9Ioe5a78EoKeWmPNX6Q/1/5Ga55FcZ+O44k9Fvbneuw1z17PhBMhe7zD+4dW6t38GaYX4wFVaVuiI34KLCjpUi6X+nsjkYjbhxuLAHVZyMZhYjgin24+CN/nRM8ohfN2U7ZCthbfHT71KSQI2g==.{. "version": 2023102301,. "tests": [. {. "name": "DNA-93212-ru",. "total_test_percentage": 20,. "country": "ru",. "test_state": 1,. "test_groups" : [. {. "name": "DNA-93212-test-ru",. "preferences": {. "gx.show-yandex-in-mid-profile" : true. }. },. {. "name": "DNA-93212-ref-ru",. "preferences": {. "gx.show-yandex-in-mid-profile" : false. }. }. ]. },. {. "name": "DNA-99214_GXCTest10",. "total_test_percentage": 10,. "test_state": 1,. "test_groups" : [. {. "name": "GXC

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\automatic_search_engines.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	696
Entropy (8bit):	5.5212029392751605
Encrypted:	false
SSDEEP:
MD5:	A57F6FF749977E20CB51141D94BF0188
SHA1:	E5C47419036365F7BD8B4AC3CEDE333268D312DD
SHA-256:	86F89B4CC2CB0C835E543C0F6D327432E3593C42C303CC6A4C57B28652DD9199
SHA-512:	EAE1D63EC5D33E56690C80697B630D8F8600CC86539F4D5C7935CCA096BB0656352E4300F2D2338FC0AA8FC5C70676CDAF5C5EA346FA3293C8F67B4E6C15B3DE
Malicious:	false
Reputation:	unknown
Preview:	// F7n3Sy/IGmzReATRzTK63iFOUytSjLBn7i6IzCDmG2oYcMh/i4+7dDN2+duv0z2/mT17AIM4I6bzJLLlCisaJwhnLYpfUBxV0xfgvqpl8+uy1/4XJ9OcA8r9+0tW9IGuF7oeolZnD9XaLAnkIaCJ6P6AeXnhOMXmHZwL+1IELm3Vdr26IHMFggBOWxcbcW+4cBGvIXeZFR8UuAG2cruv5MtJe34/ZwhLdh1MZVSVEvmh1PONPhw1z6Divsdn54EFW7Lx5Mi5E48pPrTD1VWbxz2y9exetRjsvXMEs+dkZ7vIhLV4RUKbNOOaraJ89+ITdJw2euMU9FXVyxzsncBI1A==.{."version": 1,."list": [. {. "url": "https://medium.com",. "short_name": "medium_custom",. "countries": [. "fr",. "pl",. "no". ]. },. {. "url": "https://youtube.com". },. {. "url": "https://redir.opera.com/amazon/",. "short_name": "Amazon". }.].}.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\browser.js

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	C source, ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	22353
Entropy (8bit):	4.084825970683737
Encrypted:	false
SSDEEP:
MD5:	DF1A04DA30E0B88B9CFE8918C832BB6D
SHA1:	9D07A99E6EFA22FF4107EC01BF664939F3A6FCDC
SHA-256:	A53187E2863A1183A86939230B77CB40C05940C35469A8E855EEDCA55377E5BB
SHA-512:	E328A474DCA5D59E304AE7C6A1069A221DE2023C310C140C488CDE536EBF182AC3AD47A1E6689C5E5F8F3DFC712D1F823CE6524FE037B9268A3CD8E3D0ECB5F4
Malicious:	false
Reputation:	unknown
Preview:	// QDZIV7kmNLFZgRELAVJ4Npq5/hyhUXjTxGn2/2o0SsLUM77EXaxAuJZqQ1Mdw+aU8SKvwkSDNmeZRw+Y2asSEmnZG0HOqIMgmSfu6zHN2h0GY3CUdgtIm3LQUaU62NOFOOGcp0TnowAvMQidWXc9t4H4zDprkArVTz9cZvdVSMmkI/1lSQqFeI272KGS7W3ELlu/GROyeOfa+yv+DUmcVSt9Pw4fHkOVVgGR92BL2uV7jWANQ/AJHlVK+1z54Y/04wBZNA0w8sJU1Yu2g12hwQ7ZCwAiMOFfjm1ZhznUCtQYgEJDoXsFQrdGywrZjZQkidlO+Op7u32m2GbP51mYxg==./. Copyright (C) 2023 Opera Norway AS. All rights reserved.. . This file is part of the Opera web browser.. . This script patches sites to work better with Opera. For more information see http://www.opera.com/docs/browserjs/. . If you have comments on these patches (for example if you are the webmaster. and want to inform us about a fixed site that no longer needs patching). please report issues through the bug tracking system. https://bugs.opera.com/. . DO NOT EDIT THIS FILE! It will not be used by Opera if edited.. . BROWSERJS_TIMESTAMP = '202312111442'; // for versioning; see DNA-54964. **/..'use str

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\continue_shopping.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with very long lines (3079)
Category:	dropped
Size (bytes):	176599
Entropy (8bit):	6.075727372912163
Encrypted:	false
SSDEEP:
MD5:	A162EAB85D75BF2BCFA75C55006FAD81
SHA1:	BBF0FC057A13BB83EFB2EC34A26074A4A3A274F0
SHA-256:	FB4B41F69E1654CB6C9F23391DA77CAE4420EBDDA52364BAC669DBD8A066211F
SHA-512:	86FE37B6E9195555B1B35685B55B856F8E0E8B6CECB8E8640B6A40C705266283BDA4DFB8D3E6CF2DE50CD4EFF41E167DF2712D0996F781C3D9F6282A9A2D9F5D
Malicious:	false
Reputation:	unknown
Preview:	// BfLmK3tVcIpY51J5MKykgiQE54C1mA8T+ydgVpHAMpmAG5OlG8gIwjuZSJAyaMCm0/5f2JmyfStIa7tLjTUUdIUtdsSzEDLVxH4D2nTfDlKMz06HEG9cKpRuu/iwovPG5IyU5ozwMFQcaf5A0AiZEf2si7h6rm7sW2hH8y5Qtiq3lwont5S/bg9u5xxZYQiEVU24OXB1Atlb0NT3YX9uutVmq/v0Zzf3+aObiuUqCxwd9t9sMVRpZjF25UypZhD5XSI+P4V6vSWOIwgj9sCVgUvbtOroWmOYwZK5F3bqtBd+aaJbG3tgxSdR8bqeX5YYStRHSshuqodtjukjCLyIeA==.{. "version": 9,. "partners": [. {. "partner_id": "aboutyou_at",. "partner_domain": "aboutyou.at",. "product_url_pattern": "\/p\/.*",. "product_history_pattern": "\"aboutyou.at/p/\"",. "partner_icon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAAAclBMVEUAAAD////4+PgYGBikpKQmJiYLCwvi4uLb29tLS0v09PTp6emCgoJra2tcXFxJSUnr6+vJycmKioo6OjojIyP8/PxfX1/6+vrMzMyamprf39/S0tLR0dG9vb28vLxDQ0MfHx8aGhrd3d2GhoZ3d3dFRUWvj4E8AAABVklEQVRIx+1VV5bDIAy0wcbg3kt62b3/FTeUZ+EW7Yt/M5/SSIyEEM4Xn4L5lRCVz/7Hpq13jEJCwujotRSl1yVv3BENL+v3/OThzsCTd2o84i5AvE1dt/NIyoMgH4PPt438F8Mu4syn1M/iwsRc1s/wtLdP2dje1JTkrdbbqfSDne0a6IBupf

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\custom_partner_content.json

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1824)
Category:	dropped
Size (bytes):	1344708
Entropy (8bit):	6.081849998191263
Encrypted:	false
SSDEEP:
MD5:	1FB07CF2B20D516ADC1067D9C4C57BB7
SHA1:	DA0BFEB9A98B2FDAF422A1B52FFA33ECA0684EA1
SHA-256:	294592F92BDDA407A531D81D64B7D141979F7B5B052370C1041430530DB7C481
SHA-512:	F4B17E1E60281465A3288E5BDE7C537AC419236A72B680AD533E93CAE81DC8E12221339A737C27257B0A561192F655C70230D818EB0219CCB5E4641B5FF811D8
Malicious:	false
Reputation:	unknown
Preview:	// DUwgkzpRs2UBZDQI77+cT3P6rFCB1A0dTs323s0P8VwKPNxJg7UC76QDbcCRMySUWu6oS1yzTCguRlUYTcidqpeZdtHOL09/z+luPzIHHqB/vQ9rnmKvNPJpGrBJkKfytTOuw9v8frDeZaeH6r4iB1b3IcxXDVBG/cZiVMvhj0/b9SbAbkgN94GUrDjIArHEo49eBMFcYKuLFjOUmbiRuESFn3Rlx1SFNsPk2GEohrRvsb3Fzh9UH6hwKFUEBxwUWIGMtPpf2rIDmUxAEUigjvrWMiGoDk4x5FdM+p5livY9OVeyVGtcfDm8zZJ3psJ6Uz8cqK1ZhYsebZFUup9rZA==.{. "version": 32,. "partner_id": "std-1",. "user_agent": "std-1",. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed_ysrcunow",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed_ysrcunow",. "wiki". ],. "speed_dial_index_list": [0].

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\daily_wallpapers.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72163
Entropy (8bit):	4.601891206052405
Encrypted:	false
SSDEEP:
MD5:	9DA90B26455525B2331FB64ABD1B0D60
SHA1:	592BB5CFCC9DF4126BEE2AC5464703D180789AC3
SHA-256:	924BD0C85221070ADAA23138C911C55AB29D84279782FE937D1E70407CC22C66
SHA-512:	D058B76007FD7568E23E351C96E8F34AF639D30DC0633052CBE8A094598E3F74D90E81DAE9EAA5AD96988F3CC2157A249927F0D015104666449C5D116E256CFF
Malicious:	false
Reputation:	unknown
Preview:	{. "daily_wallpapers_schedule": [. {. "wallpaper_id": "mods/kaandijoelepfajcbaglpnacgmebonpc/smart_wallpaper",. "start_date": "2023/9/4",. "end_date": "2023/9/5". },. {. "wallpaper_id": "mods/anlamljaonmlkmfaipamolamdpjobldl/smart_wallpaper",. "start_date": "2023/9/5",. "end_date": "2023/9/6". },. {. "wallpaper_id": "mods/eaahgnceaiheanheajmiojafolhdfbih/smart_wallpaper",. "start_date": "2023/9/6",. "end_date": "2023/9/7". },. {. "wallpaper_id": "mods/dafbhaiokkmgdlcpiblejdpgcnipgljh/smart_wallpaper",. "start_date": "2023/9/7",. "end_date": "2023/9/8". },. {. "wallpaper_id": "mods/jpghigceifbjmaommcoeheogkbphlanb/smart_wallpaper",. "start_date": "2023/9/8",. "end_date": "2023/9/9". },. {. "wallpaper_id": "mods/eggjmmfhnmejmopboifholjgiekialgf/smart_wallpaper",. "start_date": "2023/9/9",. "end_date": "2023/9/10". },. {. "wallpaper_id": "mods/naabgogikghh

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\default_partner_content.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Unicode text, UTF-8 text, with very long lines (7765)
Category:	dropped
Size (bytes):	253313
Entropy (8bit):	6.0358064565345195
Encrypted:	false
SSDEEP:
MD5:	F7CD8DC38163562EA49E2190EE4240E3
SHA1:	FD0D43180EBD0405D9CC8A1024096C0FB477B39C
SHA-256:	6DA80D1F65E811B20085CA44CC94FA444BF40DAC4EFCED4203BE969EA1D81735
SHA-512:	7BC999ED10DE759A75A1A3FC48784516343236402D662978EF591971419D05D74B6323505F0460607A2D295DD8AFB25284E34F54363B75D34DF57F0EE383EA01
Malicious:	false
Reputation:	unknown
Preview:	// bufo8VNUHtq1v6UEiF5GloZ8je1inb+GUe++eFbHlBFZ6VoAgwXsY2T9uV98ee04yoR7XmEAKrP/ZFPjriY3N88/TRMIBixNQtlo1pZe0NI/PQPEO3wWwhwMzFm+wnq6tu5MsYoYeTHp+Cw67VgcBoyCkzmz5Gt0cCeSYpYftrZd1QnK4DJTR4zk4cOS9LskYA+01pqqdt7wHwKKuuJn+tcAlRzDhu6ttYN4Z5H45vBu2inISuYNcyTO3oj/7g319hV0MO+sR6PyXeSFrLu7RiKmzMcn9rK9uqf9mzGxQy8Xp8RBLcK2XiLx3ymNi1vLxf5c/128SCNkNdWeZ9n3Pw==.{. "version": 120,. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "at": {. "other": {. "list": [.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\doh_providers.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	801
Entropy (8bit):	5.495629414250427
Encrypted:	false
SSDEEP:
MD5:	4F98A7320537B24179D9860246E2D840
SHA1:	B727FDB4D25AA07E02464EAB8DAAE4DC663ED298
SHA-256:	574421B40CF123844F55A0A72AD5EC0BC9DEA3C8D823F8B7EC065D7B7C346175
SHA-512:	3F6273688F25D375974A18E554339B7F3E2F0BCEE19F31E265DD6256C3514A23B4980D4F2182A69AD5ADA95A2CAD8F94AC04B510A26954392626EBD28F54E5B4
Malicious:	false
Reputation:	unknown
Preview:	// ia96yydt8bWv3y5ivc46+PdnIQFXt6cwopEjrrZk+GzzrDKmMzcyxK7YvTbpmIQjCw/QjXke1u1o3WiWeFr5+90QlOeWBJnZjzqILeh/ogmgCbB7hcNIVL31zrGZF+EyVVFZVRDsBx6pLCX3DEHKGrXNOb9epqcY2EwwM0goOtSqFoc+wlNrDRNwVOVT4GQ05GKThcHzHWSMu0DzC8Yd2II64XSFBsDM9U+HlrlASNhELQ31db0HJL0EWMcQc4sFM/DixX7TPvU/oKX35liQk8HEVxVrxhm612/tW8rZ54zab/O3RW1LE/23aLHU5jslgAI36CGRvXFeXlfeA51jJA==.{. "providers": [. {. "url": "https://cloudflare-dns.com/dns-query",. "ipv4": [. "1.1.1.1",. "1.0.0.1". ],. "ipv6": []. },. {. "url": "https://dns.google/dns-query",. "ipv4": [. "8.8.8.8",. "8.8.4.4". ],. "ipv6": []. },. {. "url": "https://dns.quad9.net/dns-query",. "ipv4": [. "9.9.9.9",. "149.112.112.112". ],. "ipv6": []. }. ].}

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\partner_speeddials.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Unicode text, UTF-8 text, with very long lines (347)
Category:	dropped
Size (bytes):	379486
Entropy (8bit):	4.977729585377959
Encrypted:	false
SSDEEP:
MD5:	980611397C2A8223B35B7034493DC6ED
SHA1:	DC6651965B19CD98DBCCF2D47E5616AEF91D837F
SHA-256:	3E9BB5F46CF23BA5A261B51A24D39D820CFBECD2C6C6F4AA84ED24DCE3BB2BBF
SHA-512:	03E92FFC9166E3F852C94556B9EBF2EEBA2F5B9C72B7FB30FEEEBC41169F4E3777CCC6F2F2900AC50A28E9744C231B8BD792C01272E4F52F1BD07CDEFCF7DADC
Malicious:	false
Reputation:	unknown
Preview:	// aMvTMfwr0HztLXZQv1y+xyWRM8WBOCTknkf59MUwnsKUz4zTG42y7iJvc+jXe3/jdpxXQcfhiY5AwOQ896DLwFUNqXQ4dImU0rWWmDdFGsJAIwdIV/n/xZzr4uWwzxhNpWud01i8C/N7YHGDXDjPhA5cXFZF0DQj7zE2SIuaqEKz5hZljGyJOxpP4PSqOMm+7ZrpzOZOxFx5JYwIo4XTMVa6eppoQcw75nsgMjeVc3+++zFQgsuI2Zeb9BkQgqq2bY2touAcdrhfqfGjJmXj39Yf6sSErZYOoyRhtOgW+QOPS8maSjCFEuWYXEppoL89higpHZiKlZ4vqQ0TYVfKFw==.{. "*": {. "bookmarkbar": [],. "speeddials": [. {. "favicon_url": "https://sd-images.operacdn.com/api/v1/images/46b911f451044a30c1aa38f062e1a4939605f09b.png",. "name": "Twitch",. "partner_id": "gx_twitch",. "ping_url": "https://speeddials.opera.com/api/v2/ping/gx_twitch",. "position": 1,. "real_url": "https://www.twitch.tv/",. "replaceable": false,. "revision": "20190409",. "thumbnail_url": "https://sd-images.operacdn.com/api/v1/images/20586137116208fbaa36984a3165942edf7daea0.png",. "url": "https://www.twitch.tv/". },. {. "favicon_url": "https://s

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\purchases-schemas.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	134754
Entropy (8bit):	3.912152746351969
Encrypted:	false
SSDEEP:
MD5:	50B7EEA5800999F39B8C3D93AEBA6545
SHA1:	781B66FE6B6548CF39522E3661BD6A9ADE39456F
SHA-256:	239158E719514AC1205D1844643E24440D0833C0C7C64060AAFB6FE2378C63D4
SHA-512:	192CEA97EAE5C5148D4D5C1AC818CCB9C75F12119446BD772A9BDFC07975739A66558B580BA5B29FF47275B60DE099C954E82B91CC34DB683C63ECB42C671052
Malicious:	false
Reputation:	unknown
Preview:	// nT/e0fNNq9R2n1GNHggMQYT4GDR4XJHAsGYhnPcLb+eG0AT87u+hknCDu03zU4w1JTGc7yrHkkK17b8TIT5tk9x9KU8mgfFBqUYb39RlMQg/CzgtdoRj6qzpRGbApfZCt6JpUvp+64u5NUh1lWMayZmuKg+teFql4t1J77VVkoU5OgZxe5PGy4Hz6S+MzoiqHndxSpFPSEuIdFjOEhczMm6YPhqvMqg8IIoNGkqMcqVRM+gE/hIHPcmtvq/I8ddyvmKdB24FrzZDbUOCA704/zJrA90VqpJZYXjdYqYEH4Waa3TqqxD5HB5OJ/ps6pJS83kIVpH5qRL0pZbCnhl26Q==.[. {. "partnerKey": "etsy.com",. "onfetch": "set-basket",. "urlMask": "^https:\\/\\/www\\.etsy\\.com\\/[a-z]{1,4}\\/cart\\/[0-9]+\\/review.*",. "recordSchema": {. "partner": [. {. "type": "value",. "value": "etsy.com". }. ],. "locationUrl": [. {. "type": "eval",. "value": "location.href". }. ],. "cartTotalValue": [. {. "type": "querySelector",. "value": ".order-total-cost .currency-value",. "property": "textContent",. "postprocess": "pricevalue". }. ],. "cartTotalValueCurrency": [.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\siteprefs.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with very long lines (347)
Category:	dropped
Size (bytes):	16201
Entropy (8bit):	4.098824428208723
Encrypted:	false
SSDEEP:
MD5:	BBF46467CC831E6959702A6C6E61AE20
SHA1:	87BF7D95BE0331121B98D9FA8E63236C8E7F317D
SHA-256:	40773E83309FD180B277C4E79541F398D6DDC051A897933FE61442B199D31EB6
SHA-512:	03A882849359D3ECF6191586AF8FEB2B7AEE968F6CBE117E96F5336ECD070E093E9A226F555B0CD53671EBFD9974FC50065018F879B18490AA24580AD95FE2C0
Malicious:	false
Reputation:	unknown
Preview:	// pQvoYyS/f1QyhTtV0QfEu8Zhv0cePbj696LB/xN6wUlEESM7gXWk3KKJDpqyAz/2yqy/T1PHUGX2P7xTgnblGf2DiO7Atpk+9HfrzRp5sTAEEOBTF+NAn6RvcBzj5BeKCJztJ5jB+ZrfZdZ/U2aGoMcKgChk+aJB8QZ0fx2lP/I5ytZdOZcCp2z05I17ovcHpCqaIfUtysrlAvmtqmMSYvziEAoWjXfnszem1gi+0PHJPMunmcnPSLiXaByXNvneBYOiaUaexQa3bAzmuRVd5qPFq6KgElaHhdenJAxpZZNy+sv5BP3Ty0/RyQ9Z2DpxEFZ7OV8H8SD9U6HKRLbECw==.{. "@version": "2.0",. "timestamp": "202312181455",. "firefox_ua": [. "youtubekids.com",. "techtitute.com". ],. "chrome_ua": [. "datadoghq-browser-agent.com",. "track.capitaloneshopping.com",. "cos-rd.com",. "cdn.capitaloneshopping.com",. "capitaloneshopping.com",. "api.capitaloneshopping.com",. "pixellu.com",. "amica.com",. "delta.com",. "whiteboard.office.com",. "school.novakidschool.com",. "demodesk.com",. "capcut.com",. "chromewebstore.google.com",. "bing.com",. "fio.cz",. "fio.pl",. "air

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\specific_keywords.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Unicode text, UTF-8 text, with very long lines (5243)
Category:	dropped
Size (bytes):	46132
Entropy (8bit):	5.476429533205484
Encrypted:	false
SSDEEP:
MD5:	34CEDACC1C62313116216EA57A16683A
SHA1:	D627058E97DCAD8F0A8737DFE2FFA195D868E5E7
SHA-256:	F04CD2A8EC2686420E9A89C454C379C76B610BE2AD62E2F2F1A9641A9D9ED286
SHA-512:	FA9947AEFFBB687B4D0D632323BAD68E5E93572398FBDD5A7665E1530F3327BFA4307C4AC8AC035E423A667C322FBBF98CCA4995AB9B8EFEBBED99761D753D18
Malicious:	false
Reputation:	unknown
Preview:	// DJk2k3pkp9cay3NljwD03+GA6BPihyqZAPyGTt49ivHi9iZ6PCltyC1kZ47WPQmo7WuEhxdSZaZN7uE+VJdTrnfzgcTe4Nz9SU60AUeW3rV7dLOmyQuCm6HExT8VxWHux47vXFsehnQYT8kx56qh1FwN96iY0bsNMLnuo4JA2Hdobl43moGSrTi/eIGdTpA6pq1oHaQgMA8tu6ztgOuMXrE85Qkl8WGanStebuBLdRfGlBkLVG8IqS2YqFyTS5E7NjDLkqOYjx/rM00TqYbFaiVdCkUl5Iu/HyF3eE0cF2dpFLScIb29KBifsTSuiJpxQNvJrGe51SoLHg5oZFQFpw==.{. "version": 1,. "should_reset_discarded_ids": false,. "de":. {. "keyword_groups": [. {. "ids": [. "booking",. "expedia_hotels",. "tripadvisor",. "hotels_com",. "tui". ],. "keywords": [. "achensee",. ".gypten",. "albuquerque",. "alf",. "allg.u",. "amalfik.ste",. "andalusien",. "antalya",. "antwerpen",. "argentinien",. "australien",. "azoren",. "bad kreuzn

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\standard_themes\default_dark_theme.zip

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	575594
Entropy (8bit):	7.997587858488024
Encrypted:	true
SSDEEP:
MD5:	8DB0209E463713D66AFEF101737C0563
SHA1:	ED7633389CAFCD8A4FB18C40B39EC67F1C1D6D32
SHA-256:	53E38D9406BBDE4D600D7E2888F389B9D3211688157B3B0BE8E60BD2826E2839
SHA-512:	789742F61A55AFA748A02D51796E275FCBC132136655890E1DD87A17C37EB168A98E6511456A6747D6E2946074715F8B7F4B23632249071BD6FA5330213EBD93
Malicious:	false
Reputation:	unknown
Preview:	PK.........L.Nc...............persona.iniM....@...}..k-.Q.+.A.Q1.F,.d........D.g.)......1.%c...r.>.9....!..........bw.h........Qw.X.#.%e...^...\##5<R.7XQ..U........=...R{..../ .....m.....l../..Ri.`6...PK.........h.N./7p............wallpaper.jpg...T.[.6\|."&...".....JGP .......EzS H.....{o.$.D...APJ(."..Q.....D..y..{..}.]....s.=s.5.g...5..-.C........1.......?....._.cp.... ..................@\|..\|..z..........{..>...(.......x5.?/?.>.W..p...8.a... A.@<.@..?..p].@......n........q....{...... .e..D.o.A.ta.....5.".....8.x..^@...%.C..Occ,...ax~......T.i...S......8.8.......n@............G...c6.n.l..@p..WEE......'<.....H.^.oX...a"YX.6W7..(..'.i......X...C.~......0.=..@..6._&......C...#{...l .".^H..f.....Q............<8{m.. .....p.e..`..C...dW6...{i.................q.0f.#....'...nl.........B...@".X..X.+D8...+B8..XN.q)...~..U...T8.....A.a...@..^..Kx...H..r.......B8R..r...... !\.qn.H8L.K..... ....$.7........\<....$..xvb.s..T ..461.........\|...l..8.....=...2$... ,..#

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\standard_themes\gx-1-classic-dark.zip

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1369275
Entropy (8bit):	7.990689177640962
Encrypted:	true
SSDEEP:
MD5:	4C617C16867B8AC373F1A869990F498E
SHA1:	71BA19F7D40AA7BE1197C0E0D30177C390C0921E
SHA-256:	A0B04A4C883A25FC434618151974B00597CACDFE766E2EE67E6AA1D2EB5D6D81
SHA-512:	9975CE7FC5AC06F161C61F5F62108C04ECF56D9AE2C81108A1F99A285EAEEC5DA77E694027B22F2036B7DCFC053A1B836A90E45B325B4AD282DC2D99885EF667
Malicious:	false
Reputation:	unknown
Preview:	PK.........m.T.R.a............persona.iniM....@...}..{.A....J!M .X/...y..6..7?.....1;.5.RC..../%."....`...zV.BZ.I..9H.......N.kx.{z.!5.t.m.<.......X..,Xd4..:.........gv.....PK.........`.T%...W...........classic.png..TSm.&.]l.(..((......SQ,............;R.".R...... %...""%....I..$..s......v.5s..+9...~..y...y....l7o.AFFf..S6.ed...Ym.~.t.W.......\Cdd6....y..C:."..1..N.I..j.Q..22e....kd..O......E.}fd....1..~I..V......3..d...>xe...g.....5.....H...2....:...1"..q.?..V....#+V..c...2k.T....5..e\...x.v..1..@..i.i...s3..@....(.u...U2_z..m..jo...x).r...A.K...q5.fSy.,I.UXo]...5VD.....S...EU..z....F...=O..S... ...4....Z.sQn-7V....".5.E>..D &e:....+..j..x.j..0.6<....uX..;.rZ...B4S.u.<...,...c3P&a.\+.!....Z..P...h.yi...0}A..3.c..E..hx60.....A...K.6.....9..S.2.).'}..I<H%..6R....hD?.I.91..x.b..@q....CO/B9...($.W]..0.:.!...&v..h.>...4.=..x....#k&...Y`&.@.7...e..#..7.$...c%&g.(z...m9.f...v.s.V...J...t...E...P..y...`..6..\|..q..77.N_..Et.,..\.%....2%.t

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\standard_themes\gx-1-classic-light.zip

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1490601
Entropy (8bit):	7.991032980491148
Encrypted:	true
SSDEEP:
MD5:	81F209C261CA22CB919D77DD37136A92
SHA1:	45646D906BB358D5E1C86A46492BD85D3E089E7A
SHA-256:	4596B73D4901598F52BBEFBBEBACB70F2458AE8D690BC0B1BE53FCDE471DE072
SHA-512:	362E2F7EFD01AAF4E3CEF39E5F99D1C50B30E9129E289C4C039A63295ED5F668E6E084325BED7D9D90E41AADD4ED51B6F610F21A095D25D39EFBBF929CCF5D31
Malicious:	false
Reputation:	unknown
Preview:	PK.........m.Tm^I............persona.iniM....@.D....kE...B.E..$..R..M..o......8..3..f.G..%.=...=..\|...k.O.....E...}kcd.g...m...s.(XL.....;..... O.....T..g....q..E7.....#...g....2z+..)... ml)...&..PK.........Z.T2?.n)..........classic.png\|{.PS]....... .K.).!tP.T..Q)Ai.k....PT....H. %. -..Z .\...w....k&.9{g.Y.g?k.u"..iSS.S...Q?..xADD...........v.....tL..(..~..2.Y....^h....qn\]\..>U%"....!%bn......x.u#u.v.......?.n.bd..B.9.4.\.T1........p..x).?.B.(...2..m.6...@./H.....m. n....z%...F..fH&.@F:@.......Z.q...,.j..-...J.:.\|..7.iF.G............;.A.\h...D.....7..\.,......L1..*.....n._q ....\..9..U..8....=..4.z'.D.pA..mD.....GJ.Y\|.b....C...,hRT33..'L.jM.3..7...J.}.e..Y..z.....\|.....}....Cq.y.2....;>......7...\.HV.6.om.u0.F..c ..iJ.~..I..5.......ro2}.i%........E...`}.w.~._d.9m...h..f.,....\\.;..<5....;..H..D.......}../..~..`e.bq.{....X4..+_.^...v.Z...qH,.._....~o.....+.?U....{W.<.7.........;>.c.Ur.$...Ty.<.{..L..Yf..1.B....@...t.......U4f

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\standard_themes\gx-classic-dark.zip

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	644311
Entropy (8bit):	7.998698130487401
Encrypted:	true
SSDEEP:
MD5:	E1CD90FD73AF35BC5E37C08E570B1330
SHA1:	FEDFD7D049104A321FC68D0B85EB0C534BBFC39E
SHA-256:	57F26707CE39F684BBCC56C3522DBDAB8851C42878E2D6C3AE41C2FAC64AAF07
SHA-512:	519ACDFE72BCF76405E92CD45728048C3840D6A4494A64B9855177C681A1D104EF09B3A12536ACE68567BC0DA1A2EDDFA24C94BD65E830705B99416D2FC416B2
Malicious:	false
Reputation:	unknown
Preview:	PK........]v.R&5 .............persona.iniM....@...<E..A.''AqR.PJ..=</.]j}\|.....C>./..R.....Ow<8J...A{..v....iu......6.e.....q..2......T..@.]..... .."0../@.:F..7.^...G..F....\|.PK........'L.R.'Q...{.......GX_Wallpaper_classic.png..uT.M.7.........m..w.`!8..........\6.../.{...o.u.Y..?..SU]]]5S...QW.CE"D...@U..........G..;b.........r.....[CHX.XX.+8.m.5..V~n......N m}O}.eAK.'V.?4..N...\.b..@K.kOr.k[....MW.%9.J.R.G.].U...$..n..m..`)`E)&J..+.W...'......C.W.._r.....f.$........)...N...nM....b...C.'.....- .L.............+.....I....l.V6......oO.....U...........C@@......../.....'....?...=,.A.. .g...@../O.J..,..UE..;{..P.M...te.`egsrb.........N...j.i....n.w?l.....w....j#.....)@Gi.K/'kgO.i..OX.@V.@.^.K....^nn..n......5'..;7/.......?r.'~)I.Y.N.N).In...I.INN)^)>YY.>In)...*8{x..-......x9.W^A)wk..........@..............^.h.r.g..]..... ok+Yw.'...Y..?. #..+.%.#....?.._.V...........W......g.#...........v..8..#dm.?..q.DAZB.w.g........s..i....P..+5.>zR.R.&.......T...>...

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\standard_themes\gx-classic-light.zip

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	548237
Entropy (8bit):	7.998514259135896
Encrypted:	true
SSDEEP:
MD5:	18E33CC30EEC9EE82FC709A057C96587
SHA1:	4BE508E28CE39087B0E241B89135DA5FC1A5C07B
SHA-256:	A2E8B98F32B559A9EB475FCB509DF0F49BB6BE86EFF46D226D2DA598E98A7267
SHA-512:	B69AB5A40A85D588E7C36784D0AE33829EC3D75E9932717339FA7D9B64DABA257D2D6FD86CBC9EA6E4D1ABDC162E6B7354482AD82261674A0E7E55705AB407FD
Malicious:	false
Reputation:	unknown
Preview:	PK...........R"k.............persona.iniUT...-..`-..`ux.............M....0.D.....E.{..AP.PJY.m...l..oM=8.9<.1.!tRC.'...7.z...<:.+....."'.t:Rbxq.N.....E))..r.w2..d.m.5W.>.n..1.....(..1...@.zF.._.,V%.(....e....PK........'L.R..<..[...q......GX_Wallpaper_Light_classic.png.?...>.<..c.T..B.o..$.HR.....w&).NR..Q..%..=../.u.1.................:.s9..<.L..J.'.O...P..p......._.....X.?8..C.r].........D..bl.z........c........}-.-.[.&.;>#..>.;....)Y..#..3.Vc3.+{i...j6V+Si6MQU.U.y3K..^Nf..n.7.1.0e..a........z...;KzH...J......X.K\l.....R..*.q2c....5...e.I.....HH..............I..H.....a.Ns25....xx..4.....$?...;..0..._PBB._@._H..X...i.b..k................1..E...{.v...?..;.&.H...... ..........w......{:...5s..:...0g....V.B..I5'+.(F....W;3{....l..>S+SI.AAQcA.3^!s..^.s....................w;../,".R.W....&"(x...5!!y1y... .....7.]..M.....G......?.J.;...@..C ..Qp....q..8......r...X...\&T..Y3'+73SE'..+1.V.pAH.....5.y!...]8.k..........3..a..#....?:...G.......tH.w.$..... w.

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\resources\video_conference_popout.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	4.216969853800906
Encrypted:	false
SSDEEP:
MD5:	19BEF2D091C16C4EE3F7B9D63A48EEC2
SHA1:	E148797C1874D3DF0F9AADA3C217BAD86E07B49B
SHA-256:	A31AEB78E781F22CEE4220D24B8D62AE139902E37804BC836EADD90264AEDBB9
SHA-512:	A245BB9E697897239B449BBB35197E8033285BB7C9F101CFD8AE43FB434149102F28534C2C58D561341B72DDE90632FDAF5D73E5DECE5D453C221D67987302D0
Malicious:	false
Reputation:	unknown
Preview:	{."version": 7,."list": [. {. "urlMask": "https://meet.google.com/.",. "width": 700,. "height": 450,. "blocked": [. "https://meet.google.com/",. "https://meet.google.com/about.". ]. },. {. "urlMask": "https://whereby.com/.",. "width": 700,. "height": 450,. "blocked": [. "https://whereby.com/",. "https://whereby.com/blog.",. "https://whereby.com/information.",. "https://whereby.com/sitemap.",. "https://whereby.com/user.". ]. },. {. "urlMask": "https://teams.live.com/_#/pre-join-calling/",. "width": 700,. "height": 450. },. {. "urlMask": "https://teams.microsoft.com/_#/pre-join-calling/",. "width": 700,. "height": 450. },. {. "urlMask": "https://meet.jit.si/.",. "width": 700,. "height": 450,. "blocked": [. "https://meet.jit.si/",

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\root_files_list

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	730
Entropy (8bit):	4.668284777150785
Encrypted:	false
SSDEEP:
MD5:	3B491170F7EEA56B574A24876BF7451D
SHA1:	C5CC1BE375BB413978752F0210CD0A76A415FAEB
SHA-256:	D30B4A5E4B31A93F5EB6C20D94243839DFED71E69071683C6838B424CC2A071D
SHA-512:	178AF7B1AD0A2ADC377B921C350BF877E4D82E561C2058B7DA66CBD6172681849E4ECA77DD2D385AB8309179B15C52B2522F181A5188A448478A09677F68C7AB
Malicious:	false
Reputation:	unknown
Preview:	Assets\150x150Logo.scale-100.png..Assets\150x150Logo.scale-100_contrast-white.png..Assets\150x150Logo.scale-140.png..Assets\150x150Logo.scale-140_contrast-white.png..Assets\150x150Logo.scale-180.png..Assets\150x150Logo.scale-180_contrast-white.png..Assets\150x150Logo.scale-80.png..Assets\150x150Logo.scale-80_contrast-white.png..Assets\70x70Logo.scale-100.png..Assets\70x70Logo.scale-100_contrast-white.png..Assets\70x70Logo.scale-140.png..Assets\70x70Logo.scale-140_contrast-white.png..Assets\70x70Logo.scale-180.png..Assets\70x70Logo.scale-180_contrast-white.png..Assets\70x70Logo.scale-80.png..Assets\70x70Logo.scale-80_contrast-white.png..Resources.pri..launcher.visualelementsmanifest.xml..opera.visualelementsmanifest.xml..

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\root_files_list.1707230173.old (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	730
Entropy (8bit):	4.668284777150785
Encrypted:	false
SSDEEP:
MD5:	3B491170F7EEA56B574A24876BF7451D
SHA1:	C5CC1BE375BB413978752F0210CD0A76A415FAEB
SHA-256:	D30B4A5E4B31A93F5EB6C20D94243839DFED71E69071683C6838B424CC2A071D
SHA-512:	178AF7B1AD0A2ADC377B921C350BF877E4D82E561C2058B7DA66CBD6172681849E4ECA77DD2D385AB8309179B15C52B2522F181A5188A448478A09677F68C7AB
Malicious:	false
Reputation:	unknown
Preview:	Assets\150x150Logo.scale-100.png..Assets\150x150Logo.scale-100_contrast-white.png..Assets\150x150Logo.scale-140.png..Assets\150x150Logo.scale-140_contrast-white.png..Assets\150x150Logo.scale-180.png..Assets\150x150Logo.scale-180_contrast-white.png..Assets\150x150Logo.scale-80.png..Assets\150x150Logo.scale-80_contrast-white.png..Assets\70x70Logo.scale-100.png..Assets\70x70Logo.scale-100_contrast-white.png..Assets\70x70Logo.scale-140.png..Assets\70x70Logo.scale-140_contrast-white.png..Assets\70x70Logo.scale-180.png..Assets\70x70Logo.scale-180_contrast-white.png..Assets\70x70Logo.scale-80.png..Assets\70x70Logo.scale-80_contrast-white.png..Resources.pri..launcher.visualelementsmanifest.xml..opera.visualelementsmanifest.xml..

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\snapshot_blob.bin

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	276794
Entropy (8bit):	4.2227815588821205
Encrypted:	false
SSDEEP:
MD5:	8CDBCD1261E7810C12D3A1A6313A05FF
SHA1:	DD994DAC87A4A7C46462A4E8D1CF3BFE296E19FB
SHA-256:	9AB00172AB59CC736732C80E48DEA43B523264ADAA4C7574FB28F40A700D07F7
SHA-512:	CEE44A22B8D18042466DA276537BD438C4EC5B53AC43F372EB5A1B2FD53ECD71EE1B8ED98C36F4D7042C4F1B7270BF0E019066C32BD491877FCB55222B9859C0
Malicious:	false
Reputation:	unknown
Preview:	..........E*..G.12.0.267.14......................................................L...p...............K..a........a........a2.......ar.......a2.......a...........rt....t...2u....u....u...Rv....v....w...rw....w...2x....x....x..(Jb...(L.....@..F^......`.....(Jb...,P.....@..F^..`.....H...IDa........Db............D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\v8_context_snapshot.bin

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	642377
Entropy (8bit):	5.199822406924661
Encrypted:	false
SSDEEP:
MD5:	AA4CF0979D6B3C1AB5E8418260A443D3
SHA1:	32E40181A1D8FA1AAEDCAC8D0C7C6A2879AF4B38
SHA-256:	1D3C18289CCB3766C3736BF851B718C9BB1E2689433C362DE75F4CC05AB16EBF
SHA-512:	42ADDD732FFFAC866A3BCA7D126E17F5F214813CCE0F46DA369E6D90D13F709E81E3B5899570DAFE5076AFE690BBA1429145C53ECF861BB319C4CA6155260AFD
Malicious:	false
Reputation:	unknown
Preview:	...........<.MM12.0.267.14.........................................................i(..i[.......z..............a........a........a........ar.......a2.......a...........rt....t...2u....u....u...Rv....v....w...rw....w...2x....x....x..(Jb...(L.....@..F^......`.....(Jb...,P.....@..F^..`.....H...IDa........Db............D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\vk_swiftshader.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5098912
Entropy (8bit):	6.3517420919227705
Encrypted:	false
SSDEEP:
MD5:	2E0E9073992764EC88242B03F35F92AB
SHA1:	F7ED1D75850B6457A15EC695BFD933E88B88A91F
SHA-256:	9D3CBB1046FAEA6BD9B39C76A6A880DFCA54CADAB9B327ECAE1BAC579935830E
SHA-512:	83AFD7CB83E3CC6A9B2504BF2A9966FDAABA192D1225439391455939FE57B2CD0F10B6A6C94DA391ECA044F7385BB3FC59076CBE753024A178CEE732262218B3
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." ......=...........4......................................@O......cN...`A........................................`LI.....8lI.P.....N.......M..6....M..)....N..f...'I.8....................&I.(...@.=.@............pI.P............................text.....=.......=................. ..`.rdata........=.......=.............@..@.data...@....PJ......4J.............@....pdata...6....M..8....K.............@..@.00cfg..8....PN.......M.............@..@.gxfg....-...`N.......M.............@..@.retplne......N......0M..................tls....Y.....N......2M.............@..._RDATA..\.....N......4M.............@..@.rsrc.........N......6M.............@..@.reloc...f....N..h...<M.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\vk_swiftshader_icd.json

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Reputation:	unknown
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\vulkan-1.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	949152
Entropy (8bit):	6.60883074914281
Encrypted:	false
SSDEEP:
MD5:	C5A6058DD459F37670162E0477B80BD9
SHA1:	7C25DDCE6A595F1802ECD28E0E77ADE9834B0B18
SHA-256:	83108768BE317BC1B92058C9F4F21B198591827D974306CAA95B348FD6525491
SHA-512:	93EC32DE9BBF1E2D4EFB6F5B9D6327615BF09026A652FF4F3F6910D6CA0A7D67B4743EEC4C253EA4BC64314342E74125055A8BF24971BC7983BF9C49E31FC8D7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." .....~...........(..............................................m.....`A........................................x...<!......P................p...R...)......L...l...8...................P...(...@...@............................................text...{}.......~.................. ..`.rdata..............................@..@.data....M......."...z..............@....pdata...p.......r..................@..@.00cfg..8....`......................@..@.gxfg...P)...p...*..................@..@.retplne.............:...................tls.................<..............@..._RDATA..\............>..............@..@.rsrc................@..............@..@.reloc..L............D..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\win10_share_handler.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1137056
Entropy (8bit):	6.494678472095828
Encrypted:	false
SSDEEP:
MD5:	4C2860302A7C4B6F63169C3A90375B5B
SHA1:	C008226FCBFE686FBD59B90ACA13C1F0A9C5A7CA
SHA-256:	5FE1088FA0657F6BC9E35451C797FA7A39B5E1F94FB69EED5065DAF855C6A3B9
SHA-512:	5976C8E56D5D3801986F1BD3A6DD345A0E9488BDFEB093C484B51A6FD02627B5921859A212B1EE1BF95531F62D7249AB9D14FF677B762675EF5E7F43CF2F6E7D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." .........................................................P...........`A......................................................... .......0...x...0...)...0......l...8...................P...(...`2..@............................................text............................... ..`.rdata...b... ...d..................@..@.data................t..............@....pdata...x...0...z...l..............@..@.00cfg..0...........................@..@.gxfg....).......*..................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\win8_importing.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	617888
Entropy (8bit):	6.225703892683239
Encrypted:	false
SSDEEP:
MD5:	2E989F5ACDB006F93D49CA8E6C9FADE5
SHA1:	319894B9B426F213250327AEF5FC71D951490C92
SHA-256:	AF177D80E357F7B8502112F1D9AF118AC67EBE5221D169B555A8B41B0C430C7D
SHA-512:	E3B851F3BA312E5328FD893D2A2B7A62AC28FBB5BDDF098CE3C013711D1B1937868A5AA94009AB6D3AFDD3F19941BCBBEFA0C030CEC06290E90AC30EB1E46B59
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." .....,...........v.......................................0.......F....`A.........................................b.......c..d............`..tF...D...)... .......[..8....................Y..(....A..@............g...............................text....+.......,.................. ..`.rdata.......@.......0..............@..@.data...4f..........................@....pdata..tF...`...H..................@..@.00cfg..8...........................@..@.gxfg....$.......&..................@..@.retplne.............0...................tls....)............2..............@..._RDATA..\............4..............@..@.reloc....... .......6..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\8137cd84-7128-492b-8701-61271f2c7bfe.tmp

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1624
Entropy (8bit):	5.164279432109298
Encrypted:	false
SSDEEP:
MD5:	25A1809B23BEA77A272906CB5AE61E00
SHA1:	357D96603DB5F309803AC9B14E54C3BBA40EBE06
SHA-256:	7BCFB6B7BC34DD71A2F6555347F28862E5A7C974D2C142D1AA8CE4C2412A9A4D
SHA-512:	D00CC874DB2EAB2F1E99D668AF8BDE774B862484833CED617FEA2DB1246C470AED7C8156E761F9CC05F799E998A1BF9B316AE285523B520B35E0FA9ED7ECA595
Malicious:	false
Reputation:	unknown
Preview:	{"all-installer-experiments":["installer-experiment-test@2","installer-bypass-launcher@2"],"autoupdate":false,"browser_edition":"std-1","country":"US","enable_stats":true,"features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"13e025f64bd6:disabled,13eeaf851da7,15322f489976,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,7e93fef4a11d,818c3ef12d0b,8511df77ed15,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c24103d5839f:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,ce1c7c17ef6e,d144067b33ec,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","import_browser_data":false,"installer-experiments":[],"installer_id":"e716013c-b288-4db0-8980-2d60e36c69fd","language":"e

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-100.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	7.807674908350133
Encrypted:	false
SSDEEP:
MD5:	B5A21B88B3D8A42DF265817EBEB742BB
SHA1:	E0BE32B4FC158DB4E9783094CCE614922114B742
SHA-256:	9635C074C9D8EDDE0BAF3111DBD7DB49CBDC370C4F729C80AC382949F32BE526
SHA-512:	21ECE0DCF17B038400D09565438FCE8BE61746DAA0250F2FA9D0526BBA3D1CE6F8DA5CCE944EF8FA685C5EB6CF857B073D2A50ADA44A44A76D84813871FAA5D0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.q....LIDATx...1..... ..6.^`...................{........m.m].m.m.m........[s....._.....N.Nw..._w..P...R... ......`........_[.i1...`.$.......C........,...v.l.>.ZP.B...E@......!?d..!.d.R......g)0...^H[.u.4.k`....0<.d.1.....0...Q`..I.._T..!...\|pG.m=..a&.e.U(...C...n.^`........FB.X...Oio...z!...:.Tx.8;..9.[a........{.~.^......P.].r..d..A...?....<y.v"......l......^..._.....MA.o....?.>u._.d..`......E.@.5........E..................R...A..O}{.k..2.....jx\..5U.a.%."#.nA....6.!..W2.............R..j6r..v...."....N.GA..8.......>..p..#..,X.....Q...y..#.a..)....Q.e.zc\.'@.Al.....io....=......D.......F......A#6.^.^.Ma5...b.b...D...+.P.. .[.o..z....,...#<U.0.O.#..Z..........Q{...jA..ka\|}...q.s.y^.!.Gh..R....t.g....F.......gt..6...7YjaU....0........3..l.#.. =.h0t.06.v..C...T.}m..%...g..i,Cq..8.g.q..hx. .>..Kz...1....VF.)..q..$....._Z-.U...(....~>...-z]$.mh.%...e.+.....\|.n.2..:...N._R..x..>.\|S......i?.P....Q.F.d..U.8..i...T...........I.

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-100_contrast-white.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 150 x 150, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1828
Entropy (8bit):	7.716814612583543
Encrypted:	false
SSDEEP:
MD5:	0BAE0648C3E320C4D439F158B4FD5531
SHA1:	4E860AE24F03522C89BDF37F3CCC10B54832861E
SHA-256:	28CE8FCB22080CE1F69346CB0720BBE5662959E413426F00062B706013DA8C28
SHA-512:	6A5E4105CCBE1664546798DB057B93622C9CBD6D5AF4967E6BE4E390A18FEC0FFCC807E3331F09ED0DE63ED85569BE7EC5EED5A7C663DF6CE4A5B70E09500371
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................i....IDATx...i.]U........J..RT.H....T...seV..)b.B.5.@.a.Q..P.c. 2E....eR...P(.....P........I...s..v...y...u......Q.EQ.EQ.EQ.EQ.EQ.EQ.EQ.EQ...S.n...j.."....p..\|B..]....>.......9.32.....Y.l.R..y.\.8.4.....p.K..EY%}.5.h.[.\|.V..i.F..q~...;..W61.M5_..1F...Gj..IZ..u. ....w....oS..D.r.).U....j.y.#..y..U..;S.-"...n..v.^i.UW.j.hk...n.....,...LRe[.i.}....H.z@.9.q..".v.U9.""n.)....DD.iX.b.....'....v5.#..~.$.7.]..Tm.....i......+....m...x.j_.'"NG.]..n.j.vl{..Ls...;.T.=E..3...1;.v..xB..."^.1U..8...xL,7]...D.9.i.."..N.."...c..D...X...c+.t..8M...[......"f.........R..0R.1..Xh..;ND.=U.ID.a.....v..8...'.uct.....k.q>.q.jc.+b...F....r....AN.....}.....Y.J.k~.;4.3".U....s..$....n.q.b{.q.j......".Y_..E...b.=.S.".4...[...S....Y.6O.L...."...."......i../"..!M.>..4ED.....I..""60x.Ct.i...4.."..f..`(.....4..5.L....o........W....xX.M...E..C...r.....U...8..<'.G.}D....E.k!.8...ED..iL...V.8.."b.C3[Dl..gED..^....-...NDL.iBs..O...`m..zW...k.A

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-140.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 210 x 210, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3140
Entropy (8bit):	7.81304512495968
Encrypted:	false
SSDEEP:
MD5:	7E529063A02E4E83736B0263CB1B82E0
SHA1:	17A3C4B76962E90B1D2FA8A49441157949F4DC78
SHA-256:	A36A13A5D5E3D39E3018CCC5F8859944C87256F8BE24A3C08A6BF3CB06A26804
SHA-512:	571806725F83FECA90360B246D167A8857EDFD9EDC8DC0EF7EEEF80F291FD06088C405A5653513CB8AA309DF08CD609DF85A95E3379E3E5907566C876CA77CDE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............?..B....IDATx................................................{..dg.8....m....m.Z.m..;;y...s.GI?..Su..k=.T#..#.;..}/\.g..:b..a+.....t.A}...q..hq.-.}...`:.gk....tm.$...Ax.....B....c.ih....G6L.....;...T.U0...l....~...........W....=<j.....X..O.....r.Y..-..Q..1.....q`..PC..jL...x.'9........y.b=L.m..(U........a.....W......`:.Me.jh..U0.......;..{..I..\|.W..C..4...b.nt.......L..a.........`9.!..7N@.......E.?..$.._.q..6..":.+`....W.O.G>o.F.K.c..G.28..Q.....\|.....m..#X......N.P..{:...1.........4...F.....w......Z89.Y.w`.L...v.DC.h'......h...[=...c.2...&ze*h..t..j...@?..cpN......0...KC.....f..F.....2"...c1..m.)y..q..(..C,.e..!w.N@I..q4.......!.A...;q..Y..sy.{...."L.p..#<...'.-8.!u.C#...O;.......y<.=....h.c<.=...5N...s....._...p,..Ia...yo....=...Y..4...t.}m@....g._.......#.M{...t........t...;.bjh..l..84.C8..z....B9..[.D.R..}...r..e.pl...~.....<.~ `...Ep..b...L.^.9..x.vB..IZH.a,k..c..L..U...M0....}.n........H..<.!..B.(Y

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-140_contrast-white.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 210 x 210, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	2659
Entropy (8bit):	7.828610258666657
Encrypted:	false
SSDEEP:
MD5:	EBE7D27ED3B4CB6566A10165ABFAA941
SHA1:	FDF7C27058CF5DAF7061756E938A33C1BBB26C3D
SHA-256:	0BD63FE653885286E180FBDF6D1DADC66AF242B8ED6BD1D03D8C5ECCC20E91D7
SHA-512:	50EC8592D78F00A6387F06E077E0DEF88DB26723C0FB8632C4EA06F2E09488DB0FB82E0EB1F03DA53F9C750F6CEBD29F7889B1DE342E4F0AE69F88C4B7B1425B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............V....IDATx...{.]U}......"... .!.#..D .k..:.....5...6B..Q@+..lq.(%my.P..C-..Eb..<L5..<C!.1.$wu...f..}........5..Yk...^{.}..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)u.d.Y.b?t..Q.E.,u......$o.-..rK....nw..7..w.TF..-...5=.r....?N...a.N.....~7..7,...r..-..q.}..R....Ye#y.u...IF2...Z..6.o.F....R1<w..]T..H..zw{.k..Y.L.Fm.k.ay.W.P.....I..,5G..C..........v.]...].-R..A......1.a;J-..>E....Qe'............#^VF.J.J-.....LRe.....\|....g.M.e.+<.l$gHM.l..y..T.s#.Ow.o+....=...4....P"..J...("...]...~....z...h...P...QD....Fg.a..7m...W.`.j..C.q...E....D........8.i..D...^c...J.,.../.&rH[M..9.4._kfzN..#..bD.....[.D.4M3.....2Cs.........._k.Z%....bs7+...wkf...'.%..D.j..!M4A.z-R.k5.....q+-.*&j,..GE......p..(.j_V"......i.M...7.....E..LUz.8>i..jm....[.T.].F.%Q.;.2.....X.x.....-...b...;EQ..dU...avR[..V...f....`,.....J........K...........NWe.....Z:YT.>..{....-..(.uvV......P.x...m..ku.)q..Z>9vU;.)..xTC........j"..ra..D..(..6...t.Ib.O.....D

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-180.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 270 x 270, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3904
Entropy (8bit):	7.301300867894784
Encrypted:	false
SSDEEP:
MD5:	F332E088E89B88070EF1EFBECA5B90F8
SHA1:	86129A8B1E2E7F78D6CE23C58A37FAC9DA5E566D
SHA-256:	6A8F64754C75EDCC9ABC1138E44ACBD7064D7E8E2A28783939241DBD6AFA30A5
SHA-512:	2314AAE692C024F914661E46CFD76531DA6C09B94C084FE915A0594625927DF30282D09518A950EAFCFDD2E499B1E4877CF3CDBF5509DE0CC756DADCDE43FD45
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Oo......PLTE.....N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N...*....tRNS..8Uq...........jO+..D......o3.0y..b...g..a...@........_....d'...7Qp......K;..^h.\.W.../...S....-..J......&......Y..I!.P.w#...uT \|....:.V...1.z%.Fn.6....N..L..$.2.?.e.s".ti

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-180_contrast-white.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 270 x 270, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	3673
Entropy (8bit):	7.8322183683928195
Encrypted:	false
SSDEEP:
MD5:	98B9F7A4F4322E7B46DE392FD20F66E5
SHA1:	D009D227522206C40CF592E460C9642CD03B8769
SHA-256:	A706B332E6A846357A86C30D0E8BB7697E7DD55C2AE592DD45611DDCE0C0BF14
SHA-512:	3B3E5BAF3CFC57119E0812DE2816DF6C7DCB42E96C4891E47C4F32320FD3BE2F27A0118051A6651595BAAAA30069BB1C0D78AA701744A44534CABE7547D4BECD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............1.... IDATx...k.u.......:......o..I..J...L.H.(a...1....6S.....b.6..2M...fD.M..TN.5..o qx....;g..}^........."""""""""""""""""""""""""""""""""""""""""""""""""""""""q2.3Qr..z..<r....D.w.2.".r....s.......\..)d+.XJ.A........8Vq....g...vo.%..B..._M{.a&.XZ;.\|r.v%."NaN.Q..R6....c.cN..~H..M1.X..a'%.d,=iZwF2...;.l.xU.H[..i.6;q.....#.y...w...... m.$~..$...L\E...l. .IM2s5.==.%..-....\|.:,.`..........<.c-.".\....l...3...j4...B.sn@....Oxb.%.....B......$...-...WC).j..ru.s+.{.2"..5.c.q.e-...;.`-O1...@.G.F3.El.'..>$...(....d....6....%.CG\.e.[8.5.!.#....`q.3.W]X.%...$y...&...DZI....K..W.x.....%.......H+.O%../..n...~....C4...9nAZ..`..F...2.S.khhtz.E.(.CX....Uf....^&J:..@....$M......(.2..U.].O'vc...mzxlm....obq.M6....,.."H...}J'\yll..,....Jx..$/..X.uH.&.].....r,P-...[9.Q...Lr:....(..>..\|..;.h4V.%y.\|.]...$#....[[..d...U. ..B.H9..d.26.#.w..5.b....q....oq..0Z.y.NP..1.c.V!!.D=.k1.:.?.q'-..w.]..B,P..B...\|....+X....j,..2q....

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-80.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.769427546963699
Encrypted:	false
SSDEEP:
MD5:	1F2FB1BF463B2FF2BEC96784DEBFEF84
SHA1:	AE6F721AD937FE39F86602F71002435B18BF1EDD
SHA-256:	7E6B0D9EA7FDA1B5CA7A0B01290521DFF943DA4CBF1498412CA7D749DB42C32D
SHA-512:	0C92C4F75E620D0B636CFD83E89C69A44F6A96A00006FBD0B13637BA5DCC77C9B302029E62F4B80766811F31810F9C20AC1A98B65C38789951CA0E19A5BB6894
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....IDATx......... ..................s....P...m.m.m.m.m.6N......w.......-...g2/...)z.....K....~(^..`...j...z.^Sc.n.,.....0.VW..al6...a.....R0...k.Q..N..P.x.J[ol2..)o...A....x.....c.m;F...t.16.....L8....vb=AQ0.<.X).@....M......g.....k..,.AN...-..R......$....b..`...... %H....`6.g#..h.]q..5._.@dA..c0.;X....a.. .2...~..;.1..:.x.....q[@R....,4.w.v.._..s;.b..s.Qu5..U.\|.6Zj...P..........\...qa. ..D..W.L...c.~.....A...F1g@x....V..`..,..D.=..d.i..Q...o.c...N......$.`....]...P}.G....BT. .?.......L.n..+nG./..cC.>0.N1.\.C..B..4.l./L.3....T.c.S..bf.0..t...J..!.aU..p`.....0./..}.iL.).w..hc.M..'.. ..;'.p.Rt....R.g......8.%14...S....<.Jf./@..U.h'.G.R..D.\..z.4......<....2K.S.bj.1....=.../pd.........cfPL$7....S[.M.%H.M..W..T...ZP.aA~....D...+..~EYK.#..zOZ.]fA~...fz..].....7.>..\|.........[...v..M..vb.........L....z.`.P...X..RP{.....`...+.0...l/..>...i.w...W. .....x....T...............t..+B}d`/..+.;L...J..._...iC..pv..gA~..k.

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-80_contrast-white.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 120 x 120, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	7.721284228612739
Encrypted:	false
SSDEEP:
MD5:	17471BB63ED62A6E545B6B626A763511
SHA1:	586B9EFDE7B3A04580A49F8FE7739593D42D303E
SHA-256:	DFD1054F989CDEE25F19EA792F363F042A125CAB537A424F0224BBEE13607E39
SHA-512:	F619D963B62EDB07C8077C3C6AE60ED8D3F3DD5BB1D05A2B83DCA1A7A4A346598B055F6C7EA22E05BF281B1DE0F205F5D1054819000759D9450EE1FE8F6491AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x......m.Y...XIDATx...m..e....}....d...9]9\...r2..L..37...S..."s..SV..].t)..I..dh.Em..`A ...9.`......./..u.}...........v].KUUUUUUUUUUUUUU...~.p.....M.6Y..l.]...Fv..W;..o..d.l...r..{.d..r....a....r.y...@..>.z..C.l.qh............7{E:d.w.W..ZD.2[.~_..y^4.q.!./;GK......Z."s.m..9...{^.g...g...i..[$"F..x.Pj9.b[E...,.q.^.......v. w...4.I.E\....D....9......C".Q.._El0].=.Z`?.>gD....&Y-b...+E...(.f..~`..."^....Z...:\.h....S.v.v-KE,.8.....W.....Ag.V.....q..yD.<..6....x.d.N.....d..?.Q...[..".WZ&.,....v......Z...vG..k.4."...tv....".T.K.L.q..sQZ%.M3V..D...D.!.-.T.b.n\|W.u..xVl....X..._.."...n...5...W.?.1U7Z...p.>#.R.p..#QzJl.;D\..;E....Q..zl.w..wD.4 .j.u....D,.SE<..Bl.........U.Z.[D..._.4K..u.....mJ.e....&.m......-7*..X...:T.K.}..;~....."6(...O..(M..=.#.q.{..xHl..E,...v...3.`......X.[.E\|S.IF......C.b.....r......9....o.\.x..WM..J..5.&.IJ......\|...........q.J..!{t9L.Y.}D./5.."Vv\|./4V.v....i...8Ji......ae18...>.q....0...X.,

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-100.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	7.78686155071436
Encrypted:	false
SSDEEP:
MD5:	C3722E0232EC20AC8F99CCE7A040B294
SHA1:	91CA47DA87EC045ED3EF5D97243167F08FB9E10B
SHA-256:	A333D7E4293F5269426B3FCB673A284F3708A66F957DE62403B6570B24BAE8F5
SHA-512:	71940B8431E36307BA5176939A169B9259BB6B43C32529A10A12C5EA31447BDDCCAD7EB9EF7CB309B175EE7BD56E70926BD5AA0855D0FD9497547ECD7FF93158
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...F...F.....q......IDATx.....L../..m.m.m.m.m{.._...+...d...[.\|..y.'.{8..N8..N8....x0..$.iA&..d..@r........&X...../.z..../.....{..../u~....\|.._4$5..4...6....q..P..D.U...u...W....o@#..j .o....j...r..MI.n..X.RI.]..Wg.g..;...\|.D...2..._.#..$.....A......I..r..GOF#F...L)..P.8.....G.. .l.m..J.=(+.{..@#....CH..\|.:..n.%..0...{...O.+.Q.ORp...7L)dxS2H..Ge....e....$..k....iJT.~...eZP..A2....g..PUB..\|....v.......>..k..~h3...40.x...(.......v.%.F......vl..h`>...P...4...W4.D...\o.9...z....3]........`.}t.......XI.[z..%....S<.e... .D..TA...'.....h....l...,...$7.......0,%....I[Au"...d&?.j......,..\|...~F..pB...]......L.]d.v5...U%..h:}%..._.$...X.m.....S.yL...Bc.R;K..8.....TiP.}5.g..p..m..s].ZU....H.{P.!,..?......t.U....=m-<.a.v..I$...u.T5..LG..b]...c6.19d;k%...3......,..I.[.1..:...YN...h.5...W..._....dL6.v.Rch..~...i.1G....\|].AU.k...H.[Q.a,6.5-....Gt.9U......n(.#...D.v......_....@I.}...i.u.@..w.T%...&Y.:o.X..3.Z.m..fW..5.....D...

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-100_contrast-white.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 70 x 70, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1341
Entropy (8bit):	7.829707677562043
Encrypted:	false
SSDEEP:
MD5:	504D80D276ADCC0163A8E4720013F9E7
SHA1:	6D34A0593FFCE916CD19B66D61004FD7E7EB2CD1
SHA-256:	EBBE0B4761EA8968A0A3FAFB383AC7AE175E98CD31A0F41BDF5FCB43469B58EC
SHA-512:	9961259704FF97C0E1899A33259F62155B73264E272064F3FA90E64124513C7C8BD6AB69A39C1EFB271ECC2972AB8FD86FB836F22153A9BB35419C3816D11337
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...F...F......'.....IDATx...{L.U......#A../.9S.&:/..%]ti...TL][Hm.n..8,gsZ..Zk....:u....lF...".I..[.H(.q...{.sx.</......y....9.9.<."""""l%.J..2.L...xFp?...?.8....:N.M..`2.i..M.uZZ+'..C......9.f.1.X.}He....b...$..V.."..'T........[.s..}..F.........t.lnK..d.5...Yr..ld..x.\...iP... ....X......a ...i.C.D.E.H.&......Y....h..G.....1..h..C..>t...$...m..+..../.<.n4.."..(w..%,.R-...t.$.?..#.QB.+.ep..-.....r3.LYo....A...1CVK..$=.ER....}.o.m<.....#....D]O 1\..}..^....,.\|[..L..j..`...n.,...C.N.K..U...k..(.IF......1.....B6..X..U......oK..cvm...tP.....,lM....iAq.+...~.t..M.&...0......i(.y.Gq......Zw.,.H.\|... .H...zXR...>....K... )S...E......V..H0UR...P.....\.I......n.fj.\|..1...U(=.....~@=.X....Hq...4.....D..4S-...x.t;.....X0.....`....j....+..X8....z.t..DV.6c.\....=Ri2.y.{ac..../Gv./....X.n..o....x..ha.d.....p..V.QRg....8...?.[Qrxo!...r....Ni.4tOHz...Ca...z.K....er....3...;....(.0..[r)6.J.3.S'..(.v....l..~t..".&Fwx..M....P....>.7.E.Z.Y.%.

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-140.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2005
Entropy (8bit):	7.837796638299837
Encrypted:	false
SSDEEP:
MD5:	667BFBAAEB2D2B372B6E0D4BF4992CE4
SHA1:	4C6C2E07183963F59391945FBEE077B55F8F6B2A
SHA-256:	207519F1C7B6C7509BFEB7B55724997EEC6456C8BAF55E882E72FC5CD43DA221
SHA-512:	AC63A3DD2F6088E7849E3824C35FD58CA78EC77DC31E1F6CBD47DE7CC394318CBA7D2309912206A94180267BE057C2AF5C835424019E2A03EE33A2AB801BA9A4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...b.............IDATx..........S.d..........=...F...m...5.r..........m....g{......[1..q./.D.B."......)h.a.o..x.p..r....]..\....b fR......W.a.."..Ix............58.G.G%D.....0lE..E1D.<...u<o...6>....-.`..FX....l\.....K.....{..Y........D...............B.<G.....7.5...8...\....?.!j.b..F..PH..X....8."..,..R....X...((..G.0..&~a...{..DA<v.....H.4Q.u..a..#<Bk...E ..b\@'...3...U.\..4M...o.m.m.m.m.m..$..R9......&..NMW..{..4].....m....h..y/..x....a.[e..7.ua.^.lC8....l0....1...r.&........G.......c.....d....F]...M.a&.M..V..?[..t.P.Xx...<.(...s...'.Q....'.~{_......8....R.%..7\|O.Bl......Sr....^..@..........us.".M..?x.....T.....A....&.l........H`g..."...I}E.7..].=...C.gz........V!.EE.....7WvB.!.d..vJ...k.{?.......1.n/.Q.{.....LD..;k...\....]G..S.+....F3.}z.=F(.....$..D.[.y.... /Q..eU...]M.[r.......}.f.s..;..!...s..C...x...Y3...<....0.O.p.\..&5...f.u.....4..A..".. .lD..7.#..P.../.i. ......+...M...}/..U\...}..Ah3"t.....D...!v..V$

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-140_contrast-white.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 98 x 98, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.76630495035972
Encrypted:	false
SSDEEP:
MD5:	93223E8777B581E988B703DF82593B17
SHA1:	40A035464C27041CCC87C7935C45100D93D1C948
SHA-256:	464AFAF960C32ABDC2C3937A48BF14C5D1A819B017E719FDED591D43A65D94C4
SHA-512:	B8A3EE4A71E609625EAB51F0F6DAFCC82CC47BA2C567CC8BF73CF6423056F9171276289BFDCC8428B7C07645097664065EE9B0B78874425BFF800178222FED12
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...b...........hIDATx...........9.Q.f..ttS....u....%..1.a.s.!f..c.b.b.K7QFg3..Y..2M5..6:B..z9.%..N.s>9.{.=..........\|.7------------..QNt.G..].E.....b.s.e..X.C...Q.b.;.p..m......g....L.\te.G\.d...F..X..=f..]y.A..\e.t....Ei''...d.X...X..7[TYh.1J..g...y....]/.,r...........mi..2.6J.6Yte.....g.....<o...;..v.T..KJm..\T....i...G.."Qe.c..1.I.T#.6...2...7.y.K.'.....p..J.2S.V...zf..Z%b..Z.6.z._j.}K..w..R.2.Y..M...P..l..d.JG..Sm..0V..o.u.'R..6...(U.k...k.+m..i].n.ub..D.b.JwJ......-1..(. U..\|.^....(."UO..z;.@,2Vi..D,...;K.NAi.."f.TO.j.XlO..}$..M6..".iC.."..MO]-..[(]"U.i..E...J.K..zn..".V..M..i....q.(=%.5...R.e...:P."..(.U..[...M.G~C......Q3)..]o.%U.*./.c....t..:J...q..k...g...R....\...A.@.kl...H.vJ...x..../....9.:..?q...Y..":@i...4f..E.Yi.T}^.....Q..#..h.#"...4S.y.l...AiG.kl.QWI.nJ.E.F.}M.tP...9...U.f..g...../....]..U:N.{..B..A.2..i.Ru..A"..+jg.kE./Ru..R.g.D...n.q..X-b...f...b.+.q......gD.Y.....q.....t..kA.."&j..Ru..."...j..D..4n.S.wD..gG.x..

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-180.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 126 x 126, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2699
Entropy (8bit):	7.8799233652993115
Encrypted:	false
SSDEEP:
MD5:	704D0A2693B350E7C463B0FF2143835B
SHA1:	0313AD4C3690A590AC54552D2C27806E73776600
SHA-256:	D6367DBC074E37F3488C26B0BAD229BFE99F5C6BB0E28D37B41906C436152B57
SHA-512:	4517B2FA911149885EC5549F3173D3C774716740826873E4B2199C804B17E776A5296565930E5ACDB8D5476710A391B21E6DA8941DF64C525A487DB4619A1EA7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...~...~......#.....RIDATx......................f..`....6..m..j#fm.qm.Am.m......%_...q.i-.>dh.........q.o!!..]...LC.TF..D.o.8...8.O..\|.iLC#$PO<..1P.....wX....J..<5...$`O1.YU..g.L....<.....h....K.4Aw.....[.I...yU)....D\|..x......`f..................9f....Y...p..!..E..U%...]......l.#.....#gPB.5...^C4.G.........g...5R... ......W.~H@. .....8.....G...N.U...c....J".....YQ.m0....b.5.V.Y....:.......(W1.E...yb.,..a.bT.^.O!a...6...+!:...\|O1......ZQ9...M.6.....!.6..O.XI...#jF..w.o.#\|c...%Y.h.m.m.m.m.m.......8.qog.N.....3.}...R.....8...P.M.....].....B......3xs...:M!...K.;.mL.7l.N..=..7......sfJ.;..\|Q........}:m..08...y.+.5...D..:....\|8.m.]........04Z..b.......c.r....\|.....m.6/..!...Y..)4._..0KY.e.[.qL.!...X ..jk.....\|.....Ki....q...28...-.....<....4.d`.Z{.-]\|B..3 PJ.gP.iW-..]m..61c...8.b.,.. P?&.0........A..!_k`.\.s.>.......d..R...."<.e../.A.S .+...O.Oq.&.B.Y.6...S.!W^....... ..3.A.....GA.uX.\|[..Oh..=..[..9....l-.l..+...mM..Xu_.#)..

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-180_contrast-white.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 126 x 126, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	7.8839656878677005
Encrypted:	false
SSDEEP:
MD5:	39E2FCF13C20103C5F449C06D3A4CF75
SHA1:	AE8E1BCE2BE17ED450D891864E6AA22642AF39AC
SHA-256:	5D46E4056F3915C279F1FA9EDF61D93529FBCAE5C59D616380EC5D9405B7763D
SHA-512:	8E4902262B064008804D49D1B5F27BB7B8F33ECEFB05181AA69534E1D21662719DD4F8E0677C58215F6C5CA9EB4FB92FCA54A89F9720230AFBF06A70216ABF26
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...~...~.....Hm.....IDATx...{p......1\0<.%.1<........L.(.0P....R.(Hkk.3.>(-.X.t...>.Q........#P.H.JECxZ.<...5...${.7......../...g........x<.....x<u.0.Y<.f.s.r..7..1.Q.#.#...X...C\|.r.......h...b.e..D.[.H..RG.q..f\.9RhV.y....<.Z..0..K.9.c.s(.C9...d=.4..YJ.V....l2..Y,.....u..kH&........rFh.Na.k8A%J..<.-D...Wc.EL'..T~.......I.........N..F...<E.Q$..-N2..a.D..;H Jt..%q.....ml......3L$.n..-.Ha0SX..\.#..w..28..W...Z.......Y.......o.......v5.......\|...xv.X.G5m.e....tzq.e.7.G.r..Q...D2l.^....E)J..14............~..HCg8...JZ..TN....id..l...3.Vz9...` ....%3.F..v.JG'....Y...,.lc"-.K.]y...h.m.0C.I....".(Gq....g.S>E#....C..+.....].u...+..I...g....b.H....3d.S =.O,.7[...q.\|.6/..U.U(.ed.,....DX{.JA}.im;..)..ld.p.?....QK.....H..i.....#.~&=.&....pZ..&.2....J.s....p..r...y.e.....c..3.g.H.z".#....C'M.h...?......v...&"...z.e(i.+Wz].....<....?....M+s.&....d.....0n.....s...<Ws?I....?.{...`5z3..w8.........s.B.d..K..K....LLY.j..^...a.p.~.z....-......l.dM.

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-80.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	7.755097954664401
Encrypted:	false
SSDEEP:
MD5:	32D3E390613CDDBD639E70DDB2511AC0
SHA1:	C96AC088E72D756F31896B16776EF100379F802C
SHA-256:	DC20E5AA2B500CD5B5C9F89647D3487810685C94268F22678E27820E2454BB3E
SHA-512:	7381CEB8FEE84F398082177F30DC01593BEEFA729C73B0166AF686BCD25D54312B202D9243834B754769DE41E9A1DEED74CA91A76DCDA918A749CDB4F08C124B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...8...8.......;.....IDATx...S.,I....[k.m.m.m...k.f....0..Ag5..<.w.1...r:..g.+...+........MX.k`=l......\(...........,vDq>.......x..`wl.U...x..[.....(..p...@u..z...1M../.D>...z..'vJ..U..'C.......?c:..U........GQ...,.P.T<...-..\|$~....q..n=L..iF....X....q.......p.6{q8.u'.R..C...Qg..YCN.:........#g^.R...w.......U..j...H5..eF......iO`..4r.R.[.....0...9{....u.v....X6!>.F`.Nk.....J...5.P..}..F.\..Lk._.`.#...od..7..4!V.......-...{r.P....9^5.2.(.G..OT..<9}1....A..Q...U.{C.....o..S.....S...b....z..T...o....z..Z.xv......O\|.8.....u......c...?.....u.u........p4.v`......kQ..4.....jzf.^....F..4...j:.._K.;..z]..0.0>..........\|..W..Z5!6.b?....2O.....,.>.Q.y..-...._..k..w.}.V....s.o....W..._Q...X..=Tcmc{N.P..1..j..'...l.-.?j^2..~}Zo.J..7..F....D.91.....#2^..7.}7........$.:P..oc"6I..)n...\|A..G.....l'..x..bM#.\|...e.yT...k..y.]9...2.ao.z~.g`4....e0L..........t....n*.....}D.>.O..Vv..vE.Qs.\.~...s..........v.....T..7..A.9.s.]zQ...Gb.q).2....e...

C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-80_contrast-white.png (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PNG image data, 56 x 56, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	901
Entropy (8bit):	7.682141855410327
Encrypted:	false
SSDEEP:
MD5:	E6ADD5AFC73F7B06FC2348550595F8D6
SHA1:	4D658BDDB93FA6CB423EBC61BD20DB37E4D37DB6
SHA-256:	DD6F46D32C3E235508F9E4C7D7F993BD807D955BCA7E63CF3D57C6C4C102F46D
SHA-512:	55437DFEA7F68A4572DFC86B5428CBE9DB86C0D32D0B09BA6B7B1CF8E49E5F1BB94285BBDC97D8EE00D70BA75921DB59644787C1BE1672FE37CEE09441F249B6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...8...8...........LIDATx...mh.e...c....#.."aM..f!Dh....eFaa......0$3.a.bS.(!..$..@%1-+.,.ge..\.9..=<...}...=..7.\'7.-////...T.2.x.F...Ur.5.v..L...Iv..-..a.1&...Y!...U.S%..a......k.V!=....'..M.Pl.F!..s.V..B8g.n..9a......Z.k.....vH..i]V.Yx.....ve:R.I-.c.d...\......S.s<.?....`....).Ab.za^.s.1....~r4[...6a.......$6.o.I.z..A.Z.HG.:.r.C..E..<+.#Q..P.J.._.xYX-...[I.'l.o.{...Q.Y.E.'.V..3...H........i'.w...........:a<...W2.I..0P8(K...IL.V....).V......=". .....;.,....F&..U$6.....d...e.T.}aK...4I.!.(.U."...,}-\G.Rx[&..O...$Kk.I$.k.[&..c......S,.v.....(.Ao...,...K[&T..\|.......G.G.6a.++t\...?...La......F.....r9..t.U.9.DG.8.o#..j.d..L.~..;B....e.f....,.......b{./.....N.......`.e$npL.U..f.j.I..A....Oa.^.F.N8`...xU.........@?..t%$.,...l.n)._h0/U.d.....l.C...I....R..)..........3H...N....h.9j.2.{.n_...y..m.9.5.^...H7.i.A.....e.?..R....]....IEND.B`.

C:\Users\user\AppData\Local\Programs\Opera GX\Resources.pri (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	data
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	3.118957212117411
Encrypted:	false
SSDEEP:
MD5:	400817D0A91767CB830767AA94383F31
SHA1:	73F36C895190223F94E4D52657F14454B2BCBA44
SHA-256:	35D92C86C1C054D1C03F4E58B83681BBFD8573143EE5E4CFB4CBD788A1FFC107
SHA-512:	2216DFC65E24961A18A4622FF6D8D8A1330283E64477A0E44BAC5B8F9A4CB5690FC90F598BBC152214EE6AA8770FE6608C4C809EC6F2CC73547D8166603B3E15
Malicious:	false
Reputation:	unknown
Preview:	mrm_pri0........ ...............[mrm_decn_info].............8...[mrm_pridescex].........8...H...[mrm_hschema] .................[mrm_res_map__].............@...[mrm_decn_info].........8.......................................................................................................................................................................................................................................W.H.I.T.E...8.0...1.8.0...1.4.0...1.0.0.............8...[mrm_pridescex].........H...........................................H...[mrm_hschema] ...................................U^........m.s.-.a.p.p.x.:././.O.p.e.r.a./...O.p.e.r.a.....................L.......................F...........A...........O...........1.../.......7...!...................................F.i.l.e.s...A.s.s.e.t.s...O.p.e.r.a.P.R.I.C.o.n.f.i.g...x.m.l...7.0.x.7.0.L.o.g.o...p.n.g...1.5.0.x.1.5.0.L.o.g.o...p.n.g..........................................[mrm_res_map__].........@.......,.......................

C:\Users\user\AppData\Local\Programs\Opera GX\debug.log

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	244
Entropy (8bit):	5.162701289185902
Encrypted:	false
SSDEEP:
MD5:	BFCA623C92BCD6C930F09BE6F6937DE9
SHA1:	4CD607FE0DAEEA9DF3EBF207E1B35665042E1406
SHA-256:	74AFACD9C01F21AC9F15FB1D4C922E7CF78D2C7EC4EDDE36AC940493ED3A1560
SHA-512:	2F0457945A880195AC1567CF83336CF70D7C53D3260F034CCBC1494518AAAB477AF493959A7221785D4D7F2721454B3B4FE961B1C7DF9EA76FA12E0BC78B7B73
Malicious:	false
Reputation:	unknown
Preview:	[0206/153623.293:ERROR:check.cc(297)] Check failed: false. NOTREACHED log messages are omitted in official builds. Sorry!.[0206/153623.905:ERROR:check.cc(297)] Check failed: false. NOTREACHED log messages are omitted in official builds. Sorry!.

C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12333
Entropy (8bit):	5.292895152240265
Encrypted:	false
SSDEEP:
MD5:	AD5D0D16B556463231A87BF6E9E013FB
SHA1:	278D236DFC374AD5C0EB46B5F8312D0D4E986B84
SHA-256:	02C2F3873BFD3AD640DC0AFB56A4412FF11D264CDA8FDC0AA4EBF2688E4D8D7B
SHA-512:	AD500AF3404DE8E89D6CD07B7A58DA12433DB965B627E76CB79AD72C21470EA863C0B5D3D38F95A73A236BBF96CD59C8A81F28D977B26243A4EFEAE0F5BEA70E
Malicious:	false
Reputation:	unknown
Preview:	{"_all_users":false,"_launch_from_install_dir":true,"_skip_launcher":false,"_subfolder":"106.0.4998.74","app_id":"1707230173","copy_only":false,"files":["106.0.4998.74.manifest","CUESDK.x64_2017.dll","MEIPreload\\manifest.json","MEIPreload\\preloaded_data.pb","d3dcompiler_47.dll","dxcompiler.dll","dxil.dll","headless_command_resources.pak","headless_lib_data.pak","headless_lib_strings.pak","icudtl.dat","installer.exe","libEGL.dll","libGLESv2.dll","localization\\bg.pak","localization\\bn.pak","localization\\ca.pak","localization\\cs.pak","localization\\da.pak","localization\\de.pak","localization\\el.pak","localization\\en-GB.pak","localization\\en-US.pak","localization\\es-419.pak","localization\\es.pak","localization\\fi.pak","localization\\fil.pak","localization\\fr.pak","localization\\hi.pak","localization\\hr.pak","localization\\hu.pak","localization\\id.pak","localization\\it.pak","localization\\ja.pak","localization\\ko.pak","localization\\lt.pak","localization\\lv.pak","localiza

C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1624
Entropy (8bit):	5.164279432109298
Encrypted:	false
SSDEEP:
MD5:	25A1809B23BEA77A272906CB5AE61E00
SHA1:	357D96603DB5F309803AC9B14E54C3BBA40EBE06
SHA-256:	7BCFB6B7BC34DD71A2F6555347F28862E5A7C974D2C142D1AA8CE4C2412A9A4D
SHA-512:	D00CC874DB2EAB2F1E99D668AF8BDE774B862484833CED617FEA2DB1246C470AED7C8156E761F9CC05F799E998A1BF9B316AE285523B520B35E0FA9ED7ECA595
Malicious:	false
Reputation:	unknown
Preview:	{"all-installer-experiments":["installer-experiment-test@2","installer-bypass-launcher@2"],"autoupdate":false,"browser_edition":"std-1","country":"US","enable_stats":true,"features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"13e025f64bd6:disabled,13eeaf851da7,15322f489976,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,7e93fef4a11d,818c3ef12d0b,8511df77ed15,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c24103d5839f:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,ce1c7c17ef6e,d144067b33ec,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","import_browser_data":false,"installer-experiments":[],"installer_id":"e716013c-b288-4db0-8980-2d60e36c69fd","language":"e

C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2294176
Entropy (8bit):	6.471339679882766
Encrypted:	false
SSDEEP:
MD5:	C76F1E24C27D10347C3851ED2B7767C4
SHA1:	42DF4C074792F81ACFD0487ED83BA42E69EA9122
SHA-256:	85FCAFA1AFA1DF27CE6A79886FE1596BCA1BE5F4813808124C96EA088BAF11FE
SHA-512:	2B3E8DF573381AA9482AB4B0347E716919A4AE03B1DA96F21C35B38E222A5EFD2F05C418B979614BD555693097CA15F0AB4BBA828BDA78FE9F90E7EB67917CB0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........."............................@.............................@$.....!.#...`......................................... ...b.......h....@". ..... .,....."..)... $.\.......8.......................(....C..@............................................text............................... ..`.rdata..8....0......."..............@..@.data...............................@....pdata..,..... .....................@..@.00cfg..0.....!....... .............@..@.gxfg..../....!..0.... .............@..@.retplne......!....... ..................tls..........!....... .............@...LZMADEC......."....... ............. ..`_RDATA..\.... "....... .............@..@malloc_h.....0"....... ............. ..`.rsrc... ....@"....... .............@..@.reloc..\.... $.......".............@..B................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\launcher.visualelementsmanifest.xml (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.996593526126476
Encrypted:	false
SSDEEP:
MD5:	E8D8EAA4C2826C083AB9243B5CBD7BF8
SHA1:	534361AE03417DFD14EBD6F961B707C75A2AF41A
SHA-256:	B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
SHA-512:	8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
Malicious:	false
Reputation:	unknown
Preview:	<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1466272
Entropy (8bit):	6.40589832313238
Encrypted:	false
SSDEEP:
MD5:	39DDB5A73323607B679EE5901EF4152E
SHA1:	DB6E47C1C0A1BAB84F867A7B1E7B8C9B72894E39
SHA-256:	9A3567A92EA07D08A3931E41E89F21C3A03569DC2AF97B79CC4F0108AF132F9E
SHA-512:	26DDA00171DD0B00C045A099759F8029CD6BE03CD079B1C2ABB79A1FF89BB4A7C6C4B82152AD50F42EA9EA663AFF45B6CA1ED2E7DD5849380782665431439BFD
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........."......\...........d.........@.............................P.......^....`.........................................-P..k....P..P.......8........}...6...)...0.......:..8....................8..(...`...@............V......hG.......................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data...............................@....pdata...}.......~..................@..@.00cfg..0.... .......X..............@..@.gxfg....*...0...,...Z..............@..@.retplne.....`...........................tls.........p......................@..._RDATA..\...........................@..@.rsrc...8...........................@..@.reloc.......0......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Opera GX\opera.visualelementsmanifest.xml (copy)

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.996593526126476
Encrypted:	false
SSDEEP:
MD5:	E8D8EAA4C2826C083AB9243B5CBD7BF8
SHA1:	534361AE03417DFD14EBD6F961B707C75A2AF41A
SHA-256:	B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
SHA-512:	8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
Malicious:	false
Reputation:	unknown
Preview:	<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

C:\Users\user\AppData\Local\Programs\Opera GX\pref_default_overrides

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	unknown
Preview:	{}

C:\Users\user\AppData\Local\Programs\Opera GX\server_tracking_data

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	ASCII text, with very long lines (904), with no line terminators
Category:	dropped
Size (bytes):	904
Entropy (8bit):	5.54153536328489
Encrypted:	false
SSDEEP:
MD5:	9F424A76210BDEDF7D069698FADF9488
SHA1:	29E846F1FD7A3FEA32EC907877E34C6E7B2FC658
SHA-256:	46288F1102777C16146493B15C2529AD7EF22D3A786A313C8AB2D394F05BEE98
SHA-512:	4EAE7F1A681D7C2A33911FAF10B26E6AC3CCD87988FCAAF3E1177364DA1BB3FE62DE68B62DE1197FD0A15C7697329E4E15D205921D01863047C0D7D09D1BBA2C
Malicious:	false
Reputation:	unknown
Preview:	MzkxOTZlNTA1MDhiZTNiZDVjZDA3YTZhNDU1ZWNiYmNiZDVjZmNmNDM1NWIyYzk2ZWVlZmZlYjNlMTFiNDI3OTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0xP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1JPX1BCM19ERF8zNjYxJnV0bV9pZD04ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSZ1dG1fY29udGVudD0zNjYxXzI1NzciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MDcyMzAxMTIuNjE5OCIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fUk9fUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yNTc3IiwiaWQiOiI4ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImU3MTYwMTNjLWIyODgtNGRiMC04OTgwLTJkNjBlMzZjNjlmZCJ9

C:\Users\user\AppData\Local\Temp\.opera\BDDCE5348F09\installer.exe

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6896544
Entropy (8bit):	6.821344034536639
Encrypted:	false
SSDEEP:
MD5:	38CA4FA9A427D35D0F3229E784ABACD8
SHA1:	3585E728245C0CFB43B407A7EB12EE3D304E4FF4
SHA-256:	97BAEAD81C48262E357C4F9699401793DB88535B482D086568C5C4677A3D5143
SHA-512:	A13B0909EF72E03C8067F716ACBE97699B6BD05DA358852DD315FCD2317EC365154B7269D178A19E4BE01D4DDC6DDC319546F0F28287CB8480E2775EDFB98701
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........."...........d................@..............................i......ji...`.....................................................P.........b......;....i..)....i.$...L...8...................0...(.......@............................................text...k........................... ..`.rdata..Td.......f..................@..@.data...hJ....... ...f..............@....pdata...;.......<..................@..@.00cfg..8...........................@..@.gxfg...P&... ...(..................@..@.retplne.....P...........................tls.........`......................@..._RDATA..\....p......................@..@.rsrc.....b.......b.................@..@.reloc..$.....i.......i.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\4b616953-9f45-4830-8853-9bc278c2fefa.tmp

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.191463526678559
Encrypted:	false
SSDEEP:
MD5:	59634B5660055879E18798A4E7C9BCD7
SHA1:	3093B69AFE4E20143374EE98ADA895BED21965D2
SHA-256:	021F7FD429B23A88B7EE94073E4C2E8F2BC2A8746DBC9F1C78D18DB35790C252
SHA-512:	34D424DDA40C098B24F1E6D940BB4272058A315125EF582766B890F18674B5D0ED2632F7EA8BB2E4EA4A522EB2A606AA73BA6FFCC2BDF598FB9EA04D4F0FC57C
Malicious:	false
Reputation:	unknown
Preview:	{"welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_RO_PB3_DD_3661&utm_content=3661_2577&utm_id=8e2c63d8ae754363947f5f12e2a46921&utm_medium=pa&utm_source=PWNgames&http_referrer=&query=/opera_gx/stable/edition/std-1?utm_source=PWNgames%26utm_medium=pa%26utm_campaign=PWN_RO_PB3_DD_3661%26utm_id=8e2c63d8ae754363947f5f12e2a46921%26utm_content=3661_2577"}

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\719226b3-375c-443d-8fc7-937af75fe903.tmp

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	5.116011711617528
Encrypted:	false
SSDEEP:
MD5:	499C1E6977607D5B1A14CED6287635FC
SHA1:	1A752A4378E7EA6AA119F8206FD78300C5EA8C04
SHA-256:	6D332EE186A9ADB90F03F4AA318215AF243BE9B9F742ECB0B6503BCC821B99E7
SHA-512:	A766ED65688BA802957E411A8C9FF71504FBBBAD703A49D59BB795DEA84838951404FADA9DB5EAA354F8A348C3DA06057CC8814952BF48B0AB79DD358678E958
Malicious:	false
Reputation:	unknown
Preview:	{"country":"US","features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"13e025f64bd6:disabled,13eeaf851da7,15322f489976,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,7e93fef4a11d,818c3ef12d0b,8511df77ed15,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c24103d5839f:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,ce1c7c17ef6e,d144067b33ec,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote-features-guid":"fe2d2b1e-b1fb-460b-b93f-cacd7e2a9ee8","welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_RO_PB3_DD_3661&utm_content=3661_2577&utm_id=8e2c63d8ae754363947f5f12e2a46921&utm_medium=pa&utm_source=PWNgames&http_referrer=&query=

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\763fc574-3d8f-480a-9414-442c91b2e6d6.tmp

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	5.243697880772072
Encrypted:	false
SSDEEP:
MD5:	BAFA9BEBBFBCD1F2838F1429C0464C2E
SHA1:	547B4D4DACD15D0AEE85D689C45E5AB3E321A313
SHA-256:	272B10B548667E2FDCE1738D030013FC86FD8E5B6EC533809D20FB82764F7A69
SHA-512:	6A427B5315A782D6F260B41CFE2C56D739B7169034D9A220F115A24A2DBDEE2B2CAD65D846AFB7370DB73091DAE8D34C5F1673D38DE7D2A6D87B6886AEE4537B
Malicious:	false
Reputation:	unknown
Preview:	{"country":"US","welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_RO_PB3_DD_3661&utm_content=3661_2577&utm_id=8e2c63d8ae754363947f5f12e2a46921&utm_medium=pa&utm_source=PWNgames&http_referrer=&query=/opera_gx/stable/edition/std-1?utm_source=PWNgames%26utm_medium=pa%26utm_campaign=PWN_RO_PB3_DD_3661%26utm_id=8e2c63d8ae754363947f5f12e2a46921%26utm_content=3661_2577"}

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\Opera GX Browser .lnk

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Feb 6 13:36:13 2024, mtime=Tue Feb 6 13:36:13 2024, atime=Mon Feb 5 15:20:19 2024, length=2294176, window=hide
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.906025769294294
Encrypted:	false
SSDEEP:
MD5:	C4A5E7B5460224A70B5911F7F4689ECE
SHA1:	D6D9A7DD43849A4D9AA59B339D6593E4012BAB92
SHA-256:	D7D94428A29E9561071FA8F4893A209C28B366F457AA0616CCAD4B52A2F90A9B
SHA-512:	3DF419212F11E82A94A66D270B84D20F06C9F806B9271C04F78400DBE136E1D8D4BD8096F9EA756E45BE1CB70C5704770AC008001D577396511D3B05612C7BBE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ........Y..ln...Y..D.[6OX....#.....................(.:..DG..Yr?.D..U..k0.&...&......vk.v....\|H?..Y.......Y......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^FXXt...........................%..A.p.p.D.a.t.a...B.P.1.....FXZt..Local.<......CW.^FXZt....b.......................%.L.o.c.a.l.....Z.1.....FXht..Programs..B......FXZtFXht..............................P.r.o.g.r.a.m.s.....Z.1.....FX.t..OPERAG~1..B......FXhtFX.t....O.......................,.O.p.e.r.a. .G.X.....f.2...#.EX.. .launcher.exe..J......FX.tFX.t....xA.....................,..l.a.u.n.c.h.e.r...e.x.e.......j...............-.......i...........'.j......C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe..*.....\.....\.....\.....\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.l.a.u.n.c.h.e.r...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........\|....I.J.H..K..:...`.......X.......134349...........hT..CrF

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\additional_file0.tmp

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1499104
Entropy (8bit):	7.985603261747699
Encrypted:	false
SSDEEP:
MD5:	E9A2209B61F4BE34F25069A6E54AFFEA
SHA1:	6368B0A81608C701B06B97AEFF194CE88FD0E3C0
SHA-256:	E950F17F4181009EEAFA9F5306E8A9DFD26D88CA63B1838F44FF0EFC738E7D1F
SHA-512:	59E46277CA79A43ED8B0A25B24EFF013E251A75F90587E013B9C12851E5DD7283B6172F7D48583982F6A32069457778EE440025C1C754BF7BB6CE8AE1D2C3FC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@.................................7........................................b......................H................................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\additional_file1.tmp

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1824)
Category:	dropped
Size (bytes):	1344708
Entropy (8bit):	6.081849998191263
Encrypted:	false
SSDEEP:
MD5:	1FB07CF2B20D516ADC1067D9C4C57BB7
SHA1:	DA0BFEB9A98B2FDAF422A1B52FFA33ECA0684EA1
SHA-256:	294592F92BDDA407A531D81D64B7D141979F7B5B052370C1041430530DB7C481
SHA-512:	F4B17E1E60281465A3288E5BDE7C537AC419236A72B680AD533E93CAE81DC8E12221339A737C27257B0A561192F655C70230D818EB0219CCB5E4641B5FF811D8
Malicious:	false
Reputation:	unknown
Preview:	// DUwgkzpRs2UBZDQI77+cT3P6rFCB1A0dTs323s0P8VwKPNxJg7UC76QDbcCRMySUWu6oS1yzTCguRlUYTcidqpeZdtHOL09/z+luPzIHHqB/vQ9rnmKvNPJpGrBJkKfytTOuw9v8frDeZaeH6r4iB1b3IcxXDVBG/cZiVMvhj0/b9SbAbkgN94GUrDjIArHEo49eBMFcYKuLFjOUmbiRuESFn3Rlx1SFNsPk2GEohrRvsb3Fzh9UH6hwKFUEBxwUWIGMtPpf2rIDmUxAEUigjvrWMiGoDk4x5FdM+p5livY9OVeyVGtcfDm8zZJ3psJ6Uz8cqK1ZhYsebZFUup9rZA==.{. "version": 32,. "partner_id": "std-1",. "user_agent": "std-1",. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed_ysrcunow",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed_ysrcunow",. "wiki". ],. "speed_dial_index_list": [0].

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (copy)

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1499104
Entropy (8bit):	7.985603261747699
Encrypted:	false
SSDEEP:
MD5:	E9A2209B61F4BE34F25069A6E54AFFEA
SHA1:	6368B0A81608C701B06B97AEFF194CE88FD0E3C0
SHA-256:	E950F17F4181009EEAFA9F5306E8A9DFD26D88CA63B1838F44FF0EFC738E7D1F
SHA-512:	59E46277CA79A43ED8B0A25B24EFF013E251A75F90587E013B9C12851E5DD7283B6172F7D48583982F6A32069457778EE440025C1C754BF7BB6CE8AE1D2C3FC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@.................................7........................................b......................H................................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1853592
Entropy (8bit):	6.818631706824549
Encrypted:	false
SSDEEP:
MD5:	4C8FBED0044DA34AD25F781C3D117A66
SHA1:	8DD93340E3D09DE993C3BC12DB82680A8E69D653
SHA-256:	AFE569CE9E4F71C23BA5F6E8FD32BE62AC9538E397CDE8F2ECBE46FAA721242A
SHA-512:	A04E6FD052D2D63A0737C83702C66A9AF834F9DF8423666508C42B3E1D8384300239C9DDACDC31C1E85140EB1193BCFAC209F218750B40342492FFCE6E9DA481
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....B.`.........."......`........................@.................................sS....@.............................`................E...........,...............~.......................}......@4..........................@....................text...?_.......`.................. ..`.rdata......p.......d..............@..@.data....c.......0..................@....00cfg.......p......................@..@.tls................................@....voltbl.P...............................CPADinfo0...........................@....rsrc....E.......F..................@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\browser_assistant.exe

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3291288
Entropy (8bit):	6.8236015092223115
Encrypted:	false
SSDEEP:
MD5:	28A21AFB4BDC543B4B0309BB78B8BA4A
SHA1:	AB6230C0E1C2C12FC5C9B7A60EA5ADEF99E7783B
SHA-256:	672AEB85A07EC1A25DBCF48B64D3BDE24DD0691C2BB27ED74A536776F63B5D27
SHA-512:	806A3466DD4DE9BFCA6B13C20E69985DECFB8FFE5A31F785D649DAB249064FC4EC1FBBA9DDAEFC634D6E7AA355FEF73F511357C748043E407F979B150C159CB7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....B.`..........".......'..........6$...........@...........................2......v2...@........................../.^...1./.T.....0.@.............2.......1......k/..................... j/.......-.............P./.....`./.@....................text.....'.......'................. ..`.rdata....... '.......'.............@..@.data...,n....0..2..../.............@....00cfg.......p0.......0.............@..@.rodata.......0.......0............. ..`.tls..........0.......0.............@....voltbl.\.....0.......0.................CPADinfo0.....0.......0.............@....rsrc...@.....0.......0.............@..@.reloc........1.......0.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\files_list

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.030896101301726
Encrypted:	false
SSDEEP:
MD5:	2F070A8DDB1E4A5BC2137DBB2967E9A8
SHA1:	F9F38DA409C2D4DFCE3471CF6621B7B81B797BF5
SHA-256:	4C3722675F9E72C3ECE2A029DC8637CD8219CEB40B623D6DC75647314036AD3C
SHA-512:	52FCB7870637F46D156D2F210E119A52B5B5226B9AEDE66ACF51160FBA45310D865DC4CCE1BD8A82156C414175DE49A5DCB527CF9F635F925D3C5603872CDD7C
Malicious:	false
Reputation:	unknown
Preview:	assistant_installer.exe..browser_assistant.exe..mojo_core.dll

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\mojo_core.dll

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	990360
Entropy (8bit):	6.751997627821156
Encrypted:	false
SSDEEP:
MD5:	7913D58432695A0DD61EE6B472FBDE99
SHA1:	2F29F0B689539C03F16C1DB7DEBD216F8D71A110
SHA-256:	789E08420078F7EAFBE22A28CD657313829E52F9A5133FD20D894A0AADFC0CD1
SHA-512:	ECD2D61ED30F455746E7A70D719C9A10C85C861753BBBF9E478F6B5C6790465B1BE6951594222C5B5F5F7471E0A54EFEC8F66247F817E7AD97BB4E5839CC4326
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....B.`.........."!.........F............................................................@A.........................?..t....?............................... ..0l...*.......................).......................B...............................text...\|........................... ..`.rdata..(...........................@..@.data...,g.......,...`..............@....00cfg..............................@..@.tls................................@....voltbl..................................reloc..0l... ...n..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\files_list

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39
Entropy (8bit):	3.830148693165749
Encrypted:	false
SSDEEP:
MD5:	FE7F046D773FC1DE764E1BE70614BF20
SHA1:	C2F16957953DEEB6DE1A12FA656AC84FCAA5B085
SHA-256:	3D87AD3D7001FBE5D65682BF1111A73C4A1BA68B34C604C6BDE77C5DD8ADCC8E
SHA-512:	405BC34A634007AF8159252D1E28AD3578BD6339C81B9DE97E022FD1420D0394488C09A36BD7E23BB38DF466AE2FA1B66420F97198DBD2099A161ABCDA121A03
Malicious:	false
Reputation:	unknown
Preview:	resources/custom_partner_content.json..

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\installer_prefs_include.json (copy)

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.191463526678559
Encrypted:	false
SSDEEP:
MD5:	59634B5660055879E18798A4E7C9BCD7
SHA1:	3093B69AFE4E20143374EE98ADA895BED21965D2
SHA-256:	021F7FD429B23A88B7EE94073E4C2E8F2BC2A8746DBC9F1C78D18DB35790C252
SHA-512:	34D424DDA40C098B24F1E6D940BB4272058A315125EF582766B890F18674B5D0ED2632F7EA8BB2E4EA4A522EB2A606AA73BA6FFCC2BDF598FB9EA04D4F0FC57C
Malicious:	false
Reputation:	unknown
Preview:	{"welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_RO_PB3_DD_3661&utm_content=3661_2577&utm_id=8e2c63d8ae754363947f5f12e2a46921&utm_medium=pa&utm_source=PWNgames&http_referrer=&query=/opera_gx/stable/edition/std-1?utm_source=PWNgames%26utm_medium=pa%26utm_campaign=PWN_RO_PB3_DD_3661%26utm_id=8e2c63d8ae754363947f5f12e2a46921%26utm_content=3661_2577"}

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\installer_prefs_include.json.backup

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	5.116011711617528
Encrypted:	false
SSDEEP:
MD5:	499C1E6977607D5B1A14CED6287635FC
SHA1:	1A752A4378E7EA6AA119F8206FD78300C5EA8C04
SHA-256:	6D332EE186A9ADB90F03F4AA318215AF243BE9B9F742ECB0B6503BCC821B99E7
SHA-512:	A766ED65688BA802957E411A8C9FF71504FBBBAD703A49D59BB795DEA84838951404FADA9DB5EAA354F8A348C3DA06057CC8814952BF48B0AB79DD358678E958
Malicious:	false
Reputation:	unknown
Preview:	{"country":"US","features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"13e025f64bd6:disabled,13eeaf851da7,15322f489976,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,7e93fef4a11d,818c3ef12d0b,8511df77ed15,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c24103d5839f:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,ce1c7c17ef6e,d144067b33ec,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote-features-guid":"fe2d2b1e-b1fb-460b-b93f-cacd7e2a9ee8","welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_RO_PB3_DD_3661&utm_content=3661_2577&utm_id=8e2c63d8ae754363947f5f12e2a46921&utm_medium=pa&utm_source=PWNgames&http_referrer=&query=

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\installer_prefs_include.json~RF4084b9.TMP (copy)

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.191463526678559
Encrypted:	false
SSDEEP:
MD5:	59634B5660055879E18798A4E7C9BCD7
SHA1:	3093B69AFE4E20143374EE98ADA895BED21965D2
SHA-256:	021F7FD429B23A88B7EE94073E4C2E8F2BC2A8746DBC9F1C78D18DB35790C252
SHA-512:	34D424DDA40C098B24F1E6D940BB4272058A315125EF582766B890F18674B5D0ED2632F7EA8BB2E4EA4A522EB2A606AA73BA6FFCC2BDF598FB9EA04D4F0FC57C
Malicious:	false
Reputation:	unknown
Preview:	{"welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_RO_PB3_DD_3661&utm_content=3661_2577&utm_id=8e2c63d8ae754363947f5f12e2a46921&utm_medium=pa&utm_source=PWNgames&http_referrer=&query=/opera_gx/stable/edition/std-1?utm_source=PWNgames%26utm_medium=pa%26utm_campaign=PWN_RO_PB3_DD_3661%26utm_id=8e2c63d8ae754363947f5f12e2a46921%26utm_content=3661_2577"}

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\opera_package

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139990888
Entropy (8bit):	7.999994927046636
Encrypted:	true
SSDEEP:
MD5:	D9A07B746D1C7BBE738964B4F727AC27
SHA1:	01224816F2F34ECE24728D7DE552BCF76B647C6F
SHA-256:	36015707ABD77EB3487FBF6B83D0ACB980C37B8B0676CDB654C89A35B8651EFE
SHA-512:	7A057FDA77EE1613B77BF584BFD1EA539707C2BCE71AB7D647382BF4A0F97D4839C51EF8AEFDE9DEAEA91CE7060C983688AA4C1A24F923112A6D7DEFF179C809
Malicious:	true
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..................................@X......................................b........................W..)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\pref_default_overrides

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	unknown
Preview:	{}

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\resources\custom_partner_content.json (copy)

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1824)
Category:	dropped
Size (bytes):	1344708
Entropy (8bit):	6.081849998191263
Encrypted:	false
SSDEEP:
MD5:	1FB07CF2B20D516ADC1067D9C4C57BB7
SHA1:	DA0BFEB9A98B2FDAF422A1B52FFA33ECA0684EA1
SHA-256:	294592F92BDDA407A531D81D64B7D141979F7B5B052370C1041430530DB7C481
SHA-512:	F4B17E1E60281465A3288E5BDE7C537AC419236A72B680AD533E93CAE81DC8E12221339A737C27257B0A561192F655C70230D818EB0219CCB5E4641B5FF811D8
Malicious:	false
Reputation:	unknown
Preview:	// DUwgkzpRs2UBZDQI77+cT3P6rFCB1A0dTs323s0P8VwKPNxJg7UC76QDbcCRMySUWu6oS1yzTCguRlUYTcidqpeZdtHOL09/z+luPzIHHqB/vQ9rnmKvNPJpGrBJkKfytTOuw9v8frDeZaeH6r4iB1b3IcxXDVBG/cZiVMvhj0/b9SbAbkgN94GUrDjIArHEo49eBMFcYKuLFjOUmbiRuESFn3Rlx1SFNsPk2GEohrRvsb3Fzh9UH6hwKFUEBxwUWIGMtPpf2rIDmUxAEUigjvrWMiGoDk4x5FdM+p5livY9OVeyVGtcfDm8zZJ3psJ6Uz8cqK1ZhYsebZFUup9rZA==.{. "version": 32,. "partner_id": "std-1",. "user_agent": "std-1",. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed_ysrcunow",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed_ysrcunow",. "wiki". ],. "speed_dial_index_list": [0].

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\server_tracking_data

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with very long lines (904), with no line terminators
Category:	dropped
Size (bytes):	904
Entropy (8bit):	5.54153536328489
Encrypted:	false
SSDEEP:
MD5:	9F424A76210BDEDF7D069698FADF9488
SHA1:	29E846F1FD7A3FEA32EC907877E34C6E7B2FC658
SHA-256:	46288F1102777C16146493B15C2529AD7EF22D3A786A313C8AB2D394F05BEE98
SHA-512:	4EAE7F1A681D7C2A33911FAF10B26E6AC3CCD87988FCAAF3E1177364DA1BB3FE62DE68B62DE1197FD0A15C7697329E4E15D205921D01863047C0D7D09D1BBA2C
Malicious:	false
Reputation:	unknown
Preview:	MzkxOTZlNTA1MDhiZTNiZDVjZDA3YTZhNDU1ZWNiYmNiZDVjZmNmNDM1NWIyYzk2ZWVlZmZlYjNlMTFiNDI3OTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0xP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1JPX1BCM19ERF8zNjYxJnV0bV9pZD04ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSZ1dG1fY29udGVudD0zNjYxXzI1NzciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MDcyMzAxMTIuNjE5OCIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fUk9fUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yNTc3IiwiaWQiOiI4ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImU3MTYwMTNjLWIyODgtNGRiMC04OTgwLTJkNjBlMzZjNjlmZCJ9

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	3355816
Entropy (8bit):	7.7768157039053945
Encrypted:	false
SSDEEP:
MD5:	CFCF91EF96623A139475B53B686229DC
SHA1:	D38D63B2B59C8A0A035B5E6BE792045B9F643E6C
SHA-256:	BFD52C7C2ECA1BB09D745582455A7D9DB13E85CCFE47B35E7BFD549DF70C8EA0
SHA-512:	28354E842D3DFD7B32B6301122070FFD78ADFFE5EBB7F98FA2113FF971E98B7444454DD0EAC4A0AFFE814FBD53C7CE30B6B54CE5A3E2C5EF0A8995E3A92A0D8B
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e..........".......2..@....#...V...#...V...@...........................V..... .3...@...................................V.......V../............3..,....V.$...........................t.V.......V.............................................UPX0......#.............................UPX1......2...#...2.................@....rsrc....@....V..2....2.............@...4.02.UPX!....*.A.....;eV...2...U.&.......U..SWV.....e..E...E..E.........d....M........}...........M.1..U..Nf.........M.).).....9..L.M.4.9.r.9.wz.u..t.SPQ....K..U.....B...B..M...;}.}>.M....w..Z.9.r....X$...........`.......t.`..A..yN...~.1..E\.6.......^_[]...@>..;!.h...../h...Q......,...0\|.....f.U......Ed..p....U.M. ..2.._.@.. ..}..F..E.....op..E...X0.n.......}..u..fF.E.@@..;E.}^.....W.._.9.s...e.)..9.w...r....9...wKc'SQR...........f}.>..W.....O\|......[..d..1..M.d..HB..7.8..B?_.....@>..E

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20240206153513538.log

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with very long lines (1829)
Category:	dropped
Size (bytes):	9778
Entropy (8bit):	5.80193453751985
Encrypted:	false
SSDEEP:
MD5:	776A89A4AE5E877E188AB4DD22DC5278
SHA1:	B0273473763D41BB079CA921FD8C8B9C9EA14A85
SHA-256:	37226A5DEE2F505FA84C019EDAFC3A1E65A65150F043741D28E310C95781598B
SHA-512:	B9C357B4EB3AF629493ED1BA4D5FB8F8376EB0BAF5E1D073908F5F54A5CF2C15A688581651230054DB7B0D46D813D39B6545F4D467E886951DF04961C6128D1B
Malicious:	false
Reputation:	unknown
Preview:	[0206/153513.538:INFO:installer_main.cc(453)] Opera GX installer starting - version 106.0.4998.74 Stable.[0206/153513.538:INFO:installer_main.cc(456)] Command line: "C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe" --silent --allusers=0.[0206/153513.538:INFO:installer_main.cc(478)] Uninstall:0.[0206/153513.538:INFO:installer_main.cc(479)] Silent:1.[0206/153513.538:INFO:installer_main.cc(480)] Run Immediately0.[0206/153513.538:INFO:installer_main.cc(482)] Backend0.[0206/153513.538:INFO:installer_main.cc(483)] Inside package0.[0206/153513.538:INFO:installer_main.cc(484)] Autoupdate:0.[0206/153513.538:INFO:payload_manager_impl.cc(97)] Reading Payload.[0206/153513.538:INFO:installer_main.cc(610)] Tracking data: NGFlMmI4ZGY1OTU2ZDBiODJhMDFhYzBlYzExNWUzN2QyZjhiM2FmZmFhMmUxMzkxZDRjYTEzMDRhODliMjVhNDp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0xP3V0bV9zb3VyY2U9

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20240206153515017.log

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	ASCII text, with very long lines (1839)
Category:	modified
Size (bytes):	6268
Entropy (8bit):	5.842995726700576
Encrypted:	false
SSDEEP:
MD5:	87613D802F4C2888A7370FEFB118E7E5
SHA1:	19BE9E8C4C8348600079E6E880764E2C348CC041
SHA-256:	5D28ED16C4A9F627A3E330E7375A91BA1284E3E2297A6A7C5DBA0062C063F330
SHA-512:	95C90E557F959B7EA6F39DF15A35F694F60F6FD1C9E8B8E43976141AA0F05A7A7614DA31E902176E06D04AB44DB00B83229B8833DA6B0BD371E5A2E9287457FB
Malicious:	false
Reputation:	unknown
Preview:	[0206/153515.017:INFO:installer_main.cc(453)] Opera GX installer starting - version 106.0.4998.74 Stable.[0206/153515.017:INFO:installer_main.cc(456)] Command line: "C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7664 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240206153514" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=MzkxOTZlNTA1MDhiZTNiZDVjZDA3YTZhNDU1ZWNiYmNiZDVjZmNmNDM1NWIyYzk2ZWVlZmZlYjNlMTFiNDI3OTp7ImNv

C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20240206153613326.log

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	ASCII text, with very long lines (1784)
Category:	modified
Size (bytes):	4229
Entropy (8bit):	5.712565637488988
Encrypted:	false
SSDEEP:
MD5:	46FFFB9A7E75711052DF09A8C8404F79
SHA1:	F033444ABFA07498572F5FF71AA887722B2B3F93
SHA-256:	1560CE3310145539BED00693DF50AF6277C0B90406400BD59384A34E7CF35DD6
SHA-512:	6326AC4C929BED6DFB3779162320E8BB1BDF508DBF9A452CF88791AE4809BDBA45F6DD4DF6684DFFCE554E4025DE7EFF911171C9858121C8999ADFF37F79F617
Malicious:	false
Reputation:	unknown
Preview:	[0206/153613.326:INFO:installer_main.cc(453)] Opera GX installer starting - version 106.0.4998.74 Stable.[0206/153613.326:INFO:installer_main.cc(456)] Command line: "C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe" --backend --initial-pid=7664 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=MzkxOTZlNTA1MDhiZTNiZDVjZDA3YTZhNDU1ZWNiYmNiZDVjZmNmNDM1NWIyYzk2ZWVlZmZlYjNlMT

C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435131327664.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5133216
Entropy (8bit):	7.046050150197007
Encrypted:	false
SSDEEP:
MD5:	951DDF15B2CEF4E1D927CB3B145254CF
SHA1:	85C06B0AC6775CEE8E24BA7AC26483DBEF4E0129
SHA-256:	85F48334461377FE5DBFDCB1AED408860450AD7C2ABF442B9B6248595FACF3C8
SHA-512:	0F20AEB82A0ECBAD1820AF3CC700B245E4152D67989536FB44202787D5D2D5EEE4CD2190D2A2668DAB08C7DE3173D8439770507C491A563B28D4FA37B4F6AA10
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.........."!....../.........`.........................................O......RO...@A.........................6.m.....6......`9..............N..)...PN.....L.6.......................6......H/...............6.D...8.6.`....................text...H,/......./................. ..`.rdata.......@/......2/.............@..@.data...8....`7..L...H7.............@....00cfg........9.......7.............@..@.rodata.X.... 9.......7............. ..`.tls....Y....09.......7.............@...CPADinfo0....@9.......7.............@...malloc_h.....P9.......7............. ..`.rsrc........`9.......7.............@..@.reloc.......PN.......L.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435134067684.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5133216
Entropy (8bit):	7.046050150197007
Encrypted:	false
SSDEEP:
MD5:	951DDF15B2CEF4E1D927CB3B145254CF
SHA1:	85C06B0AC6775CEE8E24BA7AC26483DBEF4E0129
SHA-256:	85F48334461377FE5DBFDCB1AED408860450AD7C2ABF442B9B6248595FACF3C8
SHA-512:	0F20AEB82A0ECBAD1820AF3CC700B245E4152D67989536FB44202787D5D2D5EEE4CD2190D2A2668DAB08C7DE3173D8439770507C491A563B28D4FA37B4F6AA10
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.........."!....../.........`.........................................O......RO...@A.........................6.m.....6......`9..............N..)...PN.....L.6.......................6......H/...............6.D...8.6.`....................text...H,/......./................. ..`.rdata.......@/......2/.............@..@.data...8....`7..L...H7.............@....00cfg........9.......7.............@..@.rodata.X.... 9.......7............. ..`.tls....Y....09.......7.............@...CPADinfo0....@9.......7.............@...malloc_h.....P9.......7............. ..`.rsrc........`9.......7.............@..@.reloc.......PN.......L.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435138567768.dll

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5133216
Entropy (8bit):	7.046050150197007
Encrypted:	false
SSDEEP:
MD5:	951DDF15B2CEF4E1D927CB3B145254CF
SHA1:	85C06B0AC6775CEE8E24BA7AC26483DBEF4E0129
SHA-256:	85F48334461377FE5DBFDCB1AED408860450AD7C2ABF442B9B6248595FACF3C8
SHA-512:	0F20AEB82A0ECBAD1820AF3CC700B245E4152D67989536FB44202787D5D2D5EEE4CD2190D2A2668DAB08C7DE3173D8439770507C491A563B28D4FA37B4F6AA10
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.........."!....../.........`.........................................O......RO...@A.........................6.m.....6......`9..............N..)...PN.....L.6.......................6......H/...............6.D...8.6.`....................text...H,/......./................. ..`.rdata.......@/......2/.............@..@.data...8....`7..L...H7.............@....00cfg........9.......7.............@..@.rodata.X.... 9.......7............. ..`.tls....Y....09.......7.............@...CPADinfo0....@9.......7.............@...malloc_h.....P9.......7............. ..`.rsrc........`9.......7.............@..@.reloc.......PN.......L.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435144237796.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5133216
Entropy (8bit):	7.046050150197007
Encrypted:	false
SSDEEP:
MD5:	951DDF15B2CEF4E1D927CB3B145254CF
SHA1:	85C06B0AC6775CEE8E24BA7AC26483DBEF4E0129
SHA-256:	85F48334461377FE5DBFDCB1AED408860450AD7C2ABF442B9B6248595FACF3C8
SHA-512:	0F20AEB82A0ECBAD1820AF3CC700B245E4152D67989536FB44202787D5D2D5EEE4CD2190D2A2668DAB08C7DE3173D8439770507C491A563B28D4FA37B4F6AA10
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.........."!....../.........`.........................................O......RO...@A.........................6.m.....6......`9..............N..)...PN.....L.6.......................6......H/...............6.D...8.6.`....................text...H,/......./................. ..`.rdata.......@/......2/.............@..@.data...8....`7..L...H7.............@....00cfg........9.......7.............@..@.rodata.X.... 9.......7............. ..`.tls....Y....09.......7.............@...CPADinfo0....@9.......7.............@...malloc_h.....P9.......7............. ..`.rsrc........`9.......7.............@..@.reloc.......PN.......L.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2402061435148407828.dll

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5133216
Entropy (8bit):	7.046050150197007
Encrypted:	false
SSDEEP:
MD5:	951DDF15B2CEF4E1D927CB3B145254CF
SHA1:	85C06B0AC6775CEE8E24BA7AC26483DBEF4E0129
SHA-256:	85F48334461377FE5DBFDCB1AED408860450AD7C2ABF442B9B6248595FACF3C8
SHA-512:	0F20AEB82A0ECBAD1820AF3CC700B245E4152D67989536FB44202787D5D2D5EEE4CD2190D2A2668DAB08C7DE3173D8439770507C491A563B28D4FA37B4F6AA10
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e.........."!....../.........`.........................................O......RO...@A.........................6.m.....6......`9..............N..)...PN.....L.6.......................6......H/...............6.D...8.6.`....................text...H,/......./................. ..`.rdata.......@/......2/.............@..@.data...8....`7..L...H7.............@....00cfg........9.......7.............@..@.rodata.X.... 9.......7............. ..`.tls....Y....09.......7.............@...CPADinfo0....@9.......7.............@...malloc_h.....P9.......7............. ..`.rsrc........`9.......7.............@..@.reloc.......PN.......L.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2402061436127016648.dll

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6285216
Entropy (8bit):	6.829354515973936
Encrypted:	false
SSDEEP:
MD5:	55948249F63DBBF1F2023D4651BC35F3
SHA1:	70AD20581B588F6C8B1A1D966D0B03F0F4785DF6
SHA-256:	4F3E585E75BFCA91462C42C5343ED1B0CD44FBBE9E5AB7D9005745FF441F1DD2
SHA-512:	805AC1046CC96E15935D2CE1A7BCBB1186F4B65E75CAB0BA782484EB0E1AEE97CCE4BDCDF80DBA633B83F7C43699852547611ADB8B72411E37522B7B525095D0
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." .....>>..d!...............................................a.......`...`A.........................................nF.m....nF......`L.......I.4....._..)...Pa..5..,5F.8....................4F.(...0j>.@........... .F..... mF.`....................text....<>......>>................. ..`.rdata...D...P>..F...B>.............@..@.data....2....G.......G.............@....pdata..4.....I.......H.............@..@.00cfg..0.....K......BJ.............@..@.gxfg....3....K..4...DJ.............@..@.retplne......K......xJ..................rodata.X.....K......zJ............. ..`.tls....i.....L......\|J.............@...CPADinfo@.....L.......J.............@...LZMADEC...... L.......J............. ..`_RDATA..\....@L.......J.............@..@malloc_h.....PL.......J............. ..`.rsrc........`L.......J.............@..@.reloc...5...Pa..6...._.............@..B................

C:\Users\user\AppData\Local\Temp\Opera_installer_2402061436131277280.dll

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6285216
Entropy (8bit):	6.829354515973936
Encrypted:	false
SSDEEP:
MD5:	55948249F63DBBF1F2023D4651BC35F3
SHA1:	70AD20581B588F6C8B1A1D966D0B03F0F4785DF6
SHA-256:	4F3E585E75BFCA91462C42C5343ED1B0CD44FBBE9E5AB7D9005745FF441F1DD2
SHA-512:	805AC1046CC96E15935D2CE1A7BCBB1186F4B65E75CAB0BA782484EB0E1AEE97CCE4BDCDF80DBA633B83F7C43699852547611ADB8B72411E37522B7B525095D0
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." .....>>..d!...............................................a.......`...`A.........................................nF.m....nF......`L.......I.4....._..)...Pa..5..,5F.8....................4F.(...0j>.@........... .F..... mF.`....................text....<>......>>................. ..`.rdata...D...P>..F...B>.............@..@.data....2....G.......G.............@....pdata..4.....I.......H.............@..@.00cfg..0.....K......BJ.............@..@.gxfg....3....K..4...DJ.............@..@.retplne......K......xJ..................rodata.X.....K......zJ............. ..`.tls....i.....L......\|J.............@...CPADinfo@.....L.......J.............@...LZMADEC...... L.......J............. ..`_RDATA..\....@L.......J.............@..@malloc_h.....PL.......J............. ..`.rsrc........`L.......J.............@..@.reloc...5...Pa..6...._.............@..B................

C:\Users\user\AppData\Local\Temp\Opera_installer_2402061436242703168.dll

Process:	C:\Users\user\AppData\Local\Temp\.opera\BDDCE5348F09\installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6285216
Entropy (8bit):	6.829354515973936
Encrypted:	false
SSDEEP:
MD5:	55948249F63DBBF1F2023D4651BC35F3
SHA1:	70AD20581B588F6C8B1A1D966D0B03F0F4785DF6
SHA-256:	4F3E585E75BFCA91462C42C5343ED1B0CD44FBBE9E5AB7D9005745FF441F1DD2
SHA-512:	805AC1046CC96E15935D2CE1A7BCBB1186F4B65E75CAB0BA782484EB0E1AEE97CCE4BDCDF80DBA633B83F7C43699852547611ADB8B72411E37522B7B525095D0
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....e.........." .....>>..d!...............................................a.......`...`A.........................................nF.m....nF......`L.......I.4....._..)...Pa..5..,5F.8....................4F.(...0j>.@........... .F..... mF.`....................text....<>......>>................. ..`.rdata...D...P>..F...B>.............@..@.data....2....G.......G.............@....pdata..4.....I.......H.............@..@.00cfg..0.....K......BJ.............@..@.gxfg....3....K..4...DJ.............@..@.retplne......K......xJ..................rodata.X.....K......zJ............. ..`.tls....i.....L......\|J.............@...CPADinfo@.....L.......J.............@...LZMADEC...... L.......J............. ..`_RDATA..\....@L.......J.............@..@malloc_h.....PL.......J............. ..`.rsrc........`L.......J.............@..@.reloc...5...Pa..6...._.............@..B................

C:\Users\user\AppData\Local\Temp\assistant_installer_20240206153537.log

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	243
Entropy (8bit):	5.043835635290685
Encrypted:	false
SSDEEP:
MD5:	229EAD8814748CB6ED74A57422170CEA
SHA1:	C9299DB68217824D9CB7F3F80841097A337106AA
SHA-256:	1BFE81EF65897C6FEC57EA55D2B5110B20EFD55F8C9F4ABE4CC031187C33734D
SHA-512:	CA62018E71CAEDC0917B77CBC95E3894C0227CEC72294D62F40A8CA0C21337BA5CABDB988861D4F6B7EB83D8AF1DBA4583FFF7CAAFE8D9AA06E4532ACE658281
Malicious:	false
Reputation:	unknown
Preview:	[0206/153537.577:INFO:assistant_installer_main.cc(169)] Running assistant installer with command line "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe" --version.

C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\_isetup\_setup64.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\erku (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	5.519456370129206
Encrypted:	false
SSDEEP:
MD5:	4B0B5586ACE3FA10002CCF11C5999E65
SHA1:	937F74BCE6E61540EAD8AE86B1CABC7EBA433461
SHA-256:	CA64A93AB1F6F9D2F5CC8E90F8EF911E5E5AC1124359F48743A1E0962F1C4B20
SHA-512:	EB932DE2685A7B8894FDAF64E5198EFF889E0DF095F6ED7565B870AC798EB4FF7CC2F607DCFBA37566997FE0209D3C109053B99154F12A2E4060DBC933F53172
Malicious:	false
Reputation:	unknown
Preview:	http://guideveil.xyz/pe/build.php?pe=n&sub=2577&source=3876&s1=48352771&title=QWR2YW5jZWQgU3lzdGVtIFJlcGFpciBQcm8gMjAwMiAgUG9ydGFibGUgIE9wdGltaXphdGlvbiAgU0Nsb3VkV1MuZXhl&ti=1707230097

C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\is-JLGE1.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\is-S11RF.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	63465
Entropy (8bit):	6.933512065672094
Encrypted:	false
SSDEEP:
MD5:	EEF52E934EAB9C6525F0161255235FEF
SHA1:	67B6D6C3B2B5967C98F81F7C1BFC785B23BE8F19
SHA-256:	7CC2A96601BEB84CAABF0BB2C62D743678A6C6934BCECD21862B5D64C2E00920
SHA-512:	A4B1FEB035C4B518CD9D8D703D0B96D19B730427F7230D93FD20C7FBBCEFD4BEEC61955DE49EA73C100AC415261AF3DA50BA864E47E86A3CC97EC3011F92A11C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................P...............................................t...........?...........................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata... ...............................rsrc....?.......@...z..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\is-T5V69.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	63465
Entropy (8bit):	6.933512065672094
Encrypted:	false
SSDEEP:
MD5:	EEF52E934EAB9C6525F0161255235FEF
SHA1:	67B6D6C3B2B5967C98F81F7C1BFC785B23BE8F19
SHA-256:	7CC2A96601BEB84CAABF0BB2C62D743678A6C6934BCECD21862B5D64C2E00920
SHA-512:	A4B1FEB035C4B518CD9D8D703D0B96D19B730427F7230D93FD20C7FBBCEFD4BEEC61955DE49EA73C100AC415261AF3DA50BA864E47E86A3CC97EC3011F92A11C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................P...............................................t...........?...........................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata... ...............................rsrc....?.......@...z..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\is-U3G87.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	5.519456370129206
Encrypted:	false
SSDEEP:
MD5:	4B0B5586ACE3FA10002CCF11C5999E65
SHA1:	937F74BCE6E61540EAD8AE86B1CABC7EBA433461
SHA-256:	CA64A93AB1F6F9D2F5CC8E90F8EF911E5E5AC1124359F48743A1E0962F1C4B20
SHA-512:	EB932DE2685A7B8894FDAF64E5198EFF889E0DF095F6ED7565B870AC798EB4FF7CC2F607DCFBA37566997FE0209D3C109053B99154F12A2E4060DBC933F53172
Malicious:	false
Reputation:	unknown
Preview:	http://guideveil.xyz/pe/build.php?pe=n&sub=2577&source=3876&s1=48352771&title=QWR2YW5jZWQgU3lzdGVtIFJlcGFpciBQcm8gMjAwMiAgUG9ydGFibGUgIE9wdGltaXphdGlvbiAgU0Nsb3VkV1MuZXhl&ti=1707230097

C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\ret (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	63465
Entropy (8bit):	6.933512065672094
Encrypted:	false
SSDEEP:
MD5:	EEF52E934EAB9C6525F0161255235FEF
SHA1:	67B6D6C3B2B5967C98F81F7C1BFC785B23BE8F19
SHA-256:	7CC2A96601BEB84CAABF0BB2C62D743678A6C6934BCECD21862B5D64C2E00920
SHA-512:	A4B1FEB035C4B518CD9D8D703D0B96D19B730427F7230D93FD20C7FBBCEFD4BEEC61955DE49EA73C100AC415261AF3DA50BA864E47E86A3CC97EC3011F92A11C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................P...............................................t...........?...........................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata... ...............................rsrc....?.......@...z..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp

Process:	C:\Users\user\Desktop\quTbWcnSay.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.325049229886336
Encrypted:	false
SSDEEP:
MD5:	160981DD3A860558906CAA34B3508ECC
SHA1:	1CDA94576C32C9E7A2B6E3819228C59414AA7E7B
SHA-256:	5EF48C09A486AB6C23B6B2AF6AE0958D917179F176F572288A53A75AA9408D83
SHA-512:	FA808FCE9AF5AD65BD39E89CC84453583B12116A022B6DA6669FD0233084CCC0E67EC384E879B449B0484B20EE4FF3764CE1D6506C4F7AC69A91E5758CE9C384
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\nsnE22.tmp\inetc.dll

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	5.540206398655926
Encrypted:	false
SSDEEP:
MD5:	CAB75D596ADF6BAC4BA6A8374DD71DE9
SHA1:	FB90D4F13331D0C9275FA815937A4FF22EAD6FA3
SHA-256:	89E24E4124B607F3F98E4DF508C4DDD2701D8F7FCF1DC6E2ABA11D56C97C0C5A
SHA-512:	510786599289C8793526969CFE0A96E049436D40809C1C351642B2C67D5FB2394CB20887010727A5DA35C52A20C5557AD940967053B1B59AD91CA1307208C391
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........yP..P..P...:.Y..P......["R...[#Q...[.Q..]..Q...[.Q..RichP..........PE..L...?..V...........!.........^......!0.......@............................................@..........................D..l....D..d...............................X....................................................@..P............................text...!,.......................... ..`.rdata.......@.......2..............@..@.data...<<...P.......@..............@....rsrc................H..............@..@.reloc..X............R..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsnE22.tmp\s

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	3355816
Entropy (8bit):	7.7768157039053945
Encrypted:	false
SSDEEP:
MD5:	CFCF91EF96623A139475B53B686229DC
SHA1:	D38D63B2B59C8A0A035B5E6BE792045B9F643E6C
SHA-256:	BFD52C7C2ECA1BB09D745582455A7D9DB13E85CCFE47B35E7BFD549DF70C8EA0
SHA-512:	28354E842D3DFD7B32B6301122070FFD78ADFFE5EBB7F98FA2113FF971E98B7444454DD0EAC4A0AFFE814FBD53C7CE30B6B54CE5A3E2C5EF0A8995E3A92A0D8B
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....e..........".......2..@....#...V...#...V...@...........................V..... .3...@...................................V.......V../............3..,....V.$...........................t.V.......V.............................................UPX0......#.............................UPX1......2...#...2.................@....rsrc....@....V..2....2.............@...4.02.UPX!....*.A.....;eV...2...U.&.......U..SWV.....e..E...E..E.........d....M........}...........M.1..U..Nf.........M.).).....9..L.M.4.9.r.9.wz.u..t.SPQ....K..U.....B...B..M...;}.}>.M....w..Z.9.r....X$...........`.......t.`..A..yN...~.1..E\.6.......^_[]...@>..;!.h...../h...Q......,...0\|.....f.U......Ed..p....U.M. ..2.._.@.. ..}..F..E.....op..E...X0.n.......}..u..fF.E.@@..;E.}^.....W.._.9.s...e.)..9.w...r....9...wKc'SQR...........f}.>..W.....O\|......[..d..1..M.d..HB..7.8..B?_.....@>..E

C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_1.exe

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11065129
Entropy (8bit):	7.96991159694097
Encrypted:	false
SSDEEP:
MD5:	C060CC25B2F5B27A73D320F1173D1BE9
SHA1:	4667FCDACFC6DAD7176ABDED4A4888E54B00E920
SHA-256:	129F005C2043E43438B0CB621BF7D6289B12B34E6D7C4D24B9AE15523D171042
SHA-512:	28D261461D86909BF30D876125DEDEFE062A23E4265EB495E07A58724C0656BB1256A5313D947362E1D021DA94E76320328D4250344EB44C06E3F7FD94F9795D
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@.......................................@......@...................@....... .......p.......................................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_2.exe

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4724720
Entropy (8bit):	7.0944141075328115
Encrypted:	false
SSDEEP:
MD5:	FA24733F5A6A6F44D0E65D7D98B84AA6
SHA1:	51A62BEAB55096E17F2E17F042F7BD7DEDABF1AE
SHA-256:	DA1B144B5F908CB7E811489DFE660E06AA6DF9C9158C6972EC9C79C48AFACB7E
SHA-512:	1953201D8CD448AA7D23C3E57665546ACE835F97C8CC8D0F323573CEF03A6F317F86C7C3841268ECE1760B911C67845D7E6AA198A44F720DCA02A5A8BCB8E21E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............S...S...SA..R...SA..R+..SA..R...S...R...S...R...S...R...SA..R...SA..R...SA..R...S...SO..S...R..S..=S...S..US...S...R...SRich...S................PE..L...G.gb..........".......!.........D.........!...@.........................../.....'.H...@.................................$..(..................x.G.x.....-..[....$.p.....................$.......!.@.............!.......).`....................text.....!.......!................. ..`.rdata..di....!..j....!.............@..@.data.......0..j.................@....rsrc.............................@..@.reloc...[....-..\...D-.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsnE22.tmp\status.log

Process:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera GX Browser .lnk

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Feb 6 13:36:13 2024, mtime=Tue Feb 6 13:36:13 2024, atime=Mon Feb 5 15:20:19 2024, length=2294176, window=hide
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.906025769294294
Encrypted:	false
SSDEEP:
MD5:	C4A5E7B5460224A70B5911F7F4689ECE
SHA1:	D6D9A7DD43849A4D9AA59B339D6593E4012BAB92
SHA-256:	D7D94428A29E9561071FA8F4893A209C28B366F457AA0616CCAD4B52A2F90A9B
SHA-512:	3DF419212F11E82A94A66D270B84D20F06C9F806B9271C04F78400DBE136E1D8D4BD8096F9EA756E45BE1CB70C5704770AC008001D577396511D3B05612C7BBE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ........Y..ln...Y..D.[6OX....#.....................(.:..DG..Yr?.D..U..k0.&...&......vk.v....\|H?..Y.......Y......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^FXXt...........................%..A.p.p.D.a.t.a...B.P.1.....FXZt..Local.<......CW.^FXZt....b.......................%.L.o.c.a.l.....Z.1.....FXht..Programs..B......FXZtFXht..............................P.r.o.g.r.a.m.s.....Z.1.....FX.t..OPERAG~1..B......FXhtFX.t....O.......................,.O.p.e.r.a. .G.X.....f.2...#.EX.. .launcher.exe..J......FX.tFX.t....xA.....................,..l.a.u.n.c.h.e.r...e.x.e.......j...............-.......i...........'.j......C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe..*.....\.....\.....\.....\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.l.a.u.n.c.h.e.r...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........\|....I.J.H..K..:...`.......X.......134349...........hT..CrF

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera GX Browser .lnk

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Feb 6 13:36:13 2024, mtime=Tue Feb 6 13:36:13 2024, atime=Mon Feb 5 15:20:19 2024, length=2294176, window=hide
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.906025769294294
Encrypted:	false
SSDEEP:
MD5:	C4A5E7B5460224A70B5911F7F4689ECE
SHA1:	D6D9A7DD43849A4D9AA59B339D6593E4012BAB92
SHA-256:	D7D94428A29E9561071FA8F4893A209C28B366F457AA0616CCAD4B52A2F90A9B
SHA-512:	3DF419212F11E82A94A66D270B84D20F06C9F806B9271C04F78400DBE136E1D8D4BD8096F9EA756E45BE1CB70C5704770AC008001D577396511D3B05612C7BBE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ........Y..ln...Y..D.[6OX....#.....................(.:..DG..Yr?.D..U..k0.&...&......vk.v....\|H?..Y.......Y......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^FXXt...........................%..A.p.p.D.a.t.a...B.P.1.....FXZt..Local.<......CW.^FXZt....b.......................%.L.o.c.a.l.....Z.1.....FXht..Programs..B......FXZtFXht..............................P.r.o.g.r.a.m.s.....Z.1.....FX.t..OPERAG~1..B......FXhtFX.t....O.......................,.O.p.e.r.a. .G.X.....f.2...#.EX.. .launcher.exe..J......FX.tFX.t....xA.....................,..l.a.u.n.c.h.e.r...e.x.e.......j...............-.......i...........'.j......C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe..*.....\.....\.....\.....\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.l.a.u.n.c.h.e.r...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........\|....I.J.H..K..:...`.......X.......134349...........hT..CrF

C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

Process:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.39546184423832
Encrypted:	false
SSDEEP:
MD5:	04FE47813ED78D297B4B147090E782A8
SHA1:	BBA2BA54E737F4BDFBEEF3D10D2D46A66E2EF79F
SHA-256:	7982DA3C2D4B3184A246FFFB5E5495103ED3E8AE6CAB122B3572A0B03DD62D65
SHA-512:	D559813E6CA9F0CD3D245AA2379FB608F69FBD59A241E0BDEFCD9FCD29A82A0177C95FF27BE6F65664425D72FD86C202EBAFB137121D277E9AD656BD1DE14A39
Malicious:	false
Reputation:	unknown
Preview:	sdPC......................D`~p.G...\|j.+.

C:\Users\user\Desktop\Opera GX Browser .lnk

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Feb 6 13:36:13 2024, mtime=Tue Feb 6 13:36:13 2024, atime=Mon Feb 5 15:20:19 2024, length=2294176, window=hide
Category:	dropped
Size (bytes):	1442
Entropy (8bit):	4.899414970652247
Encrypted:	false
SSDEEP:
MD5:	81FD1ABA39532A08CAD9A23975249FB1
SHA1:	1587CBAAD25EF35D1FFD4C92D272AAC89135A00A
SHA-256:	E27FADA40570800AEFD172592F3F9AD6B0E021CF6E180A74D53942E6E3566A64
SHA-512:	C3C74AC90C7BE098AB8B60B04ED13EA87D4F0D6E77D20D832E23037FF3817128324EB600BCF7F8F7826C9F67B4D02C231E47ED32F41EF89D1959157310144F4C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ........Y..ln...Y..D.[6OX....#.....................(.:..DG..Yr?.D..U..k0.&...&......vk.v....\|H?..Y.......Y......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^FXXt...........................%..A.p.p.D.a.t.a...B.P.1.....FXZt..Local.<......CW.^FXZt....b.......................%.L.o.c.a.l.....Z.1.....FXht..Programs..B......FXZtFXht..............................P.r.o.g.r.a.m.s.....Z.1.....FX.t..OPERAG~1..B......FXhtFX.t....O.......................,.O.p.e.r.a. .G.X.....f.2...#.EX.. .launcher.exe..J......FX.tFX.t....xA.....................,..l.a.u.n.c.h.e.r...e.x.e.......j...............-.......i...........'.j......C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe../.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.l.a.u.n.c.h.e.r...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........\|....I.J.H..K..:...`.......X.......134349........

C:\Windows\is-0PI61.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.3121717094487435
Encrypted:	false
SSDEEP:
MD5:	BBF1722288F254DE8D16B7AAE9EF7965
SHA1:	A1B701659AC6B39A4BF882786CC11A64D9133B43
SHA-256:	D42593A83B9796C8DB28DF9490A9EB99EA8F21A3AD6B4E84EC7D7906549956E2
SHA-512:	987CB85F47CF028C997809D25504562F50AF896BD17EA5B025E6B48238574BFFFEF8D8A1EC5A0B4E3A65FD4EBE60542EFCE3954C89F60461E179C8CE0702AB14
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Windows\unins000.dat

Process:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
File Type:	InnoSetup Log Advanced System Repair Pro 2002 Portable Optimization SCloudWS.exe, version 0x418, 6295 bytes, 134349\37\user\376, \350\002\002\006\017#
Category:	dropped
Size (bytes):	6295
Entropy (8bit):	4.235976526963533
Encrypted:	false
SSDEEP:
MD5:	A1B2807492E0B0992510C734DE879D2B
SHA1:	83CFDF1641C5C1030C8842019D7318B25376670B
SHA-256:	FBD5B993B5E58DC01899608C22D8429C9C6C65D94DC4A44853C5FB42EE7D2213
SHA-512:	68668EC406A7B3D35A18A7C97381F26F97D5F6CE7F9D59451E1D6666874473BAA300B4F300A3A4FE77008387A64E8621169C2AD8FC166DBF35574A1590B37B5D
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Advanced System Repair Pro 2002 Portable Optimization SCloudWS.exe...........................................................Advanced System Repair Pro 2002 Portable Optimization SCloudWS.exe..........................................................................................................................................................................................R........<........;........1.3.4.3.4.9......j.o.n.e.s.....................#...>.. .....^........IFPS....'........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TDOWNLOADWIZARDPAGE....TDOWNLOADWIZARDPAGE.........TNEWRADIOBUTTON....TNEWRADIOBUTTON..................TONDOWNLOADPROGRES

C:\Windows\unins000.exe (copy)

Process:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.3121717094487435
Encrypted:	false
SSDEEP:
MD5:	BBF1722288F254DE8D16B7AAE9EF7965
SHA1:	A1B701659AC6B39A4BF882786CC11A64D9133B43
SHA-256:	D42593A83B9796C8DB28DF9490A9EB99EA8F21A3AD6B4E84EC7D7906549956E2
SHA-512:	987CB85F47CF028C997809D25504562F50AF896BD17EA5B025E6B48238574BFFFEF8D8A1EC5A0B4E3A65FD4EBE60542EFCE3954C89F60461E179C8CE0702AB14
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

\Device\Mailslot\opera_installer\C:\Users\user\AppData\Local\Programs\Opera GX

Process:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
File Type:	data
Category:	dropped
Size (bytes):	4552
Entropy (8bit):	3.9132475548573042
Encrypted:	false
SSDEEP:
MD5:	83315AEA5E22DD8EF109BA5AE78D9B1E
SHA1:	2D87AD11A43C47C45CFB1C5DA6714CE28D6D23C4
SHA-256:	C6D97377DA2BAFDF1923E2390B49819D5E6CC16853229D3DA8FC912BC8A1FD93
SHA-512:	39EC12E46E5678EEBD0C00D24654870C1DC0E3ED6DA7880437CDEA39FB0810C8C07EF95D973E3CA1152C1165138531AFD483F88E44A1A1B52D3459C338CBD757
Malicious:	false
Reputation:	unknown
Preview:	........:Installer message:..... .......:Installer message:......... .......:Installer message:.....%...8.......:Installer message:.........verify_package_contents.H.......:Installer message:.........verify_package_contents.................P.......:Installer message:...../...copy_file:resources/custom_partner_content.json.`.......:Installer message:...../...copy_file:resources/custom_partner_content.json.................0.......:Installer message:.........delete_file_step@.......:Installer message:.........delete_file_step................0.......:Installer message:.........delete_file_step@.......:Installer message:.........delete_file_step................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.414781423991489
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	quTbWcnSay.exe
File size:	1'672'111 bytes
MD5:	52c24e7a6a10f1418ead6e5541a2b443
SHA1:	105b34e6ccd98cad51e88cb0b06e695caaff45bd
SHA256:	7332fbc6fd5023cc26cd2e7414e8c40312783cc39b40815b91b7618b1d4c49b2
SHA512:	cb886e7cb453202904e4b4743c9441983a9ab51878ded8059a614b67c7ec34f77cc92e959796a0ff2527a62932a3ba1f2999a01f4319bc1723b9125f7d6fab9f
SSDEEP:	24576:s7FUDowAyrTVE3U5F/ezKKic6QL3E2vVsjECUAQT45deRV9RD:sBuZrEU5KIy029s4C1eH9J
TLSH:	F675BF3FF268A13EC56A1B3245738320997BBA51B81A8C1E47FC384DCF765601E3B656
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c0c2d33ceec80aa

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007F026D3E3735h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F026D486227h
call 00007F026D485D7Ah
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F026D3F91D4h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F026D3DE327h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007F026D3FA357h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F026D4862AFh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F026D48C4CAh
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F026D3FAC4Ch
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x11000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	43af0a9476ca224d8e8461f1e22c94da	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	185e04b9a1f554e31f7f848515dc890c	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	cab2107c933b696aa5cf0cc6c3fd3980	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	e7d1635e2624b124cfdce6c360ac21cd	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	8ced971d8a7705c98b173e255d8c9aa7	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	8d4e1e508031afe235bf121c80fd7d5f	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x11000	0x11000	c709e0373ace7a0e07615c2064c0b74e	False	0.18635110294117646	data	3.6962514995633304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7678	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2048	English	United States	0.1174924924924925
RT_ICON	0xc80e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.15792682926829268
RT_ICON	0xc8748	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23387096774193547
RT_ICON	0xc8a30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.39864864864864863
RT_ICON	0xc8b58	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.08339210155148095
RT_ICON	0xca180	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1023454157782516
RT_ICON	0xcb028	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.10649819494584838
RT_ICON	0xcb8d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10838150289017341
RT_ICON	0xcbe38	0x12e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8712011577424024
RT_ICON	0xcd120	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.05668398677373642
RT_ICON	0xd1348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08475103734439834
RT_ICON	0xd38f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.09920262664165103
RT_ICON	0xd4998	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2047872340425532
RT_STRING	0xd4e00	0x360	data			0.34375
RT_STRING	0xd5160	0x260	data			0.3256578947368421
RT_STRING	0xd53c0	0x45c	data			0.4068100358422939
RT_STRING	0xd581c	0x40c	data			0.3754826254826255
RT_STRING	0xd5c28	0x2d4	data			0.39226519337016574
RT_STRING	0xd5efc	0xb8	data			0.6467391304347826
RT_STRING	0xd5fb4	0x9c	data			0.6410256410256411
RT_STRING	0xd6050	0x374	data			0.4230769230769231
RT_STRING	0xd63c4	0x398	data			0.3358695652173913
RT_STRING	0xd675c	0x368	data			0.3795871559633027
RT_STRING	0xd6ac4	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd6d68	0x10	data			1.5
RT_RCDATA	0xd6d78	0x2c4	data			0.6384180790960452
RT_RCDATA	0xd703c	0x2c	data			1.1590909090909092
RT_GROUP_ICON	0xd7068	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xd7124	0x584	data	English	United States	0.2811614730878187
RT_MANIFEST	0xd76a8	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	15:34:51
Start date:	06/02/2024
Path:	C:\Users\user\Desktop\quTbWcnSay.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\quTbWcnSay.exe
Imagebase:	0x400000
File size:	1'672'111 bytes
MD5 hash:	52C24E7A6A10F1418EAD6E5541A2B443
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	15:34:51
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-G41TD.tmp\quTbWcnSay.tmp" /SL5="$20458,832512,832512,C:\Users\user\Desktop\quTbWcnSay.exe"
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	160981DD3A860558906CAA34B3508ECC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	15:35:00
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-9A6TD.tmp\setup.exe
Imagebase:	0x400000
File size:	63'465 bytes
MD5 hash:	EEF52E934EAB9C6525F0161255235FEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	15:35:13
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe" --silent --allusers=0
Imagebase:	0x650000
File size:	3'355'816 bytes
MD5 hash:	CFCF91EF96623A139475B53B686229DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	15:35:13
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x398,0x39c,0x3a0,0x374,0x3a4,0x6c5ae5e8,0x6c5ae5f4,0x6c5ae600
Imagebase:	0x650000
File size:	3'355'816 bytes
MD5 hash:	CFCF91EF96623A139475B53B686229DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	15:35:13
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\set_0.exe" --version
Imagebase:	0x550000
File size:	3'355'816 bytes
MD5 hash:	CFCF91EF96623A139475B53B686229DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	15:35:14
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7664 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240206153514" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=MzkxOTZlNTA1MDhiZTNiZDVjZDA3YTZhNDU1ZWNiYmNiZDVjZmNmNDM1NWIyYzk2ZWVlZmZlYjNlMTFiNDI3OTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0xP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1JPX1BCM19ERF8zNjYxJnV0bV9pZD04ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSZ1dG1fY29udGVudD0zNjYxXzI1NzciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MDcyMzAxMTIuNjE5OCIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fUk9fUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yNTc3IiwiaWQiOiI4ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImU3MTYwMTNjLWIyODgtNGRiMC04OTgwLTJkNjBlMzZjNjlmZCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0806000000000000
Imagebase:	0x650000
File size:	3'355'816 bytes
MD5 hash:	CFCF91EF96623A139475B53B686229DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	15:35:14
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\nsnE22.tmp\set_0.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x388,0x38c,0x390,0x364,0x394,0x6ba1e5e8,0x6ba1e5f4,0x6ba1e600
Imagebase:	0x650000
File size:	3'355'816 bytes
MD5 hash:	CFCF91EF96623A139475B53B686229DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	15:35:36
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
Imagebase:	0x400000
File size:	1'499'104 bytes
MD5 hash:	E9A2209B61F4BE34F25069A6E54AFFEA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	12
Start time:	15:35:37
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe" --version
Imagebase:	0xd60000
File size:	1'853'592 bytes
MD5 hash:	4C8FBED0044DA34AD25F781C3D117A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Target ID:	13
Start time:	15:35:37
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x334,0x338,0x33c,0x310,0x340,0xf14f48,0xf14f58,0xf14f64
Imagebase:	0xd60000
File size:	1'853'592 bytes
MD5 hash:	4C8FBED0044DA34AD25F781C3D117A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	14
Start time:	15:36:12
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe" --backend --initial-pid=7664 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402061535141" --session-guid=75a53667-4b95-44a9-92ea-4bfb86fd3244 --server-tracking-blob=MzkxOTZlNTA1MDhiZTNiZDVjZDA3YTZhNDU1ZWNiYmNiZDVjZmNmNDM1NWIyYzk2ZWVlZmZlYjNlMTFiNDI3OTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMSIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0xP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1JPX1BCM19ERF8zNjYxJnV0bV9pZD04ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSZ1dG1fY29udGVudD0zNjYxXzI1NzciLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MDcyMzAxMTIuNjE5OCIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fUk9fUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yNTc3IiwiaWQiOiI4ZTJjNjNkOGFlNzU0MzYzOTQ3ZjVmMTJlMmE0NjkyMSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImU3MTYwMTNjLWIyODgtNGRiMC04OTgwLTJkNjBlMzZjNjlmZCJ9 --silent --desktopshortcut=1 --install-subfolder=106.0.4998.74
Imagebase:	0x7ff6faf30000
File size:	6'896'544 bytes
MD5 hash:	38CA4FA9A427D35D0F3229E784ABACD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	15
Start time:	15:36:12
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Opera GX\106.0.4998.74\installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=106.0.4998.74 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2a4,0x2d4,0x7ffdfb94a5b0,0x7ffdfb94a5bc,0x7ffdfb94a5c8
Imagebase:	0x7ff6faf30000
File size:	6'896'544 bytes
MD5 hash:	38CA4FA9A427D35D0F3229E784ABACD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	18
Start time:	15:36:15
Start date:	06/02/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	19
Start time:	15:36:17
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	20
Start time:	15:36:17
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	21
Start time:	15:36:17
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	22
Start time:	15:36:17
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	23
Start time:	15:36:18
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	25
Start time:	15:36:18
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	26
Start time:	15:36:18
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	27
Start time:	15:36:19
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	28
Start time:	15:36:19
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	29
Start time:	15:36:20
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	30
Start time:	15:36:21
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	31
Start time:	15:36:21
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	32
Start time:	15:36:21
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	33
Start time:	15:36:21
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	34
Start time:	15:36:22
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	35
Start time:	15:36:22
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe" --scheduledautoupdate 0
Imagebase:	0x7ff64ab80000
File size:	2'294'176 bytes
MD5 hash:	C76F1E24C27D10347C3851ED2B7767C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Target ID:	37
Start time:	15:36:23
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	38
Start time:	15:36:23
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Opera GX\launcher.exe" --start-maximized
Imagebase:	0x7ff64ab80000
File size:	2'294'176 bytes
MD5 hash:	C76F1E24C27D10347C3851ED2B7767C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	39
Start time:	15:36:23
Start date:	06/02/2024
Path:	C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UxybGYXaoQEUBfehUKyZMhhAIotVFAaIZmPWNYOBmpJQgyK\jyKJvjQuuEeSXFxWJ.exe"
Imagebase:	0x1c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	40
Start time:	15:36:23
Start date:	06/02/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\BDDCE5348F09\installer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\BDDCE5348F09\installer.exe" --version
Imagebase:	0x7ff7f2460000
File size:	6'896'544 bytes
MD5 hash:	38CA4FA9A427D35D0F3229E784ABACD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true